joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4356c4
cmp dword [edi], 0
jne 0x40e460
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x4356c0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x43179c
mov ecx, 2
call fcn.004012b8
mov edx, 0x40e3bc
lea eax, [esi + 5]
call fcn.0040e3dc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0040e3dc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x40e435
mov dword [0x4356c0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40f5c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x435878
cmp dword [edi], 0
jne 0x40f63c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x435874]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x431810
mov ecx, 2
call fcn.004012b8
mov edx, 0x40f598
lea eax, [esi + 5]
call fcn.0040f5b8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0040f5b8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x40f611
mov dword [0x435874], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40fd5c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0040fc80
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00401c7c
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x40fdc0
call fcn.0040f768
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x40fdb2
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00401c7c
pop esi
pop ebx
ret
Function at 0x40fde4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x40fe63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402414
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x40fe1d
call fcn.00402020
jmp 0x40fe6a
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x40fe4d
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00402540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fe6a
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fe70
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004027b0
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004017b0
test ebx, ebx
je 0x40febb
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x40ff80
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410051
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
je 0x410051
xor eax, eax
push ebp
push 0x410034
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00401c7c
cmp byte [ebp + 8], 0
je 0x410010
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0040ff00
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0040fd5c
jmp 0x41002a
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0040f8a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x410051
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410234
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x4103a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x410393
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x41027f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410289
call fcn.00402020
jmp 0x4103b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9a0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x410388
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x41033a
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x410327
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004101ec
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4103bc]
cmp dl, byte [eax + 0x28]
je 0x41038f
call fcn.00402020
jmp 0x4103b0
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9c0
jmp 0x41038f
cmp ecx, ebx
jge 0x410356
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9c0
jmp 0x410289
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9a0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040e9d4
cmp edx, dword [esp + 4]
jne 0x410377
cmp eax, dword [esp]
pop edx
pop eax
jne 0x410289
push ebp
call fcn.004101ec
pop ecx
jmp 0x41038f
push ebp
call fcn.004101ec
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4103b0
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4103d8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x410482
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410412
call fcn.00402020
jmp 0x410489
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41046c
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41046c
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41046c
call fcn.00402020
jmp 0x410489
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410489
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4104b0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb50
xor eax, eax
push ebp
push 0x41057f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4104ff
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4104ff
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x410569
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41050f
call fcn.00402020
jmp 0x410586
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x410569
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x410569
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x410569
call fcn.00402020
jmp 0x410586
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410586
mov eax, dword [ebp - 4]
call fcn.0040fb5c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412718
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x412745
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4127c4
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00410b8c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x412792
mov cx, word [esp]
sub cx, si
jmp 0x412794
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x41277b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4127ba
mov cx, word [esp]
sub cx, si
jmp 0x4127bc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4127a3
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x412821
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004123ec
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x41280c
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x412821
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x412722
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x415db0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x415eef
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x415e37
mov eax, ebx
call fcn.004011a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x415e30
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004012b8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415e37
mov eax, dword [ebp - 0xc]
call fcn.004011bc
ret
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
je 0x415e5f
mov ecx, eax
mov edx, 0x415f08
mov eax, dword [ebp - 4]
call fcn.0041607c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00403cc0
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x415ec5
mov ecx, eax
mov edx, 0x415f28
mov eax, dword [ebp - 4]
call fcn.0041607c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x415efa
mov ecx, eax
mov edx, 0x415f48
mov eax, dword [ebp - 4]
call fcn.0041607c
jmp 0x415efa
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004161d0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415e37
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x415eef
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x415e37
mov eax, ebx
call fcn.004011a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x415e30
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004012b8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415e37
mov eax, dword [ebp - 0xc]
call fcn.004011bc
ret
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
je 0x415e5f
mov ecx, eax
mov edx, 0x415f08
mov eax, dword [ebp - 4]
call fcn.0041607c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00403cc0
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x415ec5
mov ecx, eax
mov edx, 0x415f28
mov eax, dword [ebp - 4]
call fcn.0041607c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x415efa
mov ecx, eax
mov edx, 0x415f48
mov eax, dword [ebp - 4]
call fcn.0041607c
jmp 0x415efa
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004161d0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416110
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.004011a4
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.0040e63c
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.004011a4
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x41616d
mov ecx, eax
mov edx, 0x41619c
mov eax, ebx
call fcn.0041607c
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x41618e
mov ecx, eax
mov edx, 0x4161bc
mov eax, ebx
call fcn.0041607c
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x416b70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x416bc1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x416ba8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x416b98
jmp 0x416bc1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x416ba9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419794
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov ebp, dword [ebx + 0x24]
dec ebp
test ebp, ebp
jl 0x4197ff
inc ebp
xor esi, esi
push 0xcc0020
mov eax, esi
add eax, eax
mov edx, dword [ebx + 0x20]
mov eax, dword [edx + eax*8 + 4]
push eax
mov eax, esi
add eax, eax
mov edx, dword [ebx + 0x20]
mov eax, dword [edx + eax*8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov edi, esi
add edi, edi
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 0xc]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 8]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 4]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8]
push eax
mov eax, dword [ebx + 0x2c]
call fcn.00417bc8
call fcn.004169ac
push eax
call sub.gdi32.dll_BitBlt
inc esi
dec ebp
jne 0x4197a5
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4199ac
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
mov byte [esp + 4], 0
mov eax, ebx
call fcn.0041986c
test al, al
je 0x4199dc
mov edx, dword [esp]
mov eax, ebx
call fcn.004198c8
mov byte [esp + 4], 1
jmp 0x419af4
push 0
push 0
mov eax, dword [esp + 8]
call fcn.0040ea24
mov byte [esp + 0xc], 0x4e
lea edx, [esp + 0xc]
mov ecx, 1
mov eax, dword [esp]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00419804
mov ebp, dword [ebx + 0x24]
dec ebp
test ebp, ebp
jl 0x419af4
inc ebp
xor esi, esi
mov edi, esi
add edi, edi
mov eax, dword [ebx + 0x20]
mov edx, dword [eax + edi*8 + 8]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebx + 0x20]
mov edx, dword [eax + edi*8 + 0xc]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0xcc0020
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 4]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8]
push eax
mov eax, dword [ebx + 0x2c]
call fcn.00417bc8
call fcn.004169ac
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 0xc]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 8]
push eax
push 0
push 0
mov eax, dword [ebx + 0xc]
call fcn.00417bc8
call fcn.004169ac
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebx + 8]
call fcn.0040f004
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebx + 0x20]
lea edx, [eax + edi*8]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb7c
mov eax, dword [ebx + 0x20]
lea edx, [eax + edi*8 + 4]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb7c
mov eax, dword [ebx + 8]
call fcn.0040e9d4
mov dword [esp + 8], eax
lea edx, [esp + 8]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb7c
push 0
push 0
mov edx, dword [ebx + 8]
mov eax, dword [esp + 8]
call fcn.0040eb9c
mov byte [esp + 4], 1
inc esi
dec ebp
jne 0x419a15
mov al, byte [esp + 4]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41a3d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x41a434
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040257c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00419ccc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a43b
lea eax, [ebp - 0xc]
call fcn.00402414
ret

Function at 0x41b734
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004017b0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
cmp byte [0x435984], 0
je 0x41b793
cmp dword [0x4345a0], 2
jne 0x41b793
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x41b87c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004027b0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x41b8b6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0041b42c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8