joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013c90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::GetMute
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x3c]
mov esi, eax
test esi, esi
jns 0x10013df3
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8
Function at 0x10013e10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::GetVolumeStepInfo
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push dword [esp + 0x18]
push ecx
call dword [eax + 0x40]
mov esi, eax
test esi, esi
jns 0x10013f7e
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10013fa0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::VolumeStepUp
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x44]
mov esi, eax
test esi, esi
jns 0x10014103
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8
Function at 0x10014120
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::VolumeStepDown
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x48]
mov esi, eax
test esi, esi
jns 0x10014283
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8
Function at 0x100142a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::QueryHardwareSupport
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x4c]
mov esi, eax
test esi, esi
jns 0x10014403
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8
Function at 0x10014420
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioEndpointVolume::GetVolumeRange
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push ecx
call dword [eax + 0x50]
mov esi, eax
test esi, esi
jns 0x10014599
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100160f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperDevicePropertyStore::GetCount
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0xc]
mov edi, eax
test edi, edi
jns 0x1001624e
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movlpd qword [esp + 0x24], xmm0
call eax
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], edi
mov ecx, eax
call fcn.10024ee0
jmp 0x100162ed
test ebx, ebx
je 0x100162f8
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movlpd qword [esp + 0x24], xmm0
call eax
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__cProps:
mov ecx, eax
call fcn.10002460
mov esi, eax
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
push ecx
call fcn.1000b580
add esp, 4
mov ecx, esi
push dword [ebx]
call fcn.10007ed0
push eax
call fcn.10002700
mov eax, edi
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8
Function at 0x10016780
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperDevicePropertyStore::Commit
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov eax, dword [edi + 8]
add esp, 0x1c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x100168de
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 4
Function at 0x10016b30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperEndpoint::QueryInterface_riid:
mov ecx, eax
call fcn.10002460
mov esi, dword [esp + 0x2c]
mov ecx, eax
mov edx, esi
call fcn.100247b0
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push esi
push ecx
call dword [eax]
mov esi, eax
test esi, esi
jns 0x10016ca7
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016cc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
movlpd qword [esp + 0x1c], xmm0
call ebx
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperEndpoint::GetDataFlow
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov edi, dword [esp + 0x28]
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0xc]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x18]
movlpd qword [esp + 0x18], xmm0
push eax
call ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test esi, esi
jns 0x10016e1f
sub ecx, dword [0x100824a0]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x28]
mov dword [esp + 0x28], esi
mov ecx, eax
call fcn.10024ee0
jmp 0x10016eae
sub ecx, dword [0x100824a0]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x24], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__pDataFlow:
mov ecx, eax
call fcn.10002460
mov ecx, dword [edi]
test ecx, ecx
jne 0x10016e8b
mov edx, str.eRender
jmp 0x10016ea7
cmp ecx, 1
jne 0x10016e97
mov edx, str.eCapture
jmp 0x10016ea7
cmp ecx, 2
mov edx, str.eAll
mov edi, 0x100765dc
cmovne edx, edi
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 8