joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be0c4]
cmp byte [0x100bde89], 0
mov dword [ebp - 4], eax
je 0x1002a445
fld dword [0x100be0b4]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be0b8]
mov esi, eax
call fcn.100596f0
fld dword [0x100be0ac]
mov edi, eax
call fcn.100596f0
fld dword [0x100be0b0]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002a445
mov ecx, dword [0x100cb10c]
cmp dword [ecx + 0x2dc], 3
jb 0x1002a445
cmp dword [ebp + 8], 0x201
jne 0x1002a40f
mov al, 1
mov byte [0x100be0c8], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be0c8], 0
jb 0x1002a445
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be0c4], eax
mov eax, 3
call fcn.1000f110
mov byte [0x100bde89], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002a7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be4fc]
cmp byte [0x100be501], 0
mov dword [ebp - 4], eax
je 0x1002a87c
fld dword [0x100be4ec]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be4f0]
mov esi, eax
call fcn.100596f0
fld dword [0x100be4e4]
mov edi, eax
call fcn.100596f0
fld dword [0x100be4e8]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002a87c
cmp dword [ebp + 8], 0x201
jne 0x1002a82a
mov al, 1
mov dword [0xe8cb3c], 0
mov byte [0x100be500], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be500], 0
jb 0x1002a87c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x100be591], 0
mov dword [0x100be4fc], eax
jne 0x1002a864
cmp byte [0x100be5d9], 0
jne 0x1002a864
call fcn.1002a890
xor al, al
mov esp, ebp
pop ebp
ret 4
mov byte [0x100be591], 0
mov dword [0xe8cb3c], 0
mov byte [0x100be5d9], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b110
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be73c]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b1bc
fld dword [0x100be72c]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be730]
mov esi, eax
call fcn.100596f0
fld dword [0x100be724]
mov edi, eax
call fcn.100596f0
fld dword [0x100be728]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b1bc
cmp dword [ebp + 8], 0x201
jne 0x1002b190
mov al, 1
mov byte [0x100be740], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be740], 0
jb 0x1002b1bc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be73c], eax
mov byte [0x100be591], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b1d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be784]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b281
fld dword [0x100be774]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be778]
mov esi, eax
call fcn.100596f0
fld dword [0x100be76c]
mov edi, eax
call fcn.100596f0
fld dword [0x100be770]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b281
cmp dword [ebp + 8], 0x201
jne 0x1002b250
mov al, 1
mov byte [0x100be788], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be788], 0
jb 0x1002b281
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be784], eax
mov byte [0x100be591], 0
mov dword [0xe8cb3c], 0
call fcn.100113e0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be7cc]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b347
fld dword [0x100be7bc]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be7c0]
mov esi, eax
call fcn.100596f0
fld dword [0x100be7b4]
mov edi, eax
call fcn.100596f0
fld dword [0x100be7b8]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b347
cmp dword [ebp + 8], 0x201
jne 0x1002b313
mov eax, 1
mov byte [0x100be7d0], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be7d0], 0
jb 0x1002b347
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be7cc], eax
mov eax, 0x100bd618
call fcn.1002c1a0
mov eax, 1
mov byte [0x100bde89], al
mov dword [0xe8cb3c], eax
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be814]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b401
fld dword [0x100be804]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be808]
mov esi, eax
call fcn.100596f0
fld dword [0x100be7fc]
mov edi, eax
call fcn.100596f0
fld dword [0x100be800]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b401
cmp dword [ebp + 8], 0x201
jne 0x1002b3d0
mov al, 1
mov byte [0x100be818], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be818], 0
jb 0x1002b401
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be814], eax
mov byte [0x100be591], 0
mov dword [0xe8cb3c], 0
call fcn.10024b90
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b410
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be85c]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b4d9
fld dword [0x100be84c]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be850]
mov esi, eax
call fcn.100596f0
fld dword [0x100be844]
mov edi, eax
call fcn.100596f0
fld dword [0x100be848]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b4d9
cmp dword [ebp + 8], 0x201
jne 0x1002b490
mov al, 1
mov byte [0x100be860], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be860], 0
jb 0x1002b4d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be85c], eax
xor eax, eax
mov byte [0x100be591], 0
mov dword [0xe8cb3c], eax
cmp byte [0x100be939], 1
jne 0x1002b4d4
mov byte [0x100be939], al
mov dword [0xe8cb3c], eax
xor al, al
mov esp, ebp
pop ebp
ret 4
call fcn.100101c0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b4f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be8a4]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b5ae
fld dword [0x100be894]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be898]
mov esi, eax
call fcn.100596f0
fld dword [0x100be88c]
mov edi, eax
call fcn.100596f0
fld dword [0x100be890]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b5ae
cmp dword [ebp + 8], 0x201
jne 0x1002b570
mov al, 1
mov byte [0x100be8a8], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be8a8], 0
jb 0x1002b5ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be8a4], eax
mov byte [0x100be591], 0
push 0x23
mov ecx, 0x861110
mov dword [0xe8cb3c], 0
call ecx
mov edx, 0x85ec50
mov ecx, eax
call edx
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b5c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be8ec]
cmp byte [0x100be591], 0
mov dword [ebp - 4], eax
je 0x1002b678
fld dword [0x100be8dc]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be8e0]
mov esi, eax
call fcn.100596f0
fld dword [0x100be8d4]
mov edi, eax
call fcn.100596f0
fld dword [0x100be8d8]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002b678
cmp dword [ebp + 8], 0x201
jne 0x1002b640
mov al, 1
mov byte [0x100be8f0], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be8f0], 0
jb 0x1002b678
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be8ec], eax
mov al, 1
mov byte [0x100be591], 0
mov dword [0xe8cb3c], 0
mov byte [0x100c0511], al
mov byte [0x100c1df8], al
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [0x100bd61c]
cmp byte [0x100be591], 0
je 0x1002b73c
fld dword [0x100be72c]
push ebx
push edi
call fcn.100596f0
fld dword [0x100be730]
mov edi, eax
call fcn.100596f0
fld dword [0x100be724]
mov ebx, eax
call fcn.100596f0
fld dword [0x100be728]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
test al, al
je 0x1002b73a
cmp dword [ebp + 8], 0x201
jne 0x1002b70b
pop edi
mov eax, 1
pop ebx
mov byte [0x100be740], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret 4
xor edi, edi
mov byte [0x100be740], 0
mov dword [0xe8cb3c], edi
cmp esi, 0x1f4
jb 0x1002b73a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be73c], eax
mov byte [0x100be591], 0
mov dword [0xe8cb3c], edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c5d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100bf39c]
cmp byte [0x100bf359], 0
mov dword [ebp - 8], eax
je 0x1002c69f
fld dword [0x100bf38c]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100bf390]
mov esi, eax
call fcn.100596f0
fld dword [0x100bf384]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf388]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002c69f
cmp dword [ebp + 8], 0x201
jne 0x1002c652
mov al, 1
mov byte [0x100bf3a0], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 0x1f4
mov byte [0x100bf3a0], 0
jb 0x1002c69f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dl, byte [0x100bd684]
mov dword [0x100bf39c], eax
lea eax, [ebp - 8]
mov ecx, 5
push eax
mov dword [ebp - 8], 0xedf305c1
mov byte [ebp - 4], dl
call fcn.10052330
mov byte [0x100bf359], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002c6b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100bf3e4]
cmp byte [0x100bf359], 0
mov dword [ebp - 4], eax
je 0x1002c75c
fld dword [0x100bf3d4]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100bf3d8]
mov esi, eax
call fcn.100596f0
fld dword [0x100bf3cc]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf3d0]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002c75c
cmp dword [ebp + 8], 0x201
jne 0x1002c730
mov al, 1
mov byte [0x100bf3e8], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100bf3e8], 0
jb 0x1002c75c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bf3e4], eax
mov byte [0x100bf359], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c1d0c]
push ebx
mov ebx, 1
push esi
cmp eax, ebx
jne 0x1002c97f
mov word [ebp - 4], 0x3c1
mov byte [ebp - 2], 0xff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100c1d14], eax
lea eax, [ebp - 4]
push eax
jmp 0x1002c9b1
cmp eax, 3
jne 0x1002c9c8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x100c1d14]
add ecx, 0x3e8
cmp eax, ecx
jb 0x1002c9c8
mov word [ebp - 4], 0x3c1
mov byte [ebp - 2], 0xff
call esi
lea edx, [ebp - 4]
mov dword [0x100c1d14], eax
push edx
mov ecx, 3
call fcn.10052330
mov dword [0x100c1d0c], 2
add esp, 4
call fcn.1002bbe0
test al, al
jne 0x1002caea
call fcn.1002c0d0
test al, al
jne 0x1002caea
mov eax, dword [0x100c1d10]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
push str.RTT:__d_ms
push 0x100c1d88
call esi
mov eax, dword [0x100c1d10]
cdq
sub eax, edx
sar eax, 1
push eax
push str.PING:__d_ms
push 0x100c1d24
call esi
add esp, 0x18
cmp dword [0x100c1d10], 0
mov dword [0x100c1d18], 0
mov ecx, 5
jle 0x1002ca90
push 0x100c1d88
push 0x78
push 0x1d6
push 0xff19bdff
call fcn.10029570
push 0x100c1d24
push 0x78
push 0x217
push 0xff19bdff
mov ecx, 5
call fcn.10029570
push 0x100c1d88
push 0x100c1dba
call esi
push 0x100c1d24
push 0x100c1d56
call esi
mov ecx, dword [0x100c1d10]
add esp, 0x30
pop esi
mov dword [0x100c1d18], ebx
mov dword [0x100c1d1c], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x100c1d1c], 0
jle 0x1002cab6
push 0x100c1dba
push 0x50
push 0x1d6
push 0xff19bdff
call fcn.10029570
push 0x100c1d56
jmp 0x1002cad1
push 0x100c1d88
push 0x78
push 0x1d6
push 0xff19bdff
call fcn.10029570
push 0x100c1d24
push 0x78
push 0x217
push 0xff19bdff
mov ecx, 5
call fcn.10029570
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002caf0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100c0164]
cmp eax, 0x3e8
jb 0x1002cb8e
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1002cb8e
call esi
cmp dword [0x100bc058], 0
mov dword [0x100c0164], eax
je 0x1002cb55
push str.Chat_Window_Separate__OFF_
push 1
call fcn.100296d0
add esp, 8
push str.._LordConfigs.ini
mov dword [0x100bc058], 0
push 0x1005ec9c
jmp 0x1002cb78
push str.Chat_Window_Separate__ON_
push 1
call fcn.100296d0
add esp, 8
push str.._LordConfigs.ini
mov dword [0x100bc058], 1
push 0x1005eca0
push str.SeparateChat
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
jmp fcn.1000a820
pop esi
ret
Function at 0x1002cb90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100becdc]
cmp eax, 0x3e8
jb 0x1002cc38
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1002cc38
call esi
cmp dword [0x100bc050], 0
mov dword [0x100becdc], eax
je 0x1002cc05
push str.HPBAR_MONSTER__OFF_
push 1
call fcn.100296d0
add esp, 8
push str.._LordConfigs.ini
push 0x1005ec9c
push str.HPMonsterName
push str.Setting
mov dword [0x100bc050], 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
ret
push str.HPBAR_MONSTER__ON_
push 1
call fcn.100296d0
add esp, 8
push str.._LordConfigs.ini
push 0x1005eca0
push str.HPMonsterName
push str.Setting
mov dword [0x100bc050], 1
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
ret
Function at 0x10033540
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x100a22bc]
jns 0x1003354d
jmp fcn.100335c0
mov eax, dword [0x100a22b8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x100a22b8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x10033d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x414239
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x414239], 0
mov edx, dword [ebp - 4]
push edx
push 1
push 0x414239
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40ad9b
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x40ad9b], 0xfa
mov edx, dword [ebp - 4]
push edx
push 4
push 0x40ad9b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40ad96
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x40ad96], 0xd8
mov edx, dword [ebp - 4]
push edx
push 4
push 0x40ad96
call esi
push 0x10033780
push 0x40b1c0
mov bl, 0xe9
call fcn.10056900
push 0x100338d0
push 0x40b500
call fcn.10056900
push 0x10033730
push 0x413efe
mov bl, 0xe8
call fcn.10056900
push 0x10033750
push 0x4140d9
call fcn.10056900
push 0x10033750
push 0x41412e
call fcn.10056900
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10033ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100c04c4]
cmp byte [0x100c03f1], 0
mov dword [ebp - 4], eax
je 0x1003409c
fld dword [0x100c04b4]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100c04b8]
mov esi, eax
call fcn.100596f0
fld dword [0x100c04ac]
mov edi, eax
call fcn.100596f0
fld dword [0x100c04b0]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1003409c
cmp dword [ebp + 8], 0x201
jne 0x10034070
mov al, 1
mov byte [0x100c04c8], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100c04c8], 0
jb 0x1003409c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100c04c4], eax
mov byte [0x100c03f1], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x10035010
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x100c03f1], 0
mov esi, eax
je 0x100350de
fld dword [0x100c0424]
push ebx
push edi
call fcn.100596f0
fld dword [0x100c0428]
mov edi, eax
call fcn.100596f0
fld dword [0x100c041c]
mov ebx, eax
call fcn.100596f0
fld dword [0x100c0420]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x100350de
sub esi, dword [0x100c0434]
cmp dword [ebp + 8], 0x201
jne 0x1003509b
mov eax, 1
mov byte [0x100c0438], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov byte [0x100c0438], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x64
jb 0x100350de
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp + 8]
mov ecx, 4
push edx
mov dword [0x100c0434], eax
mov dword [ebp + 8], 0x16fb04c1
call fcn.10052330
add esp, 4
mov dword [0x100a22d4], 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10039170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10038990
push 0x8c5bb5
mov bl, 0xe8
call fcn.10056900
add esp, 8
mov esi, 0xa
mov ebx, 0x56fc5e
call fcn.100560c0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10039030
push 5
sub eax, 0x56fc63
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100391e8
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100391ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x56fd1a
call fcn.100560c0
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100390f0
push 5
sub ecx, 0x56fd1f
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10039244
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1003924a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x7d2ecb
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x7d2ecb], 0x1005efc4
mov edx, dword [ebp - 4]
push edx
push 4
push 0x7d2ecb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x7d2eeb
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x7d2eeb], 0x1005efe0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x7d2eeb
call esi
push 0x10041ec0
push 0x80b7f6
mov bl, 0xe8
call fcn.10056900
push 0x10041b60
push 0x7d2bc0
mov bl, 0xe9
call fcn.10056900
push 0x10041d70
push 0x7d2b00
call fcn.10056900
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10064018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xd4e5e8
push str.DataLocalAmuletSetType.bmd
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1004215c
push ebx
push edi
push 0xa000
call fcn.10056d67
push 0xa000
mov dword [0x100c7d50], eax
call fcn.10056d67
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
mov ebx, eax
push 0xa000
push ebx
call edi
push esi
push 1
lea eax, [ebp - 0x108]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x2c
mov ecx, 0xa000
call fcn.10056cd0
cmp dword [ebp - 0x108], eax
je 0x100420f8
push str.DataLocalAmuletSetType.bmd
lea ecx, [ebp - 0x104]
push 0xd2bb20
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov eax, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0xe8c578]
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
mov esi, ebx
xor edi, edi
lea esp, [esp]
push 0x14
push esi
mov edx, 0x4071a0
call edx
mov ecx, dword [esi]
mov eax, dword [0x100c7d50]
mov dword [edi + eax], ecx
mov edx, dword [esi + 4]
mov dword [edi + eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [edi + eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [edi + eax + 0xc], edx
mov ecx, dword [esi + 0x10]
mov dword [edi + eax + 0x10], ecx
add edi, 0x14
add esp, 8
add esi, 0x14
cmp edi, 0xa000
jl 0x10042100
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10058d40
mov esp, ebp
pop ebp
ret
push str.DataLocalAmuletSetType.bmd
lea edx, [ebp - 0x104]
push 0xd2bb38
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [0xe8c578]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0xe8c578]
push 0
push 0
push 2
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10058d40
mov esp, ebp
pop ebp
ret