joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21120bb0
Capabilities:
Check mutex on windows

Disassembly:
inc word [0x2115929c]
cmp word [0x21159294], 0
push edi
mov edi, dword [esp + 8]
je 0x21120c32
cmp word [0x2115929c], 1
je 0x21120bda
cmp word [0x21159298], 0
je 0x21120c32
mov eax, dword [0x21159308]
test eax, eax
jne 0x21120c32
call fcn.21112300
test eax, eax
je 0x21120c32
fld dword [esp + 0x20]
mov eax, dword [0x2115c0bc]
sub esp, 0x30
fstp qword [esp + 0x28]
fld dword [esp + 0x4c]
fstp qword [esp + 0x20]
fld dword [esp + 0x48]
fstp qword [esp + 0x18]
fld dword [esp + 0x44]
fstp qword [esp + 0x10]
fld dword [esp + 0x40]
fstp qword [esp + 8]
fld dword [esp + 0x3c]
fstp qword [esp]
push edi
push str.AIL_set_3D_orientation__lX__f__f__f__f__f__f__r_n
push eax
call fcn.211306e2
add esp, 0x3c
mov eax, dword [0x211566c0]
test eax, eax
je 0x21120c6b
mov eax, dword [0x211592a0]
test eax, eax
jne 0x21120c62
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x21120c50
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x21120c50
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
mov edx, edi
call fcn.211044b0
mov eax, dword [0x211566c0]
test eax, eax
pop edi
je 0x21120ca7
mov ecx, dword [0x211592a0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
dec word [0x2115929c]
ret 0x1c

Function at 0x21120ec0
Capabilities:
Check mutex on windows

Disassembly:
inc word [0x2115929c]
cmp word [0x21159294], 0
push edi
mov edi, dword [esp + 8]
je 0x21120f1a
cmp word [0x2115929c], 1
je 0x21120eea
cmp word [0x21159298], 0
je 0x21120f1a
mov eax, dword [0x21159308]
test eax, eax
jne 0x21120f1a
call fcn.21112300
test eax, eax
je 0x21120f1a
fld dword [esp + 0xc]
mov eax, dword [0x2115c0bc]
sub esp, 8
fstp qword [esp]
push edi
push str.AIL_update_3D_position__lX__f__r_n
push eax
call fcn.211306e2
add esp, 0x14
mov eax, dword [0x211566c0]
test eax, eax
je 0x21120f4e
mov eax, dword [0x211592a0]
test eax, eax
jne 0x21120f45
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x21120f33
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x21120f7e
mov eax, dword [edi + 4]
test eax, eax
je 0x21120f7e
mov ecx, dword [0x211567dc]
imul eax, eax, 0x258
mov eax, dword [eax + ecx + 0x238]
test eax, eax
je 0x21120f7e
mov edx, dword [esp + 0xc]
mov ecx, dword [edi]
push edx
push ecx
call dword [eax + 0x98]
mov eax, dword [0x211566c0]
test eax, eax
pop edi
je 0x21120f95
mov edx, dword [0x211592a0]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
dec word [0x2115929c]
ret 8
Function at 0x21120fa0
Capabilities:
Check mutex on windows

Disassembly:
inc word [0x2115929c]
cmp word [0x21159294], 0
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
je 0x21120ff6
cmp word [0x2115929c], 1
je 0x21120fcf
cmp word [0x21159298], 0
je 0x21120ff6
mov eax, dword [0x21159308]
test eax, eax
jne 0x21120ff6
call fcn.21112300
test eax, eax
je 0x21120ff6
mov eax, dword [0x2115c0bc]
push ebx
push edi
push str.AIL_auto_update_3D_position__lX__ld__r_n
push eax
call fcn.211306e2
add esp, 0x10
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112102b
mov eax, dword [0x211592a0]
test eax, eax
jne 0x21121022
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x21121010
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x21121057
mov eax, dword [edi + 4]
test eax, eax
je 0x21121057
mov ecx, dword [0x211567dc]
imul eax, eax, 0x258
mov eax, dword [eax + ecx + 0x238]
test eax, eax
je 0x21121057
mov edx, dword [edi]
push ebx
push edx
call dword [eax + 0x9c]
mov eax, dword [0x211566c0]
test eax, eax
pop edi
pop ebx
je 0x2112106e
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
dec word [0x2115929c]
ret 8
Function at 0x21124a00
Capabilities:
Check mutex on windows

Disassembly:
test esi, esi
push ebx
push edi
je 0x21124aa9
mov eax, dword [0x21159310]
test eax, eax
je 0x21124aa9
mov eax, dword [esi + 0x1c4]
test eax, eax
je 0x21124b0b
mov eax, 0x21159290
lock inc dword [eax]
cmp dword [esi + 0x1c8], 0xfffffffe
je 0x21124ac0
mov eax, dword [0x211566c0]
test eax, eax
je 0x21124a4f
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esi + 0x1c8]
push ebp
push 0
push 0
push 0
push ecx
lea ebx, [esi + 0x1e0]
push ebx
call dword [sym.imp.WINMM.dll_midiOutOpen]
mov ebp, eax
mov eax, dword [0x211566c0]
test eax, eax
je 0x21124a9e
mov eax, dword [0x211592a0]
test eax, eax
jne 0x21124a95
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call edi
test eax, eax
mov dword [0x211592a0], eax
je 0x21124a84
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebp, ebp
pop ebp
je 0x21124aae
dec dword [0x21159290]
pop edi
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x1d0]
mov eax, dword [ebx]
push pe_nt_image_headers32
push edx
push eax
call dword [sym.imp.WINMM.dll_midiOutPrepareHeader]
xor edi, edi
mov dword [esi + 0x1c4], edi
mov eax, 0x21159290
lock dec dword [eax]
mov eax, esi
call fcn.211240f0
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, edi
jle 0x21124b0b
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi + 8]
cmp dword [eax], 0x10
jne 0x21124afd
mov dword [eax], 8
mov edx, dword [esi + 0x10]
add edx, edi
push edx
call sym.mss32.dll__AIL_resume_sequence_4
mov eax, dword [esi + 0x14]
inc ebx
add edi, 0x81c
cmp ebx, eax
jl 0x21124ae0
pop edi
mov eax, 1
pop ebx
ret
Function at 0x2112cc60
Capabilities:
Capture microphone audio

Disassembly:
push ecx
mov eax, dword [esi + 0x20]
cmp eax, ecx
je 0x2112cd71
push ebx
xor ebx, ebx
cmp ecx, ebx
mov ecx, dword [esi + 0x39]
push edi
je 0x2112cd1d
mov edi, dword [sym.imp.WINMM.dll_waveInAddBuffer]
push 0x20
lea eax, [esi + 0x3d]
push eax
push ecx
mov dword [esi + 0x45], ebx
call edi
cmp ax, bx
je 0x2112ccaf
movzx edx, ax
push edx
push str.waveInAddBuffer___failed__code__0x_X_n
push 0x211566d0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x49]
mov edx, dword [esi + 0x39]
push 0x20
lea ecx, [esi + 0x5d]
or eax, 0x80000000
push ecx
mov dword [esi + 0x49], eax
push edx
mov dword [esi + 0x65], ebx
call edi
cmp ax, bx
je 0x2112ccd4
movzx eax, ax
push eax
jmp 0x2112cc96
mov ecx, dword [esi + 0x69]
mov edx, dword [esi + 0x39]
or ecx, 0x80000000
push edx
mov dword [esi + 0x69], ecx
call dword [sym.imp.WINMM.dll_waveInStart]
cmp ax, bx
je 0x2112cd0c
movzx eax, ax
push eax
push str.waveInStart___failed__code__0x_X_n
push 0x211566d0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
xor eax, eax
pop ebx
pop ecx
ret
mov ebx, 1
pop edi
mov dword [esi + 0x35], ebx
mov dword [esi + 0x20], ebx
mov eax, ebx
pop ebx
pop ecx
ret
push ecx
mov dword [esi + 0x35], ebx
call dword [sym.imp.WINMM.dll_waveInReset]
call sym.mss32.dll__AIL_ms_count_0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add eax, 0x3e8
mov dword [esp + 8], eax
mov ebx, 1
call sym.mss32.dll__AIL_ms_count_0
cmp dword [esp + 8], eax
jbe 0x2112cd66
push ebx
call edi
mov eax, dword [esi + 0x49]
test eax, eax
jns 0x2112cd5a
test byte [esi + 0x4d], bl
je 0x2112cd40
mov eax, dword [esi + 0x69]
test eax, eax
jns 0x2112cd66
test byte [esi + 0x6d], bl
je 0x2112cd40
pop edi
mov eax, ebx
mov dword [esi + 0x20], 0
pop ebx
pop ecx
ret
Function at 0x2112cd80
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x21159168]
mov ecx, eax
inc eax
test ecx, ecx
push esi
mov dword [0x21159168], eax
jne 0x2112ce5d
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112cdac
mov edx, dword [0x211592a0]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 0x8000
call esi
push str.DSOUND.DLL
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [0x2115916c], eax
call esi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x211566c0]
test eax, eax
pop edi
je 0x2112ce0a
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112ce01
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112cdf0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x2115916c]
test eax, eax
je 0x2112ce53
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov dword [0x21159170], eax
mov eax, dword [0x2115916c]
push str.DirectSoundEnumerateA
push eax
call esi
mov ecx, dword [0x21159170]
test ecx, ecx
mov dword [0x21159174], eax
je 0x2112ce46
test eax, eax
jne 0x2112ce5d
mov ecx, dword [0x2115916c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
dec dword [0x21159168]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x2112ce70
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112ce85
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x21159168]
test eax, eax
je 0x2112ceb7
dec eax
mov dword [0x21159168], eax
jne 0x2112ceb7
mov ecx, dword [0x2115916c]
push ecx
mov dword [0x21159170], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x2115916c], 0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112cef3
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112ceea
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112ced8
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x2112d620
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, eax
test esi, esi
je 0x2112d6b4
mov eax, dword [esi + 0xa0]
test eax, eax
mov dword [esi + 0xb0], edi
je 0x2112d6ea
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112d654
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0xa4]
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax]
push edx
mov edx, dword [esi + 0xb0]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
mov eax, dword [0x211566c0]
jge 0x2112d6b8
test eax, eax
je 0x2112d6aa
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112d6a1
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea ebx, [ebx]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112d690
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.SetCooperativeLevel___failed.
call sym.mss32.dll__AIL_set_error_4
xor eax, eax
pop esi
ret
test eax, eax
je 0x2112d6ea
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112d6e1
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x2112d6d0
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112d6d0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x21159304], edi
mov eax, 1
pop esi
ret
Function at 0x2112de30
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [edi + 0x30]
test eax, eax
mov dword [edi + 0x70], 0
jne 0x2112df4c
push ebp
push esi
mov esi, 1
mov dword [edi + 0x30], esi
mov eax, dword [0x2115664c]
test eax, eax
je 0x2112de89
mov ecx, dword [edi + 0x78]
mov eax, dword [edi + 0x74]
xor edx, edx
test ecx, ecx
jle 0x2112de75
mov ecx, dword [eax + 0xc]
or dword [ecx + 8], esi
mov ecx, dword [edi + 0x78]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
inc edx
cmp edx, ecx
jl 0x2112de61
mov eax, dword [0x21159308]
test eax, eax
jne 0x2112df4a
pop esi
pop ebp
jmp fcn.2112f8d0
mov eax, dword [0x21156658]
test eax, eax
je 0x2112de99
lock inc dword [0x21159318]
movzx ecx, word [edi + 0x9a]
mov esi, dword [edi + 0xe0]
push ebx
push ecx
call fcn.2112cf00
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 4
mov eax, dword [edi + 0xe0]
mov edx, dword [eax]
push 1
push 0
push 0
push eax
call dword [edx + 0x30]
cmp eax, 0x88780096
jne 0x2112df2b
mov eax, dword [edi + 0xe0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112defd
mov edx, dword [0x211592a0]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0xa
call ebx
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112dec2
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112df24
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112df13
push 0xffffffffffffffff
push eax
call ebp
jmp 0x2112dec2
test eax, eax
pop ebx
je 0x2112df3a
push str.Could_not_start_output_buffer
call sym.mss32.dll__AIL_set_error_4
mov eax, dword [0x21156658]
test eax, eax
je 0x2112df4a
lock dec dword [0x21159318]
pop esi
pop ebp
ret
Function at 0x2112f5a0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x2115930c]
xor ebx, ebx
cmp esi, ebx
jne 0x2112f5c3
mov esi, dword [0x21159164]
cmp esi, ebx
jne 0x2112f5c3
mov esi, eax
cmp esi, ebx
je 0x2112f745
cmp eax, ebx
je 0x2112f745
cmp dword [esi + 0xc4], ebx
jne 0x2112f73d
lock inc dword [0x2115915c]
mov eax, esi
mov dword [esi + 0x368], 1
call fcn.2112df50
cmp dword [0x211566c0], ebx
je 0x2112f603
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esi + 0x68]
push ecx
call fcn.2112dd70
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x211566c0], ebx
je 0x2112f643
mov eax, dword [0x211592a0]
cmp eax, ebx
jne 0x2112f63a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x211592a0], eax
je 0x2112f628
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x38]
xor edx, edx
cmp eax, ebx
push edi
jle 0x2112f674
xor ecx, ecx
nop
mov eax, dword [esi + 0x34]
mov edi, dword [ecx + eax + 8]
cmp edi, 4
lea eax, [ecx + eax + 8]
jne 0x2112f666
mov dword [eax], 0x10
mov eax, dword [esi + 0x38]
inc edx
add ecx, 0x2ac
cmp edx, eax
jl 0x2112f650
mov eax, dword [0x2115664c]
cmp eax, ebx
je 0x2112f6c3
cmp dword [esi + 0x78], ebx
mov edi, dword [esi + 0x74]
jle 0x2112f6b3
push ebp
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea esp, [esp]
test eax, eax
je 0x2112f6a2
mov ecx, dword [esi + 0x68]
push 0x20
push edi
push ecx
call ebp
mov eax, dword [0x2115664c]
mov ecx, dword [esi + 0x78]
mov edx, dword [edi + 0xc]
mov edi, dword [edx + 4]
inc ebx
cmp ebx, ecx
jl 0x2112f690
xor ebx, ebx
pop ebp
cmp eax, ebx
je 0x2112f6c3
mov eax, dword [esi + 0x68]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
jmp 0x2112f6d6
cmp dword [esi + 0xd8], ebx
je 0x2112f6d6
call fcn.2112d780
mov dword [esi + 0xd8], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0xc4], 1
mov dword [esi + 0x68], ebx
mov dword [esi + 0x368], ebx
lock dec dword [0x2115915c]
cmp dword [0x211566c0], ebx
pop edi
je 0x2112f709
mov ecx, dword [0x211592a0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x211566c0], ebx
je 0x2112f73d
mov eax, dword [0x211592a0]
cmp eax, ebx
jne 0x2112f734
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x211592a0], eax
je 0x2112f722
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x2112f8d0
Capabilities:
Check mutex on windows

Disassembly:
push esi
call sym.mss32.dll__AIL_ms_count_0
mov dword [0x21159180], eax
lock inc dword [0x2115917c]
mov ecx, dword [0x2115917c]
mov eax, 1
cmp ecx, eax
jne 0x2112f94a
cmp dword [0x2115664c], eax
jne 0x2112f8fe
call fcn.2112e0b0
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112f913
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call sym.mss32.dll_stream_background
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112f94a
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112f941
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112f930
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lock dec dword [0x2115917c]
mov esi, dword [0x2115930c]
test esi, esi
je 0x2112f970
jmp 0x2112f960
push esi
call fcn.2112e270
mov esi, dword [esi + 0xcc]
test esi, esi
jne 0x2112f960
pop esi
ret

Function at 0x2112f980
Capabilities:
Check mutex on windows

Disassembly:
call sym.mss32.dll__AIL_ms_count_0
sub eax, dword [0x21159180]
cmp eax, 0xa
jbe 0x2112f9e5
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112f9cb
mov eax, dword [0x211592a0]
test eax, eax
jne 0x2112f9c2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea esp, [esp]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x211592a0], eax
je 0x2112f9b0
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.2112f8d0
mov eax, dword [0x211566c0]
test eax, eax
je 0x2112f9e5
mov eax, dword [0x211592a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
ret

Function at 0x2112fc00
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov dword [0x211592dc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x2112fc47
push str.Unable_to_create_file.
mov dword [0x211592dc], 4
call sym.mss32.dll__AIL_set_error_4
xor eax, eax
pop esi
pop ecx
ret 4
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 8]
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x2112fc76
cmp dword [esp + 4], edi
jne 0x2112fc76
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret 4
push 0x21141d58
mov dword [0x211592dc], 6
call sym.mss32.dll__AIL_set_error_4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x2112fca0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
sub esp, 0x2c
test al, 2
mov edx, 0
setne dl
and al, 1
push esi
mov esi, ecx
lea ecx, [edi + 0x24]
mov dword [esp + 8], ecx
push 0
inc edx
neg al
mov word [esp + 0x1e], dx
movzx edx, dx
push 0x80
push 2
sbb eax, eax
and eax, 8
add eax, 8
movzx ecx, ax
imul ecx, edx
mov word [esp + 0x32], ax
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov word [esp + 0x30], ax
mov eax, ecx
imul eax, esi
cdq
and edx, 7
add eax, edx
push 0
sar eax, 3
push 0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
push 0x40000000
push eax
mov dword [esp + 0x20], 0x46464952
mov dword [esp + 0x28], 0x45564157
mov dword [esp + 0x2c], 0x20746d66
mov dword [esp + 0x30], 0x10
mov word [esp + 0x34], 1
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], 0x61746164
mov dword [esp + 0x48], edi
mov dword [0x211592dc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x2112fd7b
push str.Unable_to_create_file.
mov dword [0x211592dc], 4
call sym.mss32.dll__AIL_set_error_4
xor eax, eax
pop esi
add esp, 0x2c
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0x2c
lea edx, [esp + 0x14]
push edx
push esi
call ebx
mov ecx, dword [esp + 0x3c]
push 0
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
push esi
call ebx
test eax, eax
pop ebx
je 0x2112fdc1
cmp dword [esp + 0x34], edi
jne 0x2112fdc1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x2c
ret 8
push 0x21141d58
mov dword [0x211592dc], 6
call sym.mss32.dll__AIL_set_error_4
xor eax, eax
pop esi
add esp, 0x2c
ret 8

Function at 0x21130a0d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x21130ae7
mov eax, 0x94
call fcn.21133040
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x21130ab0
mov ecx, dword [esi + 0x10]
mov dword [0x21156280], ecx
mov eax, dword [esi + 4]
mov dword [0x2115628c], eax
mov edx, dword [esi + 8]
mov dword [0x21156290], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x21156284], esi
je 0x21130a72
or esi, 0x8000
mov dword [0x21156284], esi
shl eax, 8
add eax, edx
push 0
mov dword [0x21156288], eax
call fcn.21132db9
test eax, eax
pop ecx
je 0x21130ab0
call fcn.21132fab
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x2115c0b0], eax
call fcn.21132e89
mov dword [0x21156240], eax
call fcn.211328fc
test eax, eax
jge 0x21130ab4
call fcn.21132e0a
xor eax, eax
jmp 0x21130ad8
call fcn.21132cfd
test eax, eax
jl 0x21130ae0
call fcn.21132aca
test eax, eax
jl 0x21130ae0
call fcn.21131d4c
test eax, eax
jne 0x21130ae0
inc dword [0x2115623c]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.21132aa7
jmp 0x21130aab
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x21130ad5
cmp dword [0x2115623c], eax
jle 0x21130ab0
dec dword [0x2115623c]
cmp dword [0x211562bc], eax
jne 0x21130b09
call fcn.21131e84
call fcn.21132aa7
call fcn.21132e0a
jmp 0x21130ad5
Function at 0x21131db1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x211562c0], esi
push edi
jne 0x21131dd1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x211562bc], esi
mov byte [0x211562b8], al
jne 0x21131e37
mov ecx, dword [0x2115c0a8]
test ecx, ecx
je 0x21131e18
mov eax, dword [0x2115c0a4]
sub eax, 4
cmp eax, ecx
jmp 0x21131e11
mov eax, dword [eax]
test eax, eax
je 0x21131e03
call eax
mov eax, dword [0x2115c0a4]
sub eax, 4
cmp eax, dword [0x2115c0a8]
mov dword [0x2115c0a4], eax
jae 0x21131dfb
mov eax, 0x21154024
mov esi, 0x2115402c
cmp eax, esi
mov edi, eax
jae 0x21131e37
mov eax, dword [edi]
test eax, eax
je 0x21131e30
call eax
add edi, 4
cmp edi, esi
jb 0x21131e28
mov eax, 0x21154030
mov esi, 0x21154034
cmp eax, esi
mov edi, eax
jae 0x21131e56
mov eax, dword [edi]
test eax, eax
je 0x21131e4f
call eax
add edi, 4
cmp edi, esi
jb 0x21131e47
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x21131e71
push dword [ebp + 8]
mov dword [0x211562c0], 1
call fcn.21131d1c
pop ecx
pop ebp
ret