joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421675
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004215f1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4217ed
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4217ed
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x42179c
jg 0x4216ce
test eax, eax
je 0x421792
push 1
push 0x1000
call fcn.00416169
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4216f4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x421789
push 0x8000
push ebx
call fcn.00412c95
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x421720
jg 0x42171b
cmp ecx, 0x1000
jb 0x421720
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00418c83
add esp, 0x10
cmp eax, 0xffffffff
je 0x421765
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x42171b
jl 0x42174c
test ecx, ecx
jne 0x42170d
push dword [ebp - 0xc]
push ebx
call fcn.00412c95
push esi
call fcn.004161c6
add esp, 0xc
xor edi, edi
jmp 0x4217fe
cmp byte [edi + 0x24], 0
je 0x42177c
cmp dword [edi + 0x20], 5
jne 0x42177c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x421787
mov edi, dword [edi + 0x18]
jmp 0x421789
xor edi, edi
push esi
call fcn.004161c6
pop ecx
jmp 0x4217fe
test ecx, ecx
jg 0x42175e
jl 0x42179c
test eax, eax
jae 0x42175e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004149af
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4217bf
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42175e
jmp 0x4217f6
push ebx
call fcn.0041cb09
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42175e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4217fe
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4217fb
mov edi, dword [edi + 0x18]
jmp 0x4217fe
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004149af
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.10008610
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x5fc840
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19f000]
push edi
jmp 0x5fc85a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fc861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc850
mov eax, 1
add ebx, ebx
jne 0x5fc873
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fc884
jne 0x5fc8a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc8a3
dec eax
add ebx, ebx
jne 0x5fc890
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fc868
add ebx, ebx
jne 0x5fc89f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5fc8f5
xor ecx, ecx
sub eax, 3
jb 0x5fc8bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fc92a
sar eax, 1
mov ebp, eax
jmp 0x5fc8c6
add ebx, ebx
jne 0x5fc8c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc894
inc ecx
add ebx, ebx
jne 0x5fc8d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc894
add ebx, ebx
jne 0x5fc8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fc8d6
jne 0x5fc8f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fc8d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fc914
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fc906
jmp 0x5fc856
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fc914
add edi, ecx
jmp 0x5fc856
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fc932
cmp byte [edi], 0x11
jne 0x5fc932
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5fc937
lea edi, [esi + 0x1f5000]
mov eax, dword [edi]
or eax, eax
je 0x5fc9af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x312cc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x312e40]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fc964
mov ecx, edi
jns 0x5fc993
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x312e44]
or eax, eax
je 0x5fc9a9
mov dword [ebx], eax
add ebx, 4
jmp 0x5fc981
call dword [esi + 0x312e54]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5fc9e0
cmp al, 0xef
ja 0x5fc9d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5fc9b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5fc9c2
mov ebp, dword [esi + 0x312e48]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5fca14
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x523f96
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0510724
jmp 0x52411d
pushfd
pop word [esp]
pushfd
mov word [esp + 1], sp
jmp 0x523eb2
pop word [esp]
mov dword [esp], eax
call 0x523ebf
mov eax, gs
cmp dword [eax], eax
add byte [eax], al
mov dword [esp + 6], ebx
mov dword [esp + 8], ecx
call 0x523ee7
sbb dword [ebx + 0x14a55633], esp
xchg cx, ax
adc byte [ebx + 0xec830a], dl
sub esp, 0x10
call fcn.00523e3d
call fcn.00523f18
mov byte [0x2fdcb525], al
pushfd
fcom qword [esi - 0x3c]
mov dword [reloc.MSVCRT.dll_strncpy], eax
stc
fdivr dword [ebx]
call 0x523ec4
jmp 0x523f29
lea esp, [esp + 2]
lea esp, [esp + 6]
jmp 0x523fb1
pop word [esp]
push esp
mov dword [esp], ebx
push dword [esp + 4]
jmp 0x523fbd
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp], ebx
push esp
push ebp
push edi
jmp 0x523f63
lea esp, [esp + 2]
mov dword [esp + 4], esi
call 0x523f96
mov edi, 0xeb24248d
pushfd
jmp 0x523249
lea esp, [esp + 2]
mov dword [esp + 4], edx
push ax
jmp 0x523f79
jbe 0x523f88
lea esp, [esp + 2]
mov dword [esp + 4], esi
jmp 0x523f90
bswap ebx
mov ch, bh
lea esi, [esi*4]
jmp 0x524030
shr edx, 1
ror dl, 2
mov ebp, dword [esp + 0x2c]
jmp 0x523fec
sub esp, 0xc0
mov esi, esp
not al
mov ecx, ebp
call fcn.00524041
xchg dword [edx + ecx*4], edx
in eax, dx
sbb al, 0xa3
adc eax, dword [ecx + reloc.MSVCRT.dll_strncpy]
rol byte [ebx + 0x3784153a], 0x8d
cmp eax, 0xb44c2ac7
lea edi, reloc.MSVCRT.dll_strncpy
lea edi, [esp]
setae dl
setnp cl
jmp 0x52400d
rdtsc
jmp 0x524002
rol ebp, 0xa
jae 0x52405e
rdtsc
shr edx, 1
ror dl, 2
jmp 0x524007

Function at 0x524148
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0
dec eax
jbe 0x523edc
sub esp, 0
sub esp, 0x10
lea ecx, reloc.MSVCRT.dll_strncpy
jmp 0x5225e3
setge al
xchg bl, cl
add edi, 4
jmp 0x523f4f
jne 0x524124
test al, 0xcb
invalid
jmp 0x524157
adc eax, esp
pop esi
sbb byte [0x9727d48d], 0xcc
outsb dx, byte [esi]
cld
wait
jbe 0x524137
inc esi
sub bx, si
jno 0x524132
jo 0x524157
jno 0x524142
popal
add bl, dh
xor al, 0x70
jae 0x524119
rol ebp, 0
lds eax, [eax]
rol ebx, 9
jmp 0x5241da
lea edx, [esi*4]
mov eax, 0x73ada352
not dx
xchg bh, dl
bswap eax
jmp 0x524184
xchg bl, cl
jmp 0x523fdf
rdtsc
not ebx
jmp 0x5241b9
not dx
xchg bh, dl
bswap eax
jmp 0x524184
bswap ebx
jmp 0x524200
lea esp, [esp + 4]
neg ebp
mov edx, ebp
mov ebx, 0xfbba0d02
xchg bx, ax
jmp 0x5241a3
jp 0x524163
lea edx, [esi*4]
mov eax, 0x73ada352
jmp 0x52419a
add ebp, 0x18bcd0cf
xchg bh, al
lea ebx, [eax + esi]
lea ebx, [edi + ebp]
not dx
call fcn.005244e1
in al, dx
bound eax, qword [0x587945f4]
mov ebx, 0xc1311c89
rcl dword [edx], cl
je 0x52417d
xchg bl, cl
setge al
xchg bl, cl
jmp 0x523fe4
Function at 0x5ccdb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi - 0x71], ah
pop word [esp]
lea esp, [esp + 2]
push ebx
dec ebx
jmp 0x5ccdec
push eax
mov ebx, esi
bsr eax, edi
std
push edx
dec dx
jmp 0x5cce3d
mov bl, 0xe0
lea ebx, [edx*4]
lea ebx, [eax*4]
setae bh
shr ebx, cl
xchg bh, bl
jmp 0x5ccdd3
bts bx, si
lea edx, [ebx*4]
mov dword [esp], ecx
jmp 0x5cce8e
push sp
xchg byte [esp], dh
lea edx, [esp + 0x81]
mov ebx, 0x52f77193
btr edx, edx
push word [esp]
jmp 0x5cce27
xchg dword [esp + 2], ebx
btc ebx, ebp
lea eax, [edx + esi]
mov al, 0xdf
mov bx, dx
clc
jmp 0x5ccea2
mov bx, word [esp + 2]
pop bx
sub esp, 0x1b
pop bx
xchg word [esp + 0xe], dx
cmc
jmp 0x5cce78
pop ebx
rdtsc
lea esp, [esp + 0xb]
mov al, cl
mov dh, ah
setp bl
jmp 0x5ccf73
push bp
mov byte [esp], bl
mov ebx, 0x16850156
setnp bh
btc ebx, edi
jmp 0x5ccf1a
inc ax
btr ax, bx
mov bx, 0x69e0
mov edx, edi
mov edx, esi
add dh, 0x69
jmp 0x5ccedb
xchg dl, bl
mov bx, word [esp + 1]
mov byte [esp], bl
pop dx
shr bx, cl
jmp 0x5ccf46
mov dx, bx
lea eax, [esi + ebp]
cld
xchg byte [esp], dl
mov dx, word [esp]
rdtsc
jmp 0x5ccf04
neg edx
lea edx, [eax*4]
mov ebx, dword [esp]
mov dword [esp], edx
bt edx, esi
jmp 0x5ccf58
bswap ebx
mov dh, byte [esp]
sub esp, 4
dec edx
mov al, 0xaf
xchg word [esp + 1], bx
jmp 0x5ccf2c
add esp, 0
push dword [esp + 1]
lea ebx, [esp + esi]
push ebx
pop ax
inc dx
call fcn.005ccf9f
push es
popfd
or eax, 0x6c22a754
mov dh, byte [esp]
pushal
sub esp, 0x1e
lea esp, [esp + 0x4a]
bts eax, eax
cmp ax, bx
jmp 0x5ccef1
add esp, 2
call fcn.005ce679
jge 0x5ce665
insb byte es:[edi], dx
or eax, dword [esi]
loopne 0x5ce6b9
rol dword [ebx + 0x26], cl
aad 0x32
salc
inc ecx
popal
jmp 0x5ccd95
lodsb al, byte [esi]
sub dword [ecx - reloc.MSVCRT.dll_strncpy], edi
call 0x5ce6e1
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
push ebx
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x5ce65d

Function at 0x5cd4d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, al
mov ebx, eax
xchg byte [esp + 6], al
xchg word [esp + 3], dx
jmp 0x5cd516
lea ebx, [edx + ebx]
rdtsc
dec bh
push word [esp + 2]
clc
cld
jmp 0x5cd526
mov dh, 0x4e
xchg bh, ah
lea ebx, [ebp + 0x6b]
cld
neg edx
mov dword [esp + 3], ebx
jmp 0x5cd500
xchg dword [esp + 5], ebx
push word [esp + 8]
pop eax
mov ax, 0x8477
xchg word [esp + 1], ax
rdtsc
jmp 0x5cd56c
mov al, 0x46
mov dh, byte [esp + 0xb]
push word [esp + 1]
mov edx, edi
sete ah
call fcn.005cd5fe
call 0x830497f1
outsd dx, dword [esi]
sub eax, 0x5c8adbf6
and al, 5
add edx, 0x2d6f82a7
neg bl
mov bl, byte [esp + 5]
mov byte [esp + 4], al
push dword [esp + 6]
mov dword [esp + 6], ebp
jmp 0x5cd556
Function at 0x5cdadd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, dx
mov bx, word [esp]
call 0x5cdadd
shr bl, 0x41
mov eax, dword [edi]
xchg edi, eax
add ebp, ebp
xor edi, dword [eax + reloc.MSVCRT.dll_strncpy]
pop ds
xchg ebp, eax
add eax, 0x84499f6c
aaa

Function at 0x5ce5fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 5]
push dword [esp + 9]
push dword [esp + 7]
jmp 0x5ce646
jmp 0x5ce5e7

Function at 0x5cf7f1
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x1b]
pop dword [esp + 1]
lea esp, [esp + 2]
jmp 0x5cf828
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5cf879
mov eax, dword [eax + 0x1c]
jmp 0x5cf863

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000c8f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
mov dword [esp + 0x30], edx
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioClient3::QueryInterface
mov ecx, eax
call fcn.10002460
mov edx, str._riid:
mov ecx, eax
call fcn.10002460
mov esi, dword [esp + 0x2c]
mov ecx, eax
mov edx, esi
call fcn.100247b0
push eax
call fcn.10002700
add esp, 0x1c
test ebx, ebx
jne 0x1000ca86
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x80004003
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, 0x80004003
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
mov edx, 0x10074714
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000cac1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000ca92
mov dword [ebx], edi
mov eax, dword [edi]
push edi
call dword [eax + 4]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc
push ebx
push dword [esp + 0x18]
push edi
call fcn.1000d2a0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000cae0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [ebx + 0xc]
mov edx, esp
mov esi, eax
mov dword [esp + 0x28], edx
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioClient3::GetSharedModeEnginePeriod
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [ebx + 8]
add esp, 0x1c
mov eax, dword [ecx]
push edi
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x34]
push dword [esp + 0x1c]
push ecx
call dword [eax + 0x48]
mov esi, eax
test esi, esi
jns 0x1000cc72
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x18]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x1c]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000cc90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [0x1007f098]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
sub esp, 0x18
lea ecx, [edi + 0xc]
mov edx, esp
mov esi, eax
mov dword [esp + 0x30], edx
push ecx
mov ecx, edx
call fcn.1000d180
mov ecx, esi
call fcn.10024bc0
mov edx, str._DebugWrapperAudioClient3::GetCurrentSharedModeEnginePeriod
mov ecx, eax
call fcn.10002460
push eax
call fcn.10002700
mov ecx, dword [edi + 8]
add esp, 0x1c
mov eax, dword [ecx]
push ebx
push dword [esp + 0x18]
push ecx
call dword [eax + 0x4c]
mov esi, eax
test esi, esi
jns 0x1000ce02
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x100824a0]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x100824a4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100242a0
sub esp, 8
lea eax, [esp + 0x34]
movsd qword [esp], xmm0
push str._0.3lf
push 0x10
push eax
call fcn.10019b10
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, 0x100824a8
call fcn.10002460
mov edx, str.__INFO_
mov ecx, eax
call fcn.10002460
mov edx, str.__hr:
mov ecx, eax
call fcn.10002460
lea edx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov ecx, eax
call fcn.10024ee0
push eax
call fcn.10002700
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c0aa
mov esp, ebp
pop ebp
ret 0xc