joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e9d4
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
mov esi, ecx
call fcn.100158cd
push str.MacromediaMutexOmega
push 1
pop ebp
xor ebx, ebx
push ebp
push ebx
mov dword [esi], 0x1009e544
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x1005ea98
mov edi, 0xfc10
push str.MacromediaFMOmega
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 0x24], eax
je 0x1005ea8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push ebx
push ebx
push 0xf001f
push dword [esi + 0x24]
cmp eax, 0xb7
setne byte [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp byte [esp + 0x14], bl
mov dword [esi + 4], eax
je 0x1005ea7d
cmp eax, ebx
je 0x1005ea8f
mov dword [eax], ebp
mov eax, dword [esi + 4]
mov dword [eax + 4], ebp
mov eax, dword [esi + 4]
mov byte [eax + 0xa010], bl
mov eax, dword [esi + 4]
mov dword [eax + 0xc], ebx
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
jmp 0x1005ea8f
cmp eax, ebx
je 0x1005ea8f
cmp dword [eax], ebp
je 0x1005ea8f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [esi + 4], ebx
jne 0x1005eabd
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x1005eab0
push eax
call edi
mov dword [esi + 0x24], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x1005eabd
push eax
call edi
mov dword [esi + 0x20], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1005f248
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x100b5874]
push ebx
push esi
push edi
push 1
pop ebx
cmp eax, ebx
je 0x1005f39c
push 2
pop esi
cmp eax, esi
je 0x1005f3b0
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x1005f28b
mov dword [0x100b5874], esi
jmp 0x1005f3b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
push edi
call esi
push str.WSAStartup
push edi
mov dword [0x100b5830], eax
call esi
push str.listen
push edi
mov dword [0x100b5834], eax
call esi
push str.closesocket
push edi
mov dword [0x100b5838], eax
call esi
push str.bind
push edi
mov dword [0x100b583c], eax
call esi
push str.htons
push edi
mov dword [0x100b5840], eax
call esi
push str.htonl
push edi
mov dword [0x100b5844], eax
call esi
push str.socket
push edi
mov dword [0x100b5848], eax
call esi
push str.WSAAsyncSelect
push edi
mov dword [0x100b584c], eax
call esi
push str.accept
push edi
mov dword [0x100b5850], eax
call esi
push str.WSAGetLastError
push edi
mov dword [0x100b5854], eax
call esi
push str.WSAAsyncGetHostByName
push edi
mov dword [0x100b5858], eax
call esi
push str.inet_addr
push edi
mov dword [0x100b585c], eax
call esi
push str.connect
push edi
mov dword [0x100b5860], eax
call esi
push str.send
push edi
mov dword [0x100b5864], eax
call esi
push str.recv
push edi
mov dword [0x100b5868], eax
call esi
push str.WSACancelAsyncRequest
push edi
mov dword [0x100b586c], eax
call esi
mov dword [0x100b5870], eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [0x100b5834]
test eax, eax
jne 0x1005f3a6
cmp byte [ebp - 0x190], bl
jne 0x1005f3a0
mov al, byte [ebp - 0x18f]
cmp al, bl
jne 0x1005f3a0
mov dword [0x100b5874], ebx
mov eax, ebx
jmp 0x1005f3b2
call dword [0x100b5830]
mov dword [0x100b5874], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005f3f7
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x10
lea eax, [ebp - 0x10]
push 0
mov edi, ecx
push eax
call fcn.100982c0
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.WSOCK32.dll_htons
mov esi, dword [ebp + 8]
mov word [ebp - 0xe], ax
cmp byte [esi], 0
je 0x1005f476
push 0x100a899c
push esi
call fcn.10098710
pop ecx
test eax, eax
pop ecx
je 0x1005f476
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x1005f483
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x1005f495
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.10098320
mov ax, word [esi + 8]
add esp, 0xc
mov word [ebp - 0x10], ax
jmp 0x1005f483
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [edi]
call dword [0x100b5864]
test eax, eax
je 0x1005f499
xor al, al
jmp 0x1005f4b9
cmp byte [ebp + 0x10], 0
jne 0x1005f4b7
lea eax, [ebp + 0x10]
push 4
push eax
push 1
push 6
mov dword [ebp + 0x10], 1
push dword [edi]
call sub.WSOCK32.dll_setsockopt
mov al, 1
pop edi
pop esi
leave
ret 0x10
Function at 0x10060007
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10060133
push edi
mov edi, 0x100b4348
push dword [esi]
mov ecx, edi
call fcn.100137e9
cmp dword [ebp + 8], 5
mov dword [esi], ebx
jle 0x100600d5
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10060066
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x10060090
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push eax
call fcn.10045fb6
pop ecx
pop ecx
jmp 0x10060087
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x10060090
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push 6
push eax
call fcn.100460d1
add esp, 0xc
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [esi]
cmp edi, ebx
je 0x1006012c
cmp byte [edi], bl
je 0x1006012c
lea eax, [ebp + 0xa]
push eax
push edi
call fcn.10045c78
cmp word [ebp + 0xa], 0xd
pop ecx
pop ecx
jne 0x100600d1
cmp byte [edi], bl
mov eax, edi
je 0x100600cd
cmp byte [eax + 1], bl
lea ecx, [eax + 1]
je 0x100600cd
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, ecx
cmp byte [eax], bl
jne 0x100600bb
mov byte [eax], bl
jmp 0x1006009a
add edi, eax
jmp 0x1006009a
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10060101
push eax
call fcn.10098240
pop ecx
inc eax
push eax
mov ecx, edi
call fcn.10013731
push dword [ebp + 8]
mov dword [esi], eax
push eax
call fcn.100987a0
pop ecx
pop ecx
mov edi, dword [esi]
cmp edi, ebx
je 0x1006012c
mov al, byte [edi]
cmp al, bl
je 0x1006012c
cmp al, 0xd
jne 0x10060129
mov eax, edi
cmp byte [eax + 1], bl
lea ecx, [eax + 1]
je 0x10060125
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, ecx
cmp byte [eax], bl
jne 0x10060113
mov byte [eax], bl
jmp 0x10060107
inc edi
jmp 0x10060107
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, dword [esi]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100602e2
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10060311
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call esi
test eax, eax
jne 0x10060307
push 0xd
call esi
test eax, eax
je 0x1006030a
push 1
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x1006b340
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1006b37b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1006b362
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1006b373
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1006b37d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1006b358
xor eax, eax
pop edi
pop esi
ret
Function at 0x1006b7af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73

Function at 0x1006b897
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1006b8a5
cmp dword [eax + 0xc], ebx
je 0x1006b948
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
invalid

Function at 0x1006b999
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1006b9b4
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
retf 0x3f73
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne fcn.1006b999
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1006b9a1
cmp edx, ebx
jne 0x1006baef
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1006b970
add eax, dword [eax + 4]
jmp 0x1006b95d
mov dword [ebp + 0xc], ebx
jmp 0x1006b9bf
Function at 0x1006b9ef
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x1006b9d7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1006b9f5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1006ba53
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1006ba3a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1006ba43
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1006ba4d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1006ba2f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1006b9b9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1006baa0
dec eax
je 0x1006ba97
sub eax, 3
je 0x1006ba8e
mov dword [ebp - 4], 0x40
jmp 0x1006babd
mov dword [ebp - 4], 4
jmp 0x1006baa3
mov dword [ebp - 4], 0x20
jmp 0x1006baa3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1006baef
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1006ba6f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1006b300
xchg edi, eax
dec ebp
sub byte [edi + 0x6a1475ff], ah
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1006bafb
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006cc4e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [0xfafffff9], edx
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.1006b300
cmpsd dword [esi], dword es:[edi]
add al, 0x60
push ebp
lea eax, [ebp - 0x6f4]
push eax
call fcn.1006b310
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1006b2c5
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x1006d3a6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x1006ce7b
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
call dword [esi + eax*8 - 0x7647b]
call dword [esi - 0x7637a3a]
invalid
call dword [esi - 0x7627a3a]
invalid
call dword [esi + eax*8 - 0x7617b]
call dword [ebp - 0x7607a3a]
invalid
invalid
fcmovnb st(0), st(6)
test dword [eax - 0x42000008], esp
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
xchg edi, eax
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.1006b310
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.1006b310
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.1006b271
add esp, 0xc
lea eax, [ebp - 0x504]
invalid
test dword [eax - 4], esp
invalid
Function at 0x1006d4a0
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
stc
invalid
mov ebp, esp
add ebp, 0x24
push esp
call fcn.1006b300
jl 0x1006d465
aam 0xc
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x1006d4c4
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1006b300
push ss
inc edx
and byte [esi - 0x75], dl
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1006b300
xchg ebp, eax
jge 0x1006d51f
jb 0x1006d537
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1006d4ed
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1006d4ed
call fcn.1006b300
push esp
dec ecx
add al, 0x8c
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1006b300
jo 0x1006d4c3
mov eax, dword [ebx]
invalid
add dword [edx], esi
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.1006bb00
je 0x1006d559
in eax, 0xff
push dword [ebp + ebx - 1]
adc eax, sym.imp.WINMM.dll_timeGetTime
call dword [sym.imp.WINMM.dll_timeGetTime]
and eax, 0x7fffffff
sub eax, edi
cmp eax, 0x1388
jg 0x1006d559
cmp dword [ebp], ebx
jne 0x1006d4c2
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1007ba17
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
call fcn.10011c52
xor ebx, ebx
pop ecx
cmp dword [esi + 0x2c], ebx
mov dword [ebp - 0x10], eax
jne 0x1007baa6
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x18]
cmp eax, ebx
je 0x1007ba4e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 0x1009f6f8
push 1
push ebx
push 0x1009f220
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1007ba8c
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x1009f210
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
push str.999999
call fcn.10011c52
pop ecx
push eax
mov ecx, esi
call fcn.1007b9b7
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jge 0x1007bb9f
mov edx, dword [esi + 0x2c]
dec edx
cmp dword [ebp - 0x10], edx
jle 0x1007bb9f
cmp eax, ecx
mov dword [ebp + 8], eax
jge 0x1007bb9f
inc dword [esi + 0x20]
lea eax, [ebp - 8]
push eax
mov ecx, esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.1007b9b7
cmp eax, dword [ebp + 8]
jne 0x1007bafc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0x1009f7a8
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x20]
cmp dword [ebp - 4], ebx
je 0x1007bb7b
lea edi, [esi + 0x28]
mov eax, dword [edi]
cmp eax, ebx
je 0x1007bb0e
mov edi, eax
jmp 0x1007bb04
push 0xa
push dword [esi + 0x2c]
call fcn.10035b39
push 0xa0
mov dword [ebp - 0xc], eax
call fcn.1005bf24
add esp, 0xc
cmp eax, ebx
je 0x1007bb38
push dword [ebp - 0xc]
mov ecx, eax
call fcn.1006a126
mov ebx, eax
push dword [ebp - 0xc]
mov ecx, 0x100b4348
call fcn.100137e9
push 0x3c
call fcn.1005bf24
test eax, eax
pop ecx
je 0x1007bb61
push dword [ebp + 8]
mov ecx, eax
push ebx
push dword [esi + 0x24]
call fcn.1007b0fc
jmp 0x1007bb63
xor eax, eax
push eax
mov ecx, ebx
mov dword [edi], eax
call fcn.1006a1dd
mov eax, dword [ebp - 4]
inc dword [esi + 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x1007bb88
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x2c]
jl 0x1007bb9f
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x1c]
jl 0x1007bacc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1007bf9d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor esi, esi
push eax
push 1
push esi
push str.SoftwareMicrosoftMultimediaSound_Mapper
push SysReAllocString
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007c08e
cmp dword [ebp + 8], esi
mov ebx, str.Record
mov edi, str.Playback
mov eax, ebx
jne 0x1007bfe6
mov eax, edi
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1007c08c
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.1005bf24
pop ecx
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, ebx
cmp dword [ebp + 8], ecx
jne 0x1007c01a
mov eax, edi
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 4]
push ecx
push ecx
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1007c08c
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1007c03c
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x1007c042
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
mov edi, eax
cmp edi, esi
jle 0x1007c08c
cmp dword [ebp + 8], 0
je 0x1007c063
lea eax, [ebp - 0x40]
push 0x30
push eax
push esi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
push dword [ebp - 4]
lea eax, [ebp - 0x38]
jmp 0x1007c076
lea eax, [ebp - 0x74]
push 0x34
push eax
push esi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
push dword [ebp - 4]
lea eax, [ebp - 0x6c]
push eax
call fcn.10098710
pop ecx
test eax, eax
pop ecx
je 0x1007c089
inc esi
cmp esi, edi
jl 0x1007c048
jmp 0x1007c08c
mov dword [ebp - 0x10], esi
xor esi, esi
cmp dword [ebp - 8], esi
je 0x1007c09c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
pop edi
pop esi
pop ebx
je 0x1007c0ad
push dword [ebp - 4]
call fcn.1005bf2f
pop ecx
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x1007c2f9
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
add ecx, 0x24
call fcn.1007c71b
mov edi, eax
mov eax, dword [ebp + 0xc]
neg edi
sbb edi, edi
mov byte [eax], 0
inc edi
mov dword [ebp - 4], edi
je 0x1007c3ca
cmp byte [esi + 0x2aa], 0
jne 0x1007c3d3
cmp dword [esi + 0x28c], 0
jle 0x1007c3d3
mov byte [eax], 1
mov edi, dword [esi + 0x24c]
lea ebx, [esi + 0x24c]
lea eax, [esi + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x48]
push dword [esi + edi*4 + 8]
push dword [ebp + 8]
call fcn.10098320
add esp, 0xc
dec dword [esi + 0x28c]
mov eax, dword [esi + 0x28c]
xor ecx, ecx
test eax, eax
jle 0x1007c38e
mov eax, dword [ebx + 4]
inc ecx
mov dword [ebx], eax
add ebx, 4
cmp ecx, dword [esi + 0x28c]
jl 0x1007c37d
lea eax, [esi + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shl edi, 5
push 0x20
lea eax, [edi + esi + 0x4c]
push eax
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
cmp byte [esi + 0x2a8], 0
lea edi, [esi + 0x2a8]
je 0x1007c3c7
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInStart]
and byte [edi], 0
mov edi, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi + 0x2a9], 0
lea ebx, [esi + 0x2a9]
je 0x1007c3ef
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInStart]
and byte [ebx], 0
jmp 0x1007c3ca
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1007c3ca

Function at 0x1007c46f
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x18]
push edi
push eax
mov eax, dword [esi + 4]
add eax, 0x9c
push eax
call fcn.1007bf29
mov ebx, dword [ebp + 8]
and dword [esi + 0x28c], 0
and byte [esi + 0x2a8], 0
pop ecx
lea eax, [esi + 8]
pop ecx
mov dword [esi + 0x48], ebx
mov edi, eax
mov dword [ebp - 4], 0x10
push ebx
call fcn.1005bf24
mov dword [edi], eax
add edi, 4
dec dword [ebp - 4]
pop ecx
jne 0x1007c4ae
push 0x30000
push esi
lea eax, [ebp - 0x18]
push 0x1007c3f9
push eax
mov eax, dword [esi + 4]
push dword [eax + 0x50]
push esi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x1007c538
lea eax, [esi + 8]
xor ebx, ebx
lea edi, [esi + 0x4c]
mov dword [ebp - 4], eax
push 0x20
push 0
push edi
call fcn.100982c0
mov eax, dword [ebp - 4]
add esp, 0xc
mov eax, dword [eax]
push 0x20
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
push edi
mov dword [edi + 0xc], ebx
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
push 0x20
push edi
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
add dword [ebp - 4], 4
inc ebx
add edi, 0x20
cmp ebx, 0x10
jl 0x1007c4ea
and byte [esi + 0x2aa], 0
mov byte [esi + 0x2a9], 1
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
mov eax, ecx
pop ebx
leave
ret 4