joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110c7e0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push ecx
call fcn.01088760
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 1
push 1
push eax
call fcn.010b3180
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x1082940
push eax
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x110c7c0
push 0
push 0
mov ebx, eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10c6db0
push 0
push 0
call edi
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x10c6e20
push 0
push 0
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10d2ba0
push 0
push 0
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f24b0
push 0
push 0
call edi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x10d2be0
push 0
push 0
call edi
push 0x11170
push 1
lea edx, [ebp - 0x2c]
push edx
push 6
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x110c8f7
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
inc edi
cmp edi, 6
jl 0x110c8e4
mov ecx, dword [esi]
mov edx, dword [ecx]
mov dword [ebp + 8], edx
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x2c]
test eax, eax
je 0x110c914
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1bc]
call ecx
inc edi
cmp edi, 6
jl 0x110c900
test ebx, ebx
je 0x110c955
cmp ebx, 0xffffffff
je 0x110c955
push 1
add esi, 0x2fcf8
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x110c94e
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x110cad0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2834c]
push eax
call fcn.0104e630
mov dword [esi + 0x2a090], eax
test eax, eax
je 0x110cb20
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x110ba80
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x110cb20
cmp esi, 0xffffffff
je 0x110cb20
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x11120a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010a5660
test dword [esi + 0x28418], 0x200
mov ebx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
jne 0x111217a
mov eax, dword [esi + 8]
cmp dword [eax + 0x9a8], 0
jne 0x111217a
mov ecx, dword [ebp + 0xc]
test dword [ecx + 0x44c], 0x1000
jne 0x111217a
push 0x100e4d8
push 0x100d8b4
call fcn.0101d7a0
test eax, eax
jne 0x1112136
push 0x100e4e4
push 0x100d8b4
call fcn.0101d7a0
test eax, eax
jne 0x1112136
push 0x100e4d0
push 0x100d8b4
call fcn.0101d7a0
test eax, eax
jne 0x1112136
push 0x101a938
push 0x100d8b4
call fcn.0101d7a0
test eax, eax
je 0x111217a
test byte [esi + 0x284dc], 0x40
jne 0x111217a
cmp dword [esi + 0x2a1cc], 0
je 0x111217a
push esi
push 0x10e84d0
call fcn.0101cb80
mov edi, eax
test edi, edi
je 0x111216a
cmp edi, 0xffffffff
je 0x111216a
push 0xffffffffffffffff
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call fcn.010db540
push 0
push 1
push esi
call fcn.010c3cd0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x44c]
test eax, 0x800
je 0x1112264
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
lea eax, [esi + 0x2a140]
push eax
call ebx
mov ecx, dword [esi + 8]
push 2
push ecx
mov dword [ebp + 0xc], 0
call fcn.010a5800
test eax, eax
jne 0x11121c9
push esi
call fcn.010bdb40
cmp eax, 2
je 0x11121c9
test byte [esi + 0x28418], 0x10
je 0x11121d0
mov dword [ebp + 0xc], 0x10
push 1
lea edx, [esi + 0x2a148]
push edx
mov edi, 2
call ebx
push 1
lea eax, [esi + 0x2a144]
push eax
call ebx
test dword [esi + 0x28418], 0x400000
je 0x11121fc
mov edi, 0x22
cmp dword [esi + 0x2875c], 0
je 0x1112229
test byte [esi + 0x28704], 1
jne 0x1112229
mov ecx, dword [ebp + 0xc]
push edi
push 0
push 0x104e1e0
push ecx
push 0x4001
push 0
push esi
call fcn.0110fbd0
jmp 0x1112242
mov edx, dword [ebp + 0xc]
push edi
push 0
push 0x104e1e0
push edx
push 0x4001
push 0
push esi
call fcn.0110fa90
push 1
lea eax, [esi + 0x2a1d4]
push eax
call ebx
test eax, eax
jne 0x11122c4
push esi
push 0x10e8fa0
push esi
call fcn.0104e8f0
pop edi
pop esi
pop ebx
pop ebp
ret 8
test al, al
jns 0x1112295
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x11074a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1112295
cmp edi, 0xffffffff
je 0x1112295
push 0xffffffffffffffff
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0xc]
test dword [eax + 0x44c], 0x200
jne 0x11122be
cmp dword [eax + 0x18c], 0
jne 0x11122be
push 0
push 3
push esi
call fcn.0110fd70
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
call fcn.01111fd0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1112450
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2834c]
push edi
xor edi, edi
lea ebx, [edi + 1]
cmp dword [eax + 0x14], edi
je 0x11124c4
mov eax, dword [esi + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x26a8c], 6
jb 0x111247e
cmp dword [eax + 0x60], edi
je 0x1112488
push eax
call fcn.01095fa0
test eax, eax
je 0x11124af
mov eax, dword [esi + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x10151bc
push 0x10100c8
mov dword [ebp + 8], ebx
mov ecx, dword [eax]
push DirectSoundEnumerateW
push ecx
call fcn.010891e0
mov edi, ebx
mov edx, dword [esi + 0x2834c]
mov dword [edx + 0x17c], ebx
mov eax, dword [esi + 8]
push eax
call fcn.010a56d0
push esi
mov dword [esi + 0x407c], 0
call fcn.0110a1a0
test eax, eax
jne 0x11124e9
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.0110a1a0
push esi
call fcn.010db540
push 0x1d
push esi
call fcn.010fbbb0
mov ecx, dword [esi + 8]
push 0
push ecx
call fcn.010941f0
mov eax, dword [esi + 0x2834c]
cmp dword [eax + 8], 0
je 0x1112517
push eax
push esi
call fcn.01103b30
jmp 0x1112536
cmp dword [eax + 0x14], 0
je 0x1112530
push eax
push esi
call fcn.01103b30
test eax, eax
jne 0x1112536
mov dword [esi + 0x407c], ebx
jmp 0x1112536
mov dword [eax + 0x178], ebx
cmp dword [esi + 0x407c], 0
jne 0x111255a
test edi, edi
jne 0x111255a
lea edx, [ebp + 8]
push edx
push edi
push esi
push 0x1111f10
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
jmp 0x111255c
xor edi, edi
mov eax, dword [esi + 0x2834c]
cmp dword [eax + 0x14], 0
je 0x111256e
push esi
call fcn.0104dab0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1113630
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
xor edi, edi
push 0x20a
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], edi
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x14]
add esp, 0xc
push ecx
push edi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x60]
lea eax, [esi + 0x448]
push eax
push 0x1014544
mov dword [ebp + 0xc], eax
mov eax, dword [edi]
push edx
push eax
call fcn.010b19c0
cmp dword [esi + 0x184], 0
mov ebx, eax
jne 0x1113819
test ebx, ebx
jne 0x111369f
mov dword [ebp - 0xc], eax
cmp dword [esi + 8], 0
jne 0x1113813
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x10100c8
push edi
call fcn.010962c0
test eax, eax
je 0x11137c9
cmp dword [ebp - 8], 0x80001cc
jae 0x11136e7
lea ecx, [ebp - 0x218]
push ecx
push esi
push edi
call fcn.01113580
jmp 0x1113820
test ebx, ebx
je 0x1113762
cmp dword [ebp - 4], 0
jne 0x1113744
mov ebx, dword [ebp + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [ebx]
mov ecx, dword [edx + 0x1b8]
push eax
call ecx
lea edx, [ebp - 0x218]
mov dword [ebx], 0
mov eax, dword [edi]
push edx
push eax
call fcn.010c82b0
test eax, eax
jne 0x1113729
lea ecx, [ebp - 0x218]
push ecx
push esi
push edi
call fcn.01113580
mov edx, dword [esi]
mov ecx, dword [edi]
push 5
push 0
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call fcn.0101f220
jmp 0x1113820
push esi
push edi
call fcn.010f33f0
test eax, eax
jne 0x1113820
mov dword [esi + 0x444], 1
jmp 0x1113813
mov ebx, dword [ebp - 4]
test ebx, ebx
jne 0x111379c
cmp dword [esi + 0x440], ebx
jne 0x111379c
cmp dword [esi + 0x24], ebx
jne 0x111379c
cmp dword [esi + 0x30], ebx
jne 0x111379c
cmp dword [esi + 0x34], ebx
jne 0x111379c
cmp dword [esi + 0x16c], ebx
jne 0x111379c
cmp dword [esi + 0x28], ebx
jne 0x111379c
cmp dword [esi + 0x170], ebx
jne 0x111379c
mov dword [esi + 0x24], 1
push esi
push edi
call fcn.010f33f0
test ebx, ebx
je 0x1113813
cmp dword [esi + 0x440], 0
je 0x1113813
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
push edi
call fcn.010ba430
mov dword [esi + 0x440], 0
jmp 0x1113813
test ebx, ebx
je 0x111380c
push 0xb
push edi
call fcn.010404a0
test eax, eax
jne 0x1113813
push 7
push edi
mov dword [esi + 0x10], 1
call fcn.010a5800
cmp eax, 1
jne 0x1113813
mov edx, dword [edi]
push edx
call fcn.010883f0
test eax, eax
jne 0x1113813
push edi
call fcn.010a64c0
test eax, eax
je 0x1113813
push esi
push edi
call fcn.0104db30
jmp 0x1113820
push esi
push edi
call fcn.010f33f0
cmp dword [ebp - 0xc], 0
je 0x1113820
push esi
push edi
call fcn.01113470
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1113840
cmp eax, 0xffffffff
je 0x1113840
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x1b8]
push eax
call edx
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1113a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0101fad0
mov edi, eax
test edi, edi
je 0x1113a8f
mov edx, dword [ebp - 4]
push edi
push edx
push esi
call fcn.0104d890
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x100bf14
push 0x100bf14
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
cmp dword [esi + 0x4c], 0
mov dword [esi + 0x18], eax
je 0x1113ae5
push 0x100c238
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1113acb
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [esi + 0x50], ecx
push eax
sete cl
push ecx
call fcn.01108ab0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x100c24c
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1113b00
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.011139b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1113b20
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
push 0x454
lea eax, [ebp - 0x454]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x179
push 8
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1113b8d
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x454]
push edx
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], ecx
call fcn.01113a50
mov eax, dword [ebp - 0x18]
push eax
call fcn.0102bbe0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1113bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1122590
push 0x11218b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, 1
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
jne 0x1113c3e
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
sub eax, dword [esi + 0x58]
cmp eax, 0x1388
jbe 0x1113c18
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 0
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0xc]
push edx
mov eax, dword [eax + 8]
call eax
call edi
mov dword [esi + 0x58], eax
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x1113c3e
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1113e10
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 1
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x1113e4e
push eax
push eax
push esi
push 0x1113d50
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1113e58
cmp eax, 0xffffffff
je 0x1113e58
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
ret 4
add esi, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
pop esi
pop ebp
ret 4

Function at 0x1113f20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push esi
push 0x1113e70
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x1c], eax
pop esi
pop ebp
ret 4

Function at 0x11140b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x1113f50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x11140dc
cmp eax, 0xffffffff
je 0x11140dc
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
ret 4

Function at 0x11142e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x1114326
cmp dword [eax + 0x50], 0
je 0x1114302
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
pop ebp
ret 4
push 0
push 0
push eax
push 0x1113f50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1114326
cmp eax, 0xffffffff
je 0x1114326
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
ret 4

Function at 0x11144a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x112891c], 0
jne 0x11144b3
call fcn.01114400
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x11144df
test dl, 7
je 0x11144df
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
dec esi
inc edx
test esi, esi
ja 0x11144c2
cmp esi, 8
jb 0x111456c
mov edi, esi
shr edi, 3
lea ecx, [ecx]
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x1128918]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1128918]
sub edi, 1
jne 0x11144f0
xor ecx, ecx
test esi, esi
jbe 0x111458c
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x1128918]
inc ecx
cmp ecx, esi
jb 0x1114573
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x11169d0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
push edi
mov dword [esi + 0xc18], 0
mov al, 1
jne 0x11169ef
mov al, byte [ebp + 0x10]
cmp byte [ebp + 0x14], 0
mov dword [ebp + 0x10], DirectSoundEnumerateW
je 0x1116a03
mov dword [ebp + 0x10], 0xc0000000
mov ebx, 1
test al, al
je 0x1116a11
mov ebx, 3
xor eax, eax
cmp byte [esi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.011148c0
test eax, eax
je 0x1116a4c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1116a4c
cmp word [eax], 0
je 0x1116a4c
mov ecx, dword [ebp + 0x10]
push 0
push edi
push 3
push 0
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
jmp 0x1116a62
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 0
push edi
push 3
push 0
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1116a7e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x1116a7e
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne al
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp + 0x13], al
test al, al
je 0x1116b35
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1116ad6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1116ab3
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x418]
push edi
push edx
call ebx
add esp, 0xc
jmp 0x1116adf
xor eax, eax
mov word [esi + 0x418], ax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1116b0a
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1116af0
mov ecx, dword [ebp + 8]
sub eax, edx
inc eax
push eax
push ecx
lea edx, [esi + 0x17]
push edx
call ebx
add esp, 0xc
jmp 0x1116b27
push 0
push 0
push 0x1000000
lea eax, [esi + 0x17]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
mov byte [eax], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [esi + 4]
push eax
mov ecx, esi
call fcn.01114850
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1116d10
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x1116d1f
xor al, al
pop esi
ret
cmp dword [esi + 4], 0xffffffff
je 0x1116d2a
call fcn.01116c80
cmp byte [esi + 0x13], 0
je 0x1116d1b
lea eax, [esi + 0x17]
test eax, eax
je 0x1116d4c
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
test eax, eax
jne 0x1116d4c
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1116d60
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [ebp + 0xc]
jne 0x1116d8b
cmp edi, 0x4e20
jbe 0x1116d80
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x1116dfd
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1116dd9
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 2
je 0x1116dbd
cmp eax, 3
jne 0x1116dd9
cmp edi, 0x4e20
jbe 0x1116dd9
push 0x4e20
push ebx
mov ecx, esi
call fcn.01116d60
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x1116df3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x1116df3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1116f80
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.011148c0
test eax, eax
je 0x1116faf
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1116faf
cmp word [eax], 0
je 0x1116faf
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x1116fca
mov edx, dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret 0xc
xor al, al
pop ebp
ret 0xc
Function at 0x1118e30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x60
call fcn.0101c0a0
mov esi, eax
mov eax, dword [ebp + 0x18]
push eax
push esi
call fcn.01118db0
test eax, eax
je 0x1118fcb
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x40], ecx
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [esi + 0x44], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x54], 1
mov dword [esi + 4], edx
mov dword [esi + 0x4c], eax
push edi
mov dword [ecx], esi
call fcn.0101e3c0
push eax
push edi
call fcn.0101e800
mov edi, dword [ebp + 0x14]
push edi
mov dword [esi + 0xc], eax
call fcn.0101e3c0
push eax
push edi
call fcn.0101e800
mov dword [esi + 0x10], eax
lea esp, [esp]
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call fcn.011141b0
cmp dword [ebp - 4], 0
mov ebx, eax
jne 0x1118fc2
push esi
call fcn.011140f0
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x1118f10
push eax
push eax
push esi
push 0x1113d50
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1118f1a
cmp eax, 0xffffffff
je 0x1118f1a
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1118f1a
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push esi
call fcn.01113bb0
push 1
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x1118f4f
push eax
push eax
push esi
push 0x1113d50
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1118f59
cmp eax, 0xffffffff
je 0x1118f59
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1118f59
lea ecx, [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
test ebx, ebx
je 0x1118f74
cmp ebx, 0xffffffff
je 0x1118f74
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1118f7f
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x1118fae
push eax
push eax
push esi
push 0x1113d50
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1118fb8
cmp eax, 0xffffffff
je 0x1118fb8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1118fb8
lea edx, [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
cmp dword [ebp + 8], 0
jne 0x1118eb0
pop edi
mov dword [esi + 0x54], 0
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x28