joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003390
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034500
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10048434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001402e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10012bfe
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov edx, dword [0x1008eb2c]
mov dword [ecx], 0
mov ecx, dword [0x1008eb28]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov edx, dword [0x1008e038]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x1008eb30]
cmp eax, dword [edx + 4]
jle 0x10003e26
push 0x1008eb30
call fcn.100141c2
add esp, 4
cmp dword [0x1008eb30], 0xffffffff
jne 0x10003e26
push 0x10034b30
mov dword [0x1008eb34], 0x10041c34
call fcn.1001459d
push 0x1008eb30
call fcn.10014178
add esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003e5c
lea eax, [ebp - 8]
mov dword [esi], 0
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001401b
mov esp, ebp
pop ebp
ret
Function at 0x10005620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x10005645
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 0x1cc000
push 0x401000
call esi
lea eax, [ebp - 0xc]
push eax
push 4
push 0x18000
push 0x5cd000
call esi
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008e038]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x10091280]
cmp eax, dword [esi + 4]
jle 0x100056c2
push 0x10091280
call fcn.100141c2
add esp, 4
cmp dword [0x10091280], 0xffffffff
jne 0x100056c2
push 0x10034b50
mov dword [0x10091284], 0x10041c5c
call fcn.1001459d
push 0x10091280
call fcn.10014178
add esp, 8
call fcn.10005760
test al, al
je 0x10005745
mov eax, dword [0x1009128c]
cmp eax, dword [esi + 4]
jle 0x1000570f
push 0x1009128c
call fcn.100141c2
add esp, 4
cmp dword [0x1009128c], 0xffffffff
jne 0x1000570f
push 0x10034b40
mov dword [0x10091288], 0x10041c6c
call fcn.1001459d
push 0x1009128c
call fcn.10014178
add esp, 8
call fcn.10009d10
test al, al
je 0x10005745
call fcn.10007040
test al, al
jne 0x1000573d
call fcn.10007120
test al, al
jne 0x1000573d
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret
Function at 0x100063d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008e038]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1008eb30]
cmp eax, dword [ecx + 4]
jle 0x10006433
push 0x1008eb30
call fcn.100141c2
add esp, 4
cmp dword [0x1008eb30], 0xffffffff
jne 0x10006433
push 0x10034b30
mov dword [0x1008eb34], 0x10041c34
call fcn.1001459d
push 0x1008eb30
call fcn.10014178
add esp, 8
push ebx
push esi
push edi
push 0x10036e62
push 5
mov dword [ebp - 8], 0
call fcn.100145b2
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x100064ba
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x100065d0
push 5
sub ecx, 0x4e0546
push 0x4e0541
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x100064ba
mov eax, dword [esi]
mov ecx, 0x4e0541
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x100064ba
push 5
push 0x4e0541
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 6
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x10006538
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006600
sub ecx, 0x50d979
push 6
mov dword [esi + 1], ecx
push 0x50d974
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10006538
mov eax, dword [esi]
mov ecx, 0x50d974
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10006538
push 6
push 0x50d974
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 6
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x100065b6
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006630
sub ecx, 0x4df308
push 6
mov dword [esi + 1], ecx
push 0x4df303
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x100065b6
mov eax, dword [esi]
mov ecx, 0x4df303
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x100065b6
push 6
push 0x4df303
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret
Function at 0x100066c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp eax, 1
jne 0x100067c9
push 0
push eax
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push str.1216883658909024366
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call fcn.1000f3b0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.shell32.dll
call esi
push str.xProtect.dll
call esi
push str.music.dll
call esi
push 0
push 0
push 0
push 0x10006970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp + 0x10], 0
jne 0x100067b6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008e038]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10091290]
cmp eax, dword [ecx + 4]
jle 0x10006790
push 0x10091290
call fcn.100141c2
add esp, 4
cmp dword [0x10091290], 0xffffffff
jne 0x10006790
push 0x10034b60
mov dword [0x10091294], 0x10041d00
call fcn.1001459d
push 0x10091290
call fcn.10014178
add esp, 8
mov ecx, 0x10091294
call fcn.10005620
test al, al
jne 0x1000682c
push 0
push str.Erro:_ClientPatch.dll
push 0x10041cac
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x100067b6
cmp dword [ebp + 0x10], eax
je 0x100067b6
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008e038]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10091290]
cmp eax, dword [ecx + 4]
jle 0x10006825
push 0x10091290
call fcn.100141c2
add esp, 4
cmp dword [0x10091290], 0xffffffff
jne 0x10006825
push 0x10034b60
mov dword [0x10091294], 0x10041d00
call fcn.1001459d
push 0x10091290
call fcn.10014178
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1001401b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ce10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x667
push esi
push edi
movzx eax, word [ebx + 4]
cmp ax, cx
jne 0x1000ce6c
push 0x1388
push 0
push 0x1008eb90
call fcn.10016210
push 0x1388
lea ecx, [ebx + 0xc]
push ecx
push 0x1008eb90
call fcn.10015c90
mov ecx, dword [ebx + 0x1394]
add esp, 0x18
mov dword [0x1008ff18], ecx
jmp 0x1000cff8
mov ecx, 0xd1d
cmp ax, cx
jne 0x1000ceb1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
jmp 0x1000cff8
mov ecx, 0x5000
cmp ax, cx
jne 0x1000cf19
mov esi, dword [ebx + 0x6c]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
jmp 0x1000cff8
mov ecx, 0xd1e
cmp ax, cx
jne 0x1000cf6a
mov edi, dword [ebx + 0x68]
test edi, edi
je 0x1000cf5c
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4a571c
mov dword [ebp - 8], 0x40
call esi
lea eax, [ebp - 8]
mov dword [0x4a571c], edi
push eax
push dword [ebp - 8]
push 4
push 0x4a571c
call esi
mov eax, 0xd1d
mov word [ebx + 4], ax
jmp 0x1000cff8
mov ecx, 0xaf1
cmp ax, cx
jne 0x1000cfb8
mov esi, dword [ebx + 0x68]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x10057aac]
jmp 0x1000cefa
mov ecx, 0x666
cmp ax, cx
jne 0x1000cff8
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [0x1008eb54], xmm0
movups xmm0, xmmword [ebx + 0x20]
movups xmmword [0x1008eb64], xmm0
movups xmm0, xmmword [ebx + 0x30]
movups xmmword [0x1008eb74], xmm0
movq xmm0, qword [ebx + 0x40]
movq qword [0x1008eb84], xmm0
mov eax, dword [ebx + 0x48]
mov dword [0x1008eb8c], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d480
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
mov dword [ebp - 0x44], eax
jmp 0x1000d4bd
cmp dword [ebx + 0x10], 0
jne 0x1000d570
mov esi, dword [ebp - 0x44]
mov eax, 0x20d
cmp word [esi + 4], ax
jne 0x1000d570
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [ebp - 0x31]
xorps xmm0, xmm0
push eax
movzx eax, byte [ebp - 0x32]
push eax
movzx eax, byte [ebp - 0x33]
push eax
movzx eax, byte [ebp - 0x34]
push eax
movzx eax, byte [ebp - 0x35]
push eax
movzx eax, byte [ebp - 0x36]
push eax
lea eax, [ebp - 0x30]
movaps xmmword [ebp - 0x30], xmm0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
mov word [ebp - 0x20], 0
call fcn.100055a0
lea ecx, [ebp - 0x30]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d525
sub ecx, edx
cmp ecx, 0xc
jge 0x1000d53b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esi + 0x42]
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
movups xmmword [edx], xmm0
mov ecx, eax
mov word [edx + 0x10], 0
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1000d551
mov eax, 0x605
mov word [esi + 0x54], ax
mov eax, 0x120f
mov word [esi + 0x5c], ax
jmp 0x1000d582
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
call fcn.1001401b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000f3b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x10036e62
push 0x64
call fcn.1001491e
mov esi, eax
add esp, 8
test esi, esi
je 0x1000f54c
push 0x64
push 0
push esi
call fcn.10016210
lea eax, [esi + 4]
mov byte [esi], 1
mov dword [eax + 4], 0
xorps xmm0, xmm0
mov dword [eax + 8], 0
movups xmmword [eax + 0xc], xmm0
push 2
movq qword [eax + 0x1c], xmm0
mov dword [eax + 0x24], 0
push eax
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
call fcn.1001369f
lea eax, [esi + 0x34]
push eax
call fcn.1001382b
xorps xmm0, xmm0
mov dword [0x1007da54], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x1000f45a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000f44f
cmp byte [eax], 0
je 0x1000f44f
push eax
push esi
call fcn.1000f960
jmp 0x1000f457
push 0
push esi
call fcn.1000f8e0
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x10058358
mov dword [0x1007da50], eax
call fcn.100136c0
add esp, 4
test eax, eax
jne 0x1000f55b
cmp dword [0x10058384], 0x7fffffff
je 0x1000f562
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000f4a1
movups xmm0, xmmword [eax]
movups xmmword [0x10079400], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x1000f4ab
xorps xmm0, xmm0
movups xmmword [0x10079400], xmm0
movq qword [0x10079410], xmm0
xorps xmm0, xmm0
push 0x10058358
movups xmmword [0x10079418], xmm0
movq qword [0x10079428], xmm0
call fcn.100136e5
add esp, 4
cmp dword [0x100793fc], 0
jne 0x1000f556
push esi
call fcn.10011df0
mov dword [0x100793fc], eax
mov dword [eax + 8], 0x1000dd10
mov eax, dword [0x100793fc]
mov dword [eax + 0xc], 0x1000dd20
mov al, 1
mov esi, dword [0x1007da54]
xchg byte [esi], al
push 4
call fcn.1001402e
add esp, 8
test eax, eax
je 0x1000f515
mov dword [eax], esi
jmp 0x1000f517
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1000dd70
push 0
push 0
call fcn.1001f6db
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1000f578
cmp dword [esi + 0x60], 0
jne 0x1000f573
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1007da54], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.100139eb
push 6
mov dword [0x10058384], 0x7ffffffe
call fcn.100139eb
call fcn.1001f4db
push 6
mov dword [ebp - 4], 0
call fcn.100139eb
int3
Function at 0x1000f960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000f9d4
push str.Error_opening_Steam_key_n
jmp 0x1000fa94
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000fa8f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x1000fa8f
shr ecx, 1
mov eax, esi
je 0x1000fa48
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x1000fa43
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x1000fa30
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.1000f870
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1000f590
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call fcn.1001de3b
add esp, 4
push eax
call fcn.1000fac0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1001401b
mov esp, ebp
pop ebp
ret
Function at 0x1000fb30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x10035518]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1003551c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x10035500]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x10035510]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1000fc00
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x1000fbc9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x1000fc16
inc ax
mov word [ebp - 0xa], ax
jmp 0x1000fbdf
cmp eax, 0xe7
jne 0x1000fc16
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x1000fc16
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1000fbb0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret

Function at 0x1001891b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001895a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001895a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001895a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001895a
cmp dword [ecx + 0x74], 0xe
jbe 0x1001895a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100273ba
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a5b4
push 0x1003a5ac
push str.FlsAlloc
push 0x1f
call fcn.10027242
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100273ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x100351c0]
call esi
jmp 0x100273f4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10027438
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a5c4
push 0x1003a5bc
push str.FlsGetValue
push 0x21
call fcn.10027242
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002746f
push dword [ebp + 8]
mov ecx, esi
call dword [0x100351c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10027477
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a5cc
push 0x1003a5c4
push str.FlsSetValue
push 0x22
call fcn.10027242
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100274b1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100351c0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10027c1f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10014a70
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10022808
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10027c61
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10027dbd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10014980
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1008e6e0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.10028ca6
mov ecx, dword [esi*4 + 0x1008e6e0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10027db6
cmp eax, dword [ecx + edi + 0x24]
jne 0x10027db6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10027db6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10028ca6
add esp, 0x14
test edx, edx
jl 0x10027db6
jg 0x10027d2c
test eax, eax
jb 0x10027db6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10027db6
jl 0x10027d46
cmp dword [ebp - 0x1008], eax
ja 0x10027db6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10027d64
test ebx, ebx
je 0x10027d9d
cmp ecx, edi
jae 0x10027d9d
mov al, byte [ecx]
cmp al, 0xd
jne 0x10027d7e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10027d8a
cmp byte [ecx + 1], 0xa
jne 0x10027d8a
inc ecx
jmp 0x10027d8a
movzx eax, al
movsx eax, byte [eax + 0x100486b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10027d64
cmp edx, ebx
jne 0x10027d64
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10027dbb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001401b
leave
ret