joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100088d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x100aace8
call fcn.10012b10
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
movzx ecx, byte [ebp - 0x109]
push ecx
push 0x1009c7a0
lea ecx, [ebp - 0x110]
call fcn.10015790
mov ecx, eax
call fcn.10008750
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10012b10
push eax
mov ecx, dword [ebp + 8]
call fcn.10012b10
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret

Function at 0x10008950
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x100aace8
call fcn.10012b10
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
movzx ecx, byte [ebp - 0x109]
push ecx
push 0x1009c7a4
lea ecx, [ebp - 0x114]
call fcn.100157d0
mov ecx, eax
call fcn.10008750
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10012b10
push eax
mov ecx, dword [ebp + 8]
call fcn.10012b10
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
add esp, 4
fstp dword [ebp - 0x110]
fld dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret

Function at 0x10008fc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098d23
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
push 0x1009c7d8
mov ecx, dword [ebp + 8]
call fcn.10012a10
push eax
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.100129c0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x28]
call fcn.10012b10
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10009032
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100090a9
push 1
push 0x40
push 2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xdc]
call fcn.10012fd0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0xdc]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
movzx ecx, al
test ecx, ecx
je 0x1000909a
lea ecx, [ebp - 0xdc]
call fcn.10012f30
mov byte [ebp - 0x29], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.100090e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10012c20
mov al, byte [ebp - 0x29]
jmp 0x100090bf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.100090e0
mov byte [ebp - 0x2a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10012c20
mov al, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret
Function at 0x10011580
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099d78
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10012eb0
mov dword [ebp - 4], 0
push 0
movzx ecx, byte [ebp - 0x51]
push ecx
push 0x1009dc3c
lea ecx, [ebp - 0x30]
call fcn.100377f0
mov ecx, eax
call fcn.10008850
push eax
lea ecx, [ebp - 0x28]
call fcn.10012a90
cmp eax, 0xffffffff
jne 0x10011606
movzx edx, byte [ebp - 0x52]
push edx
push str..cfg
lea ecx, [ebp - 0x38]
call fcn.10037890
mov ecx, eax
call fcn.10008850
push eax
lea ecx, [ebp - 0x28]
call fcn.10012b90
lea eax, [ebp - 0x28]
push eax
push 0x100aad04
lea ecx, [ebp - 0x50]
push ecx
call fcn.10015ab0
add esp, 0xc
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
push edx
mov ecx, 0x100aace8
call fcn.10012c70
lea ecx, [ebp - 0x50]
call fcn.10012c20
mov ecx, 0x100aace8
call fcn.10012b10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10012c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret
Function at 0x10013390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x100134b3
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x100133c9
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x100134c8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10013460
jg 0x100133f2
cmp dword [ebp + 0xc], 0
jbe 0x10013460
cmp dword [ebp - 8], 0
jl 0x10013460
jg 0x10013400
cmp dword [ebp - 0xc], 0
jbe 0x10013460
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1001341e
jl 0x10013412
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1001341e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.10006e40
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x100134a3
jg 0x1001346e
cmp dword [ebp + 0xc], 0
jbe 0x100134a3
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x100134a3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x100134c8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100134d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x100135fb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10013509
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10013610
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x100135a0
jg 0x10013532
cmp dword [ebp + 0xc], 0
jbe 0x100135a0
cmp dword [ebp - 8], 0
jl 0x100135a0
jg 0x10013540
cmp dword [ebp - 0xc], 0
jbe 0x100135a0
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1001355e
jl 0x10013552
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1001355e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10006e40
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x100135eb
jg 0x100135ae
cmp dword [ebp + 0xc], 0
jbe 0x100135eb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x100135eb
mov ecx, dword [ebp - 4]
call fcn.10014b10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x10013610
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10014ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x10014bc7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10014bce
mov al, 1
jmp 0x10014ca4
call fcn.10006f80
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10006f80
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10006f00
add esp, 8
movzx eax, al
test eax, eax
je 0x10014c0a
xor al, al
jmp 0x10014ca4
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10014c47
cmp dword [ebp - 0x30], 1
je 0x10014c4e
cmp dword [ebp - 0x30], 3
je 0x10014c9e
jmp 0x10014ca2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x10014c7e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x10014c7e
xor al, al
jmp 0x10014ca4
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10014c92
mov dword [ebp - 0x38], 1
jmp 0x10014c99
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x10014ca4
mov al, 1
jmp 0x10014ca4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret

Function at 0x1003ba30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [0x100aac34], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x1003b800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x100478e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 4
shl eax, 0
cmp dword [eax + 0x100af560], 0
jne 0x10047960
mov dword [ebp - 0x20], 0xedb88320
mov dword [ebp - 0x10], 0
jmp 0x10047910
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x10047960
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
jmp 0x10047931
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jae 0x10047951
mov ecx, dword [ebp - 0x14]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x10047928
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x100af560], ecx
jmp 0x10047907
mov edx, dword [ebp + 0x10]
not edx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x100479bd
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x1c], 0
je 0x100479bb
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
xor ecx, dword [edx*4 + 0x100af560]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x1004797a
jmp 0x10047a2e
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movzx edx, byte [ebp - 1]
test edx, edx
je 0x10047a2e
movzx eax, byte [ebp - 1]
cmp eax, 0x23
jne 0x10047a0d
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10047a0d
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10047a0d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 1]
xor ecx, edx
xor eax, dword [ecx*4 + 0x100af560]
mov dword [ebp - 0xc], eax
jmp 0x100479bd
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10048670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x10048685
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100486a6
xor eax, eax
jmp 0x1004879b
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100486e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x100486e6
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x100486fa
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x1004879b
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp + 0x14]
push edx
call fcn.1004a060
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10048729
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x1004879b
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x10048762
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.1004a0a0
add esp, 4
xor eax, eax
jmp 0x1004879b
cmp dword [ebp + 0x14], 0
jle 0x1004877d
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x10048798
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10071130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100aa00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100af51c], 0
jne 0x1007114e
call fcn.10071060
call fcn.1004a0e0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x100af52c]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
cvtsi2ss xmm0, edx
push ecx
movss dword [esp], xmm0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x3c]
call fcn.10043cd0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [0x100af530]
mov edx, dword [ebp - 0x2c]
sbb edx, dword [0x100af534]
call fcn.10098b40
cvtsd2ss xmm0, xmm0
mov edx, dword [0x100af53c]
mov ecx, dword [0x100af538]
movss dword [ebp - 0x34], xmm0
call fcn.10098b40
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x34]
divss xmm1, xmm0
mov edx, dword [ebp - 0x18]
movss dword [edx + 8], xmm1
mov eax, dword [ebp - 0x30]
mov dword [0x100af530], eax
mov ecx, dword [ebp - 0x2c]
mov dword [0x100af534], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10071219
mov dword [ebp - 0x1c], 1
jmp 0x10071220
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 0xd5], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10071248
mov dword [ebp - 0x20], 1
jmp 0x1007124f
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
mov cl, byte [ebp - 0x20]
mov byte [eax + 0xd6], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10071277
mov dword [ebp - 0x24], 1
jmp 0x1007127e
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x18]
mov cl, byte [ebp - 0x24]
mov byte [eax + 0xd7], cl
mov edx, dword [ebp - 0x18]
mov byte [edx + 0xd8], 0
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0xd4]
test ecx, ecx
je 0x100712ab
mov dword [ebp - 0x28], 0
jmp 0x100712bb
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.1004a110
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100972e3
mov esp, ebp
pop ebp
ret
Function at 0x10071380
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10071300
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
mov ecx, dword [0x100aac30]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x100713b2
xor al, al
jmp 0x100713dd
push 0x10071d60
push 0xfffffffffffffffc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 4], eax
cmp dword [ebp - 8], 0
jne 0x100713db
xor al, al
jmp 0x100713dd
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10071f30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10071f50
xor eax, eax
jmp 0x1007211a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x10071f6a
xor eax, eax
jmp 0x1007211a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0x4550
je 0x10071f88
xor eax, eax
jmp 0x1007211a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x50]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], edx
jmp 0x10071fb8
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x2c]
jae 0x10072118
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x3f
je 0x10072094
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
cmp ecx, 0x30
jl 0x10072012
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax]
cmp edx, 0x39
jg 0x10072012
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx]
sub eax, 0x30
mov dword [ebp - 0x20], eax
jmp 0x1007202a
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
and ecx, 0xffffffdf
sub ecx, 0x37
mov dword [ebp - 0x20], ecx
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
cmp ecx, 0x30
jl 0x10072069
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
cmp ecx, 0x39
jg 0x10072069
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
sub ecx, 0x30
mov dword [ebp - 0x24], ecx
jmp 0x10072081
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
and ecx, 0xffffffdf
sub ecx, 0x37
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x20]
shl ecx, 4
or ecx, dword [ebp - 0x24]
cmp eax, ecx
jne 0x100720fa
cmp dword [ebp - 8], 0
jne 0x100720a0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax]
test edx, edx
jne 0x100720b7
mov eax, dword [ebp - 8]
jmp 0x1007211a
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x3f3f
je 0x100720d9
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x3f
jne 0x100720d9
mov dword [ebp - 0x28], 2
jmp 0x100720e0
mov dword [ebp - 0x28], 3
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
test eax, eax
jne 0x100720f8
mov eax, dword [ebp - 8]
jmp 0x1007211a
jmp 0x10072113
cmp dword [ebp - 8], 0
je 0x10072113
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
jmp 0x10071faf
xor eax, eax
mov esp, ebp
pop ebp
ret