joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65144f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov esi, dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
add eax, 0x1a
sub esp, 8
cmp eax, ebx
jbe 0x65144fb0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
mov ebx, eax
lea eax, [eax + 0x7fffffff]
sub esp, 8
cmp word [edi + eax*2], 0x5c
lea edx, [eax + eax]
je 0x65144fdb
mov eax, 0x5c
add ebx, 1
mov word [edi + edx + 2], ax
lea edx, [ebx + ebx]
mov ecx, dword [str.spoolPRINTERS_]
lea eax, [edi + edx]
mov dword [eax], ecx
mov ecx, dword [0x65156804]
mov dword [eax + 4], ecx
mov ecx, dword [0x65156808]
mov dword [eax + 8], ecx
mov ecx, dword [0x6515680c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x65156810]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x65156814]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x65156818]
mov dword [eax + 0x18], ecx
mov ecx, dword [0x6515681c]
mov dword [eax + 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str._05d.SPL
mov dword [esp + 0xc], eax
lea eax, [edi + edx + 0x1e]
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sym._swprintf
lea esp, [ebp - 0xc]
lea eax, [ebx + 0x19]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65145ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
test byte [0x651531d8], 8
jne 0x65145c28
test ebx, ebx
je 0x65145bd2
mov eax, dword [ebx]
cmp eax, 3
je 0x65145c90
cmp eax, 1
je 0x65145bf0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x65145c70
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p___ld___p__n
mov dword [esp + 8], str.fpWritePrinter
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x1c]
jmp 0x65145bbe
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xbbb
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebx + 4]
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x14], edx
mov edx, dword [ebx + 8]
mov dword [ebp + 8], edx
mov eax, dword [eax + 0x28]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp eax
Function at 0x65145e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x651531d8], 8
jne 0x65145e78
test ebx, ebx
je 0x65145e5c
cmp dword [ebx], 4
je 0x65145ec0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p__p__lu__p_n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], str.fpReadPrinter
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x651531d8
mov dword [esp + 0x14], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65145e53
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ebx, dword [ebp - 4]
sub esp, 0x14
leave
ret 0x10
Function at 0x651469a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [eax + 4]
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x6c
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x65146b18
sub eax, edi
sar eax, 1
mov edx, eax
test edx, edx
je 0x65146ab0
test byte [0x651531d8], 8
jne 0x65146ac0
mov eax, edx
neg eax
cmp edx, 0xf
ja 0x65146ab2
test esi, esi
je 0x65146a69
lea ecx, [edx + edx]
cmp ecx, 4
jb 0x65146a50
mov eax, dword [ebx + 4]
lea ebx, [esi + 4]
and ebx, 0xfffffffc
mov dword [esi], eax
mov eax, dword [edi + ecx - 4]
mov dword [esi + ecx - 4], eax
mov eax, esi
sub eax, ebx
mov dword [ebp - 0x50], ebx
mov ebx, edi
sub ebx, eax
add eax, ecx
and eax, 0xfffffffc
cmp eax, 4
jb 0x65146a63
mov dword [ebp - 0x58], edx
and eax, 0xfffffffc
mov dword [ebp - 0x54], edi
mov edi, ebx
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov edx, dword [edi + eax]
mov dword [ebx + eax], edx
add eax, 4
cmp eax, dword [ebp - 0x4c]
jb 0x65146a38
mov edi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
jmp 0x65146a63
test ecx, ecx
je 0x65146a63
movzx eax, byte [ebx + 4]
mov byte [esi], al
test cl, 2
jne 0x65146b28
xor eax, eax
mov word [esi + ecx], ax
lea eax, [ebp - 0x3c]
lea ebx, [ebp - 0x38]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x3c], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
mov edx, dword [ebp - 0x4c]
sub esp, 8
test eax, eax
je 0x65146b08
cmp edx, dword [ebp - 0x3c]
jne 0x65146b08
mov dword [esp + 8], edx
mov dword [ebp - 0x4c], edx
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov edx, dword [ebp - 0x4c]
test eax, eax
jne 0x65146b08
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
mov dword [ebp - 0x4c], edx
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.found__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x65156aa8
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x4c]
mov eax, edx
neg eax
cmp edx, 0xf
jbe 0x651469f1
jmp 0x65146ab2
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edx, eax
jmp 0x651469cf
movzx eax, word [edi + ecx - 2]
mov word [esi + ecx - 2], ax
jmp 0x65146a63
Function at 0x65146b40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x2c
test byte [0x651531d8], 8
jne 0x65146c18
test edi, edi
je 0x65146ba0
cmp word [edi], 0
je 0x65146ba0
mov eax, str.Windows_NT_x86
xor ebx, ebx
mov dword [esp + 4], eax
mov esi, dword [ebx*4 + 0x65156c84]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x65146bb5
add ebx, 1
cmp ebx, 6
je 0x65146c50
mov eax, dword [ebx*4 + 0x65156c84]
mov eax, dword [eax]
jmp 0x65146b69
call dword [sym.imp.kernel32.dll_GetVersion]
mov esi, 0x65156cdc
test eax, eax
mov eax, 0x65156dc0
cmovns esi, eax
test byte [0x651531d8], 8
jne 0x65146bd0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__using__p:__s_n
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65146b58
movzx eax, byte [0x651531d8]
test al, 1
jne 0x65146c7a
mov edx, dword fs:[0x18]
xor esi, esi
mov dword [edx + 0x34], 0x70d
test al, 8
je 0x65146bbe
xor eax, eax
jmp 0x65146bd2
mov edx, 0xffffffff
mov eax, edi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.unsupported_Environment:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x651531d8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
movzx eax, byte [0x651531d8]
jmp 0x65146c5b
Function at 0x65146db0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
xor ebx, ebx
sub esp, 0x3c
mov eax, dword [ecx + 0x820]
mov word [ecx + eax*2], bx
mov eax, dword [ecx + 0x824]
mov word [ecx + eax*2 + 0x410], di
mov eax, 1
test esi, esi
je 0x65146e9a
cmp word [esi], 0
je 0x65146e9a
mov eax, dword [ecx + 0x828]
mov edi, ecx
and eax, 0x10
jne 0x65146e28
cmp word [ecx], 0
mov esi, ecx
je 0x65146e18
nop
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x65146e08
lea esi, [esi]
movzx ebx, word [edx + eax]
mov word [ecx + eax], bx
add eax, 2
test bx, bx
jne 0x65146e18
lea ebx, [edi + 0x410]
cmp word [edi + 0x410], 0
mov dword [ebp - 0x1c], ebx
je 0x65146f30
nop
add ebx, 2
cmp word [ebx], 0
jne 0x65146e40
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [edx + eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x65146e50
test byte [0x651531d8], 8
jne 0x65146ee0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CopyFileW]
sub esp, 0xc
mov ebx, eax
test byte [0x651531d8], 8
jne 0x65146ea8
xor eax, eax
or ebx, dword [edi + 0x82c]
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.got__d_with__lu_n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65146e8f
mov eax, dword [ebp - 0x1c]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov edx, 0xffffffff
mov ebx, eax
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s____s_n
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65146e69
mov ebx, dword [ebp - 0x1c]
jmp 0x65146e49
Function at 0x65147ca0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
lea eax, [ebp - 0x224]
push ebx
sub esp, 0x24c
mov dword [ebp - 0x228], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintMonitors_
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x65147cf8
test byte [0x651531d8], 8
jne 0x65147dec
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x228]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x224]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test byte [0x651531d8], 8
jne 0x65147e20
mov edi, dword [ebp - 0x228]
test edi, edi
je 0x65147dcd
xor ebx, ebx
xor edi, edi
lea esi, [ebp - 0x220]
lea esi, [esi]
xor eax, eax
mov dword [esp + 4], ebx
mov word [ebp - 0x220], ax
mov eax, dword [ebp - 0x224]
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
xor edx, edx
mov eax, esi
sub esp, 0x10
call sym._monitor_load
cmp eax, 1
sbb edi, 0xffffffff
add ebx, 1
cmp dword [ebp - 0x228], ebx
ja 0x65147d88
mov eax, dword [ebp - 0x224]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x651531d8], 8
je 0x65147ceb
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._ld_monitors_loaded_n
mov dword [esp + 8], str.monitor_loadall
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x228]
mov dword [esp + 0xc], str._ld_monitors_registered_n
mov dword [esp + 8], str.monitor_loadall
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65147d71
Function at 0x6514e1a0
Capabilities:
Check if process is running under wine
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x651531d8], 8
jne 0x6514e1e0
test ebx, ebx
je 0x6514e1c0
cmp dword [ebx], 1
je 0x6514e210
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p__ld_n
mov dword [esp + 8], str.fpScheduleJob
mov dword [esp + 4], 0x651531d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x6514e1b7
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
add esp, 0x20
pop ebx
pop esi
pop ebp
jmp sym._fpScheduleJob_8.part.0
Function at 0x65151ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x65151cf8
cmp byte [esi + ebx - 1], 0xa
je 0x65151ccc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6515b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x65152350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x65152528
mov edi, dword [0x6515b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x65152437
test byte [0x65153208], 8
jne 0x651524d0
lea ebx, [ebp - 0xe0]
mov edi, ebx
test byte [0x65153218], 8
jne 0x65152490
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x651523d9
cmp esi, 3
jbe 0x65152448
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x651523ea
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x651586c8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x651523d9
mov dword [esp], 0x65153218
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x651523b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x651523b0
mov dword [esp], 0x65153208
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x6515239b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xe0]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x651523a3
mov eax, 0xffffffff
jmp 0x65152437

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x403858
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403860
mov edx, dword [esp + 0x48]
lea ecx, [esp]
call fcn.00404060
lea edx, [esp + 4]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
lea edx, [esp + 0xc]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
lea edx, [esp + 0x14]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
push dword [esp]
push dword [esp + 0x60]
push dword [esp + 0x54]
call fcn.00403000
mov dword [esp + 0x1c], eax
push dword [esp]
push dword [esp + 0x68]
push dword [esp + 0x5c]
call fcn.00403000
mov dword [esp + 0x1c], eax
push dword [esp + 0x4c]
mov ebp, dword [esp + 8]
pop eax
mov dword [ebp], eax
push dword [esp + 0x50]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x54]
pop eax
mov dword [ebp + 8], eax
push dword [esp + 0x5c]
mov ebp, dword [esp + 0x10]
pop eax
mov dword [ebp], eax
push dword [esp + 0x60]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x64]
pop eax
mov dword [ebp + 8], eax
cmp dword [esp + 0x58], 0
je 0x403a6b
push dword [esp + 0x58]
pop eax
call fcn.00408000
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x58]
add ebx, 4
push ebx
pop eax
call fcn.00408000
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x58]
add ebx, 8
push ebx
pop eax
call fcn.00408000
mov dword [esp + 0x28], eax
push dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
pop eax
mov dword [ebp], eax
push dword [esp + 0x24]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x28]
pop eax
mov dword [ebp + 8], eax
mov dword [esp + 0x2c], 0
mov eax, 2
cmp eax, dword [esp + 0x2c]
jl 0x403a6b
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x14]
shl ebx, 2
mov ebx, dword [ebp + ebx]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0xc]
shl edi, 2
cmp ebx, dword [ebp + edi]
jle 0x403a61
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x14]
shl ebx, 2
mov ebx, dword [ebp + ebx]
add ebx, 0x200
push ebx
call fcn.00407fb0
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x403a36
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x14]
shl ebx, 2
push dword [ebp + ebx]
push dword [esp + 0x34]
jmp loc.00411000
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0x10
push dword [0x40e460]
push dword [0x40e4b4]
call fcn.004048a4
push 1
jmp fcn.00401fd5
inc dword [esp + 0x2c]
jno 0x403994
mov ebp, dword [esp + 4]
push dword [ebp]
pop eax
mov dword [0x40e498], eax
mov ebp, dword [esp + 0xc]
push dword [ebp]
pop eax
mov dword [0x40e3e8], eax
push dword [ebp + 4]
pop eax
mov dword [0x40e430], eax
push dword [ebp + 8]
pop eax
mov dword [0x40e3ec], eax
mov ebx, dword [0x40e430]
and ebx, ebx
jle 0x403ab2
mov ebx, dword [0x40e3ec]
and ebx, ebx
jle 0x403ab2
mov eax, 1
jmp 0x403ab4
xor eax, eax
and eax, eax
je 0x403ace
mov ebp, dword [esp + 4]
push dword [ebp + 4]
pop eax
mov dword [0x40e46c], eax
push dword [ebp + 8]
pop eax
mov dword [0x40e4b8], eax
mov eax, 1
jmp 0x403ad7
push dword [esp]
call fcn.0040aca0
push eax
push dword [esp + 8]
call fcn.0040a9e5
push dword [esp + 0x10]
call fcn.0040a9e5
push dword [esp + 0x18]
call fcn.0040a9e5
pop eax
add esp, 0x34
pop edi
pop ebx
pop ebp
ret 0x24
Function at 0x401370
Capabilities:
Capture microphone audio
Link many functions at runtime

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32_LoadLibraryA]
push esi
push edi
push str.waveInOpen
mov edi, ecx
push 0x418030
call ebp
mov ebx, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call ebx
push str.waveInGetNumDevs
push 0x418030
mov esi, eax
call ebp
push eax
call ebx
call eax
test eax, eax
je 0x4013b5
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
push 0x418098
push 0x418010
mov dword [esp + 0x18], 0
call ebp
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push 4
push edi
push 0x401570
push 0
push 0
call eax
mov edx, dword [esp + 0x10]
mov dword [edi + 0x2c], eax
push 0x20000
push 0
lea eax, [edi + 0x46]
push edx
lea ebx, [edi + 0x18]
push eax
push 0xffff
push ebx
call esi
test eax, eax
je 0x40140b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
lea esi, [edi + 0x30]
mov dword [esp + 0x14], 2
mov ecx, dword [esi]
mov edx, dword [esi - 0x28]
push 0x20
mov dword [ecx], edx
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov edx, dword [esi]
xor eax, eax
mov dword [edx + 0x10], eax
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
mov eax, dword [ebx]
push edx
push eax
call dword [sym.imp.WINMM_waveInPrepareHeader]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x401416
mov ecx, dword [edi + 0x1c]
mov eax, dword [ebx]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
push edx
push eax
call dword [sym.imp.WINMM_waveInAddBuffer]
push str.waveInStart
push 0x418030
call ebp
push eax
call dword [sym.imp.KERNEL32_GetProcAddress]
push 0x41807c
push 0x418010
mov esi, eax
call ebp
push eax
call dword [sym.imp.KERNEL32_GetProcAddress]
mov ecx, dword [edi + 0x2c]
push ecx
call eax
mov edx, dword [ebx]
push edx
call esi
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x401d40
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x411f2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.00401970
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a4], 0
call fcn.00401970
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a4], 1
call fcn.00401970
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a4], 2
call fcn.00401970
lea eax, [esp + 0xc]
mov dword [esi], 0x415340
push eax
push 0x202
call dword [sym.imp.WS2_32_Ordinal_115]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32_CreateEventA]
mov byte [esp + 4], 0x46
mov byte [esp + 5], 0x57
mov byte [esp + 6], 0x4b
mov byte [esp + 7], 0x4a
mov edx, dword [esp + 4]
lea ecx, [esi + 0xb0]
mov byte [esi + 0xb5], 0
mov dword [esi + 0xac], eax
mov byte [esp + 8], 0x47
mov byte [esp + 9], 0x48
mov ax, word [esp + 8]
mov dword [ecx], edx
mov dword [esi + 0xa8], 0xffffffff
mov word [ecx + 4], ax
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret