joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a00ad
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
cmp edx, 0xfc
je 0x100a0137
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a0071
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call 0x101445cf
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call 0x10139874
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100a00b4
lea eax, [ebp - 0x1a4]
push eax
call 0x10139887
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10101a04
push edi
call 0x10146721
jo 0x100a0115
or al, byte [eax]
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call 0x10144625
lea eax, [ebp - 0xa0]
push edi

Function at 0x100a3f5b
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x100a3f7c
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
mov cl, byte [ecx]
cmp cl, 0xa
jne 0x100a3f67
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
mov byte [eax], cl
inc eax
mov ecx, eax
lea edx, [ebp - 0x414]
sub ecx, edx
cmp ecx, 0x400
jl 0x100a3f48
mov edi, eax
invalid
test esp, ebp
sti
invalid

Function at 0x100a3fa1
Capabilities:
Write file on windows

Disassembly:
je 0x100a3fe6
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x100a3fb8
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x100a3f42
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x100a4055
cmp dword [ebp + 8], edi
je fcn.100a402c
invalid
push 5
pop esi
cmp dword [ebp + 8], esi
jne 0x100a401e
call 0x10142074
mov dword [eax], 9
call 0x10142088
mov dword [eax], esi
jmp 0x100a4027
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x100a3fb8
push dword [ebp + 8]
call 0x10142050
pop ecx
sub eax, dword [ebp - 0x10]

Function at 0x100a50e7
Capabilities:
Read file on windows

Disassembly:
mov cl, byte [eax + 4]
test cl, 2
jne 0x100a527c
test cl, 0x48
je 0x100a5115
mov al, byte [eax + 5]
cmp al, 0xa
je 0x100a5115
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [edi]
push dword [ebp + 0x10]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100a5167
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100a514f
call 0x101431dd
mov dword [eax], 9
call 0x101431f1
mov dword [eax], esi
jmp 0x100a515f
cmp eax, 0x6d
je 0x100a527c
push eax
call 0x10143188
pop ecx
or eax, 0xffffffff
jmp 0x1014a3e5
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [eax + esi + 4]
test al, 0x80
je 0x100a5277
test edx, edx
je 0x100a518c
cmp byte [ebx], 0xa
jne 0x100a518c
invalid
or al, 4
jmp 0x100a518e
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x10], eax
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], ecx
jae 0x100a5271
xor eax, eax
Function at 0x100a51d5
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x100a5261
cmp al, 0xd
je 0x100a51c2
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x1014a415
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x100a51e0
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x100a51d7
add dword [ebp + 0x10], 2
jmp 0x100a5235
mov byte [ebx], 0xd
inc ebx
mov dword [ebp + 0x10], eax
jmp 0x100a5253
lea eax, [ebp - 0xc]
push 0
push eax
inc dword [ebp + 0x10]
lea eax, [ebp - 1]
push 1
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100a5208
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a524f
cmp dword [ebp - 0xc], 0
je 0x100a524f
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x100a522a
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x100a5235
mov byte [ebx], 0xd
mov ecx, dword [edi]
inc ebx
mov byte [ecx + esi + 5], al
jmp 0x100a5253
cmp ebx, dword [ebp + 0xc]
jne 0x100a523a
cmp byte [ebp - 1], 0xa
jne 0x100a523a
mov byte [ebx], 0xa
jmp 0x100a5252
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call 0x101495e0
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x100a5253
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x100a51a6
jmp 0x100a5271
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x100a5271
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x100a527e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100a7008
Capabilities:
Get geographical location

Disassembly:
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
pop esi
pop ebx
test eax, eax
je 0x100a6f88
cmp ebx, 1
jl 0x100a6f88
mov esi, dword [ebp + 0x10]
lea ecx, [ebx - 1]
push ecx
push eax
push esi
call 0x1014d697
add esp, 0xc
and byte [esi + ebx - 1], 0
push 1
add dword [eax - 0x17], ebx
cwde
outsd dx, dword [esi]
or al, byte [eax]

Function at 0x100aa3d4
Capabilities:
Get geographical location

Disassembly:
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call 0x2341948a
adc byte [ebx], dh
invalid
cmp eax, edi
jne 0x100aa41e
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100aa403
push 1
jmp 0x100aa418
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100aa4be
push 2
pop eax
mov dword [0x101336f0], eax
invalid
clc
Function at 0x100aa4f1
Capabilities:
Get geographical location

Disassembly:
adc al, 0x53
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x101336f4]
xor esi, esi
cmp eax, esi
jne 0x100aa531
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100aa516
push 1
jmp 0x100aa52b
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100aa5dc
push 2
pop eax
mov dword [0x101336f4], eax
cmp eax, 2
jne 0x100aa54d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10154b2b
cmp eax, 1
jne 0x100aa5dc
cmp dword [ebp + 0x18], esi
jne 0x100aa563
mov eax, dword [0x101333f8]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x100aa5dc
mov dword [ebp - 4], esi
add eax, eax
add eax, 3
and al, 0xfc
call 0x10151e27
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x20], edi
jmp 0x100aa59c
or dword [ebp - 4], 0xffffffff
cmp edi, esi
je 0x100aa5dc
push dword [ebp - 0x1c]
push edi
push dword [ebp + 0xc]
or al, 0xff
jne 0x100aa5b6
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100aa5dc
cmp dword [ebp + 0x14], esi
push esi
push esi
jne 0x100aa5c3
push esi
push esi
jmp 0x100aa5c9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push 0x220
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x100aa5de
xor eax, eax
lea esp, [ebp - 0x30]

Function at 0x100b0a6a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov ecx, dword [eax]
mov ecx, dword [eax]
push 0x1f
pop edi
push edi
add dword [ebp + 0xc], 2
mov eax, ecx
shr eax, 5
and eax, 0x1f
imul eax, eax, 0xff
movzx eax, ax
cdq
idiv edi
mov ebx, eax
mov eax, ecx
imul ebx, ebx, 0x96
shr eax, 0xa
and eax, edi
imul eax, eax, 0xff
add byte [eax], al
movzx eax, ax
cdq
idiv edi
and ecx, edi
imul ecx, ecx, 0xff
imul eax, eax, 0x4d
add ebx, eax
xor eax, eax
mov ax, cx
pop ecx
cdq
idiv ecx
imul eax, eax, 0x1d
add ebx, eax
mov eax, dword [ebp + 8]
sar ebx, 8
mov byte [esi + eax], bl
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x100b0a63
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x100b0a98
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov ecx, dword [eax]
mov ecx, dword [eax]
push 0x1f
pop edi
push edi
add dword [ebp + 0xc], 2
mov eax, ecx
shr eax, 5
and eax, 0x1f
imul eax, eax, 0xff
movzx eax, ax
cdq
idiv edi
mov ebx, eax
mov eax, ecx
imul ebx, ebx, 0x96
shr eax, 0xa
and eax, edi
imul eax, eax, 0xff
add byte [eax], al
movzx eax, ax
cdq
idiv edi
and ecx, edi
imul ecx, ecx, 0xff
imul eax, eax, 0x4d
add ebx, eax
xor eax, eax
mov ax, cx
pop ecx
cdq
idiv ecx
imul eax, eax, 0x1d
add ebx, eax
mov eax, dword [ebp + 8]
sar ebx, 8
mov byte [esi + eax], bl
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x100b0a63
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x100b0ae2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
push 0x3f
pop edi
push 0x1f
add dword [ebp + 0xc], 2
mov eax, ecx
shr eax, 5
and eax, 0x3f
imul eax, eax, 0xff
movzx eax, ax
cdq
idiv edi
pop edi
push edi
mov ebx, eax
mov ax, cx
imul ebx, ebx, 0x96
shr ax, 0xb
and ecx, edi
imul ecx, ecx, 0xff
imul eax, eax, 0xff
movzx eax, ax
cdq
idiv edi
imul eax, eax, 0x4d
add ebx, eax
xor eax, eax
mov ax, cx
pop ecx
cdq
idiv ecx
imul eax, eax, 0x1d
add ebx, eax
mov eax, dword [ebp + 8]
sar ebx, 8
mov byte [esi + eax], bl
inc esi
cmp esi, dword [ebp + 0x10]
jl fcn.100b0ae2
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x100b298b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor byte [eax - 0x3e7cbdff], cl
add edi, dword [ebx]
push ebp
hlt

Function at 0x100badce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dword [ecx], eax
add byte [eax], al
dec eax
je 0x100baee4
dec eax
je 0x100baea0
dec eax
je 0x100badfd
push str.Ignoring_bad_adaptive_filter_type
push dword [ebp + 8]
call 0x101736b7
mov eax, dword [ebp + 0x10]
and byte [eax], 0
pop ecx
pop ecx
jmp 0x10175d29
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 0xb]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add eax, 7
sar eax, 3
sub ecx, eax
test eax, eax
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x10], edx
mov dword [ebp + 0x14], edi
jbe 0x100bae30
mov esi, eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 0xb]
mov ecx, dword [ecx + 4]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add eax, 7
sar eax, 3
sub ecx, eax
test eax, eax
mov ebx, esi
jbe 0x100baec9
mov dl, byte [edi]
shr dl, 1
add byte [esi], dl
inc edi
inc esi
dec eax
jne 0x100baebe
test ecx, ecx
jbe fcn.100baf2c
movzx edx, byte [edi]
movzx eax, byte [ebx]
add eax, edx
cdq
sub eax, edx
sar eax, 1
add byte [esi], al
inc ebx
inc edi
inc esi
dec ecx
jne 0x100baecd
jmp fcn.100baf2c
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
jbe fcn.100baf2c
mov edx, dword [ebp + 0x14]
mov dl, byte [ecx + edx]
add byte [eax], dl
inc eax
inc ecx
cmp ecx, esi
jb 0x100baef3
jmp fcn.100baf2c
Function at 0x100c37b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [eax], edx
shl dword [eax + 0x3c], 1
call 0x10192e4e
test al, al
je 0x100c3c20
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xae0]
add ecx, dword [eax + 0xadc]
push 0x3de
add ecx, dword [eax + 0xad8]
mov esi, str.F:dev_fmodsrc372win_src_fsound.c
mov dword [eax + 0xad4], ecx
mov eax, dword [0x1011b914]
mov eax, dword [eax + 0xaf8]
push esi
shl eax, 2
push eax
push ebx
call 0x10196153
mov ecx, dword [0x1011b914]
adc dword [eax], edx
mov dword [ecx + 0xaf0], eax
mov eax, dword [0x1011b914]
add esp, 0x10
cmp dword [eax + 0xaf0], ebx
je 0x100c3859
mov ecx, dword [eax + 0xaec]
add ecx, dword [eax + 0xad4]
push 0x3ea
imul ecx, ecx, 0x1dc
push esi
push ecx
push ebx
call 0x1019618e
mov ecx, dword [0x1011b914]
mov dword [ecx + 0xaa8], eax
mov eax, dword [0x1011b914]
add esp, 0x10
cmp dword [eax + 0xaa8], ebx
jne 0x100c3868
mov dword [0x10133818], 0xc
jmp 0x10187488
mov dword [eax + 0xac8], ebx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xad8]
dec ecx
mov dword [eax + 0xacc], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xacc]
inc ecx
mov dword [eax + 0xab0], ecx
mov eax, dword [0x1011b914]
mov edx, dword [eax + 0xab0]
mov ecx, dword [eax + 0xadc]
lea ecx, [ecx + edx - 1]
mov dword [eax + 0xab4], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xab4]
inc ecx
mov dword [eax + 0xabc], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xae0]
mov edx, dword [eax + 0xabc]
lea ecx, [ecx + edx - 1]
mov dword [eax + 0xac0], ecx
add byte [ecx + 0x1011b914], ah
mov ecx, dword [eax + 0xabc]
mov dword [eax + 0xac4], ecx
mov eax, dword [0x1011b914]
Function at 0x100c3806
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [eax], edx
shl dword [eax + 0x3c], 1
call 0x10192e4e
test al, al
je 0x100c3c20
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xae0]
add ecx, dword [eax + 0xadc]
push 0x3de
add ecx, dword [eax + 0xad8]
mov esi, str.F:dev_fmodsrc372win_src_fsound.c
mov dword [eax + 0xad4], ecx
mov eax, dword [0x1011b914]
mov eax, dword [eax + 0xaf8]
push esi
shl eax, 2
push eax
push ebx
call 0x10196153
mov ecx, dword [0x1011b914]
adc dword [eax], edx
mov dword [ecx + 0xaf0], eax
mov eax, dword [0x1011b914]
add esp, 0x10
cmp dword [eax + 0xaf0], ebx
je 0x100c3859
mov ecx, dword [eax + 0xaec]
add ecx, dword [eax + 0xad4]
push 0x3ea
imul ecx, ecx, 0x1dc
push esi
push ecx
push ebx
call 0x1019618e
mov ecx, dword [0x1011b914]
mov dword [ecx + 0xaa8], eax
mov eax, dword [0x1011b914]
add esp, 0x10
cmp dword [eax + 0xaa8], ebx
jne 0x100c3868
mov dword [0x10133818], 0xc
jmp 0x10187488
mov dword [eax + 0xac8], ebx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xad8]
dec ecx
mov dword [eax + 0xacc], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xacc]
inc ecx
mov dword [eax + 0xab0], ecx
mov eax, dword [0x1011b914]
mov edx, dword [eax + 0xab0]
mov ecx, dword [eax + 0xadc]
lea ecx, [ecx + edx - 1]
mov dword [eax + 0xab4], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xab4]
inc ecx
mov dword [eax + 0xabc], ecx
mov eax, dword [0x1011b914]
mov ecx, dword [eax + 0xae0]
mov edx, dword [eax + 0xabc]
lea ecx, [ecx + edx - 1]
mov dword [eax + 0xac0], ecx
add byte [ecx + 0x1011b914], ah
mov ecx, dword [eax + 0xabc]
mov dword [eax + 0xac4], ecx
mov eax, dword [0x1011b914]

Function at 0x100c68ef
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
je 0x100c691a
mov edi, dword [ebp - 8]
test edi, edi
je 0x100c691a
xor ecx, ecx
cmp dword [esi + 0x10c], ecx
jbe 0x100c691a
xor edx, edx
mov dx, word [edi]
sar edx, 8
mov byte [eax], dl
inc eax
inc edi
inc edi
inc ecx
cmp ecx, dword [esi + 0x10c]
jb 0x100c6904
ljmp 0x1c75:0xfff075ff
push dword [ebp - 0x10]
push dword [ebp + 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 8]
push esi
call 0x1018d8e3
push dword [ebp - 0x18]
xor bl, bh
and al, 0xff
jne 0x100c6919
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call 0x1018d8f7
push 0xff
push esi
push dword [ebp + 0x10]
call 0x10198919
or eax, 0xcc48300
push esi
call 0x1018ccef
mov esi, dword [ebp + 0x10]

Function at 0x100c6c05
Capabilities:
Encode data using xor

Disassembly:
test cl, 0x10
je 0x100c6c52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call 0x10160c10
add esp, 0xc
jmp 0x100c6ca4

Function at 0x100c83e7
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx + 0x2ec8e], cl
add dh, dh
rol dword [eax + 0x74], 4
Function at 0x100cbde8
Capabilities:
Capture microphone audio

Disassembly:
adc dword [eax], edx
cmp byte [ecx + 0x1524], 0
je 0x100cbe9b
add byte [eax], al
invalid
push dword [0x101389bc]
call 0x1019abdb
pop ecx
mov ecx, dword [0x1011b914]
cmp byte [ecx + 0x1524], 0
je 0x100cbe9b
mov eax, dword [0x101389ac]
cmp eax, dword [0x101389b0]
jae 0x100cbdde
push 0x64
xor edx, edx
pop ecx
div ecx
mov eax, dword [0x101389b4]
mov esi, edx
cdq
idiv dword [0x1011d290]
push eax
imul eax, esi
push eax
call 0x101a2af6
pop ecx
pop ecx
push 0x20
lea eax, [esi + esi*8]
lea eax, [eax*4 + 0x10137b90]
push eax
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea eax, [esi - 1]
test eax, eax
jge 0x100cbe5b
push 0x63
pop eax
lea eax, [eax + eax*8]
push 0x20
lea esi, [eax*4 + 0x10137b90]
push esi
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
push 0x20
push esi
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov eax, dword [0x101389ac]
inc eax
cmp eax, dword [0x101389b0]
mov dword [0x101389ac], eax
jb 0x100cbe17
jmp 0x10197c73
mov byte [ecx + 0x1525], 0
xor eax, eax
pop esi
ret

Function at 0x100cbf6f
Capabilities:
Capture microphone audio

Disassembly:
push 0x12
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call 0x101662ed
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov eax, edi
and al, 0x20
Function at 0x100cbf87
Capabilities:
Capture microphone audio

Disassembly:
neg al
push 8
mov esi, dword [ebp + 0x10]
mov word [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
mov word [ebp - 4], bx
sbb eax, eax
inc eax
inc eax
mov word [ebp - 0x12], ax
movzx ecx, word [ebp - 0x12]
and edi, 0x10
mov eax, edi
neg eax
sbb eax, eax
and eax, 8
add eax, 8
mov word [ebp - 6], ax
movzx eax, ax
imul eax, ecx
pop ecx
cdq
idiv ecx
push 0x30000
push ebx
push 0x100cbea6
mov word [ebp - 8], ax
movzx eax, ax
mov ecx, eax
imul ecx, esi
mov dword [0x1011d290], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1011b914]
mov dword [ebp - 0xc], ecx
push dword [eax + 0x1520]
push 0x10137b8c
call dword [sym.imp.WINMM.dll_waveInOpen]
adc eax, sym.imp.WINMM.dll_waveInOpen
cmp eax, ebx
je 0x100cc022
push 4
pop ecx
cmp eax, ecx
je 0x100cc017
xor ecx, ecx
cmp eax, 0x20
setne cl
dec ecx
and ecx, 0xfffffffe
add ecx, 8
mov dword [0x10133818], ecx
jmp 0x1019818a
lea eax, [esi + esi*4]
cdq
mov ecx, 0x3e8
idiv ecx
cmp edi, ebx
mov dword [0x101389b4], eax
je 0x100cc03d
shl eax, 1
mov dword [0x101389b4], eax
test byte [ebp + 0xc], 0x40
je 0x100cc04a
shl eax, 1
mov dword [0x101389b4], eax
imul eax, eax, 0x64
push 0x3ba
push str.F:dev_fmodsrc372win_srcoutput_winmm.c
push eax
push ebx
call 0x1019e9af
mov ecx, dword [0x101389b4]
add esp, 0x10
mov dword [0x101389b8], eax
mov esi, eax
xor edx, edx
mov eax, 0x10137b94
mov dword [eax + 0x1c], esi
mov dword [eax + 0xc], ebx
mov edi, dword [eax + 0x1c]
mov dword [eax + 8], edx
mov dword [eax - 4], edi
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ebx
add eax, 0x24
inc edx
add esi, ecx
cmp eax, 0x101389a4
jl 0x100cc075
mov esi, 0x10137b90
push 0x20
push esi
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
jne 0x100cc101
push 0x20
push esi
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
jne 0x100cc101
add esi, 0x24
cmp esi, 0x1013897c
jl 0x100cc09e
mov eax, dword [0x1011b914]
mov dword [0x101389ac], ebx
mov dword [0x101389b0], ebx
mov byte [eax + 0x1524], 1
call 0x1019aea4
cmp eax, ebx
mov dword [0x101389bc], eax
jne 0x100cc10d
mov dword [0x10133818], 0xc
jmp 0x100cc168
mov dword [0x10133818], 8
jmp 0x100cc15d
push ebx
push 2
push ebx
push 0x100cbdcb
call 0x1019ae06
mov ecx, dword [0x1011b914]
mov dword [ecx + 0x1528], eax
mov eax, dword [0x1011b914]
add esp, 0x10
cmp dword [eax + 0x1528], ebx
jne 0x100cc143
mov dword [0x10133818], 5
jmp 0x100cc168
push dword [0x10137b8c]
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
je 0x100cc16c
mov dword [0x10133818], 3
mov eax, dword [0x1011b914]
mov byte [eax + 0x1524], bl
xor al, al
jmp fcn.100cc16e
mov al, 1

Function at 0x100cc305
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [0x10138bc8], ebx
push esi
push edi
jne fcn.100cc43a
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.dsound.dll
call edi
mov dword [0x10138bc8], eax
mov eax, dword [0x1011b914]
test byte [eax + 9], 0x30
je 0x100cc345
Function at 0x100cc339
Capabilities:
Get common file path

Disassembly:
push str.dsound3d.dll
call edi
mov dword [0x10138bcc], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate8
push dword [0x10138bc8]
call esi
cmp eax, ebx
mov dword [0x10138bec], eax
jne 0x100cc373
push str.DirectSoundCreate
push dword [0x10138bc8]
mov edx, dword [ebx]
adc bh, bh
salc
mov dword [0x10138be4], eax
push str.DirectSoundEnumerateA
push dword [0x10138bc8]
call esi
cmp dword [0x10138bec], ebx
mov dword [0x10138be8], eax
setne al
push eax
push dword [0x10138bc8]
call 0x101b37a4
cmp dword [0x10138bec], ebx
pop ecx
pop ecx
je 0x100cc410
push 0x104
lea eax, [ebp - 0x400]
push eax
mov dword [0x1011d71c], 8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
adc byte [eax], dl
test eax, eax
je fcn.100cc43a
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x200]
push eax
call 0x1019e38b
lea eax, [ebp - 0x200]
push str.d3d9.dll
push eax
call 0x1019e3de
push ebx
lea eax, [ebp - 0x200]
push ebx
push eax
call 0x1019f192
add esp, 0x1c
cmp eax, ebx
je fcn.100cc43a
push eax
call 0x1019f330
pop ecx
mov dword [0x1011d71c], 9
jmp fcn.100cc43a
push str.ddraw.dll
call edi
mov edi, eax
cmp edi, ebx
je fcn.100cc43a
push str.DirectDrawCreateEx
push edi
call esi
salc
test eax, eax
je 0x100cc433
mov dword [0x1011d71c], 7
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]

Function at 0x100cc346
Capabilities:
Get common file path

Disassembly:
push str.dsound3d.dll
call edi
mov dword [0x10138bcc], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate8
push dword [0x10138bc8]
call esi
cmp eax, ebx
mov dword [0x10138bec], eax
jne 0x100cc373
push str.DirectSoundCreate
push dword [0x10138bc8]
mov edx, dword [ebx]
adc bh, bh
salc
mov dword [0x10138be4], eax
push str.DirectSoundEnumerateA
push dword [0x10138bc8]
call esi
cmp dword [0x10138bec], ebx
mov dword [0x10138be8], eax
setne al
push eax
push dword [0x10138bc8]
call 0x101b37a4
cmp dword [0x10138bec], ebx
pop ecx
pop ecx
je 0x100cc410
push 0x104
lea eax, [ebp - 0x400]
push eax
mov dword [0x1011d71c], 8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
adc byte [eax], dl
test eax, eax
je fcn.100cc43a
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x200]
push eax
call 0x1019e38b
lea eax, [ebp - 0x200]
push str.d3d9.dll
push eax
call 0x1019e3de
push ebx
lea eax, [ebp - 0x200]
push ebx
push eax
call 0x1019f192
add esp, 0x1c
cmp eax, ebx
je fcn.100cc43a
push eax
call 0x1019f330
pop ecx
mov dword [0x1011d71c], 9
jmp fcn.100cc43a
push str.ddraw.dll
call edi
mov edi, eax
cmp edi, ebx
je fcn.100cc43a
push str.DirectDrawCreateEx
push edi
call esi
salc
test eax, eax
je 0x100cc433
mov dword [0x1011d71c], 7
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]