joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403dd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edi, [esp + 0x10]
mov eax, ebx
xor edx, edx
div dword [esp + 0x41c]
mov ebp, dword [esp + 0x418]
xor eax, eax
mov byte [ebx + ecx], bl
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ebp]
mov dword [edi - 4], eax
jl 0x403dfa
xor eax, eax
lea edi, [esp + 0x10]
mov dl, byte [eax + ecx]
mov ebp, dword [edi]
mov ebx, edx
and ebx, 0xff
add ebx, ebp
add esi, ebx
and esi, 0x800000ff
jns 0x403e4a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + ecx]
add edi, 4
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x100
mov byte [esi + ecx], dl
jl 0x403e29
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc

Function at 0x403e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x403efc
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x403e9b
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x403eb8
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x403ee6
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x403e8a
pop ebp
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x403f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406230
push 0x405cd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x124], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24c]
push eax
push 0x20019
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403f7e
mov dword [ebp - 0x20], 0xffffffff
jmp 0x403fe4
cmp dword [ebp + 0x24], ebx
jne 0x403fe4
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jbe 0x403fe4
cmp eax, 2
ja 0x403fe4
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp + 0x14]
push edx
push ebx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403fe4
lea edx, [ebp - 0x124]
push edx
mov ecx, dword [0x408cb4]
call fcn.00403b20
push eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [0x408cb4]
call fcn.00403cb0
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00404006
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406240
push 0x405cd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
sub eax, ebx
je 0x404057
dec eax
je 0x40407a
jmp 0x4040cf
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4040cf
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4040cf
mov edi, dword [ebp + 0x14]
cmp edi, ebx
jbe 0x4040cf
cmp edi, 2
ja 0x4040cf
mov esi, dword [ebp + 0x18]
push esi
mov ecx, dword [0x408cb4]
call fcn.00403c30
inc eax
push eax
push esi
push edi
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4040cf
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004040ef
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404110
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.MHz
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x4041b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x428
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
mov esi, dword [esp + 0x444]
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x440]
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, ecx
xor eax, eax
mov edi, ebp
mov byte [esp + 0xd], 0x59
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0xc], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
mov byte [esp + 0xe], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x17], al
mov byte [esp + 0x22], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov al, 0x73
mov byte [esp + 0x15], cl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x438]
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x63
mov byte [esp + 0x39], 0x5c
mov byte [esp + 0x3a], 0x25
mov byte [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x448]
push 0
push esi
push 0
push ebp
push 1
push eax
lea ecx, [esp + 0x58]
push ecx
push 0x80000002
call fcn.00403f10
add esp, 0x2c
pop edi
pop esi
pop ebp
add esp, 0x428
ret
Function at 0x404e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push 0xa
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, dword [0x408cb4]
mov byte [esp + 0xc], 0x4d
mov byte [esp + 0xd], 0x6f
mov byte [esp + 0xe], 0x74
mov byte [esp + 0xf], 0x68
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x36
mov byte [esp + 0x14], 0x30
mov byte [esp + 0x15], 0
call fcn.00403dd0
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
and edx, 0xffff
lea ecx, [esp + 0xc]
push edx
push eax
push ecx
mov ecx, dword [0x408cb4]
call fcn.00403e70
add esp, 0x10c
ret
Function at 0x4055a0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x405550
push eax
push ecx
call sub.MSVCRT.dll__beginthreadex
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x405620
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
sub esp, 0x2c
mov al, 0x45
push ebx
mov byte [esp + 5], al
mov byte [esp + 8], al
mov al, 0x6c
mov cl, 0x6f
mov byte [esp + 0xe], al
mov byte [esp + 0xf], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov al, 0x70
push ebp
mov byte [esp + 0x25], al
mov byte [esp + 0x2b], al
push esi
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x32], cl
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0x10]
mov dl, 0x65
mov bl, 0x68
push eax
push ecx
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], 0x54
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x53
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 2
call eax
push 0x128
mov edi, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x405770
mov ebp, dword [esp + 0x40]
mov ecx, dword [0x408cb4]
lea ebx, [esi + 0x24]
push ebp
push ebx
call fcn.00403a90
test eax, eax
jne 0x40574e
mov edi, dword [esi + 8]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405770
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405738
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405759
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4031a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4031b0
pop dword [ebp - 0x1c]
mov eax, 0xf0d0324c
add eax, 0xf6fff64
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbc4b7c23
sub dword [ebp - 0x2c], 0x6df936d8
mov dword [ebp - 0x28], 0x5c9f527b
sub dword [ebp - 0x28], 0x2a6c0636
mov dword [ebp - 0x24], 0xc7d898c1
sub dword [ebp - 0x24], 0x7b8c5493
mov dword [ebp - 0x20], 0xa722dfad
add dword [ebp - 0x20], 0x58dd2053
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x8debb70a
add eax, 0x72548962
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd459af43
sub dword [ebp - 0x2c], 0x5fe745ed
mov dword [ebp - 0x28], 0xd02b21bb
sub dword [ebp - 0x28], 0x8ebec046
mov dword [ebp - 0x24], 0x3877db76
add dword [ebp - 0x24], 0x2af790f6
mov dword [ebp - 0x20], 0xe0ae72be
sub dword [ebp - 0x20], 0xe0ae72be
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x307d1715
sub eax, 0x303cd691
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e34
push 0
call eax
mov ecx, 0xf0b45b3f
add ecx, 0xf4bf5cf
xor edx, edx
add edx, eax
mov ebx, 0x40a0a76b
add ebx, 0xbfa06095
add ebx, dword [ebp - 0x1c]
mov edi, 0x76206901
sub edi, 0x3e2e2c4
mov esi, dword [ebx]
add esi, edi
mov dword [edx], esi
xor dword [ebp - 0x10], 0x466a079f
add edx, 4
add ebx, 0x40c4fd49
add ebx, 0xbf3b02bb
loop 0x4032d4
add eax, 0x1370b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8f292827
add ecx, 0x7116d7d9
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402ee4
pop dword [ebp - 0x14]
mov eax, 0x979ca0af
add eax, 0x68a38e35
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3b84f383
add dword [ebp - 0x24], 0x12cd51c8
mov dword [ebp - 0x20], 0x9f4b4ac4
sub dword [ebp - 0x20], 0x6d17fe7f
mov dword [ebp - 0x1c], 0xbd3321d4
sub dword [ebp - 0x1c], 0x70e6dda6
mov dword [ebp - 0x18], 0x6cbe02a3
sub dword [ebp - 0x18], 0x6cbe02a3
lea eax, [ebp - 0x24]
push eax
mov eax, 0x257da56d
sub eax, 0x253d2469
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xcea6636a
add dword [ebp - 0x24], 0xa5cc05ec
mov dword [ebp - 0x20], 0xbee2ab6c
add dword [ebp - 0x20], 0x8289b609
mov dword [ebp - 0x1c], 0x2b898735
sub dword [ebp - 0x1c], 0xc81a1ac9
mov dword [ebp - 0x18], 0xddf5af36
add dword [ebp - 0x18], 0x220a50ca
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37077
push 0
call eax
mov ecx, 0x38dd4970
add ecx, 0xc722fe89
xor ebx, ebx
add ebx, eax
mov edx, 0xe52c6638
add edx, 0x1b1a7dc8
add edx, dword [ebp - 0x14]
mov edi, 0x4f04015d
add dword [ebp - 0x10], ecx
mov esi, dword [edx]
add dword [ebp - 0xc], edx
xor esi, edi
add dword [ebp - 8], eax
mov dword [ebx], esi
add dword [ebp - 8], ebx
add ebx, 4
add edx, 0xcdcfbeef
sub edx, 0xcdcfbeeb
loop 0x402ffd
add eax, 0xa68f74b9
sub eax, 0xa68e6202
mov ebx, eax
add eax, 0x689d6b24
sub eax, 0x689d6b1f
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4048ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4048fe
pop dword [ebp - 0x20]
mov eax, 0x4048fe
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4f7be
push 0
mov eax, 0x95bb6de3
sub eax, 0x9576bb27
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x5f27c6a8
add ecx, 0xa0d87fb2
mov edi, eax
mov ebx, 0xda6d9944
add ebx, 0x25dae4bc
add ebx, dword [ebp - 0x20]
mov edx, 0xecf44c03
sub edx, 0x31ccdbd9
xor dword [ebp - 0x10], 0xf4ba234d
mov esi, dword [ebx]
add dword [ebp - 4], 0x31ec8bdc
add esi, edx
xor dword [ebp - 8], ecx
mov dword [edi], esi
sub dword [ebp - 4], edi
add edi, 0x3b6267af
add edi, 0xc49d9855
add ebx, 0x2a314ed5
sub ebx, 0x2a314ed1
loop 0x404958
add eax, 0x10c3b
mov ebx, eax
add eax, 5
mov ecx, 0xaa43cfb
add ecx, 0xf59bc305
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x41d24b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x2c
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0042f8e0
push 0x2c
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.0042f8e0
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x2c]
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x34], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x60]
push eax
push 0x41ad40
push ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0x20]
push ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41d332
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41d30c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41d313
mov esi, 0x80004005
push esi
push 0x461
push str.elevation.cpp
call fcn.00403821
push str.Failed_to_create_elevated_cache_thread.
push esi
call main
pop ecx
pop ecx
jmp 0x41d37c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x41c7c9
push dword [ebp + 0xc]
call main
mov esi, eax
test esi, esi
jns 0x41d35c
push str.Failed_to_pump_messages_in_child_process.
push esi
call main
pop ecx
pop ecx
jmp 0x41d375
push dword [ebp - 8]
push edi
call main
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x38
Function at 0x4010bb
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x48], 0
mov dword [esi], 0x636ae0
je 0x40110b
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInStop]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInReset]
push 2
lea edi, [esi + 0x34]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
add edi, 4
dec ebx
jne 0x4010e4
push dword [esi + 0x18]
call dword [sym.imp.WINMM.dll_waveInClose]
push 0xffffffffffffffff
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp byte [esi + 0x49], 0
je 0x40113c
push dword [esi + 0x44]
call dword [sym.imp.WINMM.dll_waveOutReset]
push 2
lea edi, [esi + 0x34]
pop ebx
push 0x20
push dword [edi]
push dword [esi + 0x44]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 4
dec ebx
jne 0x401120
push dword [esi + 0x44]
call dword [sym.imp.WINMM.dll_waveOutClose]
push 2
lea edi, [esi + 0x34]
pop ebx
push dword [edi - 0x2c]
call fcn.005decb5
push dword [edi]
call fcn.005decb5
push dword [edi - 0x24]
call fcn.005decb5
push dword [edi + 8]
call fcn.005decb5
add esp, 0x10
add edi, 4
dec ebx
jne 0x401142
push dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x28]
call edi
push dword [esi + 0x30]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x401226
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
je 0x401280
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004012ea
lea eax, [ebp - 4]
xor esi, esi
push eax
push 4
push edi
push 0x4013cb
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x20000
push esi
push dword [ebp - 4]
mov dword [edi + 0x30], eax
lea eax, [ebp - 0x1c]
lea ebx, [edi + 0x18]
push eax
push dword [edi + 0x2c]
push ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x401284
xor al, al
jmp 0x4012e5
lea esi, [edi + 0x34]
mov dword [ebp - 8], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x2c]
push 0x20
mov dword [eax], ecx
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi]
and dword [eax + 0x10], 0
mov eax, dword [esi]
and dword [eax + 0x14], 0
push dword [esi]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec dword [ebp - 8]
jne 0x40128e
mov eax, dword [edi + 0x1c]
push 0x20
push dword [edi + eax*4 + 0x34]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [edi + 0x48], 1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403b3f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x403b5e
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403b5e
test al, 0x10
jne 0x403b5e
push 1
pop eax
jmp 0x403b60
xor eax, eax
ret 4