joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b120
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x4fec39
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54a020]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, 0x400
push edi
mov dword [esp + 0x18], 0
mov ebx, str.unknown
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov esi, eax
push 0x3ff
push esi
call sub.WSOCK32.dll_gethostname
mov ebp, eax
test ebp, ebp
je 0x47b1a1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x271e
jne 0x47b1a3
add edi, edi
push edi
push esi
call dword [sym.imp.MSVCR80.dll_realloc]
mov esi, eax
add esp, 8
lea eax, [edi - 1]
push eax
push esi
call sub.WSOCK32.dll_gethostname
mov ebp, eax
test ebp, ebp
jne 0x47b176
mov ebx, esi
test ebp, ebp
jne 0x47b1f8
cmp byte [esp + 0x44], 0
je 0x47b1f8
push ebx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x47b1ba
mov ebx, dword [eax]
push ebx
lea ecx, [esp + 0x1c]
call fcn.0047b960
push esi
mov dword [esp + 0x3c], 2
call dword [sym.imp.MSVCR80.dll_free]
mov esi, dword [esp + 0x44]
add esp, 4
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0047be80
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x18]
jmp 0x47b231
push ebx
lea ecx, [esp + 0x28]
call fcn.0047b960
mov edi, 1
push esi
mov dword [esp + 0x3c], edi
call dword [sym.imp.MSVCR80.dll_free]
mov esi, dword [esp + 0x44]
add esp, 4
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.0047be80
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 0
call fcn.0047b260
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x47c3a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fed78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x54a020]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], edi
call fcn.0047b880
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edi
call fcn.0047ba20
mov esi, dword [esp + 0x2c]
push 0xffffffffffffffff
push edi
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0047ba20
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x47c416
push eax
call sub.MFC80.DLL_Ordinal_266
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x49bd20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0042c200
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x3c], 0
jne 0x49bd67
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0042b7d2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call sub.MSVCR80.dll__stat64i32
add esp, 8
test eax, eax
jl 0x49bd50
mov eax, 8
call fcn.0042c200
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.0049bf90
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x49bd50
push 0x533ea4
push esi
call sub.MSVCR80.dll_fopen
add esp, 8
test eax, eax
mov dword [esp + 0x40], eax
je 0x49be41
jmp 0x49bdc4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x49bdd2
cmp ebx, 0x400
mov esi, ebx
jl 0x49bdd7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call sub.MSVCR80.dll_fread
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x44], edi
jle 0x49be25
fild dword [esp + 0x44]
mov eax, 8
call fcn.0042c200
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.0049bf90
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x49bdc0
sub ebx, esi
test ebx, ebx
jg 0x49bdc0
mov ecx, dword [esp + 0x40]
push ecx
call sub.MSVCR80.dll_fclose
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004b5e60
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042b7d2
mov esp, ebp
pop ebp
ret

Function at 0x49be60
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call fcn.00461110
test eax, eax
mov edi, dword [esp + 0x10]
jne 0x49beba
push str.RANDFILE
call sub.MSVCR80.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x49beba
cmp byte [esi], 0
je 0x49beba
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x49be90
sub eax, edx
add eax, 1
cmp eax, edi
jae 0x49beba
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.004b5f10
add esp, 0xc
cmp eax, edi
jb 0x49bf2c
pop edi
xor eax, eax
pop esi
ret
call fcn.00461110
test eax, eax
jne 0x49bed2
push str.HOME
call sub.MSVCR80.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x49bedd
mov esi, 0x512470
jmp 0x49bee2
cmp byte [esi], 0
je 0x49bf25
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x49bee7
sub eax, edx
add eax, 6
cmp eax, edi
jae 0x49bf25
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.004b5f10
push edi
push 0x53643c
push esi
call fcn.004b5f60
push edi
push str..rnd
push esi
call fcn.004b5f60
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x4a16f0
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
je 0x4a170b
push eax
call fcn.004b6030
add esp, 4
ret
call fcn.004c6ca0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4a1713
push esi
push edi
sub eax, edx
push 0x21b
lea edi, [eax + 0xd]
push str..cryptoconfconf_mod.c
push edi
call fcn.004a3070
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4a173f
pop edi
pop esi
ret
push edi
call fcn.004c6ca0
push eax
push esi
call fcn.004b5f10
push edi
push 0x53643c
push esi
call fcn.004b5f60
push edi
push str.openssl.cnf
push esi
call fcn.004b5f60
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret

Function at 0x4aa2f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
lea eax, [ecx + 1]
ret
Function at 0x4aaf70
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
lea eax, [ecx + 1]
ret
Function at 0x4ad8e0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0042c200
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4ad945
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4ad945
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call sub.MSVCR80.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR80.dll_vfprintf
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call sub.MSVCR80.dll__vsnprintf
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4ad9d4
call fcn.004ad800
test eax, eax
jle 0x4ad9d4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042b7d2
add esp, 0x108
ret

Function at 0x4ada30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4ada56
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
add eax, 1
or cl, dl
sub edi, 1
jne 0x4ada46
pop esi
movzx eax, cl
pop edi
ret
Function at 0x4b2ae0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10
call fcn.0042c200
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x14]
push ebx
mov ebx, dword [esi + 0x20]
push ebp
shr eax, 6
push edi
xor ebp, ebp
and eax, 1
push str.OPENSSL_ALLOW_PROXY_CERTS
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0xffffffff
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
je 0x4b2b2b
mov dword [esp + 0x18], 1
cmp dword [esi + 0x48], ebp
jle 0x4b2ce7
mov ecx, dword [esi + 0x4c]
push ebp
push ecx
call fcn.0049e050
mov edx, dword [esi + 0x14]
add esp, 8
test byte [edx + 0x14], 0x10
mov edi, eax
jne 0x4b2b72
test dword [edi + 0x28], 0x200
je 0x4b2b72
push esi
push 0
mov dword [esi + 0x5c], 0x22
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
cmp dword [esp + 0x18], 0
jne 0x4b2b9f
test dword [edi + 0x28], 0x400
je 0x4b2b9f
push esi
push 0
mov dword [esi + 0x5c], 0x28
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
push edi
call fcn.004a5360
mov ecx, dword [esp + 0x10]
add esp, 4
cmp ecx, 0xffffffff
je 0x4b2bd4
test ecx, ecx
je 0x4b2bc7
test eax, eax
je 0x4b2be6
mov edx, dword [esi + 0x14]
test byte [edx + 0x14], 0x20
je 0x4b2c07
cmp eax, 1
jmp 0x4b2be4
test eax, eax
je 0x4b2c07
mov dword [esi + 0x5c], 0x25
jmp 0x4b2bed
mov edx, dword [esi + 0x14]
test byte [edx + 0x14], 0x20
je 0x4b2c07
cmp eax, 1
je 0x4b2c07
test eax, eax
je 0x4b2c07
mov dword [esi + 0x5c], 0x18
push esi
push 0
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x18]
test eax, eax
jle 0x4b2c52
xor edx, edx
test ecx, ecx
setg dl
push edx
push eax
push edi
call fcn.004a5770
add esp, 0xc
test eax, eax
je 0x4b2c35
mov ecx, dword [esi + 0x14]
test byte [ecx + 0x14], 0x20
je 0x4b2c52
cmp eax, 1
je 0x4b2c52
push esi
push 0
mov dword [esi + 0x5c], 0x1a
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
cmp ebp, 1
jle 0x4b2c8c
test byte [edi + 0x28], 0x20
jne 0x4b2c8c
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x4b2c8c
mov edx, dword [esp + 0x14]
lea eax, [eax + edx + 1]
cmp dword [esp + 0x10], eax
jle 0x4b2c8c
push esi
push 0
mov dword [esi + 0x5c], 0x19
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
mov eax, dword [edi + 0x28]
test al, 0x20
jne 0x4b2c98
add dword [esp + 0x10], 1
test eax, 0x400
je 0x4b2cd3
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x4b2cc4
cmp ebp, eax
jle 0x4b2cc4
push esi
push 0
mov dword [esi + 0x5c], 0x26
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x4b2cec
add dword [esp + 0x14], 1
mov dword [esp + 0xc], 0
jmp 0x4b2cdb
mov dword [esp + 0xc], 1
add ebp, 1
cmp ebp, dword [esi + 0x48]
jl 0x4b2b34
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4b9b00
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0042c200
mov eax, dword [0x54a020]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
test ebx, ebx
push edi
mov dword [esp + 0x14], ecx
je 0x4b9b4f
mov eax, 1
mov dword [esi], ebx
jmp 0x4b9b51
mov ebx, dword [esi]
test ecx, ecx
je 0x4b9c18
push ebx
call fcn.004b8e80
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x4b9b80
push str.j____int_sizeof_ctx__key_
push 0x51
push str..cryptohmachmac.c
call fcn.004ada00
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x4b9bb9
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.004b6160
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.004b6210
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.004b6220
add esp, 0x24
jmp 0x4b9bf4
cmp ebp, 0x80
jbe 0x4b9bd5
push str.len___0__len____int_sizeof_ctx__key_
push 0x57
push str..cryptohmachmac.c
call fcn.004ada00
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call sub.MSVCR80.dll_memcpy
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x4b9c1c
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
jmp 0x4b9c1c
test eax, eax
je 0x4b9c95
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x4b9c20
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.004b6160
push ebx
call fcn.004b8e80
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.004b6210
add esp, 0x1c
xor eax, eax
jmp 0x4b9c60
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x4b9c60
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.004b6160
push ebx
call fcn.004b8e80
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.004b6210
add esp, 0x1c
lea eax, [esi + 0x14]
push eax
add esi, 4
push esi
call fcn.004b6340
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042b7d2
add esp, 0x8c
ret
Function at 0x4e26d0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.0042c200
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x4e26ea
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x4e276c
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4e2738
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.004adfc0
add esp, 8
test eax, eax
jne 0x4e2759
push edi
mov edi, 0x52dd44
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x4e2738
push ebx
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
jne 0x4e275c
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.004adfc0
add esp, 8
test eax, eax
je 0x4e2763
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebx
call sub.MSVCR80.dll_getenv
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4e7ba0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4e7c90
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x4e7c22
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x4e7c7b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x4e7c34
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x4e7c66
lea edx, [edi + 0x3c]
jmp 0x4e7c73
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x4e7bc0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x4f5b20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x4f5b39
mov edi, ebx
mov ebx, eax
jmp 0x4f5b3b
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x4f5b4b
mov eax, esi
jmp 0x4f5b55
push eax
push esi
call fcn.004a83c0
add esp, 8
test eax, eax
jne 0x4f5b5d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x4f5b7b
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x4f5b64
cmp eax, dword [edi + 4]
jge 0x4f5b92
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x4f5b80
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x4f5bb6
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x4f5bb6
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x4f5ba5
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10001632
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea eax, [ebp + 0xc]
mov esi, ecx
push eax
mov ecx, 0x10070d60
mov edi, edx
call fcn.10001edf
xor eax, eax
movzx edx, si
mov esi, dword [ebp + 8]
inc eax
mov word [0x1006ead4], ax
movzx eax, di
mov ecx, eax
mov word [0x1006eae2], ax
mov edi, eax
movd xmm0, esi
shr edi, 3
mov eax, edx
imul eax, edi
cvtdq2pd xmm0, xmm0
mov dword [0x1006ead8], esi
shr cx, 3
movzx ecx, cx
push 0x30008
mov word [0x1006ead6], dx
imul eax, esi
shr esi, 0x1f
addsd xmm0, qword [esi*8 + 0x10068350]
mov dword [0x1006eadc], eax
xor esi, esi
mov eax, edx
imul ecx, eax
xor eax, eax
mov word [0x1006eae4], ax
cvtpd2ps xmm0, xmm0
push esi
push 0x10001790
push 0x1006ead4
push 0xffffffffffffffff
push 0x1006eb04
mov word [0x1006eae0], cx
mulss xmm0, dword [0x100682fc]
cvttss2si eax, xmm0
mov dword [0x1006ead0], eax
imul eax, edi
mov dword [0x1006eaa8], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
mov ecx, esi
call fcn.10001711
inc esi
cmp esi, 2
jb 0x100016ed
push dword [0x1006eb04]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
lea ecx, [ebp + 0xc]
pop esi
pop ebp
jmp fcn.10001f0f

Function at 0x10001711
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
push 0
push dword [0x1006eaa8]
mov esi, ecx
mov ecx, 0x10070d20
push esi
call fcn.10001d7e
mov ecx, eax
call fcn.10001e82
mov edi, dword [0x10070d5c]
mov ebx, esi
shl ebx, 5
mov ecx, 0x10070d20
push esi
add edi, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
mov dword [edi], eax
mov eax, dword [0x1006eaa8]
mov dword [edi + 4], eax
xor eax, eax
push 0x20
push edi
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push dword [0x1006eb04]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x10070d5c]
push 0x20
add eax, ebx
push eax
push dword [0x1006eb04]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebx
ret
Function at 0x10001c17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
movzx esi, word [0x1006eafe]
mov ebx, edx
push edi
movzx edi, word [0x1006eaf2]
imul esi, edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x10
mov eax, esi
imul eax, dword [0x1006eaf4]
shr eax, 3
mov dword [ebp - 0x14], eax
mov eax, esi
cdq
xor esi, esi
and edx, 7
add eax, edx
push esi
sar eax, 3
push 0x80
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
push 2
imul eax, edi
push esi
push esi
push 0x40000000
push ecx
mov dword [ebp - 0x1c], eax
add eax, 0x24
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001c93
xor al, al
jmp 0x10001d79
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 4]
push eax
push 4
push str.RIFF
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.WAVE
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.fmt
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x1006eaf2
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x1006eaf4
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x1006eafe
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.data
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 4]
push dword [ebx]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret