joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107e8b0
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x2841c], 0
je 0x107e9ed
mov eax, dword [esi + 8]
mov eax, dword [eax]
push ebx
push 0x100e738
push 0x1009bc4
add eax, 0x237a4
push eax
call fcn.01061570
mov ecx, dword [esi + 8]
mov ebx, eax
mov eax, dword [ecx]
push 0x100e70c
push 0x1009bc4
add eax, 0x237a4
push eax
call fcn.01061570
mov dword [ebp + 8], eax
test ebx, ebx
je 0x107e9ec
test eax, eax
je 0x107e9ec
mov eax, dword [esi + 0x2841c]
dec eax
push edi
cmp eax, 7
ja case.0x107e921.3
jmp dword [eax*4 + 0x107e9f4]
mov edx, dword [esi + 8]
mov eax, dword [edx]
push 0x100e6e4
push eax
call fcn.01071f30
push 0x100e6b8
jmp 0x107e992
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 0x100e690
push ecx
call fcn.01071f30
mov edx, dword [esi + 8]
mov edi, eax
mov eax, dword [edx]
push 0x100e664
push eax
jmp 0x107e99a
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push 0x100e63c
push edx
call fcn.01071f30
mov edi, eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 0x100e610
push ecx
jmp 0x107e99a
mov edx, dword [esi + 8]
mov eax, dword [edx]
push 0x100e5e8
push eax
call fcn.01071f30
push 0x100e5bc
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edi, eax
push edx
call fcn.01071f30
mov esi, eax
test edi, edi
je case.0x107e921.3
test esi, esi
je case.0x107e921.3
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov eax, dword [ebp + 8]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push edi
call fcn.010608a0
push esi
call fcn.010608a0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push ebx
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
push eax
call edi
mov ecx, dword [ebp + 8]
push ecx
push 0
call esi
push eax
call edi
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x1084b70
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
push edi
push 0x20a
xor esi, esi
lea eax, [ebp - 0x428]
push esi
push eax
call sub.msvcrt.dll_memset
push 0x20a
lea ecx, [ebp - 0x21c]
push esi
push ecx
call sub.msvcrt.dll_memset
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add esp, 0x18
push edi
push ebx
call fcn.01084ae0
push 0x103
lea edx, [ebp - 0x21c]
push edx
push esi
push esi
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0x103
lea ecx, [ebp - 0x428]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
jne 0x1084bf8
push 0x20a
lea edx, [ebp - 0x21c]
push esi
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp + 0xc], esi
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1084c18
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push 0x31
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1084ca1
mov edx, dword [ebp + 8]
push edi
mov dword [esi], edx
call fcn.0105ca50
mov dword [esi + 4], eax
lea eax, [ebp - 0x428]
push eax
call fcn.0105ca50
lea ecx, [ebp - 0x21c]
push ecx
mov dword [esi + 8], eax
call fcn.0105ca50
mov dword [esi + 0xc], eax
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], ecx
mov edx, dword [ebp - 8]
mov dword [esi + 0x20], edx
mov eax, dword [ebp - 4]
mov dword [esi + 0x24], eax
mov eax, dword [ebx + 0x2fbd0]
test eax, eax
je 0x1084c95
mov dword [eax + 0x28], esi
pop edi
mov dword [ebx + 0x2fbd0], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0x2fbcc], esi
mov dword [ebx + 0x2fbd0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1086360
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x402
push 8
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test ebx, ebx
je 0x10863af
mov esi, eax
test esi, esi
je 0x1086414
mov eax, dword [ebp + 0xc]
push eax
add ebx, 0x25f5c
push ebx
push 0x100ec54
push 0x103
push esi
call fcn.0101d440
add esp, 0x14
jmp 0x10863f7
mov ebx, eax
test ebx, ebx
je 0x1086414
push 0x103
push ebx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10863c4
mov edx, dword [ebp + 0xc]
mov cx, word [0x100ec50]
push 0x100ec48
push edx
push ebx
mov word [edi], cx
call fcn.01061180
push ebx
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test esi, esi
je 0x108641d
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x1086650
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
je 0x1086714
mov eax, dword [ebp + 8]
push esi
push 0x100edc8
push eax
call fcn.01086360
mov esi, eax
test esi, esi
je 0x108670f
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x100edb4
push esi
call edi
test eax, eax
jne 0x1086691
mov eax, fcn.0101b180
mov ebx, dword [ebp + 0xc]
push 0x100eda4
push esi
mov dword [ebx + 0x3bc], eax
call edi
test eax, eax
jne 0x10866ab
mov eax, fcn.0101b180
push 0x100ed94
push esi
mov dword [ebx + 0x3c0], eax
call edi
test eax, eax
jne 0x10866c2
mov eax, fcn.0101b180
push 0x100ed84
push esi
mov dword [ebx + 0x3c4], eax
call edi
test eax, eax
jne 0x10866d9
mov eax, fcn.0101b180
push 0x100ed70
push esi
mov dword [ebx + 0x3c8], eax
call edi
test eax, eax
jne 0x10866f0
mov eax, fcn.0101b180
push 0x100ed58
push esi
mov dword [ebx + 0x3d8], eax
call edi
test eax, eax
jne 0x1086707
mov eax, fcn.0101b180
pop edi
mov dword [ebx + 0x3d4], eax
pop ebx
pop esi
pop ebp
ret 0xc
push 0x100edc8
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x1086710
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebp
ret 0xc
Function at 0x10882f0
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0x40
mov edi, eax
call fcn.0101c4b0
mov esi, dword [ebp + 8]
lea ebx, [esi + eax*4 + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push esi
call fcn.01087c30
mov ecx, dword [esi + 0x1cc]
lea eax, [ebp - 0x10]
push eax
push 8
push edi
call ecx
test eax, eax
je 0x10883d0
push 0x44
lea edx, [ebp - 0x54]
push 0
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0x1a
mov dword [ebp - 8], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x10883c6
mov edi, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
call edi
test eax, eax
je 0x10883c6
cmp dword [ebp - 4], 0
jne 0x10883c6
cmp dword [esi + 0x26a8c], 6
jb 0x10883c6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 0xc]
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10883c6
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x54]
push edx
push eax
call edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1088760
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x130]
push edi
call eax
push eax
push esi
call fcn.010885e0
mov edi, eax
test edi, edi
je 0x1088839
push 1
push 0x100fcd8
push edi
push esi
call fcn.01088660
push 1
push 0x100fcc4
push edi
push esi
call fcn.01088660
push 1
push 0x100fcac
push edi
push esi
call fcn.01088660
push 1
push 0x100fc98
push edi
push esi
call fcn.01088660
push 1
push 0x100fc84
push edi
push esi
call fcn.01088660
push 1
push 0x100fc70
push edi
push esi
call fcn.01088660
push 1
push 0x100fc58
push edi
push esi
call fcn.01088660
push 1
push 0x100fc3c
push edi
push esi
call fcn.01088660
push 1
push 0x100fc20
push edi
push esi
call fcn.01088660
push 1
push 0x100fc00
push edi
push esi
call fcn.01088660
push 1
push 0x100fbf0
push edi
push esi
call fcn.01088660
push 1
push 0x100fbd8
push edi
push esi
call fcn.01088660
push edi
push esi
call fcn.01088510
push edi
push esi
call fcn.0101cb00
pop edi
pop esi
pop ebp
ret 4
Function at 0x108aac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x40
call fcn.0101c4b0
mov esi, dword [ebp + 8]
lea edi, [esi + eax*4 + 8]
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push esi
call fcn.01087c30
mov eax, dword [esi + 0x14c]
push DirectSoundEnumerateW
push 0
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x108ab7b
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x140]
push DirectSoundEnumerateW
push ecx
push ebx
call edx
mov edi, eax
test edi, edi
je 0x108ab6f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp + 8], eax
mov ecx, dword [esi + 0x144]
lea eax, [ebp - 0x20]
push eax
push edi
call ecx
test eax, eax
je 0x108ab3e
cmp dword [ebp - 0x1c], 4
je 0x108ab66
cmp dword [esi + 0x2f1ac], 0
jne 0x108ab66
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, 0xea60
ja 0x108ab66
mov edx, dword [esi + 0x128]
push 0x1f4
call edx
jmp 0x108ab27
mov edx, dword [esi + 0x138]
push edi
call edx
mov eax, dword [esi + 0x138]
push ebx
call eax
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x108bb50
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0108b9a0
push esi
call fcn.0108ba70
pop esi
pop ebp
ret 0xc
Function at 0x108bc00
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
sub esp, 0xb8
cmp dword [eax], 0x18
jae 0x108bc1e
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x18
push ebx
push edi
xor edi, edi
push 0x2c
lea ecx, [ebp - 0x50]
push edi
push ecx
mov dword [ebp - 0x1c], edi
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, eax
add esp, 0xc
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
push 7
push ebx
push ecx
push edx
mov dword [ebp - 0x50], ebx
call fcn.01025c70
test eax, eax
je 0x108bcab
mov eax, dword [ebp - 0x40]
xor eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
xor eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push edx
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.01025ab0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp + 0x1c], edi
mov esi, ebx
cmp ebx, 0x10000
jb 0x108bcd9
mov eax, 0xbacf914d
mul ebx
mov ecx, ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
imul ecx, ecx, 0x25
sub esi, ecx
add esi, 4
xor eax, eax
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
push ebx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xb8], 0x67452301
mov dword [ebp - 0xb4], 0xefcdab89
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
call fcn.01025e40
cmp eax, 0xffffffff
je 0x108bd95
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x24]
xor ecx, ecx
mov edx, eax
mov ebx, ecx
add edx, esi
adc ecx, ebx
cmp ecx, ebx
mov ebx, dword [ebp + 0x10]
jg 0x108bdd6
jl 0x108bd47
cmp edx, ebx
ja 0x108bdd6
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0x1c]
add dword [ebp + 8], 0x3fd
push esi
add eax, ecx
push eax
lea edx, [ebp - 0xb8]
push edx
call fcn.0108b9a0
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x20]
jae 0x108bd92
xor edx, edx
lea eax, [edi + 0x936d]
mov ecx, 0x3fd
div ecx
add edx, dword [ebp + 8]
mov edi, edx
lea edx, [esi + edi]
cmp edx, ebx
jbe 0x108bd8b
mov edi, ebx
sub edi, esi
mov eax, edi
cmp edi, 0xffffffff
jne 0x108bd28
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0xb8]
push eax
call fcn.0108ba70
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], ebx
pop esi
test edi, edi
je 0x108bc92
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
or edi, 0xffffffff
jmp 0x108bd95
Function at 0x108ca20
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0x40
call fcn.0101c4b0
mov ebx, dword [ebp + 8]
lea eax, [ebx + eax*4 + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
xor edi, edi
push edi
push 1
push 0x40
push ebx
call fcn.01087c30
push 0x41
lea ecx, [ebp - 0x50]
push edi
push ecx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [edx], 0x20
mov eax, 0xaaaaaaaa
mov dword [esi], eax
add esp, 0xc
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
mov dword [esi + 0xc], eax
push edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push edi
mov dword [esi + 0x18], eax
push edi
mov dword [esi + 0x1c], eax
mov edx, dword [ebx + 0x194]
lea eax, [ebp - 8]
push eax
push edi
push edi
lea ecx, [ebx + 0x26796]
push ecx
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call edx
push ebx
call fcn.01088f60
mov edi, eax
test edi, edi
je 0x108cb14
mov eax, dword [ebx + 0x110]
push edi
call eax
cmp byte [eax], 4
jb 0x108cb0b
mov ecx, dword [ebx + 0x124]
push 1
push edi
call ecx
mov edx, dword [ebx + 0x124]
push 2
push edi
mov dword [ebp + 0x10], eax
call edx
push 3
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x124]
push edi
call eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x108caf6
mov ecx, dword [ecx]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x108cb02
mov edx, dword [ecx]
mov dword [ebp + 8], edx
test eax, eax
je 0x108cb0b
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 0x190]
push edi
call ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
push edx
push eax
push edi
push 0x1010258
lea ecx, [ebp - 0x50]
push 0x3f
push ecx
call fcn.0101d440
add esp, 0x18
test edi, edi
jne 0x108cb5f
cmp dword [ebp + 8], edi
jne 0x108cb5f
cmp dword [ebp - 4], edi
jne 0x108cb5f
mov eax, 0xabababab
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
jmp 0x108cbb8
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108cb65
sub eax, edx
cmp eax, 0x20
jbe 0x108cb76
mov byte [ebp - 0x30], cl
mov dx, word [0x1010254]
lea ecx, [ecx]
lea eax, [ebp - 0x50]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108cb86
sub eax, edi
cmp eax, 0x20
jae 0x108cba5
lea edi, [ebp - 0x50]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x108cb98
mov word [edi], dx
jmp 0x108cb80
test esi, esi
je 0x108cbb8
push 0x20
lea edx, [ebp - 0x50]
push edx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
lea ecx, [ecx]
mov edx, dword [eax + esi]
xor edx, ecx
mov edi, ecx
mov cl, byte [eax + esi]
rol edi, cl
mov dword [eax + esi], edx
add eax, 4
mov ecx, edi
cmp eax, 0x20
jb 0x108cbc0
add ebx, 0x20
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x108d9b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0x108d870
push 0
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebx + 0x26b64], eax
test eax, eax
je 0x108da3b
mov edx, dword [ebx + 0x248]
push 0x2710
push eax
call edx
cmp eax, 0x102
jne 0x108da21
test edi, edi
je 0x108da28
mov ecx, 0x10106f0
mov esi, 4
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x108da14
jmp 0x108da28
push edi
push ebx
call fcn.0108d900
mov eax, dword [ebx + 0x26b64]
test eax, eax
je 0x108da3b
push eax
mov eax, dword [ebx + 0x1bc]
call eax
mov eax, dword [ebx + 0x25f58]
test eax, eax
je 0x108da8c
push eax
push 0x10106e8
lea ecx, [ebp - 0x110]
push 0x103
push ecx
call fcn.0101d440
lea eax, [ebp - 0x110]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108da67
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x108da71
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
push edi
push ebx
call fcn.0102d510
pop edi
pop esi
mov dword [ebx + 0x26b64], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x108f640
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
push ebx
push esi
push edi
push 0xa0a
lea eax, [ebp - 0xc1c]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
add esp, 0xc
call esi
mov edi, dword [ebp + 8]
mov ebx, eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x23110]
cmp dword [ecx + 0x174], 0
jne 0x108f6bb
cmp byte [eax + 0x3098e], 0
jne 0x108f6bb
jmp 0x108f690
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
call fcn.01047f60
test eax, eax
jne 0x108f6bb
call esi
sub eax, ebx
cmp eax, 0xc350
ja 0x108f6bb
mov edx, dword [edi]
cmp byte [edx + 0x3098e], 0
je 0x108f690
mov eax, dword [edi]
mov ecx, dword [eax + 0x23110]
test dword [ecx + 0x138], 0x800
mov edx, 0x100bf14
jne 0x108f6d9
mov edx, 0x100bf10
lea esi, [eax + 0x23120]
push esi
lea esi, [eax + 0x23161]
push esi
push edx
mov edx, dword [ecx + 0x13c]
add eax, 0x30b98
push eax
shl edx, 5
mov eax, dword [edx + 0x11258d0]
push eax
add ecx, 0x1cc
push ecx
push 0x1010aa8
lea ecx, [ebp - 0xc1c]
push 0x3ff
push ecx
call fcn.0101e760
mov ecx, dword [edi]
add esp, 0x24
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0x1010aa0
push 0x10100f0
push DirectSoundEnumerateW
push ecx
call fcn.01089770
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov esi, eax
test esi, esi
je 0x108f7ae
cmp word [esi], 0
je 0x108f759
nop
add eax, 2
cmp word [eax], 0
jne 0x108f750
sub eax, esi
sar eax, 1
cmp eax, 0x28
jae 0x108f7a2
push 0x20a
lea edx, [ebp - 0x210]
push 0
push edx
call sub.msvcrt.dll_memset
push esi
push 0x1010a88
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.0101e760
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xc1c]
push edx
call fcn.0101e2a0
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
lea eax, [ebp - 0xc1c]
push eax
call fcn.010302c0
mov ecx, dword [edi]
mov eax, dword [ecx + 0x23110]
mov dword [ebp + 8], 0
test eax, eax
je 0x108f7d2
add eax, 0x70
jmp 0x108f7d4
xor eax, eax
push 1
push 0
push 0
push 0
push 0
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0xc1c]
push edx
push eax
push ecx
call fcn.0108b7d0
test eax, eax
je 0x108f80e
mov esi, dword [ebp + 8]
test esi, esi
je 0x108f80e
push esi
push edi
call fcn.01030580
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x108f8c0
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1b4
push 0
push edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0x108f91d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108f8e5
sub eax, edx
mov ebx, eax
je 0x108f91d
lea eax, [ebx + 1]
test eax, eax
je 0x108f91d
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x108f91f
mov eax, dword [ebp + 0x14]
push ebx
push eax
push esi
call fcn.0101c010
jmp 0x108f91f
xor esi, esi
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0xc], esi
test eax, eax
je 0x108f968
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108f930
sub eax, edx
mov ebx, eax
je 0x108f968
lea eax, [ebx + 1]
test eax, eax
je 0x108f968
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x108f96a
mov ecx, dword [ebp + 0x1c]
push ebx
push ecx
push esi
call fcn.0101c010
jmp 0x108f96a
xor esi, esi
mov eax, dword [ebp + 0x20]
mov dword [edi + 4], esi
test eax, eax
je 0x108f9af
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108f977
sub eax, edx
mov ebx, eax
je 0x108f9af
lea eax, [ebx + 1]
test eax, eax
je 0x108f9af
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x108f9b1
mov edx, dword [ebp + 0x20]
push ebx
push edx
push esi
call fcn.0101c010
jmp 0x108f9b1
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], esi
test eax, eax
je 0x108f9f8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x108f9c0
sub eax, edx
mov ebx, eax
je 0x108f9f8
lea eax, [ebx + 1]
test eax, eax
je 0x108f9f8
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x108f9fa
mov eax, dword [ebp + 0x18]
push ebx
push eax
push esi
call fcn.0101c010
jmp 0x108f9fa
xor esi, esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push 0x1010b84
push eax
mov dword [edi], esi
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
jne 0x108fa28
mov dword [edi + 0x1b0], 1
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
lea esi, [edi + 0x18]
push eax
xor edx, edx
push ecx
push esi
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0108b9a0
push esi
call fcn.0108ba70
push 0x40
lea ecx, [edi + 0x84]
push ecx
push 0x10
lea esi, [edi + 0x70]
push esi
call fcn.01030750
add edi, 0xc5
push edi
push 0x10
push esi
call fcn.0101ddb0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x1c