joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54cb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [esp + 8], 0
mov eax, ecx
je 0x54cd23
mov edx, dword [eax + 4]
push ebx
mov ecx, edx
shr ecx, 0x1d
cmp ecx, 7
push esi
push edi
jae 0x54cca7
movzx ebx, byte [ecx*2 + 0x65a9f0]
movzx ecx, byte [ecx*2 + 0x65a9f1]
add dword [eax + 0xc], ecx
mov edx, dword [eax + 0xc]
shl dword [eax + 4], cl
test edx, edx
jl 0x54cbbe
mov edi, edi
mov edx, dword [eax + 8]
movzx esi, byte [edx]
mov ecx, dword [eax + 0xc]
shl esi, cl
add ecx, 0xfffffff8
add edx, 1
mov dword [eax + 8], edx
add dword [eax + 4], esi
test ecx, ecx
mov dword [eax + 0xc], ecx
jge 0x54cba0
test ebx, ebx
je 0x54cc8b
mov esi, dword [eax + 4]
add dword [eax + 0xc], ebx
or edi, 0xffffffff
mov ecx, ebx
shl edi, cl
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
sar edx, cl
mov ecx, ebx
shl esi, cl
cmp ebx, 0x10
push ebp
mov ebp, dword [eax + 0xc]
mov dword [eax + 4], esi
jb 0x54cc17
mov ecx, dword [eax + 8]
movzx ecx, byte [ecx]
mov dword [esp + 0x18], ecx
mov ecx, ebp
mov ebp, dword [esp + 0x18]
shl ebp, cl
mov ecx, dword [eax + 8]
add ecx, 1
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ebp, esi
add ecx, 0xfffffff8
mov dword [eax + 4], ebp
mov dword [eax + 0xc], ecx
cmp ebx, 8
jb 0x54cc36
mov esi, dword [eax + 8]
movzx ebp, byte [esi]
mov ecx, dword [eax + 0xc]
shl ebp, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebp
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
test bl, 7
pop ebp
je 0x54cc5a
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x54cc5a
mov esi, dword [eax + 8]
movzx ebx, byte [esi]
shl ebx, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebx
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
xor edx, edi
mov ecx, edx
sar ecx, 0x1f
sub edx, ecx
add dword [eax + 0x28], edx
mov ecx, dword [eax + 0x28]
test ecx, 0xffffff00
je 0x54cc8b
or dword [eax + 0x4098], 5
xor edx, edx
test ecx, ecx
setl dl
sub edx, 1
and edx, 0xff
mov dword [eax + 0x28], edx
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x10]
push ecx
mov ecx, dword [esp + 0x14]
push 1
push edx
mov edx, dword [eax + 0x60]
push ecx
mov ecx, eax
call edx
pop edi
pop esi
pop ebx
ret 8
add dword [eax + 0xc], 3
lea ecx, [edx*8]
mov dword [eax + 4], ecx
js 0x54ccd5
mov edx, dword [eax + 8]
movzx esi, byte [edx]
mov ecx, dword [eax + 0xc]
shl esi, cl
add ecx, 0xfffffff8
add edx, 1
mov dword [eax + 8], edx
add dword [eax + 4], esi
test ecx, ecx
mov dword [eax + 0xc], ecx
jge 0x54ccb7
mov ebx, 5
lea ebx, [ebx]
mov ecx, dword [eax + 4]
mov edx, ecx
lea esi, [ecx + ecx]
and edx, 0x80000000
add dword [eax + 0xc], 1
mov ecx, dword [eax + 0xc]
mov dword [eax + 4], esi
js 0x54cd16
mov edi, dword [eax + 8]
movzx edi, byte [edi]
shl edi, cl
add edi, esi
mov esi, dword [eax + 8]
add esi, 1
add ecx, 0xfffffff8
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
test edx, edx
je 0x54cbbe
add ebx, 1
jmp 0x54cce0
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 4]
push 0
push 0
push ecx
mov ecx, eax
mov eax, dword [eax + 0x60]
push edx
call eax
ret 8
Function at 0x54cd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [esp + 0xc], 0
mov eax, ecx
je 0x54cebc
mov edx, dword [eax + 4]
push ebx
mov ebx, edx
push esi
shr ebx, 0x1e
add dword [eax + 0xc], 2
mov ecx, dword [eax + 0xc]
lea edx, [edx*4]
push edi
mov dword [eax + 4], edx
js 0x54cd84
mov esi, dword [eax + 8]
movzx edi, byte [esi]
shl edi, cl
add esi, 1
mov dword [eax + 8], esi
add edi, edx
add ecx, 0xfffffff8
mov dword [eax + 4], edi
mov dword [eax + 0xc], ecx
cmp ebx, 3
jb 0x54cdcf
mov ebx, 3
mov edi, edi
mov ecx, dword [eax + 4]
mov edx, ecx
lea esi, [ecx + ecx]
and edx, 0x80000000
add dword [eax + 0xc], 1
mov ecx, dword [eax + 0xc]
mov dword [eax + 4], esi
js 0x54cdc6
mov edi, dword [eax + 8]
movzx edi, byte [edi]
shl edi, cl
add edi, esi
mov esi, dword [eax + 8]
add esi, 1
add ecx, 0xfffffff8
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
test edx, edx
je 0x54cdcf
add ebx, 1
jmp 0x54cd90
test ebx, ebx
je 0x54ce9d
mov esi, dword [eax + 4]
add dword [eax + 0xc], ebx
or edi, 0xffffffff
mov ecx, ebx
shl edi, cl
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
sar edx, cl
mov ecx, ebx
shl esi, cl
cmp ebx, 0x10
push ebp
mov ebp, dword [eax + 0xc]
mov dword [eax + 4], esi
jb 0x54ce28
mov ecx, dword [eax + 8]
movzx ecx, byte [ecx]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
mov ebp, dword [esp + 0x1c]
shl ebp, cl
mov ecx, dword [eax + 8]
add ecx, 1
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ebp, esi
add ecx, 0xfffffff8
mov dword [eax + 4], ebp
mov dword [eax + 0xc], ecx
cmp ebx, 8
jb 0x54ce47
mov esi, dword [eax + 8]
movzx ebp, byte [esi]
mov ecx, dword [eax + 0xc]
shl ebp, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebp
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
test bl, 7
pop ebp
je 0x54ce6b
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x54ce6b
mov esi, dword [eax + 8]
movzx ebx, byte [esi]
shl ebx, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebx
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
xor edx, edi
mov ecx, edx
sar ecx, 0x1f
sub edx, ecx
mov ecx, dword [esp + 0x14]
add dword [ecx], edx
test dword [ecx], 0xffffff00
je 0x54cea1
or dword [eax + 0x4098], 5
xor edx, edx
cmp dword [ecx], edx
setl dl
sub edx, 1
and edx, 0xff
mov dword [ecx], edx
jmp 0x54cea1
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
mov edx, dword [eax + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push 1
push edx
mov edx, dword [eax + 0x60]
push ecx
mov ecx, eax
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 4]
push 0
push 0
push ecx
mov ecx, eax
mov eax, dword [eax + 0x60]
push edx
call eax
ret 0xc

Function at 0x54ddf9
Capabilities:
Get number of processors
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
sub edx, 0x13cf6
add edx, 0xde63
pop edx
push ecx
or ecx, 0xb008
call fcn.0054de27
add byte [edx], bh
dec edi
inc esp
cmp cl, byte [edi + edi - 0x7d]
add esp, 4
add ecx, 0x1e09
Function at 0x551f88
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push edx
xor edx, 0x18247
call 0x551f22
add byte [edx + edi + 0x46], al
cmp al, byte [ecx + 0x4e]
add esp, 4
pop edx
push ebx
xor ebx, 0x685c
jmp 0x551f34
and ebx, 0x10e52
xor ebx, 0x11e3f
pop ebx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ecx
push ebx
add esp, 4
add ecx, 0x8c62
pop ecx
push edx
and edx, 0x13d0f
call 0x551f88
add byte [ecx + 0x4f], cl
cmp dword [edi], edi
dec esp
xor eax, 0x8104c483
retf 0x9c6a
Function at 0x552a70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov es, word [eax]
add byte [ecx + 0x12b49c2], al
add byte [edx - 0x75], bl
test dword [eax], ecx
stc
invalid
Function at 0x553a28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
jmp 0x553a60
pop edi
push ebx
call 0x553a6f
add byte [edi], dh
xor al, 0x44
cmp edi, dword [ebx]
aas
inc ecx
add esp, 4
call 0x553a7e
add byte [esi + 0x3b], cl
dec edi
xor eax, 0xc4834d47
add al, 0x81
retf

Function at 0x553a6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
jmp 0x553a60
pop edi
push ebx
call 0x553a6f
add byte [edi], dh
xor al, 0x44
cmp edi, dword [ebx]
aas
inc ecx
add esp, 4
call 0x553a7e
add byte [esi + 0x3b], cl
dec edi
xor eax, 0xc4834d47
add al, 0x81
retf

Function at 0x553a7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
jmp 0x553a60
pop edi
push ebx
call 0x553a6f
add byte [edi], dh
xor al, 0x44
cmp edi, dword [ebx]
aas
inc ecx
add esp, 4
call 0x553a7e
add byte [esi + 0x3b], cl
dec edi
xor eax, 0xc4834d47
add al, 0x81
retf

Function at 0x553be5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
jmp 0x553a05
and ebx, 0xbd99
pop ebx
push ebx
and ebx, 0xdb4d
jmp 0x553a1c
call fcn.00553a28
add byte [edi], bh
dec edx
xor ecx, dword [ebx + 0x44]
add esp, 4
pop eax
push edx
sub edx, 0x852a
sub edx, 0x121da
xor edx, 0x1611
jmp 0x553c02
pop edx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x553c2f
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x5539fa
mov dword [ebp - 0x710], 0
Function at 0x554288
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
xor ebx, 0x11531
xor ebx, 0xbb74
add ebx, 0xefbd
add ebx, 0x1399d
pop ebx
push edx
xor edx, 0x7681
and edx, 0xa35e
or edx, 0x10fb5
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
sub edx, 0x8c91
sub edx, 0xc39d
pop edx
push edx
or edx, 0xba5e
jmp 0x554274
sub edx, 0xd28c
call fcn.00554288
add byte [edi], bh
dec esi
cmp eax, 0x45354333
dec esp
add esp, 4
pop edx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
push esi
add esp, 4
xor eax, 0x14628
or eax, 0x1472e
pop eax
push ebx
and ebx, 0x27b6
xor ebx, 0x158f5
sub ebx, 0x14a7e
pop ebx
push edi
push edx
add esp, 4
and edi, 0x17030
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x554332
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x55438c
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x55425a
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x55425a
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x554376
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x554380
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x5543d5
push ecx
push ebx
add esp, 4
xor ecx, 0x6fc0
and ecx, 0x143ba
pop ecx
push edi
sub edi, 0x8f80
add edi, 0x631f
call 0x5543c3
add byte [ebx + esi + 0x38], cl
dec ecx
inc ecx
cmp eax, 0xc4833c3a
add al, 0x5f
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x55443d
push edi
sub edi, 0xd392
pop edi
push eax
jmp 0x5543e3
pop eax
push edi
or edi, 0x648a
jmp 0x5543f2
xor edi, 0x9d65
pop edi
push eax
xor eax, 0x60e4
or eax, 0x481d
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x554433
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x5541fe
mov dword [ebp - 0x2a8], 0
Function at 0x5543c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
xor ebx, 0x11531
xor ebx, 0xbb74
add ebx, 0xefbd
add ebx, 0x1399d
pop ebx
push edx
xor edx, 0x7681
and edx, 0xa35e
or edx, 0x10fb5
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
sub edx, 0x8c91
sub edx, 0xc39d
pop edx
push edx
or edx, 0xba5e
jmp 0x554274
sub edx, 0xd28c
call fcn.00554288
add byte [edi], bh
dec esi
cmp eax, 0x45354333
dec esp
add esp, 4
pop edx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
push esi
add esp, 4
xor eax, 0x14628
or eax, 0x1472e
pop eax
push ebx
and ebx, 0x27b6
xor ebx, 0x158f5
sub ebx, 0x14a7e
pop ebx
push edi
push edx
add esp, 4
and edi, 0x17030
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x554332
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x55438c
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x55425a
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x55425a
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x554376
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x554380
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x5543d5
push ecx
push ebx
add esp, 4
xor ecx, 0x6fc0
and ecx, 0x143ba
pop ecx
push edi
sub edi, 0x8f80
add edi, 0x631f
call 0x5543c3
add byte [ebx + esi + 0x38], cl
dec ecx
inc ecx
cmp eax, 0xc4833c3a
add al, 0x5f
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x55443d
push edi
sub edi, 0xd392
pop edi
push eax
jmp 0x5543e3
pop eax
push edi
or edi, 0x648a
jmp 0x5543f2
xor edi, 0x9d65
pop edi
push eax
xor eax, 0x60e4
or eax, 0x481d
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x554433
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x5541fe
mov dword [ebp - 0x2a8], 0
Function at 0x580c90
Capabilities:
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x620930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x684a20
call fcn.005828b0
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x20], ebx
mov dword [esi], 0x660c18
mov dword [esi + 4], 0x660c10
mov dword [edi], 0x660c00
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x64]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x6c]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0xbc], ebx
fldz
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xc4], bl
mov byte [esi + 0xc5], bl
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
fstp dword [esi + 0xd8]
fld1
mov dword [esi + 0xdc], ebx
mov cl, byte [0x6c7f7b]
fst dword [esi + 0xf8]
neg cl
fstp dword [esi + 0xfc]
mov byte [esi + 0xe4], bl
mov byte [esi + 0xe5], bl
mov byte [esi + 0xe6], bl
mov byte [esi + 0xe7], bl
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
sbb ecx, ecx
mov dword [esi + 0xf0], ebx
mov byte [esi + 0xf4], bl
and ecx, 0xfffffffe
add ecx, 2
mov dword [esi + 0xe0], ecx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov eax, 0x6575cc
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x12c], eax
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x148], ebx
xor eax, eax
mov dword [esi + 0x7c], ebx
mov byte [esp + 0x1c], 4
mov dword [esi + 0x3c], eax
mov ebp, dword [esp + 0x28]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x580e31
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
jne 0x580e31
mov byte [esi + 0xe4], 1
mov ecx, dword [ebp]
push edi
call fcn.00583270
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x582c80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6209b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0xc], esi
call fcn.0051a0b9
mov dword [esi], 0x660c9c
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov word [esi + 0x2c], bx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], 1
lea eax, [esi + 0x38]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x48]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x44], ebx
call fcn.0051a307
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0xc]
lea eax, [esi + 0x64]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x598920
Capabilities:
Capture microphone audio

Disassembly:
push 0xffffffffffffffff
push 0x622b88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
mov dword [esp + 4], esi
jne 0x598957
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push ebx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0xcc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x24], ebx
call edx
test al, al
mov eax, dword [esp + 0x14]
jne 0x59899b
push eax
call fcn.005f7a6f
add esp, 4
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
movzx ecx, word [eax + 0xc]
mov edx, dword [eax + 8]
add edx, 9
mov eax, 0xcccccccd
mul edx
shr edx, 3
push ebp
lea ebp, [edx + ecx - 1]
mov eax, ebp
xor edx, edx
div ecx
lea ecx, [esi + 0x124]
sub ebp, edx
lea eax, [ebp + ebp]
push eax
call fcn.00414d00
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x18]
push 0x10008
push ebx
push ecx
push edx
lea eax, [esi + 0xe0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x598a0f
mov eax, dword [esp + 0x18]
push eax
call fcn.005f7a6f
add esp, 4
pop ebp
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov byte [esi + 0x1b], 1
mov dword [esp + 0x10], ebx
add esi, 0xec
push edi
mov edi, edi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x124]
add ecx, ebx
lea edi, [esi - 8]
mov dword [edi], ecx
xor ecx, ecx
push 0x20
add eax, 0xe0
mov dword [esi - 4], ebp
mov dword [esi], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov edx, dword [eax]
push edi
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
jne 0x598a97
mov eax, dword [esp + 0x10]
push 0x20
add eax, 0xe0
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
jne 0x598ac2
mov eax, dword [esp + 0x14]
add eax, 1
add esi, 0x20
add ebx, ebp
cmp eax, 2
mov dword [esp + 0x14], eax
jl 0x598a20
mov eax, dword [esp + 0x10]
add eax, 0xe0
mov eax, dword [eax]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
je 0x598aed
mov ecx, dword [esp + 0x10]
call fcn.005985d0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005f7a6f
add esp, 4
pop edi
pop ebp
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x10]
call fcn.005985d0
mov edx, dword [esp + 0x1c]
push edx
call fcn.005f7a6f
add esp, 4
pop edi
pop ebp
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.005f7a6f
mov ecx, dword [esp + 0x24]
add esp, 4
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x598d40
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x598d7c
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x598d6a
mov ecx, dword [esi + 4]
push 0
push 0
push 0x444
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp byte [esi + 0x1a], 0
mov byte [esi + 0x14], 0
je 0x598d7c
mov ecx, esi
pop esi
jmp fcn.00598920
pop esi
ret

Function at 0x598d80
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x598dbc
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x598daa
mov ecx, dword [esi + 4]
push 0
push 0
push 0x445
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp byte [esi + 0x1a], 0
mov byte [esi + 0x14], 0
je 0x598dbc
mov ecx, esi
pop esi
jmp fcn.00598920
pop esi
ret
Function at 0x59a070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6217b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
mov dword [esp + 0xc], esi
call fcn.0051a0b9
mov dword [esi], 0x672860
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], edi
call fcn.0051a307
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 1
call fcn.0051a307
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret