joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6e20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4d6f8c
cmp byte [esi], 0
je 0x4d6f8c
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
xor ebx, ebx
xor edi, edi
cmp eax, 5
jle 0x4d6f13
push esi
call fcn.004b5400
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x4d6f89
push ebp
call fcn.004210d0
mov esi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x4d6e9e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push eax
call fcn.004b55b0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ebp, [esi + esi*2 + 1]
push ebp
call fcn.00439320
mov edi, eax
add esp, 4
test edi, edi
je 0x4d6f00
mov ecx, dword [esp + 0x14]
push 0
push 0
push ebp
push edi
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push 0x2002
mov byte [eax + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4d6ef7
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4d6ee6
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.00527b30
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.00527b30
mov edi, dword [esp + 0x1c]
add esp, 4
jmp 0x4d6f51
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d6f18
sub eax, edx
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4d6f89
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4d6f40
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4d6f40
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x4d6f59
test edi, edi
je 0x4d6f89
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d6f89
call dword [sym.imp.USER32.dll_EmptyClipboard]
test edi, edi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x4d6f7a
push edi
push 0xd
call esi
test ebx, ebx
je 0x4d6f83
push ebx
push 1
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
pop esi
ret 8

Function at 0x4d6f90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
xor esi, esi
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d6fcd
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
test eax, eax
jne 0x4d6fc1
push 0xd
call edi
test eax, eax
jne 0x4d6fc1
mov eax, dword [ebx]
push eax
call edi
test eax, eax
je 0x4d6fc6
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4d71b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x120
push esi
push edi
mov edi, dword [esp + 0x13c]
test edi, edi
jne 0x4d7280
mov eax, dword [esp + 0x138]
test eax, eax
mov edi, dword [esp + 0x130]
push ebx
mov ebx, dword [esp + 0x130]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x10], 0x114
mov byte [esp + 0x1c], 0
je 0x4d7249
lea eax, [esp + 0x18]
push eax
mov esi, 1
push esi
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d7249
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
call ebp
test eax, eax
je 0x4d723a
cmp dword [esp + 0x14], esi
jne 0x4d723a
xor esi, esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4d7270
mov esi, dword [esp + 0x13c]
push esi
call ebp
push eax
push esi
push 1
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4d7270
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x120
ret
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
lea eax, [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d72e3
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esp + 0xc]
push esi
push 1
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4d72e3
test esi, esi
jne 0x4d72e3
pop edi
mov eax, 1
pop esi
add esp, 0x120
ret
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
Function at 0x4d79c0
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x114
push ebx
push esi
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [esp + 0x120]
push 0
push esi
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4d7b1e
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d7a2e
pop esi
xor eax, eax
pop ebx
add esp, 0x114
ret 4
push ebp
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
mov edi, eax
push 0
lea edx, [edi - 8]
push edx
push esi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 8
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], 8
jne 0x4d7aff
cmp dword [esp + 0x18], 0xfa123456
jne 0x4d7a8b
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffff8
sub edx, ecx
add edi, edx
push 0
push 0
push edi
push esi
call ebp
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0x16c]
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call edi
mov eax, dword [ebx + 0x41c]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [eax + 0x16c]
jne 0x4d7aff
push 0
mov dword [esp + 0x1c], 0xfa123456
mov edx, dword [eax + 0x16c]
lea eax, [esp + 0x14]
push eax
push 8
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x30], edx
call edi
cmp dword [esp + 0x10], 8
jne 0x4d7aff
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop ebp
jne 0x4d7b1e
mov edx, dword [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
pop esi
pop ebx
add esp, 0x114
ret 4
Function at 0x4d8f90
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4d8fb5
mov al, byte [esi + 1]
inc esi
cmp al, 0x22
je 0x4d8fb2
test al, al
jne 0x4d8fa2
cmp al, 0x22
jne 0x4d8fc8
inc esi
jmp 0x4d8fc8
cmp al, 0x20
jbe 0x4d8fc8
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
ja 0x4d8fc0
mov al, byte [esi]
test al, al
je 0x4d8fdc
mov edi, edi
cmp al, 0x20
ja 0x4d8fdc
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4d8fd0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x30], 1
movzx eax, word [esp + 0x34]
jne 0x4d9000
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4da120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.00435470
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0x940]
push str.defaultcamera
call fcn.004e4be0
mov dword [esp + 0x18], ebx
push 0xa
push ebx
call fcn.00493770
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x800]
add esp, 8
push esi
call fcn.004f6380
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x800]
push esi
call fcn.004f6540
push esi
mov edi, eax
call fcn.00527b30
add esp, 4
test edi, edi
je 0x4da2a7
mov ecx, dword [ebp]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0xa0]
mov dword [esp + 0x18], 2
call fcn.004f6e40
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4da1ee
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00462090
mov ecx, eax
call fcn.00435b10
test al, al
je 0x4da274
mov dword [esp + 0x1c], ebx
jmp 0x4da2a7
lea ecx, [esp + 0x10]
call fcn.004621a0
mov edi, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4da200
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x4da227
mov cl, byte [eax + edi]
movzx edx, cl
mov dl, byte [edx + 0x53cee8]
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x4da211
mov eax, dword [0x545f98]
xor ebx, ebx
test eax, eax
je 0x4da263
mov eax, 0x545f98
mov esi, eax
lea esp, [esp]
mov eax, dword [eax]
push eax
push edi
call fcn.00434f00
add esp, 8
test eax, eax
jne 0x4da25e
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
mov eax, esi
jne 0x4da240
jmp 0x4da263
mov ebx, 1
push edi
call fcn.00527b30
add esp, 4
test ebx, ebx
je 0x4da287
mov ebx, dword [esp + 0x18]
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x18], ebx
jl 0x4da158
jmp 0x4da2a7
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edx + 0x940]
push str.defaultcamera
call fcn.004e3da0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
push 0xa
push ecx
call fcn.00493770
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4e6760
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov al, byte [edi]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cmp al, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
je 0x4e67b8
nop
movzx esi, al
movzx eax, byte [esi + 0x53cee8]
xor eax, esi
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
add esi, eax
mov ecx, esi
mov esi, edx
shr esi, 0x1a
shl edx, 6
or esi, edx
add esi, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov edx, esi
jne 0x4e6780
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
call fcn.00527b30
add esp, 4
push 0x5464c8
mov ecx, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.00434890
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x10]
mov edi, 8
lea esp, [esp]
mov ecx, esi
shr ecx, 0x1c
push ecx
call fcn.004343e0
add esp, 4
push eax
mov ecx, ebp
call fcn.00434550
shl esi, 4
dec edi
jne 0x4e67f0
inc ebx
cmp ebx, 2
jl 0x4e67e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4ee870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebx + 8]
push edi
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00470950
xor esi, esi
mov eax, 2
mov ecx, 0x40
lea edi, [esp + 0x70]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
push eax
push edi
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.004db7e0
cmp dword [esp + 0x44], edi
jge 0x4ee9cf
lea edi, [esp + 0x70]
push 0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 0
call fcn.004dcb00
lea eax, [esp + 0xc]
mov ecx, edi
push eax
inc esi
add edi, 4
call fcn.00462490
mov ecx, dword [esp + 0xc]
mov eax, ecx
and eax, 7
cmp esi, 0x40
jge 0x4ee950
cmp eax, 7
jne 0x4ee925
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4ee92f
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4ee93d
lea ecx, [esp + 0xc]
call fcn.00462200
mov ecx, dword [ebp + 0x10]
cmp dword [esp + 0x44], ecx
mov dword [esp + 0xc], 2
jl 0x4ee8d7
jmp 0x4ee978
cmp eax, 7
jne 0x4ee960
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4ee96a
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4ee978
lea ecx, [esp + 0xc]
call fcn.00462200
cmp esi, 1
jl 0x4ee9cf
lea ecx, [esp + 0x70]
call fcn.0040d410
test al, al
je 0x4ee9cf
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x14]
call fcn.00462f70
mov ecx, dword [ebx + 8]
push eax
call fcn.004a3130
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], edi
call fcn.004ec3e0
test eax, eax
jne 0x4ee9cf
mov edx, dword [ebx]
dec esi
push esi
lea eax, [esp + 0x78]
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
push ecx
push eax
mov ecx, ebx
call dword [edx + 4]
lea ecx, [esp + 0x34]
call fcn.004dbb60
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00527b30
add esp, 4
lea esi, [esp + 0x170]
mov edi, 0x40
mov ecx, dword [esi - 4]
sub esi, 4
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4eea0c
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4eea16
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4eea22
mov ecx, esi
call fcn.00462200
dec edi
mov dword [esi], 2
jne 0x4ee9f1
lea ecx, [esp + 0x20]
call fcn.0046fb30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f6380
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
push eax
call fcn.00434cc0
mov ebp, eax
mov eax, dword [esi + 0x2c]
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], ebp
jne 0x4f641c
mov eax, dword [esi + 0x18]
cmp eax, edi
lea ebx, [esi + 0x18]
je 0x4f63be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx], edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x20]
push edx
push 0x54748c
push 1
push edi
push 0x546b70
mov dword [esp + 0x34], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4f6400
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edi
push ebx
push 0x546b60
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
push eax
call dword [edx + 8]
push edi
push str.999999
call fcn.00434cc0
add esp, 4
push eax
mov ecx, esi
call fcn.004f6310
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov ebx, dword [esi + 0x20]
cmp ebx, dword [esi + 0x1c]
jge 0x4f6522
mov eax, dword [esi + 0x2c]
dec eax
cmp ebp, eax
jle 0x4f6522
mov dword [esp + 0x14], ebx
inc dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], edi
call fcn.004f6310
cmp eax, ebx
jne 0x4f646a
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push 0x54743c
push edi
push edi
push eax
call dword [edx + 0x20]
cmp dword [esp + 0x20], edi
je 0x4f64ff
mov eax, dword [esi + 0x28]
cmp eax, edi
lea ebp, [esi + 0x28]
je 0x4f6488
mov edi, edi
mov ebp, dword [ebp]
cmp dword [ebp], edi
jne 0x4f6480
mov edx, dword [esi + 0x2c]
push 0xa
push edx
call fcn.00493770
push 0xa8
mov ebx, eax
call fcn.00439320
add esp, 0xc
cmp eax, edi
je 0x4f64b0
push ebx
mov ecx, eax
call fcn.004d99e0
mov edi, eax
push ebx
call fcn.00527b30
push 0x40
call fcn.00439320
add esp, 8
test eax, eax
je 0x4f64d7
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x24]
push ecx
push edi
push edx
mov ecx, eax
call fcn.004f5f50
jmp 0x4f64d9
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp], eax
call fcn.004da2f0
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x20]
inc edi
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor edi, edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4f650d
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebp, dword [esi + 0x2c]
jl 0x4f6522
mov eax, dword [esi + 0x1c]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x4f6438
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4f83d0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
jne 0x4f83e8
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea edi, [esi + 4]
push edi
push 0x20000013
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x4f8478
mov eax, dword [edi]
cmp eax, 0x197
je 0x4f8454
cmp eax, 0x191
je 0x4f8454
cmp eax, 0x12c
jb 0x4f843f
cmp eax, 0x190
jae 0x4f8444
pop edi
mov ebx, 2
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
cmp eax, 0x190
jbe 0x4f8478
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x14]
push ebx
push 7
push 0x2eee
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [0x5616d4]
xor ebx, ebx
cmp eax, 0x2f00
sete bl
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x4f8760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
lea eax, [esp + 4]
push eax
push 1
xor ebp, ebp
push ebp
push str.SoftwareMicrosoftMultimediaSound_Mapper
push 0x80000001
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f88ca
push edi
mov edi, dword [esp + 0x80]
test edi, edi
mov eax, str.Record
jne 0x4f87b4
mov eax, str.Playback
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4f88c8
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.00439320
add esp, 4
test edi, edi
mov ebp, eax
mov eax, str.Record
jne 0x4f87f4
mov eax, str.Playback
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4f88c8
test edi, edi
je 0x4f881a
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4f8820
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], eax
jle 0x4f88c8
mov edi, edi
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4f8874
push 0x30
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4f88ac
test cl, cl
je 0x4f8870
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4f88ac
add eax, 2
add esi, 2
test cl, cl
jne 0x4f8850
xor eax, eax
jmp 0x4f88b1
push 0x34
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4f88ac
test cl, cl
je 0x4f88a8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4f88ac
add eax, 2
add esi, 2
test cl, cl
jne 0x4f8888
xor eax, eax
jmp 0x4f88b1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f88c4
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4f8830
jmp 0x4f88c8
mov dword [esp + 0x10], edi
pop esi
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x4f88d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4f88e6
push ebp
call fcn.00527b30
add esp, 4
mov eax, dword [esp + 8]
pop ebp
add esp, 0x74
ret
Function at 0x4f8b90
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
push esi
add ecx, 0x24
call fcn.004f9090
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
inc esi
mov dword [esp + 8], esi
mov byte [eax], 0
je 0x4f8ca6
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x4f8c7b
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x4f8c7b
push ebx
mov byte [eax], 1
mov ebx, dword [ebp + 0x24c]
push edi
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
dec esi
mov eax, esi
xor ecx, ecx
test eax, eax
mov dword [ebp + 0x28c], esi
jle 0x4f8c33
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
inc ecx
add eax, 4
cmp ecx, edx
jl 0x4f8c20
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
test al, al
pop edi
pop ebx
je 0x4f8c71
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x4f8c9e
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
pop esi
mov byte [ebp + 0x2a9], 0
pop ebp
pop ecx
ret 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4f8e80
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
add ecx, 0x9c
push ecx
call fcn.004f86d0
mov edx, dword [esp + 0x30]
lea ebx, [edi + 8]
add esp, 8
mov dword [edi + 0x28c], 0
mov byte [edi + 0x2a8], 0
mov dword [edi + 0x48], edx
mov esi, ebx
mov ebp, 0x10
mov eax, dword [esp + 0x28]
push eax
call fcn.00439320
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebp
jne 0x4f8ec2
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x50]
push 0x30000
push edi
push 0x4f8e60
lea ecx, [esp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4f8f5b
xor ebp, ebp
lea esi, [edi + 0x4c]
mov edi, edi
xor ecx, ecx
mov edx, esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx]
mov ecx, dword [esp + 0x28]
push 0x20
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebp
mov edx, dword [edi]
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [edi]
push 0x20
push esi
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
inc ebp
add ebx, 4
add esi, 0x20
cmp ebp, 0x10
jl 0x4f8f00
mov byte [edi + 0x2a9], 1
mov byte [edi + 0x2aa], 0
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0x14
ret 4

Function at 0x4f8ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1c]
test eax, eax
push esi
je 0x4f9053
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x4f9020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4f9120
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, 0x5616f4
lea ecx, [ecx]
call edi
mov dword [esi], eax
add esi, 4
cmp esi, 0x5616fc
jl 0x4f9130
pop edi
pop esi
ret