joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100072f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x100074e7
cmp eax, dword [ecx + 0x218]
jge 0x100074e7
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x100074e7
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x10007376
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x10007376
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x10007433
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x100073fd
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10007433
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100074c0
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a74
mov esp, ebp
pop ebp
ret

Function at 0x10007530
Capabilities:
Create thread

Disassembly:
cmp dword [0x10126ff0], 0
je 0x10007576
mov eax, dword [0x10126e7c]
push 0x1012c0ec
mov dword [0x101212a0], eax
xor eax, eax
push eax
push 0x1012129c
push 0x10007660
push eax
push eax
mov dword [0x101212a8], eax
mov dword [0x101212ac], eax
mov dword [0x101212b0], eax
mov dword [0x101212b4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101212a4], eax
ret
Function at 0x10007580
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x10127014], 0
je 0x1000759d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10127014]
cmp eax, dword [ecx]
jne case.0x100075d3.0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi*4 + 0x101212a8]
cmp eax, 0x1388
jb 0x100075c8
call edi
mov dword [esi*4 + 0x101212a8], eax
mov dword [esi*4 + 0x101212b0], 0
mov eax, dword [0x10126ff4]
pop edi
cmp eax, 5
ja case.default.0x100075d3
jmp dword [eax*4 + 0x10007640]
inc dword [esi*4 + 0x101212b0]
cmp dword [esi*4 + 0x101212b0], 0x19
jmp 0x1000762d
inc dword [esi*4 + 0x101212b0]
cmp dword [esi*4 + 0x101212b0], 0x14
jmp 0x1000762d
inc dword [esi*4 + 0x101212b0]
cmp dword [esi*4 + 0x101212b0], 0xf
jmp 0x1000762d
inc dword [esi*4 + 0x101212b0]
cmp dword [esi*4 + 0x101212b0], 0xa
jmp 0x1000762d
inc dword [esi*4 + 0x101212b0]
cmp dword [esi*4 + 0x101212b0], 5
jbe case.0x100075d3.0
push 0
push 0
push 9
call fcn.10004a60
add esp, 0xc
ret

Function at 0x10007810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007883
lea ecx, [ebp - 8]
push ecx
push 0x1012715c
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.LangSelection
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10007879
push 0x10016b84
push 0x10
push 0x1012715c
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10007ba0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10007cc4
push 0x104
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10007cbd
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x418]
call fcn.1000f480
add esp, 4
test al, al
je 0x10007cbd
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x458]
call fcn.10006dc0
test al, al
jne 0x10007c44
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x458]
push eax
push 1
call fcn.10004a60
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x458]
call fcn.10007090
test al, al
jne 0x10007c84
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edx, [ebp - 0x458]
push edx
push 2
call fcn.10004a60
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
call fcn.100052f0
test al, al
jne 0x10007cbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x458]
push eax
push 5
call fcn.10004a60
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.10012a74
mov esp, ebp
pop ebp
ret
Function at 0x10008280
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1594
call fcn.10013490
mov eax, dword [0x1001b018]
xor eax, esp
mov dword [esp + 0x1590], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x150]
xor edi, edi
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x100082da
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1590]
xor ecx, esp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x14]
shr esi, 2
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], esi
cmp esi, edi
jle 0x100083c9
lea eax, [esp + edi*4 + 0x148]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
test eax, eax
je 0x100083bc
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x100083b5
push 0x104
lea edx, [esp + 0x118c]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100083b5
lea esi, [esp + 0x1188]
call fcn.1000f720
push eax
lea eax, [esp + 0x114c]
push 0x100169b4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x139c]
push ecx
mov ecx, esi
call fcn.1000f480
add esp, 0x10
test al, al
je 0x100083b1
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esp + 0x20], eax
mov ecx, 8
lea esi, [esp + 0x1148]
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1390]
push ecx
lea edx, [esp + 0x48]
push 0x10016be4
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
call fcn.10008880
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [esp + 0x10], edi
cmp edi, esi
jl 0x100082f1
mov ecx, dword [esp + 0x159c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.10012a74
mov esp, ebp
pop ebp
ret
Function at 0x10008e70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10013490
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
xor ebx, ebx
push ecx
mov dword [ebp - 0x100c], ebx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10008ec2
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x100c]
shr eax, 2
mov dword [ebp - 0x1010], eax
cmp eax, ebx
jle 0x10008f33
mov esi, dword [ebp + ebx*4 - 0x1008]
test esi, esi
je 0x10008f2e
lea edi, [ebp - 0x1018]
call fcn.10009240
test al, al
jne 0x10008f28
mov dword [ebp - 0x1018], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
mov dword [ebp - 0x1014], eax
call fcn.100092c0
mov ecx, dword [ebp + ebx*4 - 0x1008]
call fcn.10008f50
test al, al
je 0x10008eaf
mov edi, dword [ebp + ebx*4 - 0x1008]
call fcn.10007ba0
test al, al
je 0x10008eaf
mov eax, dword [ebp - 0x1010]
inc ebx
cmp ebx, eax
jl 0x10008ed5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10012a74
mov esp, ebp
pop ebp
ret

Function at 0x10009020
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.10013490
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea ecx, [ebp - 0x110c]
push ecx
xor esi, esi
push ebx
mov dword [ebp - 0x10c], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x10009071
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebp - 0x10c]
shr edi, 2
test edi, edi
jle 0x100090d6
nop
mov eax, dword [ebp + esi*4 - 0x110c]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x100090d1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100090c8
test dl, dl
je 0x100090c4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100090c8
add eax, 2
add ecx, 2
test dl, dl
jne 0x100090a8
xor eax, eax
jmp 0x100090cd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100090ea
inc esi
cmp esi, edi
jl 0x10009080
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10012a74
mov esp, ebp
pop ebp
ret 4
Function at 0x10009100
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 4
push 0x1000
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x1000913c
mov eax, dword [ebp + 8]
push 0
push ebx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10009143
push 0x8000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
pop esi
pop ebp
ret 4
push 0x10016cd4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000912e
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x1000912e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebx
push esi
push edi
test eax, eax
jne 0x10009136
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x1000a820
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp - 0x408]
call fcn.10001080
lea eax, [ebp - 0x408]
push eax
lea esi, [ebx + 0x4ef4]
mov eax, str..GameGuardLicense.bmd
call fcn.10001290
test al, al
je 0x1000a893
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push str..GameGuardLicense.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a893
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x4e48
je 0x1000a8a5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 0x4e48
lea esi, [ebx + 4]
push esi
push edi
mov dword [ebp - 0x40c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000a88c
mov eax, esi
mov ecx, 0x4e48
mov dl, byte [eax]
sub dl, 0xb
xor dl, 0x7d
mov byte [eax], dl
inc eax
dec ecx
jne 0x1000a8d3
call fcn.10007810
lea eax, [ebx + 0xf4]
call fcn.10007890
lea eax, [ebx + 0x1abc]
call fcn.100078f0
lea eax, [ebx + 0x3484]
call fcn.10007950
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10012a74
mov esp, ebp
pop ebp
ret
Function at 0x1000ab60
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x4e4c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ab83
sub eax, edx
cmp eax, 3
jb 0x1000ac5b
cmp dword [edi + 0x4e6c], 0
je 0x1000ac28
lea esi, [ebp - 0x408]
call fcn.10001080
mov eax, esi
push eax
lea esi, [ebp - 0x40c]
mov eax, ebx
call fcn.10001290
test al, al
jne 0x1000abe4
mov esi, 0x101261d8
call fcn.1000f150
mov esi, 0x10126300
call fcn.1000f150
mov esi, 0x10126428
call fcn.1000f150
call fcn.1000f3e0
mov ecx, dword [edi + 0x4e6c]
cmp ecx, dword [ebp - 0x40c]
je 0x1000ac28
mov esi, 0x101261d8
call fcn.1000f150
mov esi, 0x10126300
call fcn.1000f150
mov esi, 0x10126428
call fcn.1000f150
push 0x10
add edi, 0x46
push edi
push str.Launcher_not_found_or_invalid_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1000f3e0
push str.32770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000ac54
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.1000f3e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a74
mov esp, ebp
pop ebp
ret
Function at 0x1000afb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013758
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1001b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101261d0]
cmp eax, 0x927c0
jb 0x1000aff3
call esi
mov dword [0x101261d0], eax
xor esi, esi
cmp dword [0x101261bc], esi
je 0x1000b065
push esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov edx, dword [0x101261c0]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.1000ad90
mov edi, dword [ebp - 0x20]
test al, al
je 0x1000b04d
cmp edi, dword [ebp - 0x1c]
je 0x1000b04d
lea ecx, [ebp - 0x20]
push ecx
call fcn.1000b080
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp edi, esi
je 0x1000b065
push edi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b530
Capabilities:
Check for time delay via gettickcount
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013aaf
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
mov eax, dword [0x1001b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101261d0]
cmp eax, 0x927c0
jb 0x1000b576
call esi
mov dword [0x101261d0], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push 0x14
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 4], ebx
call fcn.1000ad90
mov esi, dword [ebp - 0x1c]
test al, al
jne 0x1000b5be
cmp esi, dword [ebp - 0x18]
jne 0x1000b6a5
lea eax, [ebp - 0x1c]
push eax
call fcn.1000b740
cmp dword [0x10126130], ebx
je 0x1000b6a5
push 0x32
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1000ad90
lea edx, [ebp - 0xf0]
push edx
call fcn.1000b910
lea esi, [ebp - 0xd8]
mov byte [ebp - 4], 1
call fcn.1000c4e0
push ebx
test eax, eax
jne 0x1000b618
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 4]
push 2
lea ecx, [ebp + ecx - 0xf0]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x1000b62f
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx + 4]
push ebx
lea ecx, [ebp + ecx - 0xf0]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ebx
sub edx, esi
push edx
push esi
lea ecx, [ebp - 0xe0]
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea eax, [ebp - 0xf0]
push eax
call fcn.1000b9d0
push 2
push str.image.jpeg
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.100027c0
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x34], ecx
mov dword [ebp + eax - 0xf0], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 2
call fcn.1000ba50
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp esi, ebx
je 0x1000b6bd
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c5e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100138c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x1000c772
cmp byte [ebx + 0x49], 0
je 0x1000c772
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x1000c766
lea esi, [ebp - 0x2c]
call fcn.1000c910
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x1000c653
lea edx, [ebp - 0x2c]
mov eax, edx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
push ecx
mov ecx, dword [ebx + 0x44]
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1000c68b
dec eax
je 0x1000c68f
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x1000c76d
call fcn.10003260
xor al, al
jmp 0x1000c774
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x1000c69f
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x1000c6cd
cmp edi, 0x10
jae 0x1000c6ae
lea eax, [ebp - 0x2c]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1000c75e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x1000c76a
test esi, esi
jne 0x1000c647
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x1000c78f
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x1000c78f
cmp edi, esi
jae 0x1000c747
push ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.10003000
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x1000c647
mov ecx, eax
cmp edi, 0x10
jae 0x1000c723
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x1000c73e
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x1000c641
test esi, esi
jne 0x1000c719
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x1000c756
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x1000c641
lea esi, [ebp - 0x2c]
call fcn.10003260
xor al, al
jmp 0x1000c774
lea esi, [ebp - 0x2c]
call fcn.10003260
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012a74
mov esp, ebp
pop ebp
ret
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3