Function at 0x10f28c0
Capabilities:
Delete file
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
call fcn.01046f30
cmp dword [esi + 0x998], 0
je 0x10f2925
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
push 0x101a3b4
push 0x10100c8
push DirectSoundEnumerateW
push eax
call fcn.010895a0
test eax, eax
je 0x10f2925
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x10f2925
push 0x101a398
push esi
call fcn.010ebe60
mov eax, dword [esi]
push 0
push eax
call fcn.010a2540
push esi
call fcn.010e2e40
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x2f204], 1
call fcn.0103ca70
mov eax, dword [esi]
push 0x1017140
add eax, 0x237a4
push 0x1009bc4
push eax
call fcn.01061570
mov edi, eax
test edi, edi
je 0x10f297b
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp dword [esi + 0x944], 0
jne 0x10f2ac0
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x22e078
push eax
call fcn.0106a740
push 1
lea ecx, [esi + 0x1648]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x22e038
push eax
call fcn.0106a740
mov edx, dword [esi]
lea ecx, [esi + 0x896]
push ecx
push edx
call fcn.0108a610
mov dword [ebp - 4], 2
nop
mov eax, dword [esi]
push 0x100a894
add eax, 0x25f5c
push 0x1009bc4
push eax
call fcn.01061570
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x10f2a8c
mov eax, dword [esi]
push 0x100a894
add eax, 0x25f5c
push 0x1009bc4
push eax
call fcn.01061570
mov dword [ebp - 8], eax
test eax, eax
je 0x10f2a7c
mov edi, dword [esi]
push 0x40
call fcn.0101c4b0
lea ebx, [edi + eax*4 + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.01087c30
push 0
push edi
call fcn.01037720
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push edi
mov dword [ebp - 0xc], 0
call fcn.01068d60
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [esi]
cmp dword [edx + 0x26b28], 0
je 0x10f2aa8
push 1
push 0x100a894
push 0
push 0
push esi
call fcn.010cc140
sub dword [ebp - 4], 1
jne 0x10f29e0
mov eax, dword [esi]
push eax
call fcn.01095bf0
push esi
call fcn.010e1cb0
push 1
push esi
call fcn.010bbcf0
push esi
call fcn.010bc710
test eax, eax
je 0x10f2ad8
push esi
call fcn.010bc820
mov edi, dword [esi]
push 0x100e45c
lea ebx, [edi + 0x237a4]
push ebx
push edi
call fcn.01071b20
push 0x100e450
push ebx
push edi
call fcn.01071b20
push esi
call fcn.010bbdb0
mov edx, dword [esi]
lea eax, [edx + 0x237a4]
test eax, eax
jne 0x10f2b0e
xor ecx, ecx
jmp 0x10f2b23
cmp word [eax], 0
mov ecx, eax
je 0x10f2b1f
add ecx, 2
cmp word [ecx], 0
jne 0x10f2b16
sub ecx, eax
sar ecx, 1
push 0
push 0x1037920
push ecx
push eax
push edx
call fcn.0101f8f0
mov ecx, dword [esi]
push 0x101233c
push 0x10122e0
push DirectSoundEnumerateW
push ecx
call fcn.01089d40
mov edx, dword [esi]
push 0
push 0
push 0
push 0x10100c8
push DirectSoundEnumerateW
push edx
call fcn.010898e0
mov edi, dword [esi]
lea ebx, [edi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.01087c30
mov ecx, dword [edi + 0x1e0]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0
push reloc.DSOUND.dll_DirectSoundEnumerateW
mov dword [ebp + 8], 0
call ecx
test eax, eax
jne 0x10f2bc2
mov edx, dword [ebp + 8]
push 1
push eax
push eax
push edx
push 0x10100c8
push 0x108a1d0
push edi
call fcn.01089e70
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x1f4]
push eax
call ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov edx, dword [esi]
push edx
call fcn.010b7aa0
cmp dword [esi + 0x944], 0
jne 0x10f2c7e
cmp dword [ebp + 0xc], 0
je 0x10f2c7e
mov ebx, dword [esi]
push 0
push 1
lea edi, [esi + 0x272]
push edi
push ebx
call fcn.01068d60
test eax, eax
jne 0x10f2c06
push edi
push ebx
call fcn.010cc600
test edi, edi
jne 0x10f2c0e
xor eax, eax
jmp 0x10f2c23
cmp word [edi], 0
mov eax, edi
je 0x10f2c1f
add eax, 2
cmp word [eax], 0
jne 0x10f2c16
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0101e7a0
mov edi, eax
test edi, edi
je 0x10f2c5c
push 0x5c
push edi
call fcn.0101e680
test eax, eax
je 0x10f2c4c
xor ecx, ecx
mov word [eax], cx
mov edx, dword [esi]
mov eax, dword [edx + 0x10c]
push edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
mov ecx, dword [eax + 0x2f24c]
mov edx, dword [eax + 0x304]
push ecx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10c]
lea ecx, [eax + 0x237a4]
push ecx
call edx
mov esi, dword [esi]
lea eax, [esi + 0x237a4]
push eax
push esi
call fcn.01034da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8