joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100352cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100352ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x1003538e
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1003535a
jg 0x10035315
test esi, esi
je 0x1003535a
test ecx, ecx
jl 0x10035393
jg 0x1003531f
test eax, eax
je 0x10035393
cmp edi, ecx
jg 0x1003532f
jl 0x10035329
cmp esi, eax
jae 0x1003532f
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x10035382
jg 0x10035367
test esi, esi
je 0x10035382
cmp dword [ebx + 0x4c], 0
je 0x10035382
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x10035367
Function at 0x10036631
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0x78
pop ebx
mov cl, 0x1b
mov word [ebp - 0xc], 0x791b
mov byte [ebp - 0xa], 0x7a
xor eax, eax
mov byte [ebp - 9], bl
mov dword [ebp - 8], 0x7a696f70
mov byte [ebp - 4], bl
mov word [ebp - 3], 0x70
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 9
jae 0x1003666b
mov cl, byte [ebp - 0xc]
jmp 0x1003665c
lea eax, [ebp - 0xb]
mov byte [ebp - 2], 0
push 0x100e0ce6
push eax
call fcn.1006327a
cmp byte [0x100e0ce6], 0
pop ecx
pop ecx
je 0x10036758
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], 0
call fcn.10049b54
pop ecx
pop ecx
mov cl, 0x25
mov dword [ebp - 0xc], 0x5514725
mov dword [ebp - 8], 0x414b4c47
xor eax, eax
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 7
jae 0x100366c6
mov cl, byte [ebp - 0xc]
jmp 0x100366b7
push 0x100df07c
lea eax, [ebp - 0xb]
mov byte [ebp - 4], 0
push 0x100df078
push eax
call fcn.1006c225
add esp, 0xc
mov dword [ebp - 8], 0x66226346
xor edx, edx
mov word [ebp - 4], 0x352b
mov cl, 0x46
mov byte [ebp - 2], dl
mov eax, edx
xor byte [ebp + eax - 7], cl
inc eax
cmp eax, 5
jae 0x10036705
mov cl, byte [ebp - 8]
jmp 0x100366f6
mov byte [ebp - 2], dl
mov eax, edx
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x1b], 0x14580c1a
mov dword [ebp - 0x17], 0xc1f161d
mov word [ebp - 0x13], 0x10
xor byte [ebp + eax - 0x1b], bl
inc eax
cmp eax, 9
jae 0x10036730
mov bl, byte [ebp - 0x1c]
jmp 0x10036721
push 0x80
lea eax, [ebp - 7]
xor ebx, ebx
push eax
push 0xc8
push 1
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x12], bl
push 0x100df080
push eax
call fcn.1006e6dc
add esp, 0x18
jmp 0x1003675a
xor ebx, ebx
mov cl, 0x3d
mov dword [ebp - 0x1c], 0x544f493d
mov dword [ebp - 0x18], 0x4f585a5a
mov eax, ebx
mov dword [ebp - 0x14], 0x49525f
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10036782
mov cl, byte [ebp - 0x1c]
jmp 0x10036773
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push 0x100e0ce7
push eax
call fcn.1006327a
cmp byte [0x100e0ce7], 0
pop ecx
pop ecx
je 0x100367e9
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], 0
call fcn.10049b54
movaps xmm0, xmmword [0x100ac6f0]
pop ecx
pop ecx
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 0x10], bl
mov ecx, ebx
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xf
jb 0x100367c3
push 0x100df088
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x10], bl
push 0x100e08f4
push eax
call fcn.1006c225
add esp, 0xc
push 0x63
pop ecx
mov byte [ebp - 0x1c], cl
mov eax, ebx
mov dword [ebp - 0x1b], 0x43040d11
mov dword [ebp - 0x17], 0xf131b06
mov dword [ebp - 0x13], 0x170a0c
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xb
jae 0x10036815
mov cl, byte [ebp - 0x1c]
jmp 0x10036806
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x10], bl
push 0x100e0d5f
push eax
call fcn.1006327a
pop ecx
pop ecx
pop ebx
leave
ret
Function at 0x100431d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x100431f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x100432ba
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
not edx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x100432e6
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ac9c0]
inc edi
sub esi, 1
jne 0x100432ce
not edx
pop edi
mov eax, edx
pop esi
pop ebp
ret

Function at 0x100432ee
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov edx, ebx
test edi, edi
je 0x10043354
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1004331c
cmp edi, 2
jb 0x1004331c
cmp byte [esi], al
jne 0x1004331c
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ac9c0]
test edi, edi
jne 0x10043305
jmp 0x1004335b
cmp al, 0x23
jne 0x10043342
cmp byte [esi], al
jne 0x10043342
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ac9c0]
mov al, byte [esi]
inc esi
test al, al
jne 0x10043334
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x1005a928
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.100427aa
mov edi, eax
mov ecx, dword [edi + 0x90]
call fcn.1005b0e1
test al, al
jne 0x1005a968
push 0xdd
push str.D:1sources_trinityshellxanaxdependenciesimguiimgui_impl_win32.cpp
push str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_backend._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [0x100e0de8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
movd xmm1, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0xc]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x100e0df0]
mov edx, dword [ebp - 8]
sbb edx, dword [0x100e0df4]
call fcn.1007e170
mov edx, dword [0x100e0dfc]
mov ecx, dword [0x100e0df8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x20], xmm0
call fcn.1007e170
movss xmm1, dword [ebp - 0x20]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [0x100e0df0], eax
mov dword [0x100e0df4], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.1005ada9
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x1005aa49
or eax, 0xffffffff
jmp 0x1005aa4e
call fcn.10042889
cmp dword [0x100df740], eax
je 0x1005aa60
mov dword [0x100df740], eax
call fcn.1005ad01
call fcn.1005aa79
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d97d
leave
ret
Function at 0x1007065a
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10117e7c]
push esi
xor esi, esi
jmp 0x1007066c
cmp dword [edx + 4], esi
jne 0x100706c0
mov edx, dword [edx]
test edx, edx
jne 0x10070665
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100706bc
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10070693
mov eax, dword [0x10117e7c]
mov dword [edx], eax
mov dword [0x10117e7c], edx
pop edi
test edx, edx
jne 0x100706c0
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x10070ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
imul esi, eax, 0x2c
push edi
add esi, dword [0x10117e70]
mov dword [ebp - 0xc], esi
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea edi, [eax*2 + 5]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], edi
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10070f47
push 0xa
pop eax
jmp 0x10070fc9
cmp dword [ebp + 0xc], 0
je 0x10070f6a
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x10070f8c
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10070f8c
test byte [esi + 0x14], 1
je 0x10070f81
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
jmp 0x10070f8c
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp + 0xc]
mov cl, dl
add cl, cl
shl dl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor dl, cl
and dl, 4
xor dl, cl
xor eax, eax
mov byte [esi + 0x14], dl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d97d
leave
ret
Function at 0x10071005
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x100710e3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100710dc
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x100710c2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100710c2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100710c2
mov edx, dword [esi]
test edx, edx
jne 0x10071090
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x100e0e44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100710db
lea ebx, [esi + 8]
jmp 0x100710b8
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x100710b8
shl eax, 3
push eax
push edx
push 0
push dword [0x100e0e44]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100710db
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10071048
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007d97d
leave
ret

Function at 0x1007115d
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.10071005
pop ecx
cmp dword [esi], ebx
je 0x100711bd
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x100711bc
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100711b3
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100713f0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x10071182
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10071500
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x10071550
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1007153f
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10071538
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10071515
pop ebx
push dword [esi]
push 0
push dword [0x100e0e44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
ret
Function at 0x10071877
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x10082484
call fcn.1007d9bd
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x10117b30]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x100e0e64]
cmp eax, dword [esi + 4]
jg 0x100718c7
mov eax, dword [0x100e0e6c]
cmp eax, dword [esi + 4]
jg 0x10071960
push dword [ebp + 8]
mov ecx, dword [0x100e0e60]
call dword [0x100e0e68]
call fcn.1007d98b
ret
push 0x100e0e64
call fcn.1007deeb
cmp dword [0x100e0e64], 0xffffffff
pop ecx
jne 0x100718a1
movaps xmm0, xmmword [0x100b7900]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 4], ebx
movaps xmm0, xmmword [str.CCCD_I8LD]
movups xmmword [ebp - 0x2c], xmm0
jmp 0x100718f8
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1e
jb 0x100718f8
mov byte [ebp - 0x1d], bl
mov cl, 0x75
mov dword [ebp - 0x18], 0x1c191675
mov eax, ebx
mov dword [ebp - 0x14], 0x5b011b10
mov dword [ebp - 0x10], 0x191911
jmp 0x10071923
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x10071932
mov cl, byte [ebp - 0x18]
jmp 0x10071923
lea eax, [ebp - 0x3b]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0x17]
push eax
call fcn.1007c6a5
or dword [ebp - 4], 0xffffffff
push 0x100e0e64
mov eax, dword [eax + 1]
mov dword [0x100e0e60], eax
call fcn.1007de9a
add esp, 0xc
jmp 0x100718a1
mov esi, 0x100e0e6c
push esi
call fcn.1007deeb
cmp dword [0x100e0e6c], 0xffffffff
pop ecx
jne 0x100718b2
movaps xmm0, xmmword [0x100b7930]
mov ecx, ebx
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 4], 1
movaps xmm0, xmmword [0x100b7890]
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x1c], bl
movaps xmm0, xmmword [0x100b7960]
movups xmmword [ebp - 0x2c], xmm0
jmp 0x100719a8
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x2f
jb 0x100719a8
mov byte [ebp - 0x1c], bl
mov cl, 8
mov dword [ebp - 0x18], 0x61646b08
mov eax, ebx
mov dword [ebp - 0x14], 0x267c666d
mov dword [ebp - 0x10], 0x64646c
jmp 0x100719d3
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x100719e2
mov cl, byte [ebp - 0x18]
jmp 0x100719d3
lea eax, [ebp - 0x4b]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0x17]
push eax
call fcn.1007c6a5
or dword [ebp - 4], 0xffffffff
push esi
mov dword [0x100e0e68], eax
call fcn.1007de9a
add esp, 0xc
jmp 0x100718b2
Function at 0x10071a09
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x80
mov eax, 0x100824c1
call fcn.1007d9bd
movaps xmm0, xmmword [0x100b7810]
xor ebx, ebx
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], bl
mov ecx, ebx
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xf
jb 0x10071a2a
mov esi, dword [ebp + 8]
mov eax, esi
mov byte [ebp - 0x20], bl
cmp dword [esi + 0x14], 0x10
jb 0x10071a47
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071a9d
mov edi, dword [ebp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 0x10
jb 0x10071a6a
mov ecx, dword [edi]
push ebx
push ecx
call eax
pop ecx
pop ecx
test eax, eax
jne 0x10071aff
movaps xmm0, xmmword [0x100b78b0]
mov ecx, ebx
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x34], 0x7b35
mov byte [ebp - 0x32], bl
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x11
jae 0x10071b05
jmp 0x10071a8e
mov cl, 0x1d
mov dword [ebp - 0x1c], 0x7c6a3d1d
mov dword [ebp - 0x18], 0x693a736e
mov eax, ebx
mov dword [ebp - 0x14], 0x68727b3d
mov word [ebp - 0x10], 0x7973
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xd
jae 0x10071ace
mov cl, byte [ebp - 0x1c]
jmp 0x10071abf
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xe], bl
push eax
lea eax, [ebp - 0x8c]
push esi
push eax
call fcn.1007182a
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.10071b43
push 0x100d941c
lea eax, [ebp - 0x2c]
jmp 0x10071b3c
call fcn.1007d98b
ret
lea eax, [ebp - 0x43]
mov byte [ebp - 0x32], bl
push eax
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.1007182a
push esi
push eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], ebx
push eax
call fcn.1001f590
add esp, 0x18
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10071b43
push 0x100d941c
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10073c9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [0x100e0e70]
push edi
test esi, esi
jne 0x10073d3a
movaps xmm0, xmmword [0x100b7aa0]
xor edx, edx
movups xmmword [ebp - 0x40], xmm0
mov ecx, edx
mov word [ebp - 0x20], 0x146f
movaps xmm0, xmmword [0x100b7a90]
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x21
jb 0x10073ce1
mov byte [ebp - 0x1e], dl
mov cl, 0x44
mov dword [ebp - 0x18], 0x2d282744
mov eax, edx
mov dword [ebp - 0x14], 0x6a302a21
mov dword [ebp - 0x10], 0x282820
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x10073d19
mov cl, byte [ebp - 0x18]
jmp 0x10073d0a
lea eax, [ebp - 0x3f]
mov byte [ebp - 0xd], dl
push eax
lea eax, [ebp - 0x17]
push eax
call fcn.1007c6a5
pop ecx
pop ecx
mov esi, dword [eax + 3]
add esi, 0xb0
mov dword [0x100e0e70], esi
mov edi, dword [ebp + 8]
movss xmm0, dword [esi + 0x34]
movss xmm1, dword [esi + 0x30]
mulss xmm0, dword [edi + 4]
mulss xmm1, dword [edi]
addss xmm1, xmm0
movss xmm0, dword [esi + 0x38]
mulss xmm0, dword [edi + 8]
addss xmm1, xmm0
movss xmm0, dword [0x100b7a80]
addss xmm1, dword [esi + 0x3c]
comiss xmm0, xmm1
movss dword [ebp - 0x1c], xmm1
jbe 0x10073d80
xor al, al
jmp 0x10073e3c
mov ecx, dword [0x100e0804]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
movd xmm3, dword [ebp - 8]
mov al, 1
movd xmm4, dword [ebp - 0xc]
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm4, xmm4
mulss xmm3, dword [0x10088e40]
mulss xmm4, dword [0x10088e40]
movss dword [ebx], xmm3
movss xmm2, dword [0x10088e44]
movss dword [ebx + 4], xmm4
movss xmm1, dword [esi + 4]
mulss xmm1, dword [edi + 4]
movss xmm0, dword [edi]
mulss xmm0, dword [esi]
addss xmm1, xmm0
movss xmm0, dword [esi + 8]
mulss xmm0, dword [edi + 8]
addss xmm1, xmm0
addss xmm1, dword [esi + 0xc]
divss xmm1, dword [ebp - 0x1c]
addss xmm1, xmm2
mulss xmm1, xmm3
movss dword [ebx], xmm1
movss xmm0, dword [esi + 0x14]
movss xmm1, dword [esi + 0x10]
mulss xmm1, dword [edi]
mulss xmm0, dword [edi + 4]
addss xmm1, xmm0
movss xmm0, dword [esi + 0x18]
mulss xmm0, dword [edi + 8]
addss xmm1, xmm0
addss xmm1, dword [esi + 0x1c]
divss xmm1, dword [ebp - 0x1c]
subss xmm2, xmm1
mulss xmm2, xmm4
movss dword [ebx + 4], xmm2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d97d
leave
ret
Function at 0x10073e82
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x10073eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10073ed4
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10073f1b
inc ax
mov word [ebp - 0xa], ax
jmp 0x10073eee
cmp eax, 0xe7
jne 0x10073f1b
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x10073f1b
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10073eb7
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d97d
leave
ret
xor al, al
jmp 0x10073f0c

Function at 0x10073f1f
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100dfa10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x10073f53
push 0x62
push str.D:1sources_trinityshellxanaxdependencies_rpc_sourceconnection_win.cpp
push 0x100b7b80
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
xor al, al
jmp 0x10073fd0
test esi, esi
jne 0x10073f65
push 0x67
push str.D:1sources_trinityshellxanaxdependencies_rpc_sourceconnection_win.cpp
push str.self
jmp 0x10073f46
cmp dword [esi + 4], 0xffffffff
push edi
je 0x10073fcd
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push ecx
push ecx
push dword [esi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10073fc6
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 8], edi
jb 0x10073fcd
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x10073fc6
cmp edi, dword [ebp - 0xc]
je 0x10073fc2
push 0x74
push str.D:1sources_trinityshellxanaxdependencies_rpc_sourceconnection_win.cpp
push str.bytesToRead__bytesRead
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov al, 1
jmp 0x10073fcf
mov ecx, esi
call fcn.10073e4b
xor al, al
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d97d
leave
ret 8