joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020cc6
Capabilities:
Encode data using xor

Disassembly:
push 0x78
mov eax, 0x10073cf3
call fcn.1003bf6c
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x10099dd0], eax
test edi, edi
jne 0x10020ce9
xor al, al
jmp 0x10020ee7
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10020d04
cmp edi, dword [esi + 4]
jne 0x10020ee5
call fcn.1002129c
jmp 0x10020ee5
and eax, 0xf0000
cmp eax, 0x10000
je 0x10020ed0
cmp eax, 0x40000
je 0x10020d34
cmp eax, 0x80000
jne 0x10020ee5
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d6e3
jmp 0x10020ee5
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d6e3
mov eax, dword [esi + 0x28]
xor ebx, ebx
sub eax, dword [esi + 0x24]
sar eax, 3
test eax, eax
je 0x10020d75
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x10020d67
mov ecx, dword [eax]
test ecx, ecx
je 0x10020d67
mov edx, 0x110
call fcn.1000d72d
mov eax, dword [esi + 0x28]
inc ebx
sub eax, dword [esi + 0x24]
sar eax, 3
cmp ebx, eax
jb 0x10020d4c
push edi
mov ecx, esi
call fcn.10020fa5
mov edi, eax
test edi, edi
je 0x10020ee5
mov eax, dword [edi + 0x60]
mov dword [ebp + 8], eax
test eax, eax
je 0x10020ee5
mov ebx, dword [edi + 0x64]
test ebx, ebx
je 0x10020ee5
push edi
mov ecx, esi
call fcn.10020fd8
cmp dword [esi + 0x18], eax
jne 0x10020ee5
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [ecx], 0x3b9aca00
jb 0x10020dd1
xor edx, edx
mov dword [ebp + 0xc], 0x3e8
div dword [ebp + 0xc]
add edx, dword [ecx]
mov dword [esi + 0x14], edx
jmp 0x10020dd6
add eax, dword [ecx]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
mov edx, 0x400000
call fcn.1000d72d
call dword [0x10088fc8]
mov cl, 0x4d
mov dword [ebp - 0x18], 0x2e35084d
mov dword [ebp - 0x14], 0x2a232c25
xor edx, edx
mov word [ebp - 0x10], 0x28
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x10020e13
mov cl, byte [ebp - 0x18]
jmp 0x10020e00
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.10004179
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x60]
and dword [ebp - 4], 0
lea esi, [ebp - 0x30]
push 0x82
push 4
push ebx
call fcn.10009171
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x10020e4a
mov eax, dword [eax]
movaps xmm0, xmmword [0x1008ae90]
xor ebx, ebx
movups xmmword [ebp - 0x84], xmm0
mov edx, ebx
mov byte [ebp - 0x64], bl
movaps xmm0, xmmword [0x1008a410]
push eax
movups xmmword [ebp - 0x74], xmm0
mov cl, byte [ebp - 0x84]
xor byte [ebp + edx - 0x83], cl
inc edx
cmp edx, 0x1f
jb 0x10020e6b
sub esp, 0x18
mov byte [ebp - 0x64], bl
lea eax, [ebp - 0x83]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x48]
push eax
call fcn.10003c43
add esp, 0x20
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.10010f68
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.1000402e
jmp 0x10020ee5
push edi
call fcn.10020fa5
test eax, eax
je 0x10020ee5
push eax
mov ecx, esi
call fcn.10020fd8
mov dword [esi + 0x18], eax
mov al, 1
call fcn.1003bf35
ret 8
Function at 0x10024b2e
Capabilities:
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x10073fef
call fcn.1003bf6c
mov esi, ecx
movzx eax, word [esi + 0xf6]
xor ebx, ebx
movaps xmm0, xmmword [0x1008ac10]
mov edx, ebx
push eax
movzx eax, word [esi + 0xf4]
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x41000a
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x12
jb 0x10024b65
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x68]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 0x10
jb 0x10024b9a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x50]
call fcn.1000de6f
xor edi, edi
lea ecx, [ebp - 0x50]
push ebx
inc edi
push edi
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
push ebx
push edi
call fcn.1000402e
movzx eax, word [esi + 0xf8]
test ax, ax
jne 0x10024c0e
mov cl, 0x5e
mov byte [ebp - 0xe], bl
mov al, 0x73
mov byte [ebp - 0x10], cl
xor al, cl
lea ecx, [ebp - 0x50]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0xf]
push eax
call fcn.10004179
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000de6f
lea ecx, [ebp - 0x50]
jmp 0x10024c8f
push eax
mov cl, 0x11
mov dword [ebp - 0x20], 0x72784511
mov dword [ebp - 0x1c], 0x2b65747a
mov edx, ebx
mov dword [ebp - 0x18], 0x75343231
mov byte [ebp - 0x14], bl
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0xb
jae 0x10024c3e
mov cl, byte [ebp - 0x20]
jmp 0x10024c2b
sub esp, 0x18
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x68]
push eax
call fcn.10003c43
add esp, 0x20
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x10024c6a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 4
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000de6f
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.1000402e
lea ecx, [ebp - 0x68]
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.1000402e
movzx eax, word [esi + 0xf4]
mov edx, ebx
movss xmm1, dword [0x1008a0c0]
push ecx
push ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov byte [ebp - 0x28], bl
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
movaps xmm0, xmmword [0x1008b180]
movups xmmword [ebp - 0x38], xmm0
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xf
jb 0x10024cce
sub esp, 0x18
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x98]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x10024d0a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10004179
mov byte [ebp - 4], 6
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0x58]
call fcn.1000de6f
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.1000402e
push ebx
push edi
lea ecx, [ebp - 0x98]
call fcn.1000402e
call fcn.1003bf35
ret
Function at 0x10025272
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x60
mov eax, 0x10074082
call fcn.1003bfa0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.100081b8
movzx eax, al
xor ebx, ebx
sub eax, ebx
je 0x10025353
sub eax, 1
jne 0x1002541b
mov cl, 0x1b
mov dword [ebp - 0x38], 0x6f74571b
mov dword [ebp - 0x34], 0x62697e6f
mov edx, ebx
mov dword [ebp - 0x30], 0x757e6d5e
mov word [ebp - 0x2c], 0x6f
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x100252d0
mov cl, byte [ebp - 0x38]
jmp 0x100252bd
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.10004179
mov dword [ebp - 4], 3
mov edx, ebx
movaps xmm0, xmmword [0x1008ad30]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x134a5f5f
mov dword [ebp - 0x40], 0x5d5a5c59
mov dword [ebp - 0x3c], 0x1d5756
mov cl, byte [ebp - 0x54]
xor byte [ebp + edx - 0x53], cl
inc edx
cmp edx, 0x1a
jb 0x10025308
lea eax, [ebp - 0x53]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call dword [0x10088fc4]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1000402e
lea ecx, [ebp - 0x6c]
jmp 0x10025413
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.100080df
cmp dword [ebp - 0x18], 0
je 0x10025410
cmp dword [ebp - 0x18], 0xff
ja 0x10025410
mov cl, 0x15
mov dword [ebp - 0x38], 0x617a5915
mov dword [ebp - 0x34], 0x6c677061
mov edx, ebx
mov dword [ebp - 0x30], 0x7b706350
mov word [ebp - 0x2c], 0x61
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x100253b7
mov cl, byte [ebp - 0x38]
jmp 0x100253a4
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x50]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x6c]
push eax
push eax
call dword [0x10088fc4]
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.1000402e
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.1000402e
call fcn.1003bf4a
ret 4
Function at 0x10025cb4
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1007417b
call fcn.1003bfa0
mov esi, ecx
mov eax, dword [esi]
mov dword [0x10099e48], eax
mov ecx, dword [esi]
call fcn.1000d750
test al, al
je 0x10025dc5
cmp byte [ebp + 8], 0
jne 0x10025dc5
movaps xmm0, xmmword [str._tLgl_Dfk_Ghdl]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x10025cf1
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x58
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.10004179
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000d977
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000ddf6
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, dword [esi + 0x10]
call fcn.1000da2c
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0xe
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.10004179
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000de6f
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, esi
call fcn.10026c01
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000402e
call fcn.1003bf4a
ret 0xc
Function at 0x100264ed
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1007417b
call fcn.1003bfa0
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d60f
movaps xmm0, xmmword [0x1008a2f0]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x10026513
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x6f
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.10004179
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000d977
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000ddf6
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, dword [esi + 0x10]
call fcn.1000da2c
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 3
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.10004179
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000de6f
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, esi
call fcn.10026c01
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000402e
call fcn.1003bf4a
ret
Function at 0x1002b4e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
mov eax, 0x100745aa
call fcn.1003bf6c
mov esi, ecx
mov eax, dword [esi]
mov dword [0x10099e70], eax
mov ecx, dword [esi]
call fcn.1000d750
test al, al
je 0x1002b5cc
cmp dword [ebp + 8], 0x1c
je 0x1002b519
cmp dword [ebp + 8], 0x9c
jne 0x1002b5cc
mov ecx, dword [esi + 0x64]
call fcn.1000da4b
test al, al
je 0x1002b5cc
xor edi, edi
mov ecx, esi
inc edi
push edi
push dword [esi + 0x60]
call fcn.10029c38
lea eax, [ebp + 9]
mov word [ebp + 8], 0x2b
xor ebx, ebx
lea ecx, [ebp - 0x34]
push eax
mov byte [ebp + 9], bl
call fcn.10004179
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x34]
mov ecx, dword [esi + 0x64]
call fcn.1000d977
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.1000402e
mov dl, 0x59
mov dword [ebp - 0x1c], 0x383c0a59
mov dword [ebp - 0x18], 0x79313a2b
mov ecx, ebx
mov dword [ebp - 0x14], 0x343c2d10
mov byte [ebp - 0x10], bl
xor dl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 0xb
jae 0x1002b599
mov dl, byte [ebp - 0x1c]
jmp 0x1002b586
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x4c]
call fcn.10004179
mov dword [ebp - 4], edi
lea edx, [ebp - 0x4c]
mov ecx, dword [esi + 0x64]
call fcn.1000ddf6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
push ebx
push edi
call fcn.1000402e
mov ecx, dword [esi + 0x64]
call fcn.1000da2c
call fcn.1003bf35
ret 4
Function at 0x1002d3a7
Capabilities:
Encode data using xor

Disassembly:
push 0xa0
mov eax, 0x100748b1
call fcn.1003bf6c
mov esi, ecx
call fcn.1002cf46
xor ebx, ebx
cmp al, 6
jne 0x1002d460
movaps xmm0, xmmword [0x1008a170]
mov edx, ebx
movups xmmword [ebp - 0x48], xmm0
mov cl, byte [ebp - 0x48]
xor byte [ebp + edx - 0x47], cl
inc edx
cmp edx, 0xe
jb 0x1002d3d4
lea eax, [ebp - 0x47]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x7c]
call fcn.10004179
mov dword [ebp - 4], ebx
mov edx, ebx
movaps xmm0, xmmword [0x1008a580]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x4c1b1612
mov word [ebp - 0x10], 0x43
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x14
jb 0x1002d40d
lea eax, [ebp - 0x23]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x64]
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x7c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push eax
call dword [0x10088fc4]
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.1000402e
jmp 0x1002d533
push 6
mov edi, ebx
lea eax, [esi + 0x110]
pop ecx
cmp dword [eax - 4], ebx
jbe 0x1002d477
cmp dword [eax], ebx
jbe 0x1002d477
add edi, dword [eax + 4]
add eax, 0x14
sub ecx, 1
jne 0x1002d46b
mov ecx, dword [esi + 0x34]
call fcn.1000d750
test al, al
je 0x1002d495
mov ecx, dword [esi + 0x34]
xor dl, dl
call fcn.1000d60f
push ecx
mov edx, edi
lea ecx, [ebp - 0xac]
call fcn.1000bcb1
pop ecx
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x1002d4b3
mov eax, dword [eax]
movaps xmm0, xmmword [0x1008af30]
mov edx, ebx
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x104643
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0x12
jb 0x1002d4c8
sub esp, 0x18
mov byte [ebp - 0x25], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x94]
push eax
call fcn.10003c43
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x100]
call fcn.1000de6f
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
push ebx
push 1
call fcn.1000402e
mov ecx, dword [esi + 0xfc]
mov dl, 1
call fcn.1000d60f
call fcn.1003bf35
ret
Function at 0x10030967
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x23392f4d
mov esi, ecx
mov dword [ebp - 0x14], 0x223f2912
mov cl, 0x4d
mov word [ebp - 0x10], 0x3d
mov edx, ebx
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x1003099e
mov cl, byte [ebp - 0x18]
jmp 0x1003098b
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3df
movaps xmm0, xmmword [0x1008b0c0]
add esp, 0x18
mov dword [esi + 0x10], eax
mov edx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x1c]
xor byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xf
jb 0x100309cc
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3df
movaps xmm0, xmmword [0x1008a9a0]
add esp, 0x18
mov dword [esi + 0x14], eax
mov edx, ebx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x15131102
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x13
jb 0x10030a0e
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3df
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x58
mov dword [ebp - 0x1c], 0x362c3a58
mov dword [ebp - 0x18], 0x362d3e07
mov ecx, ebx
mov dword [ebp - 0x14], 0x2b39343b
mov word [ebp - 0x10], 0x2b
xor dl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 0xc
jae 0x10030a6b
mov dl, byte [ebp - 0x1c]
jmp 0x10030a58
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3df
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 0x51
mov dword [ebp - 0x18], 0x3f253351
mov dword [ebp - 0x14], 0x253e3d0e
mov eax, ebx
mov dword [ebp - 0x10], 0x28233425
mov byte [ebp - 0xc], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xb
jae 0x10030ab4
mov cl, byte [ebp - 0x18]
jmp 0x10030aa5
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3df
mov ecx, dword [0x10099bc8]
add esp, 0x18
mov dword [esi + 0xc], eax
test ecx, ecx
je 0x10030afa
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x10030afa
mov ecx, dword [ecx]
call fcn.1000d52b
mov ecx, dword [esi]
add edx, 0xf5
push 5
call fcn.1000d5c6
pop ecx
mov ecx, dword [esi]
push 0x14
pop edx
call fcn.1000d72d
mov ecx, dword [esi]
mov dl, 1
call fcn.1000d60f
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10030b1b
xor dl, dl
call fcn.1000d60f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10030b29
xor dl, dl
call fcn.1000d60f
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10030b37
xor dl, dl
call fcn.1000d60f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031d38
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov dword [0x100bf160], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100bf15c], ecx
push edi
push ecx
mov dword [0x100bf158], eax
mov dword [0x100bf164], ecx
mov dword [0x100bf168], eax
mov dword [0x100bf16c], ecx
mov dword [0x100bf170], ecx
call fcn.1005e4eb
mov edi, eax
mov esi, edx
mov eax, 0x55555555
mov dword [0x100bf180], edi
xor ebx, ebx
mov dword [0x100c0500], eax
pop ecx
mov dword [0x100c0504], eax
inc ebx
mov dword [0x100bf184], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1003c170
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, 0x138
mov dword [ebx*8 + 0x100bf180], edi
adc esi, edx
mov dword [ebx*8 + 0x100bf184], esi
inc ebx
cmp ebx, eax
jl 0x10031d97
movaps xmm0, xmmword [0x1008abf0]
pop edi
pop esi
mov dword [0x100bf178], eax
mov eax, 0x100bf158
movups xmmword [0x100c0508], xmm0
pop ebx
ret 0x10

Function at 0x10035f82
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10095084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x10035fcb
cmp word [edx], cx
je 0x10035fcb
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10035ff0
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 0x14]
push ebx
push 1
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov edi, eax
test ecx, ecx
je 0x10035fee
cmp ecx, esi
je 0x10035fee
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b395
mov esp, ebp
pop ebp
ret

Function at 0x10036219
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10095084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x10036285
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1003626b
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x100362b4
inc ax
mov word [ebp - 0xa], ax
jmp 0x10036285
cmp eax, 0xe7
jne 0x100362b4
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x100362b4
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x1003624e
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b395
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x100362a3