joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018d380
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp + ecx - 0x67ffba3e], edx
adc ecx, dword [esp + ecx - 0x67ffba2e]
sal byte [esp + 0xc], 0xa7
sbb dword [esp + 7], 0x2292b619
mov edx, dword [ebp - 4]
mov eax, dword [ebp]
add edx, eax
mov dword [ebp], edx
or word [esp + 0xe], cx
mov edx, dword [esi + 1]
inc ecx
ja 0x101aa73d
mov edx, 0x44b0f8b7
mov ecx, dword [esi + edx - 0x44b0f8b7]
mov eax, 0xdb326aac
lea esi, [esi + edx - 0x44b0f8b3]
mov dword [esp + edx - 0x44b0f8b7], eax
btc eax, 0xa4
xor ecx, ebx
xadd edx, eax
bswap ecx
cdq
mov dword [esp + edx], eax
adc word [esp + edx + 1], dx
neg ecx
and byte [esp + eax - 0x44b0f8b5], dl
neg dx
ror ecx, 1
not dword [esp + edx*2]
add dx, 0xf617
xor eax, eax
xor ecx, 0x4e3f36bf
rol dl, 0x87
lea ecx, [edx + ecx - 0x4d0caaa0]
sub word [esp + edx - 0xf689], dx
xor ebx, ecx
sal edx, 0xf
sbb al, byte [esp + eax + 3]
not word [esp + edx - 0x7b457ffe]
add edi, ecx
dec edx
inc word [esp + eax - 0x3b]
mov dx, word [edx + ebp - 0x7b457fff]
js 0x100144eb
sub dword [esp + eax*8 - 0x1d8], 0x9e15d0bb
inc dword [esp + eax - 0x3b]
mov cx, word [ebp + eax*2 - 0x74]
call fcn.1003eb2d
sbb esi, 0xfffffffb
pop ecx
not ecx
xor edx, ebx
rol cx, 0xb
lea eax, [ecx*2 - 0x3073cde0]
not eax
neg edx
and cx, word [esp + eax - 0x71d758]
lea edx, [edx + eax*2 - 0x611f6c6d]
xor edx, 0xc2399b87
inc ecx
inc edx
not cl
pop ecx
add ax, 0x921e
xor ebx, edx
sub byte [esp + eax - 0x71697c], ah
btr eax, ecx
add edi, edx
shr ecx, 0x9c
lea eax, [esp + eax*8 - 0x38b4ba4]
btr ecx, 3
mov cl, byte [eax]
mov word [ebp - 2], cx
mov ecx, 0xcf811919
mov edx, ecx
sar word [esp + 6], 0xc2
sbb ebp, 1
pop eax
pop eax
jmp fcn.101dd833

Function at 0x10191b1d
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
call fcn.1012000b
mov byte [ebp - 0x93e], 0x65
jmp loc.10033b0b

Function at 0x1019278a
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
neg eax
shr word [esp + ecx - 0x7f8a4517], 0xad
lea eax, [eax + edx - 0x60e57d87]
call fcn.10122a1b
Function at 0x10197607
Capabilities:
Parse pe header

Disassembly:
xor ecx, 0x9b3d411f
ror ecx, 0xd9
neg edx
xor ebx, edx
ror ax, 0xe8
adc edi, edx
shr cl, 0x64
lea eax, [eax + ecx*2 - 0x56613b61]
mov ax, word [ebp + ecx - 0x2f405d05]
movsx edx, cx
mov dx, word [ebp + ecx - 0x2f405d03]
push ecx
ror dword [esp + ecx - 0x2f405d05], cl
mov cl, byte [ebp + ecx - 0x2f405d01]
sar byte [esp + 1], 0x46
jae 0x1006b50a
xchg edx, eax
xor ebx, ecx
add edi, ecx
add dl, dh
or edx, 0x363de10a
movzx edx, byte [esi + eax*8 - 0x5ff8]
not eax
adc esi, 1
movsx ecx, al
xchg ecx, eax
add eax, ecx
xor dl, bl
call fcn.1016a076
adc ebp, 4
jmp fcn.101cdf13
neg ecx
lea ecx, [ecx + edx*2 - 0x603bbdab]
bts edx, edx
xor ecx, 0xc2399b87
add eax, 0x2521d18d
adc ecx, edx
xor ebx, ecx
neg ax
jns 0x101ad70f
sar dword [esp + edx - 0x6c6db5fc], 0xdc
inc cl
bt eax, 0xa9
rol cl, 1
neg cl
ror cl, 1
add dl, ah
jp 0x101b75c7
dec cl
mov dword [esp + edx - 0x6c6db6e3], eax
xor bl, cl
rol byte [esp + edx - 0x6c6db6dd], 0xe7
rol ax, 0x29
cdq
lea ecx, [esp + ecx + 8]
push edx
cdq
imul word [esp + 2]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
mov edx, dword [esi + 1]
xor edx, ebx
inc edx
sal dword [esp + 1], 0x7a
xor edx, 0xba1cbb5
neg edx
mov eax, 0x940dfe10
movsx ecx, word [esp + 8]
rol edx, 1
neg edx
btc eax, ecx
cwde
setb al
xor ebx, edx
shl cl, 0x81
add edi, edx
movzx edx, byte [esi + 5]
and dword [esp + 7], ecx
jnp 0x1001e05a
neg byte [esp + 4]
sbb esi, 0xfffffff9
xor dl, bl
xor dl, 0x94
ror eax, 0x28
add cl, al
ror dl, 1
sar cl, 6
sal ax, 0x21
rol word [esp + eax*2 - 0x3ffffee], 7
neg dl
call fcn.1000a5c6
mov edx, 0xb3344d19
pushfd
shl dl, 0x7b
sub edx, 0xaab8e400
call fcn.1007725d
sub dword [esp + ecx], ecx
xor edx, ebx
btr ecx, ecx
lea eax, [ecx + ecx*4 + 0x3b11d9bd]
dec edx
mov byte [esp + ecx + 1], 0x32
dec eax
call fcn.1005265e
add edi, ecx
movsx ecx, dx
sub al, dl
mov ecx, dword [ebp + edx*4 - 0xc]
sal edx, 0x46
rol eax, 0xbb
rol eax, 0x22
mov edx, dword [edx + ebp - 0x44]
add ecx, edx
bt eax, eax
cdq
div eax
mov dword [eax + ebp - 5], ecx
mov ecx, edx
lea ebp, [eax + ebp - 5]
sub ecx, ecx
jo 0x1002646e
jbe fcn.101dd833
idiv byte [esi + 0x2c]
xor eax, 0x22beb167
hlt
shl eax, 0xfe
xor dl, bl
sal al, 0x25
pop ecx
adc dl, 0xb5
ror dl, 1
ror al, 0x25
shl cl, 0xa3
xadd ecx, eax
xor dl, 0xb
xchg al, cl
add cl, ch
sbb cx, ax
inc dl
lea eax, [ecx - 0x22c547d9]
xor al, ah
xor bl, dl
dec eax
shl ax, 0x6d
btc eax, 0x20
mov dword [ebp + ecx - 0x7594ffec], edx
div cl
push eax
mov ecx, dword [esi + ecx - 0x7594ffe2]
pop edx
xor eax, edx
lea esi, [esi + eax*2 + 6]
xor ecx, ebx
ror eax, 0xd4
xchg edx, eax
jae 0x101784c9

Function at 0x101999b2
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
not dword [esp + 8]
jb 0x101f397d
sal al, 0x2e
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.1012000b
Function at 0x1019c2c8
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information

Disassembly:
mov ebp, dword [esp + ebp + 0x25bc9006]
mov dword [esp + 0xc], 0x11cc851
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1012000b
cmc
xorps xmm0, xmmword [ebp - 0xd850]
clc
test dl, 0x83
movaps xmmword [ebp - 0xd860], xmm0
jmp loc.10028d93

Function at 0x1019caf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1012000b

Function at 0x1019cb05
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, 0xbf3e8f16
sub dx, dx
mov dword [esp + edx - 0x14b00000], edx
xor ebx, eax
call fcn.101a7344

Function at 0x1019d285
Capabilities:
Parse pe header

Disassembly:
push ecx
mov ecx, 0xf790902f
call fcn.1006d08b
adc eax, 0
jmp 0x101b831d
movlpd qword [esp + 0x20], xmm0
jmp loc.1004a919

Function at 0x101b1d4b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
jmp loc.1006c6f4
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x18]
call fcn.1012000b
push eax
jmp 0x101250af

Function at 0x101c34eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.100120b0
push ebx
movzx ecx, si
mov ecx, esi
jmp 0x101783cd
call fcn.1004cc20
mov eax, 0x40
cmp dx, 0x96a3
cmc
mov dword [ebp - 0x18], eax
cmp edi, 0x80
jmp loc.1002cd78
call fcn.10132e6a
push ebx
jmp 0x1013b012

Function at 0x101cfac9
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
jmp 0x101e5746
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
jmp 0x101b7f66
cmp ebp, edx
mov dword [esp], 0x9da4ee12
call fcn.101390e4
mov dword [esi + 0xf0], 0
jmp 0x101b7fd3
mov dword [esi + 0x108], 0
jmp loc.10074525

Function at 0x101cfd0b
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
pop ecx
jmp edi
xadd ax, cx
mov dword [ebp + eax - 0xfff7], edx
lea ebp, [ebp + eax*4 - 0x3fff4]
xadd eax, ecx
jbe 0x10036874
jmp edi
shl ax, 0x69
mov dword [esp + edx*4 - 0x72484b64], edx
xor ecx, 0x7c9eb899
lea edx, [eax + edx*8 - 0x1ad190e7]
and dword [esp], eax
ror byte [esp + 3], 0x65
sbb ecx, 0xc879025
xchg byte [esp], dl
rol eax, 0xd3
mov dword [esp + eax - 0x70071b6a], edx
xor ecx, 0xe28201a2
pop edx
xor ax, 0x70a
inc eax
neg ecx
bswap edx
sar ax, 0xef
dec edx
bswap ecx
xor ebx, ecx
neg edx
neg ax
adc edi, ecx
bswap eax
not edx
mov edx, dword [ebp + eax*8 - 0x3b7c]
mov ecx, dword [ebp + eax - 0x768]
jmp 0x101e8bec
sub eax, eax
and edx, ecx
movsx ecx, ax
not edx
dec ecx
jne 0x1019b3bc

Function at 0x101d7c23
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information

Disassembly:
pushfd
add dword [esp + 4], 0xeff85f11
mov dword [esp + 4], 0x114ba59
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1012000b
Function at 0x101f0ca8
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
and eax, dword [esp + 4]
lea esi, [esi + eax*4 - 0x2842fffa]
xor eax, 0x7eb9b38b
ror al, 0x61
xor edx, ebx
shl eax, 0x5f
movsx ecx, ax
lea edx, [edx + ecx*2 - 0x5521b8b4]
mov dword [esp + ecx], 0xda903530
ror edx, 1
or dword [esp + eax - 0x7ffffffc], eax
adc al, byte [esp + eax - 0x7ffffffb]
push ecx
lea edx, [edx + eax - 0x7f76cea9]
bswap edx
xor ebx, edx
bt ecx, 0x22
adc edi, edx
mov edx, eax
call fcn.10147d05

Function at 0x101f1c73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.1012000b

Function at 0x101f29fa
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
je 0x101f2a00
add dword [esp], 0xeffc5b41
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.1012000b
Function at 0x40c6d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x40c894
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c6fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c6f0
mov eax, 1
add ebx, ebx
jne 0x40c713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c708
jne 0x40c724
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c708
xor ecx, ecx
sub eax, 3
jb 0x40c738
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c7aa
mov ebp, eax
add ebx, ebx
jne 0x40c743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c774
inc ecx
add ebx, ebx
jne 0x40c760
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c755
jne 0x40c771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c755
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c794
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c785
jmp 0x40c6f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c794
add edi, ecx
jmp 0x40c6f6
pop esi
mov edi, esi
mov ecx, 0x243
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c7b2
cmp byte [edi], 1
jne 0x40c7b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c7b7
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c826
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc440]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc4e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c7e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc4e4]
or eax, eax
je 0x40c820
mov dword [ebx], eax
add ebx, 4
jmp 0x40c801
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40c857
cmp al, 0xef
ja 0x40c84a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40c82c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40c839
mov ebp, dword [esi + 0xc4e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c88b
sub esp, 0xffffff80
jmp 0x404b88
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000983f
pop dword [ebp - 0xc]
mov eax, 0x7b30e060
add eax, 0x94cfb7df
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x39f63
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x9ab8989d
sub ecx, 0x9ab84cc6
xor edx, edx
add edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0xc]
mov edi, 0x253c10d2
xor dword [ebp - 4], edi
mov esi, dword [ebx]
xor dword [ebp - 4], 0x6b2d8f72
xor esi, edi
sub dword [ebp - 4], 0xcbce6d50
mov dword [edx], esi
add dword [ebp - 4], edi
add edx, 4
add ebx, 4
loop 0x1000988f
add eax, 0x3af710f1
add eax, 0xc50a113e
xor ebx, ebx
add ebx, eax
add eax, 0x7931fea2
add eax, 0x86ce0163
mov ecx, 0xeefed8b6
sub ecx, 0xdefed8b6
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x100141c0
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WINMM.dll
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x100194d0], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x100010e4
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001190
Capabilities:
Link many functions at runtime
Terminate thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_puts]
push 0x100170a0
mov dword [esi], 0x100141c0
call edi
mov eax, dword [0x100194d0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push str.waveInReset
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [esp + 0x18], eax
call ebp
push 0x100170a0
call edi
mov ecx, dword [0x100194d0]
add esp, 4
push str.waveInStop
push ecx
call ebx
push 0
mov dword [esp + 0x14], eax
call ebp
push 0x100170a0
call edi
mov edx, dword [0x100194d0]
add esp, 4
push str.waveInClose
push edx
call ebx
push 0
mov dword [esp + 0x20], eax
call ebp
push 0x100170a0
call edi
mov eax, dword [0x100194d0]
add esp, 4
push str.waveInUnprepareHeader
push eax
call ebx
push 0
mov dword [esp + 0x1c], eax
call ebp
push 0x100170a0
call edi
mov ecx, dword [0x100194d0]
add esp, 4
push str.waveOutReset
push ecx
call ebx
push 0
mov dword [esp + 0x24], eax
call ebp
push 0x100170a0
call edi
mov edx, dword [0x100194d0]
add esp, 4
push str.waveOutClose
push edx
call ebx
push 0
mov dword [esp + 0x28], eax
call ebp
push 0x100170a0
call edi
mov eax, dword [0x100194d0]
add esp, 4
push str.waveOutUnprepareHeader
push eax
call ebx
push 0
mov ebx, eax
call ebp
mov al, byte [esi + 0x44]
test al, al
je 0x100012d2
mov ecx, dword [esi + 0x18]
push ecx
call dword [esp + 0x14]
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x18]
lea edi, [esi + 0x30]
mov ebp, 2
mov eax, dword [edi]
mov ecx, dword [esi + 0x18]
push 0x20
push eax
push ecx
call dword [esp + 0x24]
add edi, 4
dec ebp
jne 0x100012ab
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x20]
mov eax, dword [esi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001302
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x24]
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x40]
push 0x20
push edx
push eax
call ebx
add edi, 4
dec ebp
jne 0x100012e9
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x28]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi - 0x28]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000130a
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x28]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov eax, dword [0x100194d0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10001460
Capabilities:
Link many functions at runtime
Resume thread

Disassembly:
mov eax, dword [0x100194d0]
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
push str.waveInGetNumDevs
mov edi, ecx
push eax
call ebp
call eax
test eax, eax
jne 0x1000148c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
mov ecx, dword [0x100194d0]
push str.waveInOpen
push ecx
call ebp
push str.CreateThread
push str.KERNEL32.dll
mov esi, eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
lea edx, [esp + 0x10]
push edx
push 4
push edi
push 0x10001660
push 0
push 0
call eax
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x10]
push 0x20000
push 0
lea ecx, [edi + 0x46]
push eax
lea ebx, [edi + 0x18]
push ecx
push 0xffff
push ebx
call esi
test eax, eax
je 0x100014f6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
mov edx, dword [0x100194d0]
push str.waveInPrepareHeader
push edx
call ebp
mov dword [esp + 0x18], eax
lea esi, [edi + 0x30]
mov dword [esp + 0x14], 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x10001513
mov edx, dword [0x100194d0]
push str.waveInAddBuffer
push edx
call ebp
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebx]
push edx
push ecx
call eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x100194d0]
push str.waveInStart
push eax
call ebp
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret