joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x468bd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call fcn.00438fb0
mov edx, dword [esi + 0x8a4]
xor edi, edi
cmp edx, edi
mov dword [esp + 0x2c], edi
je 0x42ca73
mov ecx, dword [esi + 0x8a8]
cmp ecx, edi
je 0x42ca73
mov eax, dword [esi + 0x8ac]
cmp eax, edi
je 0x42ca73
push ebx
push eax
mov eax, dword [edx + 0x30]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00438e70
mov ecx, dword [esi + 0x300]
push edi
push edi
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0x8a8]
mov ebx, eax
cmp dword [edx + 0x1c], edi
jle 0x42ca23
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MulDiv]
mov eax, dword [esi + 0x89c]
push eax
sub eax, ebx
push 0xffff
push eax
call ebp
mov ecx, dword [esp + 0x28]
inc edi
mov dword [ecx + edi*4 - 4], eax
mov edx, dword [esi + 0x8a8]
cmp edi, dword [edx + 0x1c]
jl 0x42c9fd
pop ebp
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 0x8ac]
push edx
mov ecx, dword [eax]
mov eax, dword [esi + 0x8a8]
mov dword [esi + 0x1d28], ecx
mov ecx, dword [esi + 0x8a4]
push eax
mov edx, dword [ecx + 0x30]
lea ecx, [esp + 0x14]
push edx
call fcn.00438f40
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00438e30
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00438e30
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x430ff0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov word [esp + 4], 2
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov cx, word [esi + 8]
mov dword [esp + 8], eax
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 4]
mov word [esp + 6], ax
mov eax, dword [esp + 0x20]
push 0x10
push edx
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
inc eax
pop esi
neg eax
sbb eax, eax
neg eax
dec eax
add esp, 0x10
ret

Function at 0x431420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov si, word [ecx + 0x14]
test si, si
push edi
je 0x43146b
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x43146b
xor eax, eax
xor ecx, ecx
and esi, 0xffff
jle 0x43146e
push ebx
movzx bx, byte [edi + ecx]
mov edx, eax
and edx, 0xffff
shr edx, 8
mov dx, word [edx*2 + 0x4809ac]
xor dx, bx
xor ebx, ebx
mov bh, al
xor edx, ebx
inc ecx
cmp ecx, esi
mov eax, edx
jl 0x43143f
pop ebx
pop edi
pop esi
ret
xor ax, ax
pop edi
pop esi
ret
Function at 0x431480
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
call fcn.00445311
mov byte [esp + 4], al
call fcn.00445311
mov bl, al
test bl, bl
jne 0x431498
mov bl, 1
mov ecx, dword [esp + 0xc]
xor eax, eax
mov ah, byte [esp + 4]
mov al, bl
mov word [ecx + 0x10], ax
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
jle 0x4314f2
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, ecx
mov ebp, 0x48
cdq
idiv ebp
mov edi, dword [esp + 0x10]
and edi, 0xff
mov al, byte [edi + 0x485b4c]
add al, dl
mov dl, byte [esi]
add dl, al
mov al, byte [esp + 0x10]
add al, bl
mov byte [esi], dl
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x20]
inc esi
inc ecx
cmp ecx, eax
jl 0x4314b9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x431500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ebx, ebx
mov bl, byte [eax + 0x11]
mov al, byte [eax + 0x10]
test al, al
mov byte [esp + 4], bl
mov byte [esp + 0xc], al
je 0x431564
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
jle 0x431564
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, ecx
mov ebp, 0x48
cdq
idiv ebp
mov edi, dword [esp + 0x10]
and edi, 0xff
mov al, byte [edi + 0x485b4c]
add al, dl
mov dl, byte [esi]
sub dl, al
mov al, byte [esp + 0x18]
mov byte [esi], dl
add bl, al
mov eax, dword [esp + 0x20]
inc esi
inc ecx
mov byte [esp + 0x10], bl
cmp ecx, eax
jl 0x43152b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x431570
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00445311
mov byte [esp + 0x10], al
call fcn.00445311
mov bl, al
test bl, bl
jne 0x43158b
mov bl, 0x45
mov esi, dword [sym.imp.WS2_32.dll_htons]
xor eax, eax
mov ah, byte [esp + 0x10]
mov al, bl
push eax
call esi
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov word [edi], ax
mov dx, word [ebp + 2]
lea ecx, [edi + 2]
push edx
mov dword [esp + 0x1c], ecx
call esi
mov ecx, dword [esp + 0x18]
mov word [ecx], ax
mov dx, word [ebp + 4]
push edx
call esi
mov word [edi + 4], ax
mov ax, word [ebp + 6]
push eax
call esi
mov word [edi + 6], ax
mov cx, word [ebp + 8]
push ecx
call esi
mov word [edi + 8], ax
mov dx, word [ebp + 0xa]
push edx
call esi
mov word [edi + 0xa], ax
mov ax, word [ebp + 0xc]
push eax
call esi
mov word [edi + 0xc], ax
mov cx, word [ebp + 0xe]
push ecx
call esi
mov word [edi + 0xe], ax
mov dx, word [ebp + 0x10]
push edx
call esi
mov word [edi + 0x10], ax
mov ax, word [ebp + 0x12]
push eax
call esi
mov ecx, dword [esp + 0x18]
mov word [edi + 0x12], ax
xor esi, esi
mov eax, esi
mov ebp, 5
cdq
idiv ebp
mov edi, dword [esp + 0x10]
and edi, 0xff
mov al, byte [edi + 0x485c4c]
add al, dl
mov dl, byte [ecx]
add dl, al
mov al, byte [esp + 0x10]
mov byte [ecx], dl
add al, bl
inc ecx
inc esi
cmp esi, 0x12
mov byte [esp + 0x10], al
jb 0x43161a
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x431660
Capabilities:
Encrypt data using rc4 ksa
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov ecx, 5
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebx]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
xor ecx, ecx
mov word [ebx], ax
mov cl, ah
mov byte [esp + 0x14], al
test al, al
mov byte [esp + 0x10], cl
jne 0x431698
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
push ebp
lea esi, [ebx + 2]
xor edi, edi
mov eax, edi
mov ebp, 5
cdq
idiv ebp
mov ecx, dword [esp + 0x14]
and ecx, 0xff
mov al, byte [ecx + 0x485c4c]
mov cl, byte [esi]
add al, dl
sub cl, al
mov al, byte [esp + 0x14]
mov byte [esi], cl
mov cl, byte [esp + 0x18]
add al, cl
inc esi
inc edi
mov byte [esp + 0x14], al
cmp edi, 0x12
jb 0x43169e
mov dx, word [ebx + 2]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push edx
call esi
mov word [ebx + 2], ax
mov ax, word [ebx + 4]
push eax
call esi
mov cx, word [ebx + 6]
mov word [ebx + 4], ax
push ecx
call esi
mov dx, word [ebx + 8]
mov word [ebx + 6], ax
push edx
call esi
mov word [ebx + 8], ax
mov ax, word [ebx + 0xa]
push eax
call esi
mov cx, word [ebx + 0xc]
mov word [ebx + 0xa], ax
push ecx
call esi
mov dx, word [ebx + 0xe]
mov word [ebx + 0xc], ax
push edx
call esi
mov word [ebx + 0xe], ax
mov ax, word [ebx + 0x10]
push eax
call esi
mov cx, word [ebx + 0x12]
mov word [ebx + 0x10], ax
push ecx
call esi
pop ebp
pop edi
mov word [ebx + 0x12], ax
pop esi
xor eax, eax
pop ebx
ret

Function at 0x431876
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
call fcn.00431920
test eax, eax
jne 0x43190c
mov al, byte [esi + 0x10]
test al, al
jne 0x43190c
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_select]
push edi
mov edi, 1
mov ecx, esi
call fcn.00431ad0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4318af
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4318bc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x431903
xor ecx, ecx
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x14], edi
jl 0x4318cc
mov ecx, eax
lea eax, [esp + 0xc]
lea edx, [esp + 0x14]
push eax
push 0
push 0
inc ecx
push edx
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
call ebp
mov eax, dword [esi + 0x24]
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x431903
mov ecx, esi
call fcn.00431e90
mov al, byte [esi + 0x10]
test al, al
je 0x43189a
pop edi
pop ebp
pop esi
add esp, 0x10c
ret
Function at 0x431920
Capabilities:
Contain obfuscated stackstrings
Resolve dns

Disassembly:
sub esp, 0x50
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x4319c5
mov al, 0x65
mov dl, 0x74
mov byte [esp + 9], al
mov byte [esp + 0xc], al
mov al, 0x6f
mov cl, 0x2e
mov byte [esp + 0x12], al
mov byte [esp + 0x15], al
lea eax, [esp + 4]
mov byte [esp + 4], 0x75
push eax
mov byte [esp + 9], 0x70
mov byte [esp + 0xa], 0x64
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x76
mov byte [esp + 0x11], 0x6e
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x72
mov byte [esp + 0x14], 0x69
mov byte [esp + 0x15], 0x6c
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x63
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4319ac
or eax, 0xffffffff
pop esi
add esp, 0x50
ret
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x4319c5
mov eax, dword [eax]
test eax, eax
je 0x4319c5
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi + 0x28], eax
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x4319d0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
call fcn.00431a90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x11
push 2
push 2
mov dword [esi + 0x14], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x24], eax
jne 0x4319ff
or eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esp + 4]
push 4
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x431a31
mov ecx, esi
call fcn.00431a90
mov eax, 0xfffffffe
pop esi
add esp, 0x14
ret
mov ecx, dword [esi + 0x24]
xor edx, edx
mov dword [esp + 8], edx
xor eax, eax
mov dword [esp + 0xc], edx
mov word [esp + 0xa], ax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push 0x10
mov dword [esp + 0x14], edx
push eax
push ecx
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x431a7c
mov ecx, esi
call fcn.00431a90
mov eax, 0xfffffffd
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x431e90
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x220
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x431f7a
mov eax, dword [esi + 0x24]
test eax, eax
je 0x431f7a
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x431f7a
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
lea ecx, [esp + 0x34]
push 0x200
push ecx
push eax
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
cmp edi, 0xffffffff
jne 0x431efb
mov ecx, esi
call fcn.00431a90
mov byte [esi + 0x10], 1
pop edi
pop esi
add esp, 0x220
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x24]
push eax
mov dword [esp + 0xc], edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0x1a]
mov dword [esp + 0xc], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0xc]
mov word [esp + 0x10], ax
cmp edx, dword [esi + 0x28]
jne 0x431f7a
mov ax, word [esi + 0x30]
lea ecx, [esp + 0x28]
push eax
push edi
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x34]
push edx
call fcn.00431210
test eax, eax
jge 0x431f5a
mov ecx, esi
call fcn.00431a90
mov byte [esi + 0x10], 1
pop edi
pop esi
add esp, 0x220
ret
jg 0x431f7a
mov eax, dword [esi + 0x34]
cmp word [eax + 4], 5
jne 0x431f73
lea ecx, [esp + 8]
push ecx
push eax
mov ecx, esi
call fcn.00431f90
mov ecx, esi
call fcn.00431a90
pop edi
pop esi
add esp, 0x220
ret

Function at 0x432370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20019
push 0
push str.SoftwareVentrilo
push reloc.WS2_32.dll_bind
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, 4
test eax, eax
jne 0x4323db
lea ecx, [esp + 0x14]
push esi
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.DisableVersionCheck
push ecx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebp
call ebx
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
je 0x43243c
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareVentrilo
push closesocket
call edi
test eax, eax
je 0x432400
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.DisableVersionCheck
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
je 0x432431
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4336c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4695ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x486ed0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], eax
mov ecx, dword [0x486ed0]
xor edi, edi
mov dword [esp + 0x20], edi
mov dword [esi + 4], ecx
mov edx, dword [0x486ed0]
mov dword [esi + 8], edx
mov eax, dword [0x486ed0]
mov dword [esi + 0xc], eax
mov cl, byte [esp + 0x13]
mov dword [esi + 0x14], edi
mov byte [esi + 0x10], cl
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dl, byte [esp + 0x13]
mov dword [esi + 0x28], edi
mov byte [esi + 0x24], dl
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, dword [0x486ed0]
lea ecx, [esi + 0x80]
mov dword [ecx], eax
mov edx, dword [0x486ed0]
mov dword [esi + 0x84], edx
mov eax, dword [0x486ed0]
mov dword [esi + 0x88], eax
mov edx, dword [0x486ed0]
lea ebp, [esi + 0x8c]
mov dword [ebp], edx
mov eax, dword [0x486ed0]
mov dword [esi + 0xc0], eax
mov edx, dword [0x486ed0]
mov dword [esi + 0xd8], edx
mov eax, dword [0x486ed0]
mov dword [esi + 0xdc], eax
mov edx, dword [0x486ed0]
mov dword [esi + 0xe4], edx
mov ebx, 1
or eax, 0xffffffff
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0x3c
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], 0x300
mov byte [esp + 0x20], 0xd
mov dword [esi + 0x7c], edi
push 0x48af38
call fcn.0045b3b2
push 0x48af38
mov ecx, ebp
call fcn.0045b3b2
mov ecx, 8
mov eax, 2
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov ebp, 4
mov dword [esi + 0x90], eax
lea ecx, [esi + 0xd8]
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], ebp
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], ebp
mov dword [esi + 0xb8], ebp
mov dword [esi + 0xbc], ebp
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 0xffffffff
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
call fcn.0045b1b4
mov ecx, dword [esp + 0x18]
mov eax, 5
mov dword [esi + 0xec], edi
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], eax
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe8], 0xffffffff
mov dword [esi + 0xf0], 0x64
mov dword [esi + 0xf4], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebp
mov dword [esi + 0x108], ebp
mov dword [esi + 0x118], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x437770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x469946
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov byte [esi + 4], al
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov cl, byte [esp + 0xf]
mov dword [esp + 0x1c], ebx
mov byte [esi + 0x18], cl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 1
call fcn.004356b0
push ebx
push ebx
push ebx
mov dword [esi], ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x28], eax
lea eax, [esi + 0x4c]
xor edx, edx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [eax], edx
mov ecx, 7
lea edi, [esi + 0x5c]
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x438730
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x4388b9
push 8
lea ecx, [esi + 0x78]
call fcn.00435c70
test eax, eax
mov dword [esp + 0x10], eax
jne 0x43879d
mov edi, str.Unable_to_allocate_wave_header.
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esi + 4]
mov ebp, ecx
push 1
push ebp
mov ecx, ebx
call fcn.0041e900
test al, al
je 0x438794
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
mov esi, str.Unable_to_allocate_wave_header.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [ecx + ebp], 0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [eax + 0xc], esi
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
push 0x20
push edx
push eax
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
je 0x438810
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00435dd0
mov edi, str.Unable_to_prepare_header.
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esi + 4]
mov ebp, ecx
push 1
push ebp
mov ecx, ebx
call fcn.0041e900
test al, al
je 0x438805
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, str.Unable_to_prepare_header.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push 0x20
push ecx
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
je 0x438890
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push 0x20
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
mov edx, dword [esp + 0x10]
push edx
call fcn.00435dd0
mov edi, str.Unable_to_add_prepared_wave_header.
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esi + 4]
mov ebp, ecx
push 1
push ebp
mov ecx, ebx
call fcn.0041e900
test al, al
je 0x438885
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
mov esi, str.Unable_to_add_prepared_wave_header.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [ecx + ebp], 0
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x28]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0x18]
lea eax, [esp + 0x10]
push eax
push 1
push edx
call fcn.0041ea20
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x439680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469a2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
call fcn.0045c6e2
mov eax, dword [0x486ed0]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x14], eax
mov ecx, dword [0x486ed0]
mov dword [esi + 0x34], ecx
mov dl, byte [esp + 0xb]
mov dword [esi + 0x44], ebx
mov byte [esi + 0x40], dl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 3
call fcn.00436650
mov ecx, dword [esp + 0x10]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 0x18], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov byte [esi + 0x64], bl
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
mov dword [esi + 0x70], ebx
mov word [esi + 0x74], 0xffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret