joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c7e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x525058], 0
jne 0x47c7f1
call fcn.00481f00
cmp byte [0x525061], 0
je 0x47c80e
push 0
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004828c0
add esp, 0x10
pop ebp
ret
pop ebp
jmp fcn.00479cc0

Function at 0x47c820
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x525058], 0
jne 0x47c831
call fcn.00481f00
cmp byte [0x525061], 0
je 0x47c84e
push 0
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00482b70
add esp, 0x10
pop ebp
ret
pop ebp
jmp fcn.0047acc0

Function at 0x47cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 8]
push ebx
push esi
lea eax, [edx + eax*4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 8], ecx
mov esi, dword [eax]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
sub eax, 8
sub edi, dword [eax + 4]
sub esi, dword [eax]
test ecx, ecx
je 0x47cc36
nop dword [eax + eax]
sub eax, 8
mov ecx, edi
mov dword [ebp - 4], eax
mov edi, ebx
mov eax, esi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp + 8], eax
lea edx, [ecx*2 + 1]
imul edx, ecx
lea ebx, [eax*2 + 1]
imul ebx, eax
mov eax, dword [ebp - 4]
rol edx, 5
sub edi, dword [eax + 4]
sub esi, dword [eax]
rol ebx, 5
movzx ecx, bl
and ecx, 0x1f
ror edi, cl
movzx ecx, dl
xor edi, edx
mov edx, dword [ebp - 0xc]
and ecx, 0x1f
ror esi, cl
xor esi, ebx
sub dword [ebp - 8], 1
mov ebx, dword [ebp + 8]
jne 0x47cbe0
mov eax, dword [ebp - 0x10]
sub ebx, dword [eax]
sub edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], ebx
test eax, eax
je 0x47cc4a
xor esi, dword [eax]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], esi
test eax, eax
je 0x47cc61
add eax, 4
test eax, eax
je 0x47cc61
mov esi, dword [ebp + 8]
xor esi, dword [eax]
jmp 0x47cc64
mov esi, dword [ebp + 8]
mov dword [ebx + 4], esi
test eax, eax
je 0x47cc74
add eax, 4
test eax, eax
je 0x47cc74
xor edi, dword [eax]
mov dword [ebx + 8], edi
test eax, eax
je 0x47cc92
add eax, 4
test eax, eax
je 0x47cc92
mov eax, dword [eax]
pop edi
xor eax, edx
pop esi
mov dword [ebx + 0xc], eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov dword [ebx + 0xc], edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4826e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
mov edx, dword [ebp + 8]
add eax, eax
lea ecx, [ecx*4 - 4]
movups xmm0, xmmword [edx + eax*8]
movups xmm1, xmmword [edx]
movups xmmword [edx], xmm0
movups xmmword [edx + eax*8], xmm1
mov eax, 4
cmp ecx, eax
jbe 0x48272e
nop dword [eax + eax]
aesimc xmm0, xmmword [edx + ecx*4]
aesimc xmm1, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
add eax, 4
movups xmmword [edx + ecx*4], xmm1
sub ecx, 4
cmp eax, ecx
jb 0x482710
aesimc xmm0, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
pop ebp
ret
Function at 0x482740
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebx + 8]
push esi
mov esi, dword [ebx + 0x10]
push edi
mov edi, dword [ebx + 0xc]
push edi
push eax
push esi
movups xmm0, xmmword [eax + edi - 0x10]
movaps xmmword [ebp - 0x30], xmm0
call fcn.004b10f0
movaps xmm1, xmmword [ebp - 0x30]
mov edx, edi
shr edx, 2
add esp, 0xc
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [esi]
lea eax, [edx + 7]
mov dword [ebp - 8], 0x4eb5a4
shl eax, 4
xor ecx, 1
add eax, esi
mov dword [esi + edx*4], ecx
mov dword [ebp - 0xc], eax
lea eax, [edx*4]
mov dword [ebp - 0x10], eax
lea eax, [esi + edx*4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
lea eax, [edx*4 + 8]
mov dword [eax + esi], ecx
lea edx, [edx*4 + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, ecx
mov dword [ebp - 0x18], edx
mov dword [edx + esi], eax
lea eax, [esi + 0x10]
mov edx, dword [ebp - 0x10]
add eax, edx
cmp eax, dword [ebp - 0xc]
je 0x4828ac
cmp edi, 0x18
jne 0x482815
mov eax, dword [esi + 0x24]
xor eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
pinsrd xmm1, ecx, 3
jmp 0x48285a
cmp edi, 0x20
jne 0x482853
pinsrd xmm1, dword [esi + 0x2c], 3
mov eax, dword [esi + 0x14]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 2
xor ecx, dword [esi + 0x10]
xor eax, ecx
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x18]
xor ecx, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x1c]
xor eax, ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pinsrd xmm1, eax, 3
jmp 0x48285a
pinsrd xmm1, dword [esi + 0x1c], 3
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [eax]
add eax, 4
xor ecx, dword [esi]
mov dword [edx + esi], ecx
mov dword [ebp - 8], eax
lea eax, [edx + esi]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + esi], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + esi], eax
lea eax, [esi + 0x10]
add eax, edx
cmp eax, dword [ebp - 0xc]
jne 0x4827f7
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x49c74a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4cb65a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb4d9

Function at 0x4ce4c9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ce189
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x100033f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ecx, 0xfffffffc
mov esp, ecx
mov ebp, dword [esp + 0x30]
mov ecx, 0xfffffff8
mov eax, 2
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
add ebx, 0xb10
mov esi, dword [edx - 4]
mov dword [edx - 4], 0xfffffffe
mov dword [ebx - 0xa44], 0xffffffff
jmp 0x1000332b

Function at 0x100228f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, 0x109be0b0
call fcn.1000e300
push eax
mov ecx, dword [ebp - 8]
call fcn.10022a10
movzx eax, al
test eax, eax
je 0x10022918
jmp 0x10022a00
mov ecx, 0x109be0b0
call fcn.1000e300
push eax
mov ecx, dword [ebp - 8]
call fcn.10020d90
mov ecx, 0x10997a60
call fcn.101bfc00
mov ecx, eax
call fcn.10020950
movzx ecx, byte [eax]
test ecx, ecx
jne 0x10022a00
mov ecx, 0x10997a60
call fcn.101bfb20
cmp dword [eax + 0x4d30], 0x10
jg 0x10022a00
mov edx, dword [0x1033e4f4]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [0x109d7240]
cmp edx, dword [ecx + 4]
jle 0x100229c1
push 0x109d7240
call fcn.102178fc
add esp, 4
cmp dword [0x109d7240], 0xffffffff
jne 0x100229c1
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
push 0x102277a0
call fcn.101c8220
add esp, 8
add eax, 1
adc edx, 0
mov dword [0x109d7248], eax
mov dword [0x109d724c], edx
push 0x109d7240
call fcn.102178ab
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [0x109d7248]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x109d7248]
mov dword [edx], 0x11
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 4
mov edx, dword [0x109d7248]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10055dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10055dec
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10055ed2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10055e83
jg 0x10055e15
cmp dword [ebp + 0xc], 0
jbe 0x10055e83
cmp dword [ebp - 8], 0
jl 0x10055e83
jg 0x10055e23
cmp dword [ebp - 0xc], 0
jbe 0x10055e83
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10055e41
jl 0x10055e35
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x10055e41
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.10011c00
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x10055ec6
jg 0x10055e91
cmp dword [ebp + 0xc], 0
jbe 0x10055ec6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x10055ec6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10055ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10055f00
jl 0x10055ef7
cmp dword [ebp + 0xc], 0
ja 0x10055f00
xor eax, eax
xor edx, edx
jmp 0x10056047
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10055f23
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10056047
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10055f95
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10012f00
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10011c00
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10056038
mov ecx, dword [ebp - 8]
call fcn.10057350
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10056006
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10056004
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x10056047
jmp 0x10055fb1
cmp dword [ebp - 4], 0
jbe 0x10056038
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100573e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x100573fd
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10057404
mov al, 1
jmp 0x100574f1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
call fcn.10014500
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.10014500
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.10026d00
add esp, 8
movzx eax, al
test eax, eax
je 0x1005744a
xor al, al
jmp 0x100574f1
mov dword [ebp - 0x2c], 0x20
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 4]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1005748d
cmp dword [ebp - 8], 1
je 0x10057494
cmp dword [ebp - 8], 3
je 0x100574e4
jmp 0x100574ef
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
sub edx, eax
mov dword [ebp - 0xc], edx
je 0x100574c4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x100574c4
xor al, al
jmp 0x100574f1
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x100574d8
mov dword [ebp - 0x10], 1
jmp 0x100574df
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
jmp 0x100574f1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x100574f1
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1005c2c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov dword [ebp - 8], ecx
call fcn.10010de0
add eax, 0x40
mov dword [ebp - 0x10], eax
push 0x10236844
lea ecx, [ebp - 0x68]
call fcn.10010f40
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100196f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.100286b0
add esp, 8
push eax
call fcn.1005c120
add esp, 4
movzx eax, al
test eax, eax
jne 0x1005c31b
mov dword [ebp - 0xc], 1
jmp 0x1005c322
mov dword [ebp - 0xc], 0
mov cl, byte [ebp - 0xc]
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x98]
call fcn.1000b7f0
lea ecx, [ebp - 0x68]
call fcn.1000b7f0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x1005c34d
jmp 0x1005c49e
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1005c364
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x80]
call fcn.10010f40
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x48]
call fcn.10026590
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.1004eb50
add esp, 8
push str..cfg
lea ecx, [ebp - 0xb0]
call fcn.10010f40
push eax
mov eax, dword [ebp - 8]
add eax, 0x100
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.1003ef60
add esp, 0xc
lea ecx, [ebp - 0xb0]
call fcn.1000b7f0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x30]
push edx
push str.c:gamesensecfg_
lea eax, [ebp - 0xc8]
push eax
call fcn.10027210
add esp, 0xc
mov ecx, eax
call fcn.10010eb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0xc8]
call fcn.1000b7f0
push 1
push 0x40
push 2
lea ecx, [ebp - 0x30]
push ecx
push 0x10236894
lea edx, [ebp - 0xe0]
push edx
call fcn.10027210
add esp, 0xc
push eax
lea ecx, [ebp - 0x190]
call fcn.10060ef0
lea ecx, [ebp - 0xe0]
call fcn.1000b7f0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x190]
push ecx
call fcn.100275b0
add esp, 8
lea ecx, [ebp - 0x190]
call fcn.10056710
mov dword [ebp - 0x18], 0x3e8
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x50]
call fcn.100626a0
push eax
call fcn.100626c0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.1005d0e0
mov ecx, dword [ebp - 8]
call fcn.1005d3a0
lea ecx, [ebp - 0x190]
call fcn.10055a20
lea ecx, [ebp - 0x30]
call fcn.1000b7f0
lea ecx, [ebp - 0x48]
call fcn.1000b7f0
lea ecx, [ebp - 0x80]
call fcn.1000b7f0
mov esp, ebp
pop ebp
ret
Function at 0x1005c780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
ja case.default.0x1005c798
mov ecx, dword [ebp - 8]
jmp dword [ecx*4 + 0x1005c7ec]
mov al, 1
jmp 0x1005c7e5
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.1005c700
jmp 0x1005c7e5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0xffff
je 0x1005c7cc
mov byte [ebp - 1], 1
jmp 0x1005c7d0
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x1005c7e5
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.1005c740
jmp 0x1005c7e5
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10060d60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x10060d7b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x2bc
call fcn.10022b70
cmp dword [ebp - 4], eax
jae 0x10060e09
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 4]
push edx
push str._preset__i
lea eax, [ebp - 0x48]
push eax
call sym.gs.dll_sprintf
add esp, 0xc
push 0x10237490
push 0
lea ecx, [ebp - 0x48]
push ecx
push 0x102374b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
add edx, 0x40
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.10010f40
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100196f0
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
lea ecx, [ebp - 0x28]
call fcn.1000b7f0
jmp 0x10060d72
mov esp, ebp
pop ebp
ret

Function at 0x10065630
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
mov dword [ebp - 0xc], ecx
mov ecx, 0xb
mov esi, str._pipediscord_ipc_0
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x10], 0x15
mov eax, 2
imul ecx, eax, 0x15
mov edx, 0x30
mov word [ebp + ecx - 0x40], dx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x1006569d
mov ecx, dword [ebp - 4]
mov byte [ecx], 1
mov al, 1
jmp 0x1006570e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jne 0x100656e0
mov edx, 2
imul eax, edx, 0x15
movzx ecx, word [ebp + eax - 0x40]
cmp ecx, 0x39
jge 0x100656de
mov edx, 2
imul eax, edx, 0x15
mov cx, word [ebp + eax - 0x40]
add cx, 1
mov edx, 2
imul eax, edx, 0x15
mov word [ebp + eax - 0x40], cx
jmp 0x1006566b
jmp 0x10065705
cmp dword [ebp - 8], 0xe7
jne 0x10065705
push 0x2710
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x10065700
xor al, al
jmp 0x1006570e
jmp 0x1006566b
xor al, al
jmp 0x1006570e
pop edi
pop esi
mov esp, ebp
pop ebp
ret