joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100267c7
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100586ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10026911
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10026828
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov byte [eax], 1
jmp 0x1002690f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002684f
push 0x199
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x20], 0x6d2c
mov dword [ebp - 0x40], str.rqeufnssn_fkhtzbch_fnb_wfmvz_jezymfal_kmf_osuwtwf
cmp dword [ebp - 0x20], 0x700d
jle 0x100268cf
and dword [ebp - 0x1c], 0
jmp 0x10026873
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4c62
jge 0x100268cf
and dword [ebp - 0x14], 0
jmp 0x10026889
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x36f4
jge 0x100268cd
and dword [ebp - 0x18], 0
jmp 0x1002689f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x440e
jge 0x100268cb
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1006f958
call fcn.10009584
jmp 0x10026898
jmp 0x10026882
jmp 0x1002686c
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x6b6a
jge 0x100268e9
mov edx, dword [ebp - 0x40]
mov ecx, 0x1006f958
call fcn.1000b719
jmp 0x10026905
or dword [ebp - 4], 0xffffffff
jmp 0x1002690f
jmp 0x10026923
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x44]
call fcn.10019fff
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026b44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026b8a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push dword [eax]
push 0x5b82
push 0x5b3
push dword [ebp - 0xc]
push 0x4c09
push dword [ebp - 0x10]
push 1
call fcn.10026bf7
add esp, 0x1c
jmp 0x10026bf3
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10026be2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10026bc2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x10026be0
mov dword [ebp - 0x20], 0xffffffff
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.1001a320
pop ecx
pop ecx
jmp 0x10026bb7
jmp 0x10026bf3
push 0x199
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10031600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100588fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x696f
mov dword [ebp - 0x28], str.dgiobiu_gxeulauy_ccdenvr_ubgv_vzw
cmp dword [ebp - 0x20], 0x69ce
jle 0x100316cc
push 0
push 0x2684
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 0x14], 0
jmp 0x10031657
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x73fa
jge 0x100316cc
and dword [ebp - 0x18], 0
jmp 0x1003166d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4c32
jge 0x100316ca
and dword [ebp - 0x1c], 0
jmp 0x10031683
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5e3c
jge 0x100316c8
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10009564
push eax
call fcn.1003f93c
pop ecx
lea ecx, [ebp - 0x48]
call fcn.1000955a
jmp 0x1003167c
jmp 0x10031666
jmp 0x10031650
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
push 1
call fcn.1003172c
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x67b4
jge 0x100316f5
push dword [ebp - 0x28]
call fcn.1003f93c
pop ecx
jmp 0x10031711
or dword [ebp - 4], 0xffffffff
jmp 0x1003171b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031ed6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10031fea
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10031fd7
mov dword [ebp - 0x28], 0xdb58e469
mov dword [ebp - 0x30], 0xad95e17c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x20], 0xe41b66ba
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
jmp 0x10031f44
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x10031f57
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 0xde9bf9f
jmp 0x10031f3d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x20], 0
je 0x10031f76
mov eax, dword [ebp - 0x14]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x44]
test eax, eax
jne 0x10031f83
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x10031f83
and dword [ebp - 0xc], 0
jmp 0x10031f8a
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 8
jle 0x10031f99
mov dword [ebp - 0x10], 1
jmp 0x10031f9d
and dword [ebp - 0x10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x10], eax
jne 0x10031fb8
cmp dword [ebp - 0x14], 0
jne 0x10031fb8
and dword [ebp - 0x18], 0
jmp 0x10031fbf
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x18]
sub eax, ecx
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x44], eax
jmp 0x10031fe8
push 0x199
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10032007
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0x480a
push 0
push dword [ebp - 0x2c]
push 0xae8
call fcn.10035193
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1003201c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10032062
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032043
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10032060
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10032060
push 0x1f4d
push 0
push 0
call fcn.1002d5c4
add esp, 0xc
jmp 0x10032070
push 0
push 0x5567
call fcn.100321a6
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10033041
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058963
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10033098
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 0x12fa
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
push dword [eax]
push 1
push 0x319
call fcn.10033213
add esp, 0x14
jmp 0x10033202
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100330c8
push 0x1c63
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10033202
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x7bfe
mov dword [ebp - 0x48], str.dxtkw_uuvzr_hniyqfacv
cmp dword [ebp - 0x24], 0x7e68
jle 0x1003319c
and dword [ebp - 0x20], 0
jmp 0x100330fc
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10b
jge 0x1003319c
and dword [ebp - 0x14], 0
jmp 0x10033116
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2123
jge 0x10033197
and dword [ebp - 0x18], 0
jmp 0x1003312c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3c33
jge 0x10033192
and dword [ebp - 0x1c], 0
jmp 0x10033142
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x46ab
jge 0x10033190
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
idiv dword [ebp - 0x1c]
or edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x80]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10009564
push eax
call fcn.1003f93c
pop ecx
lea ecx, [ebp - 0x80]
call fcn.1000955a
jmp 0x1003313b
jmp 0x10033125
jmp 0x1003310f
jmp 0x100330f5
lea eax, [ebp - 0x68]
push eax
call fcn.1002ad2c
pop ecx
mov esi, eax
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call fcn.1002d100
shl eax, 1
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + eax*4 + 4]
mov dword [ecx], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7a51
jge 0x100331dc
push dword [ebp - 0x48]
call fcn.1003f93c
pop ecx
jmp 0x100331f8
or dword [ebp - 4], 0xffffffff
jmp 0x10033202
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100367d5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058a8c
call fcn.100579d8
sub esp, 0x18
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov byte [ebp - 0x14], cl
je 0x100368ad
mov dword [ebp - 0x18], 0x386e
cmp dword [ebp - 0x18], 0x3921
jle 0x1003682e
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1006f958
and eax, esi
cdq
push edx
push eax
call fcn.10009584
inc edi
cmp edi, 0x3b8a
jl 0x1003680b
inc esi
cmp esi, 0x1337
jl 0x10036809
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x382f
jge 0x1003684a
mov edx, str.nfeqnqxdx_yebxp_qznkmpyq_xvmxbjku_iofpoo_tvnanffc_wqviekpii_ldtbcqwbn_crufaac_pivfnff_irkkfb_qkbvkq_uvdlwujxc
mov ecx, 0x1006f958
call fcn.1000b719
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10036879
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x100369b3
push 0x46cd
push 1
push 0x606b
push 0x77d8
push 1
lea eax, [ebp + 0x1b]
mov byte [ebp + 0x1b], 0
push eax
push 0x63ef
mov edx, 0x5965
mov cl, 1
call fcn.1003630a
add esp, 0x1c
jmp 0x100369b3
cmp byte [ebp + 0x14], 0
je 0x1003699c
mov dword [ebp - 0x18], 0x2045
cmp dword [ebp - 0x18], 0xb0a
jge 0x10036919
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push str._ld__ld
call fcn.1003f63b
add esp, 0xc
xor edi, edi
push 2
pop esi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push esi
call fcn.1003673a
pop ecx
test al, al
je 0x10036906
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push esi
call fcn.1003676e
cmp edi, eax
pop ecx
cmovg eax, edi
mov edi, eax
inc esi
cmp esi, 0x74
jle 0x100368e1
push edi
push str._ld_n
call fcn.1003f93c
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, dword [ebx]
je 0x1003692a
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov dword [ebp - 0x18], 0x1f53
cmp dword [ebp - 0x18], 0x2194
jle 0x10036961
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1006f958
xor eax, esi
cdq
push edx
push eax
call fcn.10009584
inc edi
cmp edi, 0xc4c
jl 0x1003693e
inc esi
cmp esi, 0x4a07
jl 0x1003693c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x1ba3
jge 0x10036980
mov edx, str.wuu_hul_nblo_irvsyhxpw_boggi_ysxgmroed_doclecmr_xygjhg_bzhzft_iwjluy_baesuop_uwugldy_wcurtsr
mov ecx, 0x1006f958
call fcn.1000b719
jmp 0x100369b3
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x100369b3
push 0xede
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4019ac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019bf
push esp
mov dword [ebp - 0x24], 0x401711
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a5e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a3f
pop ebp
ret 0x10
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1000678b
Capabilities:
Encode data using xor

Disassembly:
inc edi
and dword [ecx + 0x407f2f26], ecx
rcl ebx, 1
adc al, 0x77
inc edi
mov bh, 0x10
sbb esp, edx
sbb eax, 0xdbd56629
and ah, byte [ebx]
loope 0x100067ab
sub eax, 0xf15bec8d
movsd dword es:[edi], dword [esi]
invalid
Function at 0x10001a90
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10021004]
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push edi
test eax, eax
je 0x10001aab
push eax
call esi
mov eax, dword [0x10021008]
test eax, eax
je 0x10001ab7
push eax
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea edx, [ebp - 0x1c]
push edx
push 0x100017f0
mov dword [0x10021010], eax
mov dword [section..SHARED], ecx
call esi
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExW]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
push 0
push eax
push 0x100017f0
push edi
call ebx
mov dword [0x10021004], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x10001a70
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
push 0
push eax
push 0x10001a70
push 3
call ebx
cmp dword [0x10021004], 0
mov dword [0x1002100c], edi
pop edi
pop esi
mov dword [0x10021008], eax
pop ebx
jne 0x10001b3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100062d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001d3ec]
jne 0x100062dc
repz ret
jmp fcn.10009dea

Function at 0x100120eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001d3ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000a80c
and dword [ebp - 0x14], 0
cmp dword [0x1001f638], 0
mov dword [ebp - 0x18], eax
jne 0x1001219e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10012246
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10012246
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001f638], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001f63c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001f640], eax
call edi
push eax
call esi
mov dword [0x1001f648], eax
test eax, eax
je 0x1001219e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001f644], eax
mov eax, dword [0x1001f644]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100121f7
cmp dword [0x1001f648], ecx
je 0x100121f7
push eax
call esi
push dword [0x1001f648]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100121f7
test ebx, ebx
je 0x100121f7
call edi
test eax, eax
je 0x100121ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100121ee
test byte [ebp - 8], 1
jne 0x100121f7
or dword [ebp + 0x10], 0x200000
jmp 0x1001222a
mov eax, dword [0x1001f63c]
cmp eax, dword [ebp - 0x18]
je 0x1001222a
push eax
call esi
test eax, eax
je 0x1001222a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001222a
mov eax, dword [0x1001f640]
cmp eax, dword [ebp - 0x18]
je 0x1001222a
push eax
call esi
test eax, eax
je 0x1001222a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001f638]
call esi
test eax, eax
je 0x10012246
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10012248
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100062d2
leave
ret
Function at 0x4010ce
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
movzx esi, ax
movzx edi, dx
shr esi, 3
imul edi, esi
mov ecx, dword [ebp + 0x10]
mov word [0x41a226], ax
imul edi, ecx
shr ax, 3
mov dword [0x41a220], edi
imul eax, edx
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
mov word [0x41a218], 1
fild qword [ebp - 8]
mov word [0x41a21a], dx
mov dword [0x41a21c], ecx
mov word [0x41a224], ax
mov word [0x41a228], di
fmul dword [0x414588]
call sub.MSVCRT.dll__ftol
imul esi, eax
push 0x30008
push edi
push 0x40122d
push 0x41a218
push 0xffffffffffffffff
push 0x41a198
mov dword [0x41a1d0], eax
mov dword [0x41a1d4], esi
call dword [sym.imp.WINMM.dll_waveInOpen]
push edi
call fcn.00401181
inc edi
pop ecx
cmp edi, 2
jb 0x401164
push dword [0x41a198]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
pop esi
leave
ret

Function at 0x401181
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x41a1d4]
mov edi, 0x41a200
mov ecx, edi
push dword [ebp + 8]
call fcn.0040180c
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
mov esi, dword [ebp + 8]
push dword [ebp + 8]
mov ecx, edi
shl esi, 5
call fcn.0040180c
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, dword [0x41a1dc]
push 0x20
mov dword [esi + ecx], eax
mov eax, dword [0x41a1dc]
mov ecx, dword [0x41a1d4]
mov dword [esi + eax + 4], ecx
mov ecx, dword [0x41a1dc]
xor eax, eax
mov dword [esi + ecx + 8], eax
mov ecx, dword [0x41a1dc]
mov dword [esi + ecx + 0xc], eax
mov ecx, dword [0x41a1dc]
mov dword [esi + ecx + 0x10], eax
mov ecx, dword [0x41a1dc]
mov dword [esi + ecx + 0x14], eax
mov eax, dword [0x41a1dc]
add eax, esi
push eax
push dword [0x41a198]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x41a1dc]
push 0x20
add esi, eax
push esi
push dword [0x41a198]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebp
ret
Function at 0x4013be
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx ecx, word [0x41a21a]
movzx eax, word [0x41a226]
imul eax, ecx
mov edx, eax
push ebx
imul edx, dword [0x41a21c]
push esi
push edi
shr edx, 3
mov dword [ebp - 0x10], edx
push 8
cdq
pop esi
xor edi, edi
idiv esi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
imul eax, ecx
mov dword [ebp - 0x18], eax
add eax, 0x24
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401438
xor al, al
jmp 0x401514
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.RIFF
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 4]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.WAVE
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.fmt
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 8]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0xc]
push 2
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 2
push 0x41a21a
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push 0x41a21c
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
push 2
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 2
push 0x41a226
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push 0x41458c
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40209b
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ecx + 4]
push edi
lea esi, [ebp + 8]
mov edi, eax
push 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push dword [ecx]
movsd dword es:[edi], dword [esi]
call sub.WS2_32.dll_connect
neg eax
sbb al, al
pop edi
inc al
pop esi
pop ebp
ret 0x10

Function at 0x402118
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x14], eax
xor eax, eax
push eax
push eax
push ecx
push 0x402137
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 4