joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d6390
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1014b08
lea eax, [esi + 0x25f5c]
push 0x1009bc4
push eax
call fcn.01061570
mov edi, dword [ebp + 0xc]
mov ebx, eax
test ebx, ebx
je 0x10d64d3
cmp word [ebx], 0
je 0x10d63d0
add eax, 2
cmp word [eax], 0
jne 0x10d63c7
sub eax, ebx
sar eax, 1
mov dword [ebp - 8], eax
push 1
lea eax, [edi + 0x84]
push eax
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov ecx, dword [edi + 0x20]
push ebx
push 0x1014b24
push 0x1010d48
push 0x1009a58
push 0x1e
push edi
push esi
call ecx
add esp, 0x1c
cmp dword [edi + 0x4c], 0
je 0x10d6482
lea edx, [ebp + 8]
push edx
push 0x1014b24
push 0x1010d48
push DirectSoundEnumerateW
push esi
call fcn.01091aa0
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10d6482
push 0x1014b24
push 0x1010d48
push 0x1009a58
call fcn.010341e0
mov dword [ebp - 4], eax
test eax, eax
je 0x10d646f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
push 0x3f
push edi
push esi
call fcn.01034280
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp dword [edi + 0x44], 0
je 0x10d64c3
cmp dword [edi + 0x48], 0
je 0x10d64a3
push 0x1014b24
push 0x1010d48
push DirectSoundEnumerateW
push esi
call fcn.01068a40
mov edx, dword [ebp - 8]
lea eax, [edx + edx + 2]
push eax
push ebx
push 1
push 0x1014b24
push 0x1010d48
push DirectSoundEnumerateW
push esi
call fcn.010891e0
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push esi
call fcn.01069630
lea eax, [esi + 0x25f5c]
push eax
push esi
call fcn.010694a0
lea ecx, [esi + 0x26796]
push ecx
push esi
call fcn.010694a0
lea edx, [esi + 0x2637c]
push edx
push esi
call fcn.010694a0
push 1
push 0
push 0
push 0
push reloc.DSOUND.dll_DirectSoundEnumerateW
push edi
push 0x10d60e0
push esi
call fcn.010b2020
push esi
call fcn.010928f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10d7510
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x170
test dword [eax + 0xc8], 0x2000000
je 0x10d7647
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push 0
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 8]
push edx
push 0x101022c
push 0x10101e8
push DirectSoundEnumerateW
push eax
call fcn.010895a0
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapFree]
test eax, eax
je 0x10d7575
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
test edi, edi
jne 0x10d7639
mov ecx, dword [esi]
push 0x103
lea eax, [ebp - 0x170]
push eax
push ecx
call fcn.010b23b0
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10d7592
sub eax, edx
push eax
lea edx, [ebp - 0x170]
push edx
lea eax, [ebp - 0x68]
push eax
call fcn.0108bb50
mov eax, dword [esi]
mov ecx, dword [ebp - 0x10]
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0x101022c
push 0x10101e8
push DirectSoundEnumerateW
push eax
mov dword [ebp + 0x10], ecx
call fcn.010891e0
mov ecx, dword [esi]
push ecx
call fcn.0108c970
mov edx, dword [0x11250bc]
mov eax, dword [esi]
push edx
push eax
call fcn.010bc1b0
mov edi, eax
test edi, edi
je 0x10d7614
mov eax, dword [esi]
mov ecx, dword [eax + 0x25f58]
push ecx
push edi
add eax, 0x2f248
push 0
push eax
call fcn.010cee00
add esp, 0x10
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
mov esi, dword [esi]
lea edx, [ebp + 0x10]
push edx
push 0
push esi
push 0x10b3160
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10d7639
push eax
mov eax, dword [esi + 0x1bc]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10d7cc0
Capabilities:
Enumerate threads

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x9c]
push eax
push 0
mov ebx, 1
push 0x418
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10d7df3
cmp edi, 0xffffffff
je 0x10d7df3
mov ecx, dword [esi + 0x9c]
push ecx
push 4
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
test ebx, ebx
je 0x10d7de0
cmp ebx, 0xffffffff
je 0x10d7de0
lea edx, [ebp - 0x28]
push edx
push ebx
mov dword [ebp - 0x28], 0x1c
call sub.KERNEL32.DLL_Thread32First
test eax, eax
je 0x10d7dd9
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x10d7d6b
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.KERNEL32.DLL_Thread32Next
test eax, eax
jne 0x10d7d54
jmp 0x10d7dd9
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.DLL_OpenThread]
mov esi, eax
test esi, esi
je 0x10d7dd9
cmp esi, 0xffffffff
je 0x10d7dd9
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0xac]
push 0
push 4
lea ecx, [ebp - 4]
push ecx
push 9
push esi
mov dword [ebp - 4], 0
call edx
cmp dword [ebp - 4], 0
je 0x10d7dcf
push esi
push edi
call fcn.0103a1c0
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x9c]
jne 0x10d7dcf
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push eax
push edi
call fcn.010d7be0
test eax, eax
je 0x10d7dcf
mov dword [ebp - 0xc], 5
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10d8a10
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x2f524], eax
jne 0x10d8bf7
push ebx
push edi
push 0x94
push eax
lea eax, [ebp - 0x9c]
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebx + 0x18], 0
je 0x10d8a82
mov eax, dword [ebx + 0x80]
imul eax, dword [ebx + 0x14]
add eax, eax
cmp eax, 0x1000
jae 0x10d8a68
mov eax, 0x1000
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
push edx
push eax
push esi
call fcn.01021090
mov edi, eax
mov dword [ebp + 8], edi
jmp 0x10d8a97
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edi
push ecx
call fcn.010608d0
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, eax
test edi, edi
je 0x10d8bf2
mov edx, dword [ebx + 0x14]
mov dword [ebp - 0x88], edx
call dword [sym.imp.msvcrt.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x98], dl
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x90], edx
test eax, eax
je 0x10d8ae3
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push edi
call fcn.01021180
push ebx
push esi
call fcn.0103c590
mov edx, dword [ebx + 0x10]
push 1
push edx
push esi
call fcn.0108ab90
mov eax, dword [ebx + 0x10]
push 1
push 0x80
push 2
push 3
push 0xc0000000
push eax
push esi
call fcn.010c8140
mov edi, eax
test edi, edi
je 0x10d8b1b
cmp edi, 0xffffffff
jne 0x10d8b41
mov ecx, dword [ebx + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edx, dword [ebx + 0x10]
push 1
push 0x80
push 2
push 7
push 0xc0000000
push edx
push esi
call fcn.010c8140
mov edi, eax
test edi, edi
je 0x10d8bd8
cmp edi, 0xffffffff
je 0x10d8bd8
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [esi + 0x27158]
push ecx
push edx
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x9c], 0x58505850
call fcn.010225c0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x27158]
push ecx
push 0xffffffffffffffff
push eax
call fcn.010225c0
mov ecx, dword [esi + 0x260]
push 0
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x10], eax
push 0x94
lea eax, [ebp - 0x9c]
push eax
push edi
call ecx
test eax, eax
je 0x10d8bcf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
lea edx, [ebp - 8]
push edx
mov edx, dword [esi + 0x260]
push eax
push ecx
push edi
call edx
test eax, eax
je 0x10d8bcf
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1bc]
push edi
call eax
push ebx
push esi
call fcn.010d89b0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10d9280
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x29c]
push edi
call ecx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 9
lea edx, [esi + 0x404]
push 8
mov dword [esi + 0x88], eax
mov dword [esi + 0x10], 0
mov dword [esi + 8], edx
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10d92fe
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push edi
push 0x10d3a90
push 0
push 0
mov dword [edi], esi
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x134], eax
test eax, eax
je 0x10d92f2
cmp eax, 0xffffffff
jne 0x10d92fe
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [esi + 0x18]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x230e0], eax
mov ecx, dword [esi + 0x18]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x230e4], edx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x230ec], ecx
mov edx, dword [esi + 0x18]
push edx
call fcn.0101c950
pop edi
mov dword [esi + 0x84], eax
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14

Function at 0x10d9350
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x184], 0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
jne 0x10d93f3
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x23110]
push 1
add ecx, 0x168
push ecx
call edi
test eax, eax
jne 0x10d93f3
mov edx, dword [esi + 0x18]
mov eax, dword [edx]
lea ecx, [eax + 0x272]
push ecx
push eax
call fcn.01096220
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x23110]
mov dword [eax + 0x16c], 1
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx + 0x23110]
mov eax, dword [eax + 0x8018]
test eax, eax
je 0x10d93c5
push 1
add eax, 0x64
push eax
call edi
mov esi, dword [esi + 0x18]
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push eax
push 0x10d9220
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10d940e
push eax
mov eax, dword [esi + 0x1bc]
call eax
pop edi
pop esi
pop ebp
ret 4
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx + 0x23110]
mov eax, dword [eax + 0x8018]
test eax, eax
je 0x10d940e
push 1
add eax, 0x64
push eax
call edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x10d9a90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push 1
add ecx, 0x2f1b4
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x22e038
push ecx
call fcn.0106a740
mov eax, dword [esi]
mov edi, dword [eax]
lea edx, [ebp + 8]
push edx
push 0
push eax
push fcn.0109d370
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10d9aef
push eax
mov eax, dword [edi + 0x1bc]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call fcn.010915b0
mov eax, dword [esi]
mov ecx, dword [0x11250a0]
mov eax, dword [eax]
push ecx
push eax
call fcn.010bc1b0
mov edi, eax
test edi, edi
je 0x10d9b35
mov edx, dword [esi]
mov eax, dword [edx]
push edi
add eax, 0x2f248
push 0
push eax
call fcn.010cee00
add esp, 0xc
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10df0e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0x213
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10df15f
mov ecx, dword [ebp + 0xc]
push edi
test ecx, ecx
je 0x10df11d
mov edi, 0x210
sub ecx, esi
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub edi, 1
jne 0x10df112
mov eax, dword [ebp + 8]
mov dword [esi + 0x20c], eax
mov edi, dword [eax]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x10df060
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10df152
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10e1900
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0xd
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10e19bb
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x10e192f
xor eax, eax
jmp 0x10e1944
cmp word [ecx], 0
mov eax, ecx
je 0x10e1940
add eax, 2
cmp word [eax], 0
jne 0x10e1937
sub eax, ecx
sar eax, 1
push eax
push ecx
mov dword [esi + 8], eax
call fcn.0101e7a0
mov dword [esi + 4], eax
test eax, eax
je 0x10e19af
mov edi, dword [ebp + 8]
push ebx
lea ebx, [edi + 0x934]
push ebx
mov dword [esi], edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov edi, dword [edi]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push fcn.010e1750
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10e199b
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
pop esi
pop ebp
ret 8
push esi
call fcn.010e1750
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
pop esi
pop ebp
ret 8
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebp
ret 8

Function at 0x10e1cb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
cmp dword [edi + 0x26a94], 0x1771
jb 0x10e1cd2
push 0
push esi
call fcn.010a1b40
jmp 0x10e1cf5
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x10a1ee0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10e1cf5
mov ecx, dword [edi + 0x1bc]
push eax
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x23110]
test eax, eax
je 0x10e1d57
push 0
add eax, 0x70
push eax
push esi
call fcn.010956a0
mov eax, dword [esi]
mov ecx, dword [eax + 0x23110]
push 0
add ecx, 0x70
push ecx
push esi
call fcn.010956a0
mov eax, dword [esi]
mov edx, dword [eax + 0x23110]
push 0
push 0
push 0
push 0x1001984
add edx, 0x4ac
push edx
push 0
push 1
push eax
call fcn.010953f0
mov eax, dword [esi]
push 0x1012168
push DirectSoundEnumerateW
push eax
call fcn.01089a10
pop edi
pop esi
pop ebp
ret 4
Function at 0x10e1d70
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push 0x803
push 8
mov ebx, 3
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10e1f45
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push 0x3ff
push esi
push eax
push 0
push ecx
call fcn.0108b280
cmp eax, 2
je 0x10e1dd9
mov edx, dword [ebp + 0x10]
mov eax, dword [edi]
push 0x3ff
push esi
push edx
push 0
push eax
call fcn.0108b280
cmp eax, ebx
jne 0x10e1f34
mov edx, dword [edi]
lea ecx, [ebp + 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0x22e078
push edx
call fcn.0106a740
mov eax, dword [ebp + 0x20]
mov ecx, dword [edi]
push esi
push eax
push ecx
call fcn.010dc430
test eax, eax
je 0x10e1f03
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push edi
call fcn.01096110
test eax, eax
je 0x10e1f03
push ebx
push edi
call fcn.010960d0
cmp dword [ebp + 0x18], 0
je 0x10e1e91
push 0x20a
lea edx, [ebp - 0x314]
push 0
push edx
call sub.msvcrt.dll_memset
push 0x10019b4
push esi
push 0x1009a1c
lea eax, [ebp - 0x314]
push 0x103
push eax
call fcn.0101e760
add esp, 0x20
lea ecx, [ebp - 0x314]
push ecx
call fcn.0101e3c0
mov ecx, dword [edi]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x314]
push eax
push 1
push 0x101233c
push 0x1015990
push DirectSoundEnumerateW
push ecx
call fcn.010891e0
xor ebx, ebx
jmp 0x10e1f34
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x10e1eea
push 0x105
lea edx, [ebp - 0x108]
push 0
push edx
call sub.msvcrt.dll_memset
push ebx
push 0x100193c
push 0x10019b8
push 0x10198d0
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0101d440
mov edx, dword [edi]
add esp, 0x24
push 5
push 0x3e8
lea ecx, [ebp - 0x108]
push ecx
push esi
push edx
call fcn.0101f220
xor ebx, ebx
jmp 0x10e1f34
mov eax, dword [edi]
push 5
push 0x3e8
push 0x10019b8
push esi
push eax
call fcn.0101f220
xor ebx, ebx
jmp 0x10e1f34
mov ecx, dword [edi]
push ecx
call fcn.010883f0
test eax, eax
je 0x10e1f16
mov ebx, 2
jmp 0x10e1f34
cmp dword [ebp + 0x14], 0
je 0x10e1f23
mov ebx, 1
jmp 0x10e1f34
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
push edx
push esi
push eax
push edi
call fcn.01096180
mov ebx, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10e1fe0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.010d91c0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push 0
push 0
push 0x100196c
push eax
push ecx
call fcn.0101f220
test eax, eax
je 0x10e2038
push edi
push 4
push eax
push esi
call fcn.0103cb40
mov edi, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10ce170
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10e2037
push eax
mov eax, dword [edi + 0x1bc]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x10e2590
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
push 1
lea eax, [edi + 0x950]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x10e2626
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 4], esi
mov dword [ebp + 8], esi
call ebx
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push edi
mov dword [ebp - 8], eax
call fcn.010e22a0
test eax, eax
je 0x10e2630
inc esi
cmp esi, 0xf
jg 0x10e25fa
call ebx
sub eax, dword [ebp - 8]
cmp eax, 0x7530
ja 0x10e25fa
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.010e22a0
test eax, eax
jne 0x10e25d6
test esi, esi
je 0x10e2610
mov edx, dword [edi]
push edi
mov dword [edx + 0x30db4], 1
call fcn.010d7930
mov eax, dword [edi]
push eax
call fcn.01097620
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10e2a70
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push edi
call fcn.0106e280
mov eax, dword [edi]
mov ecx, dword [eax + 0x230f8]
push 0
push ecx
push eax
call fcn.010d8d00
mov eax, dword [edi]
mov ecx, dword [eax + 0x230f8]
test ecx, ecx
je 0x10e2aa6
push ecx
push eax
call fcn.0103c590
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, eax
test esi, esi
jbe 0x10e2abf
mov dl, al
sub dl, 0x40
xor byte [eax + ecx], dl
inc eax
cmp eax, esi
jb 0x10e2ab2
push esi
push ecx
push edi
call fcn.010cd0d0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10e2b80
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c8
push ebx
push esi
push edi
xor edi, edi
push 0x6c0
lea eax, [ebp - 0x6c8]
push edi
push eax
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea esi, [ebp - 0x644]
mov dword [ebp - 8], edi
mov eax, dword [edi + 0x11276cc]
push eax
mov eax, dword [ebp + 8]
push 0x1009bc4
add eax, 0x237a4
push eax
call fcn.01061570
mov ebx, eax
test ebx, ebx
je 0x10e2c4f
mov eax, dword [edi + 0x11276cc]
lea ecx, [esi - 0x84]
test ecx, ecx
je 0x10e2bf8
test eax, eax
je 0x10e2bf8
push 0x3f
push eax
lea edx, [esi - 0x84]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push eax
call fcn.010dc080
cmp eax, 0x400000
jae 0x10e2c3f
mov ecx, dword [ebp + 8]
push 1
lea edi, [esi + 4]
push edi
push ebx
push ecx
call fcn.010dc240
mov dword [esi], eax
test eax, eax
je 0x10e2c3c
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ecx + 0x27158]
push eax
push 0xffffffffffffffff
push edx
call fcn.010225c0
xor eax, 0x10cc4ac
mov dword [esi + 8], eax
mov edi, dword [ebp - 8]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add edi, 4
add esi, 0x90
mov dword [ebp - 8], edi
cmp edi, 0x30
jb 0x10e2bb1
xor ecx, ecx
lea eax, [ebp - 0x640]
lea edx, [ecx + 2]
nop
cmp dword [eax - 4], 0
je 0x10e2c7f
mov esi, dword [eax]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x8c], 0
je 0x10e2c95
mov esi, dword [eax + 0x90]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x11c], 0
je 0x10e2cab
mov esi, dword [eax + 0x120]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x1ac], 0
je 0x10e2cc1
mov esi, dword [eax + 0x1b0]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x23c], 0
je 0x10e2cd7
mov esi, dword [eax + 0x240]
lea ecx, [ecx + esi + 0x90]
cmp dword [eax + 0x2cc], 0
je 0x10e2ced
mov esi, dword [eax + 0x2d0]
lea ecx, [ecx + esi + 0x90]
add eax, 0x360
sub edx, 1
jne 0x10e2c70
test ecx, ecx
je 0x10e2d59
lea edi, [ecx + 4]
test edi, edi
je 0x10e2d99
lea eax, [edi + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x10e2d59
mov esi, eax
mov dword [esi], 0x53435257
add esi, 4
push esi
push 0xc
lea ecx, [ebp - 0x6c8]
push ecx
call fcn.0103c510
lea ecx, [edi - 4]
xor eax, eax
test ecx, ecx
jbe 0x10e2d54
mov dl, al
sub dl, 0x40
xor byte [eax + esi], dl
inc eax
cmp eax, ecx
jb 0x10e2d47
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
lea esi, [ebp - 0x644]
mov edi, 0xc
lea ebx, [ebx]
mov eax, dword [esi]
test eax, eax
je 0x10e2d82
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add esi, 0x90
sub edi, 1
jne 0x10e2d70
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 0
jmp 0x10e2d59