joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100552a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0xc
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100552d1
cmp byte [esi + 0x12c5], 1
jne 0x100552d1
xor bl, bl
mov byte [esi + 0x12c5], bl
jmp 0x100552d3
xor bl, bl
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x1300]
cmp eax, 0x64
jae 0x100552ec
mov byte [esi + 0x12c5], bl
call edi
sub eax, dword [esi + 0x1340]
cmp eax, 0x64
jae 0x100552ff
mov byte [esi + 0x12c5], bl
cmp byte [esi + 0x12c5], bl
je 0x100554b8
cmp dword [0x1014a0ec], 3
jne 0x1005531c
fld dword [0x100b7120]
jmp 0x10055322
fld dword [0x100b73cc]
fstp dword [ebp - 4]
sub esp, 0x14
fldz
fstp dword [esp + 0x10]
fld dword [0x100b7f48]
fstp dword [esp + 0xc]
fld dword [0x100b736c]
fstp dword [esp + 8]
fld dword [0x100b73c8]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10020d40
fld dword [ebp - 4]
call fcn.100ac0e0
mov edi, eax
push 0x42
mov ecx, 0x100e4cc8
lea ebx, [edi + 0xa]
call fcn.1003e200
push eax
push 0xd2
push ebx
mov ebx, 3
push 0xff19bdff
lea ecx, [ebx + 0x61]
call fcn.10050e40
add esp, 0x10
push 0x43
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea eax, [edi + 0xa]
push eax
push 0xff19bdff
lea ecx, [ebx + 0x7f]
call fcn.10050e40
lea eax, [edi + 0x28]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
lea eax, [ebx + 0x44]
mov ecx, esi
fstp dword [ebp - 8]
fldz
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [0x100b7ed4]
fstp dword [esp + 4]
fld dword [ebp - 8]
fstp dword [esp]
call fcn.10051250
lea eax, [ebx + 0x44]
mov ecx, esi
call fcn.10051040
mov ebx, 0x1e
test al, al
je 0x10055431
cmp byte [esi + 0x1304], 0
mov dword [ebp - 4], ebx
je 0x10055405
mov dword [ebp - 4], 0x3c
fild dword [ebp - 4]
sub esp, 0x10
mov eax, 0x47
mov ecx, esi
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [0x100b7ed4]
fstp dword [esp + 4]
fld dword [ebp - 8]
fstp dword [esp]
call fcn.10051250
add edi, 0x8c
mov dword [ebp - 8], edi
fild dword [ebp - 8]
sub esp, 0x10
mov eax, 0x48
mov ecx, esi
fstp dword [ebp - 4]
fldz
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [0x100b7ed4]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10051250
mov eax, 0x48
mov ecx, esi
call fcn.10051040
test al, al
je 0x100554b8
cmp byte [esi + 0x1344], 0
mov dword [ebp - 8], ebx
je 0x1005548c
mov dword [ebp - 8], 0x3c
fild dword [ebp - 8]
sub esp, 0x10
mov eax, 0x48
mov ecx, esi
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [0x100b7ed4]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10051250
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100554c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124f55], 0
mov edx, eax
je 0x10055551
mov eax, 0x47
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10055551
cmp dword [ebp + 8], 0x201
jne 0x10055504
mov al, 1
mov byte [0x10124f94], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x10124f90]
mov byte [0x10124f94], 0
cmp edx, 0x1f4
jb 0x10055551
call esi
mov dword [0x10124f90], eax
mov al, byte [0x10123c9c]
lea edx, [ebp - 8]
mov ecx, 5
push edx
mov dword [ebp - 8], 0xedf305c1
mov byte [ebp - 4], al
call fcn.1008c360
mov byte [0x10124f55], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10055560
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124f55], 0
mov edx, eax
je 0x100555cc
mov eax, 0x48
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100555cc
cmp dword [ebp + 8], 0x201
jne 0x1005559f
mov al, 1
mov byte [0x10124fd4], al
pop esi
pop ebp
ret 4
sub edx, dword [0x10124fd0]
mov byte [0x10124fd4], 0
cmp edx, 0x1f4
jb 0x100555cc
call esi
mov dword [0x10124fd0], eax
mov byte [0x10124f55], 0
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4
Function at 0x100558c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10123cd4]
push ebx
mov ebx, 1
push esi
cmp eax, ebx
jne 0x100558ef
mov word [ebp - 4], 0x3c1
mov byte [ebp - 2], 0x80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10123cdc], eax
lea eax, [ebp - 4]
push eax
jmp 0x10055921
cmp eax, 3
jne 0x10055938
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x10123cdc]
add ecx, 0x3e8
cmp eax, ecx
jb 0x10055938
mov word [ebp - 4], 0x3c1
mov byte [ebp - 2], 0x80
call esi
lea edx, [ebp - 4]
mov dword [0x10123cdc], eax
push edx
mov ecx, 3
call fcn.1008c360
mov dword [0x10123cd4], 2
add esp, 4
call fcn.100548f0
test al, al
jne 0x10055adb
call fcn.10054de0
test al, al
jne 0x10055adb
push 2
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055adb
push 0x48
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055adb
push ebx
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055adb
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055adb
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055adb
mov eax, dword [0x10123cd8]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
push str.RTT:__d_ms
push 0x10123d4c
call esi
mov eax, dword [0x10123cd8]
cdq
sub eax, edx
sar eax, 1
push eax
push str.PING:__d_ms
push 0x10123ce4
call esi
add esp, 0x18
cmp dword [0x10123cd8], 0
mov dword [0x10123ce0], 0
mov ecx, 5
jle 0x10055a81
push 0x10123d4c
push 0x78
push 0x1d6
push 0xff19bdff
call fcn.10050e40
push 0x10123ce4
push 0x78
push 0x212
push 0xff19bdff
mov ecx, 5
call fcn.10050e40
push 0x10123d4c
push 0x10123d7e
call esi
push 0x10123ce4
push 0x10123d16
call esi
mov ecx, dword [0x10123cd8]
add esp, 0x30
pop esi
mov dword [0x10123ce0], ebx
mov dword [0x10123db0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x10123db0], 0
jle 0x10055aa7
push 0x10123d7e
push 0x50
push 0x1d6
push 0xff19bdff
call fcn.10050e40
push 0x10123d16
jmp 0x10055ac2
push 0x10123d4c
push 0x78
push 0x1d6
push 0xff19bdff
call fcn.10050e40
push 0x10123ce4
push 0x78
push 0x212
push 0xff19bdff
mov ecx, 5
call fcn.10050e40
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10055af0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10124990]
cmp eax, 0x190
jb 0x10055be2
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
push 0x15
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055be2
call esi
mov dword [0x10124990], eax
push 0x23
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0x23
mov eax, 0x861110
je 0x10055bc7
call eax
mov edx, 0x85f9a0
jmp 0x10055bce
call eax
mov edx, 0x85ec50
mov ecx, eax
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
add esp, 0xc
pop esi
ret

Function at 0x10055c60
Capabilities:
Execute shellcode via indirect call

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1073c1c0], 0
mov dword [0x10125d90], eax
je 0x10055c9f
push str.Camera_Restore__DEFAULT_
push 1
call fcn.10051170
add esp, 8
cmp dword [0x1073c1c0], 0
je 0x10055c9f
cmp dword [0xe609e8], 5
jne 0x10055c9f
mov eax, 0x1073c1b8
jmp fcn.100084d0
ret
Function at 0x10056230
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
push 9
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005650d
mov eax, 0x62
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100562ca
cmp ebx, 0x201
jne 0x1005627b
pop edi
mov byte [0x10125654], 1
pop esi
ret
sub edi, dword [0x10125650]
mov byte [0x10125654], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x10125650], eax
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0x22
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x60
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1005633e
cmp ebx, 0x201
jne 0x100562ef
pop edi
mov byte [0x101255d4], 1
pop esi
ret
sub edi, dword [0x101255d0]
mov byte [0x101255d4], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x101255d0], eax
push 3
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 3
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x5e
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100563b2
cmp ebx, 0x201
jne 0x10056363
pop edi
mov byte [0x10125554], 1
pop esi
ret
sub edi, dword [0x10125550]
mov byte [0x10125554], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x10125550], eax
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0x10
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x5f
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10056426
cmp ebx, 0x201
jne 0x100563d7
pop edi
mov byte [0x10125594], 1
pop esi
ret
sub edi, dword [0x10125590]
mov byte [0x10125594], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x10125590], eax
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0xd
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x61
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10056496
cmp ebx, 0x201
jne 0x1005644b
pop edi
mov byte [0x10125614], 1
pop esi
ret
sub edi, dword [0x10125610]
mov byte [0x10125614], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x10125610], eax
push 1
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 1
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x64
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1005650d
cmp ebx, 0x201
jne 0x100564bb
pop edi
mov byte [0x101256d4], 1
pop esi
ret
sub edi, dword [0x101256d0]
mov byte [0x101256d4], 0
cmp edi, 0x1f4
jb 0x1005650d
call esi
mov dword [0x101256d0], eax
push 6
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 6
mov eax, 0x861110
je 0x10056502
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
call eax
mov edx, 0x85ec50
mov ecx, eax
call edx
pop edi
pop esi
ret
Function at 0x10056510
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
push 9
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10056779
mov eax, 0x60
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100565aa
cmp ebx, 0x201
jne 0x1005655b
pop edi
mov byte [0x101255d4], 1
pop esi
ret
sub edi, dword [0x101255d0]
mov byte [0x101255d4], 0
cmp edi, 0x1f4
jb 0x10056779
call esi
mov dword [0x101255d0], eax
push 3
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 3
mov eax, 0x861110
je 0x1005676e
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x5e
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1005661e
cmp ebx, 0x201
jne 0x100565cf
pop edi
mov byte [0x10125554], 1
pop esi
ret
sub edi, dword [0x10125550]
mov byte [0x10125554], 0
cmp edi, 0x1f4
jb 0x10056779
call esi
mov dword [0x10125550], eax
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0x10
mov eax, 0x861110
je 0x1005676e
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x5f
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10056692
cmp ebx, 0x201
jne 0x10056643
pop edi
mov byte [0x10125594], 1
pop esi
ret
sub edi, dword [0x10125590]
mov byte [0x10125594], 0
cmp edi, 0x1f4
jb 0x10056779
call esi
mov dword [0x10125590], eax
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 0xd
mov eax, 0x861110
je 0x1005676e
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x61
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10056702
cmp ebx, 0x201
jne 0x100566b7
pop edi
mov byte [0x10125614], 1
pop esi
ret
sub edi, dword [0x10125610]
mov byte [0x10125614], 0
cmp edi, 0x1f4
jb 0x10056779
call esi
mov dword [0x10125610], eax
push 1
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 1
mov eax, 0x861110
je 0x1005676e
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
mov eax, 0x64
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10056779
cmp ebx, 0x201
jne 0x10056727
pop edi
mov byte [0x101256d4], 1
pop esi
ret
sub edi, dword [0x101256d0]
mov byte [0x101256d4], 0
cmp edi, 0x1f4
jb 0x10056779
call esi
mov dword [0x101256d0], eax
push 6
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
push 6
mov eax, 0x861110
je 0x1005676e
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop edi
pop esi
ret
call eax
mov edx, 0x85ec50
mov ecx, eax
call edx
pop edi
pop esi
ret
Function at 0x100584f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x100bc018]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
call fcn.10058660
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, edx
sub ecx, dword [esi + 0x5900]
mov dword [esp + 0x18], edx
cmp ecx, 0x1f4
jb 0x1005863e
cmp byte [esi + 0x5905], 0
je 0x1005863e
mov dword [esp + 0x1c], 0x165
mov dword [esp + 0x20], 0x166
mov dword [esp + 0x24], 0x167
mov dword [esp + 0x28], 0x168
mov dword [esp + 0x2c], 0x169
mov dword [esp + 0x30], 0x16a
mov dword [esp + 0x34], 0x16b
mov dword [esp + 0x38], 0x16c
xor ebx, ebx
mov ax, word [esp + ebx*4 + 0x1c]
mov ecx, esi
call fcn.10051040
test al, al
je 0x10058618
mov eax, dword [esp + ebx*4 + 0x1c]
lea edi, [eax + 5]
shl edi, 6
mov ecx, edx
sub ecx, dword [edi + esi]
shl eax, 6
cmp dword [ebp + 8], 0x201
je 0x10058636
mov byte [eax + esi + 0x144], 0
cmp ecx, 0x1f4
jb 0x1005863e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x10]
push edx
mov ecx, 8
mov dword [edi + esi], eax
mov dword [esp + 0x14], 0x8ff08c1
mov dword [esp + 0x18], ebx
call fcn.1008c360
mov edx, dword [esp + 0x1c]
mov byte [esi + 0x5905], 0
mov dword [0xe8cb3c], 0
add esp, 4
mov dword [esi + 0x5908], 0x1e0
mov byte [esi + 0x590c], 0x14
mov byte [esi + 0x5921], 0
inc ebx
cmp ebx, 8
jl 0x10058581
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret 4
mov byte [eax + esi + 0x144], 1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret 4

Function at 0x10058660
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x5905], bl
je 0x100586de
mov eax, 0x164
mov ecx, esi
call fcn.10051040
test al, al
je 0x100586de
cmp dword [ebp + 8], 0x201
jne 0x1005869f
pop edi
mov byte [esi + 0x5a44], 1
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x5a40]
mov byte [esi + 0x5a44], bl
cmp edx, 0x1f4
jb 0x100586de
call edi
mov dword [esi + 0x5a40], eax
mov byte [esi + 0x5905], bl
mov dword [0xe8cb3c], ebx
mov dword [esi + 0x5908], 0x1e0
mov byte [esi + 0x590c], 0x14
mov byte [esi + 0x5921], bl
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100588e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call edi
mov esi, eax
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10058a8d
mov eax, 0x25
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100589a0
sub esi, dword [0x10124710]
cmp ebx, 0x201
jne 0x10058948
pop edi
pop esi
mov byte [0x10124714], 1
mov dword [0xe8cb3c], 1
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [0x10124714], bl
mov dword [0xe8cb3c], ebx
cmp esi, 0x1f4
jb 0x10058a8d
call edi
mov dword [0x10124710], eax
lea eax, [ebp - 8]
lea ecx, [ebx + 8]
push eax
mov dword [ebp - 8], 0x21fc08c1
mov dword [ebp - 4], 1
call fcn.1008c360
add esp, 4
pop edi
pop esi
mov byte [0x10124756], bl
mov byte [0x10124796], bl
mov byte [0x10124716], 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x26
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10058a1c
sub esi, dword [0x10124750]
cmp ebx, 0x201
jne 0x100589d9
pop edi
pop esi
mov byte [0x10124754], 1
mov dword [0xe8cb3c], 1
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [0x10124754], bl
mov dword [0xe8cb3c], ebx
cmp esi, 0x1f4
jb 0x10058a8d
call edi
mov dword [0x10124750], eax
lea eax, [ebx + 2]
call fcn.1008c330
pop edi
pop esi
mov byte [0x10124716], bl
mov byte [0x10124796], bl
mov byte [0x10124756], 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x27
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10058a8d
sub esi, dword [0x10124790]
cmp ebx, 0x201
jne 0x10058a55
pop edi
pop esi
mov byte [0x10124794], 1
mov dword [0xe8cb3c], 1
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [0x10124794], bl
mov dword [0xe8cb3c], ebx
cmp esi, 0x1f4
jb 0x10058a8d
call edi
mov dword [0x10124790], eax
lea eax, [ebx + 3]
mov byte [0x10124716], bl
mov byte [0x10124756], bl
mov byte [0x10124796], 1
call fcn.1008c330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100595d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x3785], bl
je 0x1005963e
mov eax, 0xe0
mov ecx, esi
call fcn.10051040
test al, al
je 0x1005963e
cmp dword [ebp + 8], 0x201
jne 0x10059610
mov al, 1
pop edi
mov byte [esi + 0x3944], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x3940]
mov byte [esi + 0x3944], bl
cmp edx, 0x3e8
jb 0x1005963e
call edi
mov dword [esi + 0x3940], eax
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x10059650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x3980]
mov dword [ebp - 4], eax
call edi
sub eax, dword [esi + 0x63c0]
cmp eax, 0x3e8
jae 0x1005967e
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x3785], bl
je 0x100596fc
mov eax, 0xe1
mov ecx, esi
call fcn.10051040
test al, al
je 0x100596fc
cmp byte [esi + 0x3986], bl
je 0x100596fc
cmp dword [ebp + 8], 0x201
jne 0x100596ba
mov al, 1
pop ebx
mov byte [esi + 0x3984], al
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x3e8
mov byte [esi + 0x3984], bl
jb 0x100596fc
call edi
mov dword [esi + 0x3980], eax
xor eax, eax
call fcn.10021d40
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
mov byte [esi + 0x3945], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x3961], bl
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10059710
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x39c0]
mov dword [ebp - 4], eax
call edi
sub eax, dword [esi + 0x63c0]
cmp eax, 0x3e8
jae 0x1005973e
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x3785], bl
je 0x100597bf
mov eax, 0xe2
mov ecx, esi
call fcn.10051040
test al, al
je 0x100597bf
cmp byte [esi + 0x39c6], bl
je 0x100597bf
cmp dword [ebp + 8], 0x201
jne 0x1005977a
mov al, 1
pop ebx
mov byte [esi + 0x39c4], al
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x3e8
mov byte [esi + 0x39c4], bl
jb 0x100597bf
call edi
mov dword [esi + 0x39c0], eax
mov eax, 0x10
call fcn.10021d40
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
mov byte [esi + 0x3945], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x3961], bl
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100597d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x3a00]
mov dword [ebp - 4], eax
call edi
sub eax, dword [esi + 0x63c0]
cmp eax, 0x3e8
jae 0x100597fe
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x3785], bl
je 0x1005987f
mov eax, 0xe3
mov ecx, esi
call fcn.10051040
test al, al
je 0x1005987f
cmp byte [esi + 0x3a06], bl
je 0x1005987f
cmp dword [ebp + 8], 0x201
jne 0x1005983a
mov al, 1
pop ebx
mov byte [esi + 0x3a04], al
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x3e8
mov byte [esi + 0x3a04], bl
jb 0x1005987f
call edi
mov dword [esi + 0x3a00], eax
mov eax, 0x20
call fcn.10021d40
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
mov byte [esi + 0x3945], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x3961], bl
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10059890
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x3a40]
mov dword [ebp - 4], eax
call edi
sub eax, dword [esi + 0x63c0]
cmp eax, 0x3e8
jae 0x100598be
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x3785], bl
je 0x1005993f
mov eax, 0xe4
mov ecx, esi
call fcn.10051040
test al, al
je 0x1005993f
cmp byte [esi + 0x3a46], bl
je 0x1005993f
cmp dword [ebp + 8], 0x201
jne 0x100598fa
mov al, 1
pop ebx
mov byte [esi + 0x3a44], al
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x3e8
mov byte [esi + 0x3a44], bl
jb 0x1005993f
call edi
mov dword [esi + 0x3a40], eax
mov eax, 0x30
call fcn.10021d40
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
mov byte [esi + 0x3945], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x3961], bl
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10059950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x3a80]
mov dword [ebp - 4], eax
call edi
sub eax, dword [esi + 0x63c0]
cmp eax, 0x3e8
jae 0x1005997e
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x3785], bl
je 0x100599ff
mov eax, 0xe5
mov ecx, esi
call fcn.10051040
test al, al
je 0x100599ff
cmp byte [esi + 0x3a86], bl
je 0x100599ff
cmp dword [ebp + 8], 0x201
jne 0x100599ba
mov al, 1
pop ebx
mov byte [esi + 0x3a84], al
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x3e8
mov byte [esi + 0x3a84], bl
jb 0x100599ff
call edi
mov dword [esi + 0x3a80], eax
mov eax, 0x40
call fcn.10021d40
mov byte [esi + 0x3785], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x37a1], bl
mov byte [esi + 0x3945], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x3961], bl
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4