joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7840
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1f0]
push eax
mov ecx, dword [0x5c4c28]
imul ecx, ecx, 0x127c
add ecx, 0x11a6ec0
push ecx
call fcn.004281d0
add esp, 8
push 0x1102600
push 0x5c
mov edx, dword [0x5c4c28]
imul edx, edx, 0x127c
add edx, 0x11a6f12
push edx
push 0x5c
lea eax, [ebp - 0x1f0]
push eax
push 0x5c44f8
push 0x573458
lea ecx, [ebp - 0x2f0]
push ecx
call fcn.00532706
add esp, 0x20
cmp dword [0x5f6630], 1
jne 0x4b78e3
cmp dword [0x5f663c], 0
je 0x4b78e3
push 0x1068ea0
push 0x573470
lea edx, [ebp - 0x2f0]
push edx
call fcn.00532706
add esp, 0xc
push 1
push 0x57347c
lea eax, [ebp - 0x2f0]
push eax
call fcn.00459360
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [0x5fdb24], 1
jne 0x4b790a
jmp 0x4b7ad8
cmp dword [ebp - 8], 0
jne 0x4b791f
lea ecx, [ebp - 0x2f0]
push ecx
call fcn.0045c4a0
add esp, 4
cmp dword [ebp - 8], 0
jne 0x4b7963
lea edx, [ebp - 0x2f0]
push edx
push str.Cant_read_file:__s
lea eax, [ebp - 0x110]
push eax
call fcn.00532706
add esp, 0xc
push 0x5fd71a
push 0x5fd71b
push 0x573494
lea ecx, [ebp - 0x110]
push ecx
call fcn.00422b80
add esp, 0x10
jmp 0x4b7ad8
mov edx, dword [ebp - 8]
push edx
call fcn.004557e0
add esp, 4
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0xc], 1
jmp 0x4b7987
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x1e0]
jg 0x4b79e4
mov edx, dword [ebp - 8]
push edx
push 1
push 0xc8
lea eax, [ebp - 0x1d8]
push eax
call fcn.0053367b
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x1d8]
push ecx
call fcn.0041aba0
add esp, 0xc
movsx edx, word [ebp - 0x1d8]
cmp edx, 5
jne 0x4b79e2
movsx eax, word [ebp - 0x1d6]
cmp eax, dword [0x5fdb08]
jne 0x4b79e2
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x4b79e4
jmp 0x4b797e
cmp dword [ebp - 4], 0
jne 0x4b7a15
mov edx, dword [ebp - 0x1e0]
add edx, 1
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00455880
add esp, 8
mov edx, dword [ebp - 0x1e0]
mov dword [ebp - 4], edx
push 0xc8
push 0
lea eax, [ebp - 0x1d8]
push eax
call fcn.005323e0
add esp, 0xc
mov ecx, 5
mov word [ebp - 0x1d8], cx
mov dx, word [0x5fdb08]
mov word [ebp - 0x1d6], dx
mov dword [ebp - 0xc], 0
jmp 0x4b7a57
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
jge 0x4b7a75
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ax, word [edx*4 + 0x658f20]
mov word [ebp + ecx*2 - 0x1d2], ax
jmp 0x4b7a4e
mov ecx, dword [ebp - 4]
sub ecx, 1
imul ecx, ecx, 0xc8
add ecx, 4
mov dword [ebp - 0x1dc], ecx
push 0
mov edx, dword [ebp - 0x1dc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00532940
add esp, 0xc
push 0
push 3
lea ecx, [ebp - 0x1d8]
push ecx
call fcn.0041aba0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push 1
push 0xc8
lea eax, [ebp - 0x1d8]
push eax
call fcn.005337fa
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
call fcn.00431d50
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4c75d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0xff
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x118]
push ecx
push str._sSYSTEM
lea edx, [ebp - 0x220]
push edx
call fcn.00532706
add esp, 0xc
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
je 0x4c765a
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4c7669
xor eax, eax
mov word [ebp - 0x14], ax
xor ecx, ecx
mov word [ebp - 0x11c], cx
movzx edx, word [ebp - 0x11c]
and edx, 0x1f
shl edx, 1
mov dword [ebp - 0xc], edx
movzx eax, word [ebp - 0x11c]
and eax, 0x7e0
sar eax, 5
mov dword [ebp - 8], eax
movzx ecx, word [ebp - 0x11c]
and ecx, 0xf800
sar ecx, 0xb
mov dword [ebp - 0x10], ecx
movzx edx, word [ebp - 0x14]
and edx, 0x1f
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4d0790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [0x5fe5b0], 0
jne 0x4d07be
push 0x1d56
call fcn.005324a9
add esp, 4
mov dword [0x5fe5b0], eax
cmp dword [0x5fe5b0], 0
jne 0x4d07d4
push str.Error_allocating_memory_for_line_counts
call fcn.004f50c0
add esp, 4
cmp dword [0x5fe268], 1
jne 0x4d07e7
push 0
call fcn.004d09d0
add esp, 4
push str.LESSON
mov eax, dword [ebp + 8]
push eax
call fcn.00532680
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4d0816
mov dword [0x5fe268], 0
jmp 0x4d09b8
mov ecx, dword [ebp - 0x114]
mov byte [ecx], 0
mov edx, dword [ebp - 0x114]
add edx, 6
push edx
mov eax, dword [ebp + 8]
push eax
push str._sDATA_s
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532706
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
call fcn.00532e80
add esp, 4
mov byte [ebp + eax - 0x112], 0x7e
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00532580
add esp, 8
push 0x574fa4
mov edx, dword [ebp + 8]
push edx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d0971
mov eax, dword [ebp + 8]
push eax
push 0x574fa8
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532706
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 3
call fcn.00436500
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0xff
lea ecx, [ebp - 0x110]
push ecx
call fcn.0053516e
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x7d0
mov eax, dword [0x5fe5b0]
push eax
call fcn.0053367b
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00431d50
add esp, 4
push 5
mov edx, dword [0x65bea0]
add edx, 0x1d
push edx
lea eax, [ebp - 0x105]
push eax
call fcn.00532db5
add esp, 0xc
test eax, eax
je 0x4d096f
mov dword [ebp - 8], 0
jmp 0x4d0920
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x7d0
jge 0x4d096f
mov edx, dword [0x5fe5b0]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
test eax, eax
je 0x4d096d
push 0x5fe7cf
push 0x5fe7d0
push 0x574fb4
push str.Script_has_changed.__About_to_clear_count_file_
call fcn.00422b80
add esp, 0x10
push 0x7d0
push 0
mov ecx, dword [0x5fe5b0]
push ecx
call fcn.005323e0
add esp, 0xc
jmp 0x4d096f
jmp 0x4d0917
jmp 0x4d0987
push 0x7d0
push 0
mov edx, dword [0x5fe5b0]
push edx
call fcn.005323e0
add esp, 0xc
mov eax, dword [0x65bea0]
add eax, 0x1d
push eax
push 0x5fe388
call fcn.00532580
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 0x5fe288
call fcn.00532580
add esp, 8
mov dword [0x5fe268], 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4d09d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x5fe268], 0
jne 0x4d09f1
jmp 0x4d0adf
mov dword [0x5fe268], 0
push 0x574ff4
push 0x5fe288
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d0a1b
jmp 0x4d0adf
push 0x5fe288
push 0x574ff8
lea eax, [ebp - 0x108]
push eax
call fcn.00532706
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 3
call fcn.00436500
add esp, 8
push 0x5fe288
call fcn.00532e80
add esp, 4
mov dword [ebp - 0x10c], eax
push 0x5fe388
mov edx, dword [ebp - 0x10c]
lea eax, [edx + 0x5fe27e]
push eax
push str._s__s_r_n
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532706
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00534f64
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x7d0
mov edx, dword [0x5fe5b0]
push edx
call fcn.005337fa
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00431d50
add esp, 4
cmp dword [ebp + 8], 1
jne 0x4d0adf
cmp dword [0x5fe5b0], 0
je 0x4d0adf
mov ecx, dword [0x5fe5b0]
push ecx
call fcn.00532828
add esp, 4
mov dword [0x5fe5b0], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4d50f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x64d5b0]
push eax
call fcn.00531220
add esp, 4
call fcn.004db730
lea ecx, [ebp - 0x208]
push ecx
call fcn.00485fc0
add esp, 4
push 0x5752b0
lea edx, [ebp - 0x208]
push edx
call fcn.00532590
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0xff
push 0x600450
push 0x5ff216
push str.over_ride_font_name
push 0x5752d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [0x600450]
test ecx, ecx
je 0x4d51ab
push 0x600450
lea edx, [ebp - 0x107]
push edx
call fcn.00532580
add esp, 8
lea eax, [ebp - 0x107]
push eax
call fcn.00532e80
add esp, 4
mov byte [ebp - 0x108], al
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00531d50
add esp, 8
jmp 0x4d51bf
lea eax, [ebp - 0x20c]
push eax
push str._tHelvetica
call fcn.00531d50
add esp, 8
movsx ecx, word [ebp - 0x20c]
test ecx, ecx
jne 0x4d51db
push str.Cant_find_Helvetica_font.
push 1
call fcn.00436500
add esp, 8
jmp 0x4d51eb
movzx edx, word [ebp - 0x20c]
push edx
call fcn.00531cd0
add esp, 4
push 0xe
call fcn.00531d10
add esp, 4
push 0
call fcn.00531cf0
add esp, 4
push 0x64d520
call fcn.005316a0
add esp, 4
mov dword [0x64d8ec], 0x4d5040
mov eax, dword [0x64d8ec]
mov dword [0x64d540], eax
push 0x808
call fcn.005309c0
add esp, 4
mov dword [0x606f84], eax
push 0x808
call fcn.005309c0
add esp, 4
mov dword [0x606f80], eax
cmp dword [0x606f84], 0
jne 0x4d525a
push 0x575300
call fcn.004f50c0
add esp, 4
cmp dword [0x606f80], 0
jne 0x4d5270
push str.Out_of_memory_allocating_space_for_Color_Table
call fcn.004f50c0
add esp, 4
push 0x5ff220
push 0x4a504547
push 0x67726970
call fcn.00531a10
add esp, 0xc
mov word [ebp - 4], ax
push 0x5ff224
push 0x50494354
push 0x67726970
call fcn.00531a10
add esp, 0xc
mov word [ebp - 4], ax
push 0x5ff228
push 0x47494666
push 0x67726970
call fcn.00531a10
add esp, 0xc
mov word [ebp - 4], ax
push 0x5ff22c
push 0x424d5066
push 0x67726970
call fcn.00531a10
add esp, 0xc
mov word [ebp - 4], ax
push 0x5ff230
push 0x504e4766
push 0x67726970
call fcn.00531a10
add esp, 0xc
mov word [ebp - 4], ax
push 0x64d580
mov ecx, dword [0x5ff230]
push ecx
call fcn.00531150
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4ddd80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
push 0x658fd8
push 0x65ab60
push str._s_s_s
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532706
add esp, 0x14
push 0x65ab60
call fcn.00532e80
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push edx
push 0x5c
push 0x658fd8
push 0x5c
push 0x658de0
push str._s_c_sLESSON0_c_s
lea eax, [ebp - 0x218]
push eax
call fcn.00532706
add esp, 0x1c
push 0x658de0
call fcn.00532e80
add esp, 4
add eax, 1
mov dword [ebp - 0x114], eax
push 0x575aec
lea ecx, [ebp - 0x110]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dde5b
cmp dword [0x5fda78], 0
je 0x4dde5b
push 3
push 0x575af0
mov edx, dword [ebp - 4]
lea eax, [ebp + edx - 0x110]
push eax
call fcn.00532bd0
add esp, 0xc
push 0x575af4
lea ecx, [ebp - 0x110]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dde78
push 0x575af8
lea edx, [ebp - 0x218]
push edx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ddeb2
push 3
push 0x575afc
mov eax, dword [ebp - 0x114]
lea ecx, [ebp + eax - 0x218]
push ecx
call fcn.00532bd0
add esp, 0xc
push 0x575b00
lea edx, [ebp - 0x218]
push edx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ddec7
mov dword [0x5fd894], 0
jmp 0x4ddf85
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00532940
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.00532b62
add esp, 4
mov dword [ebp - 0x118], eax
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00532940
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
call fcn.005309c0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx*4 + 0x600550], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x600550]
push eax
call fcn.00530a20
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x600550]
mov edx, dword [ecx]
push edx
call fcn.0053367b
add esp, 0x10
push 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x600550]
mov edx, dword [ecx]
push edx
push 0x606240
call fcn.00533040
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x600550]
push ecx
call fcn.00530a40
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00431d50
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4eaea0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x600d70], 0
je 0x4eaf06
cmp dword [0x600d74], 0
je 0x4eaecf
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [0x600d74]
push ecx
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp dword [0x600d7c], 0
je 0x4eaef3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x600d7c]
push eax
call fcn.00533040
add esp, 0xc
push 0x20
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x600d70]
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
xor eax, eax
pop ebp
ret

Function at 0x4eaf10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [0x600d70]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4eb05a
mov dword [0x600d70], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
test eax, eax
je 0x4eaf5b
mov dword [ebp - 8], 2
push 0x32
mov edx, dword [ebp - 4]
push edx
call fcn.004eb070
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WINMM.dll_waveInClose]
test eax, eax
je 0x4eaf81
mov dword [ebp - 8], 2
cmp dword [0x600d74], 0
je 0x4eaf97
mov ecx, dword [0x600d74]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
mov dword [0x600d74], 0
cmp dword [0x600d7c], 0
je 0x4eafb9
mov edx, dword [0x600d7c]
push edx
call fcn.00532828
add esp, 4
mov dword [0x600d7c], 0
movsx eax, byte [0x600c68]
test eax, eax
je 0x4eb05a
push 2
lea ecx, [ebp - 0x98]
push ecx
push 0x600c68
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x9c], eax
push 0x2c
lea edx, [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
push 0
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
sub edx, 0x2c
mov dword [ebp - 0xa0], edx
push 0
push 0
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x2c
lea ecx, [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4eb0e0
Capabilities:
Capture microphone audio
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x94], 0
mov eax, dword [ebp + 8]
mov cx, word [eax]
mov word [ebp - 0xa8], cx
mov edx, dword [ebp + 8]
mov ax, word [edx + 2]
mov word [ebp - 0xa6], ax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp + 8]
mov ax, word [edx + 0xc]
mov word [ebp - 0x9c], ax
xor ecx, ecx
mov word [ebp - 0x98], cx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0xc]
shl eax, 3
mov word [ebp - 0x9a], ax
push 0x10000
push 0
mov ecx, dword [0x60137c]
push ecx
lea edx, [ebp - 0xa8]
push edx
push 0xffffffffffffffff
push 0x600d70
call dword [sym.imp.WINMM.dll_waveInOpen]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x4eb193
mov eax, 3
jmp 0x4eb335
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx + 2]
cdq
idiv ecx
imul eax, eax, 0x898
mov dword [0x600d78], eax
mov edx, dword [0x600d78]
push edx
push 0x32
mov eax, dword [0x600d70]
push eax
call fcn.004eb350
add esp, 0xc
mov dword [ebp - 0x94], eax
cmp dword [0x600d7c], 0
je 0x4eb1e4
mov ecx, dword [0x600d7c]
push ecx
call fcn.00532828
add esp, 4
push 1
mov edx, dword [0x600d78]
push edx
call fcn.005390f9
add esp, 8
mov dword [0x600d7c], eax
movsx eax, byte [0x600c68]
test eax, eax
je 0x4eb30d
push 0x1000
lea ecx, [ebp - 0x90]
push ecx
push 0x600c68
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [0x600d74], eax
cmp dword [0x600d74], 0xffffffff
jne 0x4eb240
mov dword [0x600d74], 0
or eax, 0xffffffff
jmp 0x4eb335
mov byte [ebp - 0xd8], 0x52
mov byte [ebp - 0xd7], 0x49
mov byte [ebp - 0xd6], 0x46
mov byte [ebp - 0xd5], 0x46
push 0x5767b0
lea edx, [ebp - 0xd0]
push edx
call fcn.00532580
add esp, 8
mov byte [ebp - 0xc9], 0x20
mov dword [ebp - 0xc8], 0x10
mov ax, word [ebp - 0xa8]
mov word [ebp - 0xc4], ax
mov cx, word [ebp - 0xa6]
mov word [ebp - 0xc2], cx
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xbc], eax
mov cx, word [ebp - 0x9c]
mov word [ebp - 0xb8], cx
mov dx, word [ebp - 0x9a]
mov word [ebp - 0xb6], dx
mov byte [ebp - 0xb4], 0x64
mov byte [ebp - 0xb3], 0x61
mov byte [ebp - 0xb2], 0x74
mov byte [ebp - 0xb1], 0x61
mov dword [ebp - 0xb0], 0
push 0x2c
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [0x600d74]
push ecx
call dword [sym.imp.KERNEL32.dll__lwrite]
mov edx, dword [0x600d70]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x4eb333
mov dword [ebp - 0x94], 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4eb350
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4eb389
mov eax, 1
jmp 0x4eb47d
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x600d6c], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp + 0xc]
shl ecx, 5
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4eb3d1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
jmp 0x4eb47d
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x600d68], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x600d68]
mov dword [ebp - 0x20], edx
mov eax, dword [0x600d6c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4eb40d
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jge 0x4eb47a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
mov dword [edx + 4], eax
push 0x20
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4eb446
mov dword [ebp - 0xc], 2
push 0x20
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4eb466
mov dword [ebp - 0xc], 2
mov edx, dword [ebp - 0x20]
add edx, 0x20
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x4eb404
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4eb490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x1c], eax
call fcn.004eb730
push 0x14
push 0x2000
call fcn.004eb990
add esp, 8
mov dword [0x6011b0], eax
cmp dword [0x6011b0], 0
jne 0x4eb4c7
jmp 0x4eb637
mov dword [0x600d8c], 0x14
mov dword [0x600d88], 0
mov dword [ebp - 0x18], 0
jmp 0x4eb4ed
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [0x600d8c]
cmp dword [ebp - 0x18], ecx
jge 0x4eb50d
mov edx, dword [ebp - 0x18]
shl edx, 5
mov eax, dword [0x6011b0]
mov dword [eax + edx + 0x10], 1
jmp 0x4eb4e4
push 0x600d90
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x5767b8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [0x6011b8], eax
cmp dword [0x6011b8], 0
jne 0x4eb555
mov edx, dword [0x6011b0]
push edx
call fcn.004eba20
add esp, 4
mov dword [0x6011b0], 0
jmp 0x4eb637
mov eax, dword [0x6011b8]
push eax
push 0x2c
push 1
lea ecx, [ebp - 0x48]
push ecx
call fcn.0053367b
add esp, 0x10
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov ax, word [ebp - 0x26]
mov word [ebp - 6], ax
mov cx, word [ebp - 0x32]
mov word [ebp - 0x12], cx
xor edx, edx
mov word [ebp - 4], dx
mov eax, 1
mov word [ebp - 0x14], ax
movzx ecx, word [ebp - 6]
movzx edx, word [ebp - 0x12]
imul ecx, edx
sar ecx, 3
mov word [ebp - 8], cx
movzx eax, word [ebp - 8]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
push 0x30000
push 0x600d8c
push 0x4eba40
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x6011b4
call dword [sym.imp.WINMM.dll_waveOutOpen]
test eax, eax
je 0x4eb60e
mov edx, dword [0x6011b8]
push edx
call fcn.00535898
add esp, 4
mov dword [0x6011b8], 0
mov eax, dword [0x6011b0]
push eax
call fcn.004eba20
add esp, 4
mov dword [0x6011b0], 0
mov dword [0x6011b4], 0
jmp 0x4eb637
mov dword [0x600da8], 0x400
mov dword [ebp - 0x18], 0
jmp 0x4eb62a
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x14
jge 0x4eb637
call fcn.004eb680
jmp 0x4eb621
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret

Function at 0x4eb680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6011b8], 0
je 0x4eb696
cmp dword [0x6011b4], 0
jne 0x4eb69b
jmp 0x4eb721
cmp dword [0x600da8], 0
je 0x4eb721
cmp dword [0x600d8c], 2
jle 0x4eb721
mov eax, dword [0x6011b8]
push eax
push 0x400
push 1
push 0x600db0
call fcn.0053367b
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4eb6da
mov dword [0x600da8], 0
cmp dword [0x600da8], 0
je 0x4eb721
cmp dword [ebp - 4], 0x400
jae 0x4eb709
mov ecx, 0x400
sub ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 4]
add edx, 0x600db0
push edx
call fcn.005323e0
add esp, 0xc
push 0x400
push 0x600db0
mov eax, dword [0x6011b4]
push eax
call fcn.004eb830
add esp, 0xc
mov esp, ebp
pop ebp
ret