joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431068
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ecx + 0x25]
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0x26]
mov dword [ebp - 0x14], eax
movzx eax, byte [ecx + 0x27]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0x1f]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0x21]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0x23]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
je 0x431104
push ebx
mov ebx, dword [ebp + 0xc]
inc eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 0x10], eax
mov edi, dword [ebx]
mov ecx, dword [ebp - 0x10]
mov eax, edi
xor edx, edx
shr eax, cl
mov ecx, dword [ebp - 0x14]
add ebx, 4
and eax, dword [ebp - 4]
imul eax, eax, 0xff
div dword [ebp - 4]
xor edx, edx
mov byte [esi], al
mov eax, edi
shr eax, cl
mov ecx, dword [ebp - 0x18]
inc esi
and eax, dword [ebp - 8]
imul eax, eax, 0xff
div dword [ebp - 8]
xor edx, edx
mov byte [esi], al
mov eax, edi
shr eax, cl
inc esi
and eax, dword [ebp - 0xc]
imul eax, eax, 0xff
div dword [ebp - 0xc]
mov byte [esi], al
inc esi
dec dword [ebp + 0x10]
jne 0x4310af
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4325e3
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x432639
mov al, byte [esi]
push edi
mov edi, dword [esi + 4]
mov byte [ebp - 4], al
movzx eax, al
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down
push str.C:projectsAmmyy_sources_target_trKeymap.cpp
push 2
push 0x47a230
call fcn.0040e807
add esp, 0x14
mov byte [esi + 8], 1
pop edi
pop esi
leave
ret

Function at 0x43263c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x432695
mov al, byte [esi]
push edi
mov edi, dword [esi + 4]
mov byte [ebp - 4], al
movzx eax, al
push 0
push eax
or edi, 2
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up
push str.C:projectsAmmyy_sources_target_trKeymap.cpp
push 2
push 0x47a230
call fcn.0040e807
add esp, 0x14
mov byte [esi + 9], 1
pop edi
pop esi
leave
ret

Function at 0x432698
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 8], bl
je 0x4326d3
mov al, byte [esi]
mov edi, dword [esi + 4]
mov byte [ebp - 4], al
push ebx
movzx eax, al
push eax
or edi, 2
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up
jmp 0x4326fe
cmp byte [esi + 9], bl
je 0x432712
mov al, byte [esi]
mov edi, dword [esi + 4]
mov byte [ebp - 4], al
push ebx
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down
push str.C:projectsAmmyy_sources_target_trKeymap.cpp
push 2
push 0x47a230
call fcn.0040e807
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432717
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push esi
push edi
movzx edi, byte [esp + 0xc]
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [esp + 0x10]
shr eax, 0xf
and eax, 1
je 0x4327ba
test esi, esi
jne 0x4327b7
mov ecx, 0x4737c0
test eax, eax
mov eax, str.down
jne 0x43274c
mov eax, 0x4737c0
push ebx
push ebp
push ecx
push eax
push edi
mov ebp, str.C:projectsAmmyy_sources_target_trKeymap.cpp
push str.setshiftstate__d_____s___s_
push ebp
mov ebx, 0x47a230
push 2
push ebx
call fcn.0040e807
add esp, 0x1c
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
inc esi
inc esi
push esi
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
mov eax, str.down
jne 0x4327a2
mov eax, 0x4737c0
push eax
push edi
push str.new_state__d___s_
push ebp
push 2
push ebx
call fcn.0040e807
add esp, 0x18
pop ebp
pop ebx
pop edi
pop esi
ret
test esi, esi
je 0x4327b7
mov ecx, str.down
jmp 0x43273e

Function at 0x4338c7
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
jne 0x4338dd
mov eax, 0x36b1
jmp 0x4339a8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
jne 0x4338f2
mov eax, 0x36b2
jmp 0x4339a8
mov dword [0x47aaf0], esi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, dword [0x47aaf0]
mov dword [0x47aaf4], eax
mov eax, dword [ecx]
call dword [eax + 0x24]
push 0x47aafc
push ebx
push ebx
push 0x433782
push ebx
push ebx
mov dword [0x47aaf8], eax
mov byte [0x47aae8], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x433958
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Start____CreateThread___error_d
push str.C:projectsAmmyy_sources_target_trMain.cpp
push ebx
push 0x47a230
call fcn.0040e807
add esp, 0x14
mov eax, 0x36b3
jmp 0x4339a8
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x38]
xor esi, esi
cmp byte [0x47aae8], bl
jne 0x433987
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jl 0x433962
cmp byte [0x47aae8], bl
jne 0x433987
mov eax, 0x36b4
jmp 0x4339a8
push dword [0x47aafc]
push str.Start__end_threadId_X
push str.C:projectsAmmyy_sources_target_trMain.cpp
push 2
push 0x47a230
call fcn.0040e807
add esp, 0x14
xor eax, eax
pop esi
pop ebx
ret
Function at 0x433d18
Capabilities:
Create thread

Disassembly:
mov eax, 0x4604bb
call fcn.0045d320
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00433a46
mov al, byte [ebp - 0xd]
xor ebx, ebx
lea edi, [esi + 8]
push ebx
push ebx
mov ecx, edi
mov dword [ebp - 4], ebx
mov byte [edi], al
call fcn.00424838
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 1
call fcn.00437886
lea eax, [esi + 0x238]
mov byte [ebp - 4], 2
push eax
mov dword [eax], ebx
mov ecx, dword [0x47aaf0]
mov edx, dword [ecx]
call dword [edx + 0x28]
lea edi, [esi + 0x14]
mov ecx, 0x80
xor eax, eax
push 0x24
rep stosd dword es:[edi], eax
mov word [esi + 0x214], bx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x433dab
lea ecx, [esi + 0x218]
push ecx
mov ecx, eax
call fcn.004378e7
jmp 0x433dad
xor eax, eax
mov dword [esi + 0x230], eax
mov ecx, dword [0x47aaf0]
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax + 0x44]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push 0x43426e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x234], eax
jne 0x433df8
push 0x1e
push str.C:projectsAmmyy_sources_target_trServer.cpp
lea ecx, [ebp - 0x1c]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x434755
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x434775
xor eax, eax
jmp 0x4347dc
lea eax, [ebp - 0x128]
push esi
push eax
push ebx
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x434795
xor esi, esi
jmp 0x4347d2
push dword [ebp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea eax, [ebp - 0x104]
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x4347ca
lea eax, [ebp - 0x128]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4347d0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
jmp 0x4347a5
mov edi, dword [ebp - 0x120]
mov esi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x434a9f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x8c]
cmp ecx, eax
jbe 0x434ac2
mov ecx, eax
test ecx, ecx
mov dword [esi + 0x78], ecx
je 0x434c50
xor edi, edi
cmp dword [esi + 0x6c], edi
jne 0x434b5c
mov eax, dword [esi + 0x88]
cmp eax, edi
je 0x434b5c
mov ebx, 0x4000
cmp eax, ebx
jae 0x434af5
mov ebx, eax
cmp ebx, edi
je 0x434c58
push ebx
push dword [esi + 0x64]
push esi
call fcn.004366c9
add esp, 0xc
test eax, eax
je 0x434c6e
sub dword [esi + 0x88], ebx
mov eax, dword [esi + 0x64]
test byte [esi + 0x3c], 1
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ebx
je 0x434b5c
test ebx, ebx
jbe 0x434b5c
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x64]
and eax, 0xfffd
add ecx, edi
or al, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor byte [ecx], dl
mov eax, dword [esi + 0x64]
mov al, byte [edi + eax]
push eax
lea eax, [esi + 0x90]
push eax
call fcn.00434d93
inc edi
pop ecx
cmp edi, ebx
pop ecx
jb 0x434b23
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x6c]
cmp eax, ecx
jbe 0x434b6b
mov eax, ecx
test eax, eax
je 0x434b9b
mov edx, dword [esi + 0x68]
sub ecx, eax
lea edi, [edx + eax]
mov dl, byte [edx + eax - 1]
sub dword [esi + 0x8c], eax
sub dword [esi + 0x9c], eax
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], edi
jne 0x434b9b
cmp dl, byte [esi + 0xa0]
jne 0x434c77
cmp word [esi + 0x3e], 0
jne 0x434bf0
mov eax, dword [esi + 0x78]
mov edi, dword [esi + 0x6c]
cmp eax, edi
jae 0x434bae
mov edi, eax
push edi
push dword [esi + 0x68]
push dword [esi + 0x74]
call sub.MSVCRT.dll_memcpy
push edi
lea ebx, [esi + 0x84]
push dword [esi + 0x74]
push dword [ebx]
call fcn.00434c80
sub dword [esi + 0x8c], edi
sub dword [esi + 0x6c], edi
sub dword [esi + 0x78], edi
add dword [esi + 0x74], edi
add dword [esi + 0x68], edi
add dword [esi + 0x7c], edi
add esp, 0x18
add dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [esi + 0x8c]
jmp 0x434c42
mov eax, dword [esi + 0x74]
mov ebx, dword [esi + 0x7c]
mov dword [ebp + 8], eax
lea eax, [esi + 0x68]
push 2
push eax
call fcn.00434de6
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
pop ecx
je 0x434c12
cmp eax, 1
jne 0x434c63
mov edi, dword [esi + 0x7c]
sub edi, ebx
lea ebx, [esi + 0x84]
push edi
push dword [ebp + 8]
push dword [ebx]
call fcn.00434c80
sub dword [esi + 0x8c], edi
add dword [ebp - 4], edi
add esp, 0xc
cmp dword [ebp + 0xc], 1
mov dword [ebx], eax
mov eax, dword [esi + 0x8c]
je 0x434c50
test eax, eax
je 0x434c50
cmp dword [esi + 0x78], 0
jne 0x434acd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x84]
cmp eax, dword [esi + 0x44]
je 0x434c6a
mov dword [esi + 8], 0x12
xor eax, eax
jmp 0x434c53
mov dword [esi + 8], 7
jmp 0x434c6a
mov dword [esi + 8], 0x13
jmp 0x434c6a
Function at 0x434c80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov edx, 0xff
jb 0x434d69
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
shr edi, 3
movzx ebx, byte [ecx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, edx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4624d8]
xor eax, ebx
inc ecx
mov esi, eax
movzx ebx, byte [ecx]
and esi, edx
xor esi, ebx
movzx ebx, byte [ecx + 1]
mov esi, dword [esi*4 + 0x4624d8]
shr eax, 8
xor esi, eax
inc ecx
mov eax, esi
and eax, edx
xor eax, ebx
movzx ebx, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4624d8]
shr esi, 8
xor eax, esi
inc ecx
mov esi, eax
and esi, edx
xor esi, ebx
movzx ebx, byte [ecx + 1]
mov esi, dword [esi*4 + 0x4624d8]
shr eax, 8
xor esi, eax
inc ecx
mov eax, esi
and eax, edx
xor eax, ebx
movzx ebx, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4624d8]
shr esi, 8
xor eax, esi
inc ecx
mov esi, eax
and esi, edx
xor esi, ebx
movzx ebx, byte [ecx + 1]
mov esi, dword [esi*4 + 0x4624d8]
shr eax, 8
xor esi, eax
inc ecx
mov eax, esi
and eax, edx
xor eax, ebx
movzx ebx, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4624d8]
shr esi, 8
xor eax, esi
inc ecx
mov esi, eax
and esi, edx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4624d8]
xor eax, esi
inc ecx
dec edi
jne 0x434ca3
pop ebx
jmp 0x434d6c
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
je 0x434d8d
movzx edi, byte [ecx]
mov esi, eax
and esi, edx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4624d8]
xor eax, esi
inc ecx
dec dword [ebp + 0x10]
jne 0x434d72
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x434d93
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x4624d8]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x4624d8]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x4366c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test byte [esi], 1
jne 0x4366fd
lea eax, [ebp + 0x10]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4366f8
and dword [ebp + 0x10], eax
mov dword [esi + 8], 7
mov eax, dword [ebp + 0x10]
jmp 0x43672a
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x436712
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 4]
push edi
add eax, ecx
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x14], edi
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x43672d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [eax], bl
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
je 0x43675a
cmp byte [eax + 1], 0x3a
jne 0x43675a
inc eax
inc eax
cmp byte [eax], 0x5c
jne 0x436760
inc eax
cmp byte [eax], bl
je 0x4367b2
push 0x5c
push eax
call fcn.004367b9
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x43677b
cmp dword [ebp + 0xc], ebx
je 0x4367b2
jmp 0x43677d
mov byte [esi], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x43679b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4367a7
cmp esi, ebx
je 0x4367b2
mov byte [esi], 0x5c
lea eax, [esi + 1]
jmp 0x436760
cmp esi, ebx
je 0x4367ae
mov byte [esi], 0x5c
xor eax, eax
jmp 0x4367b5
push 1
pop eax
pop esi
pop ebx
leave
ret

Function at 0x4367cf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp word [eax], di
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], edi
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
je 0x4367ff
cmp word [eax + 2], 0x3a
jne 0x4367ff
add eax, 4
cmp word [eax], 0x5c
jne 0x436807
inc eax
inc eax
cmp word [eax], di
je 0x43685f
push 0x5c
push eax
call fcn.00436866
mov esi, eax
pop ecx
cmp esi, edi
pop ecx
jne 0x436823
cmp dword [ebp + 0xc], edi
je 0x43685f
jmp 0x436826
mov word [esi], di
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436844
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x436852
cmp esi, edi
je 0x43685f
mov word [esi], 0x5c
lea eax, [esi + 2]
jmp 0x436807
cmp esi, edi
je 0x43685b
mov word [esi], 0x5c
xor eax, eax
jmp 0x436862
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x436880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x436a38
cmp dword [esi + 0x24], 0xffffffff
je 0x436a38
mov eax, dword [ebp + 0x14]
xor edi, edi
test al, 1
mov dword [esi + 8], edi
je 0x4368ff
cmp word [esi + 0x58], di
jne 0x4368cd
push esi
call fcn.00436ad2
cmp dword [esi + 8], edi
pop ecx
jne 0x436a2c
mov word [esi + 0x58], 1
mov ebx, dword [ebp + 0x10]
push dword [ebx + 0x20]
push dword [ebp + 0xc]
push esi
call fcn.00434a9f
add esp, 0xc
mov dword [ebx + 0x20], eax
cmp dword [esi + 8], edi
jne 0x4368f6
cmp dword [esi + 0x8c], edi
je 0x4368f6
push 5
jmp 0x436a3a
mov word [esi + 0x58], di
jmp 0x436a2c
mov ebx, dword [ebp + 0x10]
test byte [ebx + 4], 0x10
je 0x436931
test al, 2
je 0x43692a
push 1
push dword [ebp + 0xc]
test eax, 0x80000000
je 0x43691f
call fcn.004367cf
jmp 0x436924
call fcn.0043672d
pop ecx
cmp eax, edi
pop ecx
je 0x436988
xor eax, eax
jmp 0x436a3b
cmp eax, 4
jne 0x43693b
mov eax, dword [ebp + 0xc]
jmp 0x436980
mov dword [ebp + 8], eax
push edi
and dword [ebp + 8], 0x80000000
push dword [ebp + 0xc]
je 0x436952
call fcn.004367cf
jmp 0x436957
call fcn.0043672d
pop ecx
cmp eax, edi
pop ecx
je 0x436988
push edi
cmp dword [ebp + 8], edi
push dword [ebx + 4]
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
je 0x43697a
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x436980
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x436994
mov dword [esi + 8], 1
jmp 0x436a2c
push esi
call fcn.00436ad2
cmp dword [esi + 8], edi
pop ecx
jne 0x436a1d
cmp dword [esi + 0x34], edi
mov ebx, 0x4000
jne 0x4369c0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [esi + 0x34], eax
jne 0x4369c0
mov dword [esi + 8], 2
cmp dword [esi + 8], edi
jne 0x436a00
push ebx
push dword [esi + 0x34]
push esi
call fcn.00434a9f
add esp, 0xc
cmp eax, edi
mov dword [ebp + 8], eax
je 0x436a00
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [esi + 0x34]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4369f7
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
je 0x4369c0
mov dword [esi + 8], 3
jmp 0x4369c0
cmp dword [esi + 8], edi
mov ebx, dword [ebp + 0x10]
jne 0x436a1d
lea eax, [ebx + 0x18]
push eax
lea eax, [ebx + 8]
add ebx, 0x10
push eax
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [ebp + 0x14], 4
je 0x436a2c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00436a40
mov eax, dword [esi + 8]
pop ecx
jmp 0x436a3b
push 9
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x437ef6
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x460604
call fcn.0045d320
sub esp, 0x10
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.0043789c
and dword [ebp - 4], 0
cmp dword [esi + 0x1c], 0
je 0x437f32
mov al, byte [ebp - 0xd]
push 0x46a658
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x14]
push eax
push 4
push esi
push 0x437cc7
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp - 0x14]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jne 0x437f6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x46a528
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x437f94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x46a528
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x437fb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x46a528
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, ebx
mov dword [esi + 0x1c], 1
call fcn.004378a4
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4383aa
Capabilities:
Create thread

Disassembly:
mov eax, 0x46065c
call fcn.0045d320
sub esp, 0x20
push ebx
push esi
push edi
mov edi, str.C:projectsAmmyy_sourcesmain_soundAudioIn.cpp
mov dword [ebp - 0x10], esp
push str.StartSound__1
push edi
mov ebx, 0x47a230
mov esi, ecx
push 2
push ebx
mov dword [ebp - 0x14], esi
call fcn.0040e807
add esp, 0x10
cmp dword [esi + 0x78], 0
je 0x438401
lea eax, [ebp - 0x1c]
push str.CAudioIn::Start:_Sound_Capture_thread_is_already_active
push eax
call fcn.004109c8
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
push 0x465b58
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp + 8]
cmp eax, 0x3e8
mov dword [esi], eax
jb 0x438414
cmp eax, 0xbb80
jbe 0x438426
push 0x38
push edi
lea ecx, [ebp - 0x2c]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
mov ax, word [esi + 4]
cmp ax, 8
je 0x438448
cmp ax, 0x10
je 0x438448
push 0x39
push edi
lea ecx, [ebp - 0x2c]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
mov ax, word [esi + 6]
cmp ax, 1
je 0x43846a
cmp ax, 2
je 0x43846a
push 0x3a
push edi
lea ecx, [ebp - 0x2c]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
movzx eax, word [esi + 4]
movzx ecx, word [esi + 6]
shr eax, 3
imul eax, ecx
imul eax, dword [esi]
xor edx, edx
mov ecx, 0x3e8
lea eax, [eax + eax*4]
shl eax, 2
div ecx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004385e5
push str.StartSound__2
push edi
push 2
push ebx
call fcn.0040e807
and dword [ebp - 4], 0
add esp, 0x10
mov ecx, esi
push 0x1f40
push 3
push 0
call fcn.00438dc8
push str.StartSound__3
push edi
push 2
push ebx
call fcn.0040e807
xor edi, edi
add esp, 0x10
mov dword [esi + 0x7c], edi
push edi
push edi
push esi
push 0x438942
push edi
push edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x78], eax
cmp dword [esi + 0x78], edi
jne 0x438522
call dword [sym.imp.MSVCRT.dll__errno]
push dword [eax]
lea eax, [ebp - 0x24]
push str.Failed_to_start_Sound_Capture_thread__errno___d_
push eax
call fcn.004109c8
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x465b58
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0x14]
call fcn.00438533
push 0
push 0
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4