Function at 0x110773b0
Capabilities:
Enumerate files on windows
Get file attributes
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111de334
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
push str.Terminate_Client32__err_d__n
call fcn.111bd7b0
add esp, 8
call fcn.111bbd10
test eax, eax
je 0x11077429
push 0x1127b8d8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jle 0x11077429
push str.Error._Multiple_Terminate.__n
call fcn.111bd7b0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
jmp 0x11077420
push 0xea60
call esi
jmp 0x11077420
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov byte [0x1127ad2a], 1
xor edi, edi
push str.deleting_ipc_n
mov dword [0x1127aa74], 1
mov dword [0x1127aa70], edi
call fcn.111bd7b0
mov ecx, dword [0x1127ad18]
add esp, 4
mov esi, ecx
cmp ecx, edi
je 0x11077478
call fcn.111062f0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.deleted_ipc_n
mov dword [0x1127ad18], edi
call fcn.111bd7b0
mov ecx, dword [0x1127b21c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x138]
add esp, 4
push edi
call edx
mov eax, dword [0x1127ad08]
cmp eax, edi
je 0x110774ac
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp ebx, edi
jg 0x110774e7
cmp dword [0x1127aa4c], edi
jne 0x110774e7
cmp dword [0x1127acfc], edi
jne 0x110774e7
push edi
push edi
push 0x3e9
call fcn.11067670
mov eax, dword [0x1127b21c]
push 0x1127aa8c
push 1
push 0x2af9
push edi
push eax
call fcn.1115a050
add esp, 0x20
mov ecx, dword [0x1127b21c]
cmp ecx, edi
je 0x11077501
cmp dword [0x1127acfc], edi
je 0x11077501
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push edi
call eax
mov ecx, dword [0x1127d368]
cmp ecx, edi
je 0x11077512
push 3
call fcn.11107d00
mov eax, dword [0x1127ac60]
cmp eax, edi
je 0x11077522
mov dword [eax + 0x5c], 1
call fcn.110672c0
call fcn.11065a80
mov ecx, dword [0x1127ad34]
cmp ecx, edi
je 0x11077541
mov dword [0x1127ad34], edi
call fcn.11142ba0
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x114]
push 1
push 1
push 1
call eax
call fcn.111babb0
test al, al
je 0x1107756e
cmp byte [0x1127ad17], 0
jne 0x1107756e
call fcn.11059a40
mov ecx, dword [0x1127ac60]
cmp ecx, edi
je 0x1107757d
call fcn.110b6aa0
cmp dword [0x1127ac14], edi
je 0x110775bd
cmp dword [0x1127aa48], 0x30001
jg 0x110775bd
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push 1
call eax
mov ecx, dword [0x1127b21c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push 0x81
call eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Unload_Hook_n
call fcn.111bd7b0
mov ecx, dword [0x1127b21c]
add esp, 4
cmp ecx, edi
je 0x110775dc
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
push edi
call eax
mov ecx, dword [0x1127aa68]
cmp ecx, edi
je 0x11077606
push edi
push edi
push str.HookDirectSound
push str.Audio
call fcn.110bbc00
cmp eax, 1
jne 0x11077606
push eax
push edi
call fcn.1106d160
add esp, 8
cmp dword [0x1127acfc], edi
jne 0x11077616
cmp dword [0x1127ad10], edi
je 0x1107766a
cmp byte [0x1127ad29], 0
je 0x1107766a
lea ecx, [ebp - 0x488]
call fcn.1111a8f0
push eax
push 6
mov dword [ebp - 4], edi
call fcn.11140d70
add esp, 8
lea ecx, [ebp - 0x488]
mov dword [ebp - 4], 0xffffffff
call fcn.1111ab70
cmp dword [0x1127abdc], edi
je 0x110779b3
push 2
call fcn.111a74e0
add esp, 4
mov dword [0x1127abdc], eax
jmp 0x110779b3
push 1
call fcn.110645f0
add esp, 4
cmp dword [0x1127b854], edi
je 0x110776b0
mov dword [0x1127b868], 1
cmp dword [0x1127b858], edi
jne 0x110776b0
mov esi, dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [0x1127b854]
push 0
push 0
push 0
push ecx
call esi
call fcn.11170920
cmp dword [0x1127b858], edi
je 0x11077694
mov ecx, dword [0x1127ac60]
xor edi, edi
cmp ecx, edi
je 0x110776f4
cmp dword [ecx + 0x10], edi
jne 0x110776d1
call fcn.11170920
mov ecx, dword [0x1127ac60]
cmp dword [ecx + 0x10], edi
je 0x110776c1
mov esi, ecx
call fcn.110b6a00
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [0x1127ac60], edi
cmp dword [0x1127acfc], edi
jne 0x110776f4
call fcn.110672c0
cmp dword [0x1127ad30], edi
je 0x11077735
cmp dword [0x1127acfc], edi
jne 0x11077735
push str.remove_smartcard_devices_n
call fcn.111bd7b0
mov ecx, dword [0x1127ad30]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esp, 4
push 0x4e20
call eax
mov ecx, dword [0x1127ad30]
cmp ecx, edi
je 0x11077735
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp dword [0x1127ad00], edi
je 0x1107774c
call fcn.1115ffd0
call fcn.11163600
call fcn.111609a0
mov ecx, dword [0x1127ab0c]
cmp ecx, edi
je 0x11077762
push 1
push 0x1124b642
call fcn.110d6860
push str.TermUI..._n
call fcn.111bd7b0
call fcn.111b2090
push str.Termed
call fcn.111bd7b0
mov ecx, dword [0x1127ac24]
add esp, 8
mov esi, ecx
cmp ecx, edi
je 0x11077798
call fcn.1116f760
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [0x1127ab0c]
cmp ecx, edi
je 0x110777aa
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [0x1127b840]
cmp ecx, edi
je 0x11077810
call fcn.11171060
mov esi, eax
cmp esi, edi
je 0x1107780a
nop
mov eax, dword [esi]
cmp eax, 1
jne 0x110777db
mov ecx, dword [esi + 0x10]
movzx edx, word [ecx]
and edx, 0xfff
push edx
push str.Warning._Unprocessed_notify_NC_CMD__cmd_d_n
jmp 0x110777e1
push eax
push str.Warning._Unprocessed_notify__type_d_n
call fcn.111bd7b0
add esp, 8
mov ecx, esi
call fcn.110c4fc0
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov ecx, dword [0x1127b840]
add esp, 4
call fcn.11171060
mov esi, eax
cmp esi, edi
jne 0x110777c0
mov ecx, dword [0x1127b840]
mov esi, ecx
cmp ecx, edi
je 0x11077824
call fcn.11171490
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x1127aa64], edi
je 0x11077911
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x110a6970
push 0x20000105
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x110659d0
push 0x3000010c
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x110772b0
push 0x30000110
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push fcn.11076ae0
push 0x3000011d
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x1106d240
push 0x3000011e
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push 0x20000000
push 0x11066110
push 0x3000012b
call edx
mov ecx, dword [0x1127aa60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push edi
push 0x1106dbf0
push 0x10000121
call edx
mov ecx, dword [0x1127aa64]
mov esi, ecx
cmp ecx, edi
je 0x11077911
call fcn.11171490
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.delete_gMain.ev_n
call fcn.111bd7b0
mov ecx, dword [0x1127aa60]
add esp, 4
mov esi, ecx
cmp ecx, edi
je 0x11077938
call fcn.110ed490
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x1127b844]
push eax
mov dword [0x1127aa60], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1127ac08]
mov esi, dword [sym.imp.MSVCR100.dll_free]
cmp eax, edi
je 0x1107795f
push eax
call esi
add esp, 4
mov ecx, dword [0x1127ac20]
cmp ecx, edi
je 0x110779a1
call fcn.11171060
cmp eax, edi
je 0x11077987
push eax
call esi
mov ecx, dword [0x1127ac20]
add esp, 4
call fcn.11171060
cmp eax, edi
jne 0x11077972
mov ecx, dword [0x1127ac20]
mov esi, ecx
cmp ecx, edi
je 0x110779a1
call fcn.11171490
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [0x1127aa5c]
cmp ecx, edi
je 0x110779b3
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
call fcn.11034ff0
xor ebx, ebx
cmp eax, ebx
je 0x110779d2
push eax
call fcn.11034d00
push eax
push str.Error__s_unloading_audiocap_dll_n
call fcn.111bd7b0
add esp, 0xc
cmp dword [0x1127ace4], ebx
je 0x11077b4a
cmp dword [0x1127aa4c], ebx
jne 0x11077b4a
cmp dword [0x1127ace8], ebx
jne 0x11077b4a
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
jne 0x11077b4a
push 8
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x46c], eax
mov dword [ebp - 4], 1
cmp eax, ebx
je 0x11077a4b
mov ecx, dword [0x1127aa44]
push ecx
mov ecx, eax
call fcn.111b82f0
mov esi, eax
jmp 0x11077a4d
xor esi, esi
mov dword [ebp - 0x46c], esi
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.111b8450
push ebx
push ebx
push 0x4b
mov ecx, esi
call fcn.111b8460
test eax, eax
jne 0x11077b36
lea edx, [ebp - 0x218]
push 0x5c
push edx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x11077a9e
push 0x106e
push str.CLIENT32.CPP
push str.pSlash
call fcn.11067750
mov ecx, 0x1120ae5c
lea edx, [eax + 2]
sub edx, ecx
jmp 0x11077ab0
movzx eax, word [ecx]
mov word [ecx + edx], ax
add ecx, 2
test ax, ax
jne 0x11077ab0
push 0x250
lea eax, [ebp - 0x468]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x468]
push ecx
lea edx, [ebp - 0x218]
push edx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x11077b2a
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x11077b00
test byte [ebp - 0x468], 0x10
jne 0x11077b0a
inc edi
lea eax, [ebp - 0x468]
push eax
push esi
call ebx
test eax, eax
jne 0x11077b00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0xe
jl 0x11077b2a
push 0
push 0
jmp 0x11077b2e
push 1
push 1
call fcn.11196200
add esp, 8
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], 0xffffffff
call fcn.11066350
xor ebx, ebx
mov ecx, dword [0x1127b21c]
mov edi, dword [ebp + 8]
cmp ecx, ebx
je 0x11077b80
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [edi + 1]
neg eax
sbb eax, eax
and eax, edi
push eax
call edx
mov ecx, dword [0x1127b21c]
cmp ecx, ebx
je 0x11077b7a
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1127b21c], ebx
cmp dword [0x1127acfc], ebx
jne 0x11077bd8
cmp dword [0x1127ad10], ebx
jne 0x11077bd8
mov ecx, dword [0x1127aa68]
cmp ecx, ebx
je 0x11077ba2
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [0x1127aa6c]
mov dword [0x1127aa68], ebx
cmp ecx, ebx
je 0x11077bba
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [0x1127aa58]
mov dword [0x1127aa6c], ebx
cmp ecx, ebx
je 0x11077bd2
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x1127aa58], ebx
call fcn.111be2a0
push str.Stop_tracing__almost_terminated_n
call fcn.111bd7b0
add esp, 4
call fcn.111bd760
cmp dword [0x1127ac14], ebx
je 0x11077c2b
cmp dword [0x1127aa48], 0xa0003
mov esi, dword [sym.imp.USER32.dll_ExitWindowsEx]
jl 0x11077c19
push ebx
push 2
call esi
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1127ac14], 2
push ebx
jne 0x11077c27
push 5
jmp 0x11077c29
push 6
call esi
cmp edi, 0xffffffff
jne 0x11077c3b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]