joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x10006c30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
pop ebp
ret
Function at 0x10010d70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 0
je 0x10010e3f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
cmp eax, dword [ebp + 8]
jne 0x10010e32
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x10010dbd
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10010dd4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x10010deb
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10010e03
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x10010e1a
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x10010e32
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
jmp 0x10010d8b
mov esp, ebp
pop ebp
ret

Function at 0x10011030
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x10011041
jmp 0x100110e1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0x40
lea eax, [ebp - 0x14]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10011097
mov dword [ebp - 4], 0
jmp 0x10011084
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jae 0x10011097
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 4]
mov byte [edx], 0
jmp 0x1001107b
mov dword [ebp - 8], 0xf8
cmp dword [ebp - 0xc], 0
je 0x100110e1
lea eax, [ebp - 0x14]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100110e1
mov dword [ebp - 4], 0
jmp 0x100110ce
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jae 0x100110e1
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
jmp 0x100110c5
mov esp, ebp
pop ebp
ret
Function at 0x100110f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x1c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1000
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esp, ebp
pop ebp
ret

Function at 0x10011160
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1003d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.10010d20
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.100112b0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
jmp 0x100111ce
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x18], ecx
jge 0x1001121f
push 5
mov edx, dword [ebp - 0x14]
push edx
push 0x1003481c
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x10011214
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
lea ecx, [ebp - 0x24]
call fcn.100112b0
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 8]
lea edx, [eax + ecx - 6]
mov dword [ebp - 0x10], edx
jmp 0x1001121f
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
jmp 0x100111c5
cmp dword [ebp - 0x10], 0
jne 0x10011229
xor eax, eax
jmp 0x10011297
mov ecx, dword [0x10034814]
mov dword [ebp - 0xc], ecx
mov dx, word [0x10034818]
mov word [ebp - 8], dx
mov al, byte [0x1003481a]
mov byte [ebp - 6], al
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xb], ecx
lea edx, [ebp - 0x28]
push edx
push 0x40
push 6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov ax, word [ebp - 8]
mov word [ecx + 4], ax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c22c
mov esp, ebp
pop ebp
ret
Function at 0x10014890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], 0
jmp 0x100148b3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 7
jge 0x10014903
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 8], ax
movsx edx, word [ebp - 8]
and edx, 0x8000
jne 0x100148f2
mov eax, dword [ebp - 0xc]
movsx ecx, word [eax*2 + 0x1004d114]
and ecx, 0x8000
je 0x100148f2
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jne 0x100148f2
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
mov cx, word [ebp - 8]
mov word [eax*2 + 0x1004d114], cx
jmp 0x100148aa
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x100151f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movss xmm0, dword [0x10037c50]
movss dword [ebp - 4], xmm0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movss xmm0, dword [ebp + 0x10]
subss xmm0, dword [0x10037c50]
movss dword [ebp - 8], xmm0
mov edx, dword [ebp + 0x1c]
movss xmm0, dword [edx]
comiss xmm0, dword [ebp + 0x18]
jbe 0x10015249
mov eax, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x18]
movss dword [eax], xmm0
mov ecx, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x14]
comiss xmm0, dword [ecx]
jbe 0x10015262
mov edx, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x14]
movss dword [edx], xmm0
mov eax, dword [ebp + 0x1c]
movss xmm0, dword [eax]
subss xmm0, dword [ebp + 0x14]
mulss xmm0, dword [ebp - 8]
movss xmm1, dword [ebp + 0x18]
subss xmm1, dword [ebp + 0x14]
divss xmm0, xmm1
addss xmm0, dword [ebp + 0xc]
movss dword [ebp - 0xc], xmm0
cvttss2si ecx, dword [ebp + 0x10]
push ecx
cvttss2si edx, dword [ebp - 4]
push edx
cvttss2si eax, dword [ebp + 0xc]
push eax
cvttss2si ecx, dword [ebp + 8]
push ecx
call fcn.10015190
add esp, 0x10
test eax, eax
je 0x100152e2
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x100152e2
cvtsi2ss xmm0, dword [ebp - 0x10]
subss xmm0, dword [ebp + 0xc]
movss xmm1, dword [ebp + 0x18]
subss xmm1, dword [ebp + 0x14]
mulss xmm0, xmm1
divss xmm0, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
movss dword [eax], xmm0
push 0x64
push 0x64
push 0x64
lea ecx, [ebp - 0x24]
call fcn.10014340
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0xc]
subss xmm0, dword [0x10037bbc]
push ecx
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 8]
movss dword [esp], xmm0
mov ecx, dword [0x1003dd40]
call fcn.1001d8d0
lea ecx, [ebp - 0x34]
push ecx
call fcn.100143e0
add esp, 0xfffffff4
mov edx, esp
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push ecx
movss xmm0, dword [0x10037c50]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp - 0xc]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 8]
movss dword [esp], xmm0
mov ecx, dword [0x1003dd40]
call fcn.1001d8d0
mov esp, ebp
pop ebp
ret
Function at 0x10017300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add eax, 0x105
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
mov edx, dword [ebp + 8]
add edx, 5
push edx
call fcn.10019070
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x1001733a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xff
jge 0x1001736a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10017358
mov byte [ebp - 1], 1
jmp 0x1001735c
mov byte [ebp - 1], 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [ebp - 1]
mov byte [edx + 5], al
jmp 0x10017331
mov esp, ebp
pop ebp
ret

Function at 0x10018ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jmp 0x10018ae3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 7
jge 0x10018b33
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 8], ax
movsx edx, word [ebp - 8]
and edx, 0x8000
jne 0x10018b22
mov eax, dword [ebp - 0xc]
movsx ecx, word [eax*2 + 0x1004d128]
and ecx, 0x8000
je 0x10018b22
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jne 0x10018b22
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
mov cx, word [ebp - 8]
mov word [eax*2 + 0x1004d128], cx
jmp 0x10018ada
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x1001aac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x1001aad8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x1001ab06
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax*2 + 0x1003dd30]
test ecx, ecx
je 0x1001ab04
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x18]
je 0x1001ab04
xor al, al
jmp 0x1001ac8f
jmp 0x1001aacf
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
jge 0x1001ac07
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax]
jle 0x1001ab62
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0xc], eax
jge 0x1001ab62
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx]
jle 0x1001ab62
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp + 0x14]
cmp dword [ebp - 8], ecx
jl 0x1001ab79
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0x18]
movzx edx, byte [eax + ecx*2 + 0x1003dd30]
test edx, edx
je 0x1001abda
mov byte [0x1003dd0a], 1
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0x18]
mov byte [ecx + edx*2 + 0x1003dd30], 1
mov eax, 1
shl eax, 0
mov ecx, dword [ebp + 0x18]
movzx edx, byte [eax + ecx*2 + 0x1003dd30]
test edx, edx
jne 0x1001abd8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax]
mov dword [0x1003dd28], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [edx]
mov dword [0x1003dd2c], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 0x18]
mov byte [ecx + edx*2 + 0x1003dd30], 1
jmp 0x1001ac07
mov byte [0x1003dd0a], 0
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0x18]
mov byte [ecx + edx*2 + 0x1003dd30], 0
mov eax, 1
shl eax, 0
mov ecx, dword [ebp + 0x18]
mov byte [eax + ecx*2 + 0x1003dd30], 0
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
jne 0x1001ac5a
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0x18]
movzx eax, byte [ecx + edx*2 + 0x1003dd30]
test eax, eax
je 0x1001ac5a
mov byte [0x1003dd0a], 0
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 0x18]
mov byte [edx + eax*2 + 0x1003dd30], 0
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 0x18]
mov byte [ecx + edx*2 + 0x1003dd30], 0
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0x18]
movzx eax, byte [ecx + edx*2 + 0x1003dd30]
test eax, eax
je 0x1001ac8d
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x1003dd28]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
sub eax, dword [0x1003dd2c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001e2e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f11d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1003d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x28]
call fcn.100040f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.100040f0
mov byte [ebp - 4], 1
push 0x1004e950
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x1001e38f
push 0x1004e950
lea ecx, [ebp - 0x58]
call fcn.10004060
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 2
push str.NZT_
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10004d20
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003f30
lea ecx, [ebp - 0x40]
call fcn.10003f10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.10003f10
push 0
lea ecx, [ebp - 0x28]
call fcn.10003ea0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.10003f10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c22c
mov esp, ebp
pop ebp
ret
Function at 0x1001e700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1001e72c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x1001e812
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1001e7c3
jg 0x1001e755
cmp dword [ebp + 0xc], 0
jbe 0x1001e7c3
cmp dword [ebp - 8], 0
jl 0x1001e7c3
jg 0x1001e763
cmp dword [ebp - 0xc], 0
jbe 0x1001e7c3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x1001e781
jl 0x1001e775
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x1001e781
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.100049a0
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x1001e806
jg 0x1001e7d1
cmp dword [ebp + 0xc], 0
jbe 0x1001e806
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x1001e806
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc