joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9ab0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4d9c1c
cmp byte [esi], 0
je 0x4d9c1c
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
xor ebx, ebx
xor edi, edi
cmp eax, 5
jle 0x4d9ba3
push esi
call fcn.004b8000
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x4d9c19
push ebp
call fcn.00421380
mov esi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x4d9b2e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push eax
call fcn.004b81c0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ebp, [esi + esi*2 + 1]
push ebp
call fcn.0052b380
mov edi, eax
add esp, 4
test edi, edi
je 0x4d9b90
mov ecx, dword [esp + 0x14]
push 0
push 0
push ebp
push edi
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push 0x2002
mov byte [eax + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4d9b87
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4d9b76
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.00439d00
mov edi, dword [esp + 0x1c]
add esp, 4
jmp 0x4d9be1
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9ba8
sub eax, edx
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4d9c19
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4d9bd0
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4d9bd0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x4d9be9
test edi, edi
je 0x4d9c19
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d9c19
call dword [sym.imp.USER32.dll_EmptyClipboard]
test edi, edi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x4d9c0a
push edi
push 0xd
call esi
test ebx, ebx
je 0x4d9c13
push ebx
push 1
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
pop esi
ret 8

Function at 0x4d9c20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
xor esi, esi
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d9c5d
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
test eax, eax
jne 0x4d9c51
push 0xd
call edi
test eax, eax
jne 0x4d9c51
mov eax, dword [ebx]
push eax
call edi
test eax, eax
je 0x4d9c56
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4d9e50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x120
push esi
push edi
mov edi, dword [esp + 0x13c]
test edi, edi
jne 0x4d9f20
mov eax, dword [esp + 0x138]
test eax, eax
mov edi, dword [esp + 0x130]
push ebx
mov ebx, dword [esp + 0x130]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x10], 0x114
mov byte [esp + 0x1c], 0
je 0x4d9ee9
lea eax, [esp + 0x18]
push eax
mov esi, 1
push esi
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d9ee9
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
call ebp
test eax, eax
je 0x4d9eda
cmp dword [esp + 0x14], esi
jne 0x4d9eda
xor esi, esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4d9f10
mov esi, dword [esp + 0x13c]
push esi
call ebp
push eax
push esi
push 1
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4d9f10
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x120
ret
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
lea eax, [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d9f83
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esp + 0xc]
push esi
push 1
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4d9f83
test esi, esi
jne 0x4d9f83
pop edi
mov eax, 1
pop esi
add esp, 0x120
ret
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
Function at 0x4dc300
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4dc325
mov al, byte [esi + 1]
inc esi
cmp al, 0x22
je 0x4dc322
test al, al
jne 0x4dc312
cmp al, 0x22
jne 0x4dc338
inc esi
jmp 0x4dc338
cmp al, 0x20
jbe 0x4dc338
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
ja 0x4dc330
mov al, byte [esi]
test al, al
je 0x4dc34c
mov edi, edi
cmp al, 0x20
ja 0x4dc34c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4dc340
lea eax, [esp + 4]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x30], 1
movzx eax, word [esp + 0x34]
jne 0x4dc370
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4dd490
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.00435d20
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0x950]
push str.defaultcamera
call fcn.004e7f70
mov dword [esp + 0x18], ebx
push 0xa
push ebx
call fcn.00495630
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x800]
add esp, 8
push esi
call fcn.004f9ba0
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x800]
push esi
call fcn.004f9d60
push esi
mov edi, eax
call fcn.00439d00
add esp, 4
test edi, edi
je 0x4dd617
mov ecx, dword [ebp]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0xa0]
mov dword [esp + 0x18], 2
call fcn.004fa670
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4dd55e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.004630b0
mov ecx, eax
call fcn.004363f0
test al, al
je 0x4dd5e4
mov dword [esp + 0x1c], ebx
jmp 0x4dd617
lea ecx, [esp + 0x10]
call fcn.004631b0
mov edi, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4dd570
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x4dd597
mov cl, byte [eax + edi]
movzx edx, cl
mov dl, byte [edx + 0x53ff38]
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x4dd581
mov eax, dword [0x549250]
xor ebx, ebx
test eax, eax
je 0x4dd5d3
mov eax, 0x549250
mov esi, eax
lea esp, [esp]
mov eax, dword [eax]
push eax
push edi
call fcn.004357b0
add esp, 8
test eax, eax
jne 0x4dd5ce
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
mov eax, esi
jne 0x4dd5b0
jmp 0x4dd5d3
mov ebx, 1
push edi
call fcn.00439d00
add esp, 4
test ebx, ebx
je 0x4dd5f7
mov ebx, dword [esp + 0x18]
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x18], ebx
jl 0x4dd4c8
jmp 0x4dd617
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edx + 0x950]
push str.defaultcamera
call fcn.004e7140
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
push 0xa
push ecx
call fcn.00495630
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4e9b30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov al, byte [edi]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cmp al, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
je 0x4e9b88
nop
movzx esi, al
movzx eax, byte [esi + 0x53ff38]
xor eax, esi
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
add esi, eax
mov ecx, esi
mov esi, edx
shr esi, 0x1a
shl edx, 6
or esi, edx
add esi, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov edx, esi
jne 0x4e9b50
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
call fcn.00439d00
add esp, 4
push 0x549780
mov ecx, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.00435140
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x10]
mov edi, 8
lea esp, [esp]
mov ecx, esi
shr ecx, 0x1c
push ecx
call fcn.00434c90
add esp, 4
push eax
mov ecx, ebp
call fcn.00434e00
shl esi, 4
dec edi
jne 0x4e9bc0
inc ebx
cmp ebx, 2
jl 0x4e9bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4f14e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebx + 8]
push edi
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00471d70
xor esi, esi
mov eax, 2
mov ecx, 0x40
lea edi, [esp + 0x70]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
push eax
push edi
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.004deb60
cmp dword [esp + 0x44], edi
jge 0x4f163f
lea edi, [esp + 0x70]
push 0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 0
call fcn.004dfe90
lea eax, [esp + 0xc]
mov ecx, edi
push eax
inc esi
add edi, 4
call fcn.00463510
mov ecx, dword [esp + 0xc]
mov eax, ecx
and eax, 7
cmp esi, 0x40
jge 0x4f15c0
cmp eax, 7
jne 0x4f1595
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4f159f
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4f15ad
lea ecx, [esp + 0xc]
call fcn.00463210
mov ecx, dword [ebp + 0x10]
cmp dword [esp + 0x44], ecx
mov dword [esp + 0xc], 2
jl 0x4f1547
jmp 0x4f15e8
cmp eax, 7
jne 0x4f15d0
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4f15da
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4f15e8
lea ecx, [esp + 0xc]
call fcn.00463210
cmp esi, 1
jl 0x4f163f
lea ecx, [esp + 0x70]
call fcn.0040c310
test al, al
je 0x4f163f
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x14]
call fcn.00464010
mov ecx, dword [ebx + 8]
push eax
call fcn.004a5630
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], edi
call fcn.004ef830
test eax, eax
jne 0x4f163f
mov edx, dword [ebx]
dec esi
push esi
lea eax, [esp + 0x78]
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
push ecx
push eax
mov ecx, ebx
call dword [edx + 4]
lea ecx, [esp + 0x34]
call fcn.004def50
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00439d00
add esp, 4
lea esi, [esp + 0x170]
mov edi, 0x40
mov ecx, dword [esi - 4]
sub esi, 4
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4f167c
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4f1686
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4f1692
mov ecx, esi
call fcn.00463210
dec edi
mov dword [esi], 2
jne 0x4f1661
lea ecx, [esp + 0x20]
call fcn.00471350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f9ba0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
push eax
call fcn.00435570
mov ebp, eax
mov eax, dword [esi + 0x2c]
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], ebp
jne 0x4f9c3c
mov eax, dword [esi + 0x18]
cmp eax, edi
lea ebx, [esi + 0x18]
je 0x4f9bde
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx], edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x20]
push edx
push 0x54a744
push 1
push edi
push 0x549e28
mov dword [esp + 0x34], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4f9c20
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edi
push ebx
push 0x549e18
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
push eax
call dword [edx + 8]
push edi
push str.999999
call fcn.00435570
add esp, 4
push eax
mov ecx, esi
call fcn.004f9b30
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov ebx, dword [esi + 0x20]
cmp ebx, dword [esi + 0x1c]
jge 0x4f9d42
mov eax, dword [esi + 0x2c]
dec eax
cmp ebp, eax
jle 0x4f9d42
mov dword [esp + 0x14], ebx
inc dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], edi
call fcn.004f9b30
cmp eax, ebx
jne 0x4f9c8a
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push 0x54a6f4
push edi
push edi
push eax
call dword [edx + 0x20]
cmp dword [esp + 0x20], edi
je 0x4f9d1f
mov eax, dword [esi + 0x28]
cmp eax, edi
lea ebp, [esi + 0x28]
je 0x4f9ca8
mov edi, edi
mov ebp, dword [ebp]
cmp dword [ebp], edi
jne 0x4f9ca0
mov edx, dword [esi + 0x2c]
push 0xa
push edx
call fcn.00495630
push 0xa8
mov ebx, eax
call fcn.0052b380
add esp, 0xc
cmp eax, edi
je 0x4f9cd0
push ebx
mov ecx, eax
call fcn.004dcd60
mov edi, eax
push ebx
call fcn.00439d00
push 0x40
call fcn.0052b380
add esp, 8
test eax, eax
je 0x4f9cf7
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x24]
push ecx
push edi
push edx
mov ecx, eax
call fcn.004f9770
jmp 0x4f9cf9
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp], eax
call fcn.004dd660
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x20]
inc edi
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor edi, edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4f9d2d
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebp, dword [esi + 0x2c]
jl 0x4f9d42
mov eax, dword [esi + 0x1c]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x4f9c58
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4fbc00
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
jne 0x4fbc18
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea edi, [esi + 4]
push edi
push 0x20000013
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x4fbca8
mov eax, dword [edi]
cmp eax, 0x197
je 0x4fbc84
cmp eax, 0x191
je 0x4fbc84
cmp eax, 0x12c
jb 0x4fbc6f
cmp eax, 0x190
jae 0x4fbc74
pop edi
mov ebx, 2
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
cmp eax, 0x190
jbe 0x4fbca8
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x14]
push ebx
push 7
push 0x2eee
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [0x564734]
xor ebx, ebx
cmp eax, 0x2f00
sete bl
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x4fbfb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
lea eax, [esp + 4]
push eax
push 1
xor ebp, ebp
push ebp
push str.SoftwareMicrosoftMultimediaSound_Mapper
push 0x80000001
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4fc11a
push edi
mov edi, dword [esp + 0x80]
test edi, edi
mov eax, str.Record
jne 0x4fc004
mov eax, str.Playback
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4fc118
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.0052b380
add esp, 4
test edi, edi
mov ebp, eax
mov eax, str.Record
jne 0x4fc044
mov eax, str.Playback
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4fc118
test edi, edi
je 0x4fc06a
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4fc070
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], eax
jle 0x4fc118
mov edi, edi
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4fc0c4
push 0x30
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4fc0fc
test cl, cl
je 0x4fc0c0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4fc0fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4fc0a0
xor eax, eax
jmp 0x4fc101
push 0x34
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4fc0fc
test cl, cl
je 0x4fc0f8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4fc0fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4fc0d8
xor eax, eax
jmp 0x4fc101
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fc114
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4fc080
jmp 0x4fc118
mov dword [esp + 0x10], edi
pop esi
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x4fc129
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4fc136
push ebp
call fcn.00439d00
add esp, 4
mov eax, dword [esp + 8]
pop ebp
add esp, 0x74
ret
Function at 0x4fc3e0
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
push esi
add ecx, 0x24
call fcn.004fc8e0
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
inc esi
mov dword [esp + 8], esi
mov byte [eax], 0
je 0x4fc4f6
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x4fc4cb
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x4fc4cb
push ebx
mov byte [eax], 1
mov ebx, dword [ebp + 0x24c]
push edi
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
dec esi
mov eax, esi
xor ecx, ecx
test eax, eax
mov dword [ebp + 0x28c], esi
jle 0x4fc483
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
inc ecx
add eax, 4
cmp ecx, edx
jl 0x4fc470
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
test al, al
pop edi
pop ebx
je 0x4fc4c1
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x4fc4ee
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
pop esi
mov byte [ebp + 0x2a9], 0
pop ebp
pop ecx
ret 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4fc6d0
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
add ecx, 0x9c
push ecx
call fcn.004fbf20
mov edx, dword [esp + 0x30]
lea ebx, [edi + 8]
add esp, 8
mov dword [edi + 0x28c], 0
mov byte [edi + 0x2a8], 0
mov dword [edi + 0x48], edx
mov esi, ebx
mov ebp, 0x10
mov eax, dword [esp + 0x28]
push eax
call fcn.0052b380
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebp
jne 0x4fc712
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x50]
push 0x30000
push edi
push 0x4fc6b0
lea ecx, [esp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4fc7ab
xor ebp, ebp
lea esi, [edi + 0x4c]
mov edi, edi
xor ecx, ecx
mov edx, esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx]
mov ecx, dword [esp + 0x28]
push 0x20
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebp
mov edx, dword [edi]
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [edi]
push 0x20
push esi
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
inc ebp
add ebx, 4
add esi, 0x20
cmp ebp, 0x10
jl 0x4fc750
mov byte [edi + 0x2a9], 1
mov byte [edi + 0x2aa], 0
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0x14
ret 4

Function at 0x4fc840
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1c]
test eax, eax
push esi
je 0x4fc8a3
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x4fc870
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4fc970
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, 0x564754
lea ecx, [ecx]
call edi
mov dword [esi], eax
add esi, 4
cmp esi, 0x56475c
jl 0x4fc980
pop edi
pop esi
ret