joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019c94
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi], edi
jne 0x10019e15
mov ecx, dword [0x109be284]
push 0x11a
call fcn.1008602e
push edi
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push 0x101458e0
push 4
push edi
push 0x101458d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10019de9
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x110]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xcc]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc4]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xac]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xbc]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xa4]
push str.Microsoft_Internet_Explorer
push str.IEFrame
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x10019de9
push ebx
push closesocket
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetParent]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp + 0x10]
mov word [ebp - 0x14], 3
mov dword [ebp - 0xc], edi
call fcn.10129b10
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x14]
mov dword [ebp + 0x10], eax
mov eax, dword [esi]
mov ecx, dword [eax]
push edx
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x10], edi
je 0x10019dae
push dword [ebp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp + 0x10], edi
inc dword [ebp + 0x10]
push 0x64
call ebx
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x7c]
cmp word [ebp - 4], di
je 0x10019dd7
mov eax, dword [ebp + 0x14]
lea eax, [eax + eax*4]
shl eax, 1
cmp dword [ebp + 0x10], eax
jl 0x10019db1
mov eax, dword [ebp + 0x14]
lea eax, [eax + eax*4]
shl eax, 1
cmp dword [ebp + 0x10], eax
pop ebx
jl 0x10019df0
cmp dword [esi], edi
je 0x10019e15
mov eax, 0x80004005
jmp 0x10019e20
push 0x40
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [esi]
mov eax, dword [esi]
push 0xffffffffffffffff
push esi
call dword [eax + 0xa4]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop edi
pop esi
leave
ret 0x20
Function at 0x10035ed2
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.10035ce9
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, 0x100
push edi
add esi, 8
push 0
push esi
mov ebx, eax
call fcn.10116190
add esp, 0xc
push edi
push esi
push ebx
call sub.IMM32.dll_ImmGetDescriptionA
push esi
mov ecx, 0x10a00148
call fcn.1010f530
cmp dword [0x109b8894], 0
pop edi
sete al
pop esi
mov byte [0x109b88a8], al
xor eax, eax
pop ebx
ret

Function at 0x1003617f
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
call fcn.10035c7b
mov ecx, edi
call fcn.10036028
mov eax, dword [0x109b8894]
test eax, eax
je 0x100361a4
cmp eax, 4
jne 0x1003622c
push esi
mov esi, 0x800
test dword [ebp + 0x10], esi
je 0x1003622b
push ebx
push dword [edi]
call sub.IMM32.dll_ImmGetContext
push 0
push 0
push esi
push eax
mov dword [ebp - 4], eax
call sub.IMM32.dll_ImmGetCompositionStringA
mov ebx, eax
test ebx, ebx
je 0x10036220
lea eax, [ebx + 4]
push eax
call fcn.101159a4
test eax, eax
pop ecx
mov dword [ebp + 0x10], eax
je 0x100361f0
push ebx
push eax
push esi
push dword [ebp - 4]
call sub.IMM32.dll_ImmGetCompositionStringA
mov ebx, eax
mov eax, dword [ebp + 0x10]
and byte [eax + ebx], 0
lea esi, [edi + 0x108]
mov eax, dword [esi]
push ebx
push dword [ebp + 0x10]
lea eax, [eax + edi + 0x114]
push eax
call fcn.10116b50
add dword [esi], ebx
mov esi, dword [esi]
push dword [ebp + 0x10]
and byte [esi + edi + 0x114], 0
call fcn.101173f6
add esp, 0x10
push dword [ebp - 4]
push dword [edi]
call sub.IMM32.dll_ImmReleaseContext
pop ebx
pop esi
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1003627a
Capabilities:
Get keyboard layout

Disassembly:
push esi
push edi
push 4
xor edi, edi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sub.IMM32.dll_ImmGetProperty
or dword [esi + 0x71c], 0xffffffff
or dword [esi + 0x720], 0xffffffff
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov ecx, 0x10a00148
mov dword [esi], eax
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x718], edi
mov dword [esi + 0x724], edi
mov dword [esi + 0x728], edi
call fcn.1010f480
mov ecx, esi
call fcn.10035ce9
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x10057c7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [0x109be1d0]
jmp fcn.100d2054

Function at 0x10057efd
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [0x109be2dc]
jmp 0x10059fc6
mov byte [ecx + 0x108], 1
mov ecx, dword [0x109be1d0]
cmp byte [ecx + 0x139], 1
je 0x10059fe1
jmp fcn.100d2054
ret

Function at 0x1005a451
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x108], 1
jne 0x1005a466
cmp byte [0x109be194], 3
jne 0x1005a4e2
mov eax, dword [0x109be1d0]
cmp byte [eax + 0x242c], 0
je 0x1005a4e2
mov ecx, dword [0x109be284]
push 0xee
call fcn.10081f0a
test al, al
jne 0x1005a4e2
mov ecx, dword [0x109be284]
push 0xe1
call fcn.10081f0a
test al, al
jne 0x1005a4e2
mov ecx, dword [0x109be284]
push 0xe8
call fcn.10081f0a
test al, al
jne 0x1005a4e2
mov ecx, dword [0x109be284]
push 0xe9
call fcn.10081f0a
test al, al
jne 0x1005a4e2
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esi + 0x10c]
add ecx, 0x2bf20
cmp eax, ecx
jbe 0x1005a4e2
mov ecx, esi
pop esi
jmp 0x10059fc6
pop esi
ret
Function at 0x10075600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x10169ccc]
xor eax, dword [ebp + 4]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call fcn.10119d74
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.10115a7a
leave
ret

Function at 0x100756c7
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1012e3fd
call fcn.1011695c
sub esp, 0x310
mov eax, dword [0x10169ccc]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
cmp byte [esi + 4], 2
mov dword [ebp - 0x10], eax
push edi
jne 0x1007580b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x42c]
add ecx, 0x2bf20
cmp eax, ecx
jbe 0x1007580b
lea ecx, [ebp - 0x31c]
call fcn.1010f720
and dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.1010f720
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.1010f720
mov ecx, dword [0x109be1e4]
lea eax, [ebp - 0x21c]
push eax
push 0x890
mov byte [ebp - 4], 2
call fcn.1004036a
cmp al, 1
jne 0x100757de
mov ecx, dword [0x109be1d0]
lea eax, [ebp - 0x18]
push eax
call fcn.100ce98f
push dword [ebp - 0x14]
lea eax, [ebp - 0x11c]
push dword [ebp - 0x18]
push 0x10142418
push eax
call fcn.1010f490
add esp, 0x10
lea ecx, [ebp - 0x11c]
call fcn.1010f460
push eax
lea ecx, [esi + 0x264]
call fcn.1010f460
push eax
lea ecx, [ebp - 0x21c]
call fcn.1010f460
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.1010f490
add esp, 0x10
call edi
sub esp, 0x100
mov dword [esi + 0x42c], eax
lea eax, [ebp - 0x31c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.1010f730
mov ecx, dword [0x109be200]
call fcn.100e267c
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.1010f440
and byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.1010f440
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.1010f440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.10115a7a
pop edi
pop esi
leave
ret
Function at 0x100879ff
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x10087a0c
xor al, al
pop esi
ret
push ebx
mov ebx, dword [0x109be284]
push edi
mov edi, 0x4c6
push edi
mov ecx, ebx
call fcn.10081f0a
cmp al, 1
jne 0x10087a33
push edi
mov ecx, ebx
call fcn.1008602e
mov ebx, dword [0x109be284]
mov eax, dword [esi + 8]
test eax, eax
je 0x10087a3c
mov eax, dword [eax]
mov esi, dword [esi + 8]
cmp eax, esi
mov edi, eax
je 0x10087b16
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xec]
cmp eax, 0xca
je 0x10087b0c
cmp eax, 0xcb
je 0x10087b0c
cmp eax, 0xce
je 0x10087b0c
cmp eax, 0xdb
je 0x10087b0c
cmp eax, 0xdc
je 0x10087b0c
cmp eax, 0xdd
je 0x10087b0c
cmp eax, 0xe5
je 0x10087b0c
cmp eax, 0xf3
je 0x10087b0c
cmp eax, 0xe4
je 0x10087b0c
cmp eax, 0xe0
je 0x10087b0c
cmp eax, 0xdf
je 0x10087b0c
cmp eax, 0xf7
je 0x10087b0c
cmp eax, 0xf8
je 0x10087b0c
cmp eax, 0xfa
je 0x10087b0c
cmp eax, 0xe8
je 0x10087b0c
cmp eax, 0x11a
je 0x10087b0c
cmp eax, 0x11d
je 0x10087b0c
cmp eax, 0x122
je 0x10087b0c
cmp eax, 0x123
je 0x10087b0c
cmp eax, 0xe9
je 0x10087b0c
cmp eax, 0xe1
je 0x10087b0c
cmp eax, 0x3e7
jae 0x10087b0c
push eax
mov ecx, ebx
call fcn.10081f0a
cmp al, 1
je 0x10087b1c
mov edi, dword [edi]
cmp edi, esi
jne 0x10087a49
xor al, al
pop edi
pop ebx
pop esi
ret
mov eax, dword [edi + 8]
mov eax, dword [eax + 0xec]
cmp eax, 0xf4
je 0x10087c36
cmp eax, 0xf5
je 0x10087c36
cmp eax, 0xee
jne 0x10087b52
mov ecx, dword [0x109be2ac]
call fcn.100a65b1
jmp 0x10087c41
cmp eax, 0xcc
je 0x10087c29
cmp eax, 0xf2
je 0x10087c29
cmp eax, 0xd4
jne 0x10087b7f
mov ecx, dword [0x109be2c4]
call fcn.10057c54
jmp 0x10087c41
cmp eax, 0xed
jne 0x10087b98
mov ecx, dword [0x109be208]
push 0
call fcn.100b9e40
jmp 0x10087c41
cmp eax, 0xeb
jne 0x10087baf
mov ecx, dword [0x109be250]
call fcn.100b4610
jmp 0x10087c41
cmp eax, 0x12b
jne 0x10087bc3
mov ecx, dword [0x109be234]
call fcn.1005339d
jmp 0x10087c41
cmp eax, 0x12c
jne 0x10087beb
mov ecx, dword [0x109be234]
call fcn.10053a45
mov eax, dword [edi + 8]
push dword [eax + 0xec]
mov ecx, dword [0x109be284]
call fcn.10086051
jmp 0x10087c41
cmp eax, 0x12d
jne 0x10087bff
mov ecx, dword [0x109be234]
call fcn.1005437b
jmp 0x10087c41
cmp eax, 0xec
jne 0x10087c13
mov ecx, dword [0x109be220]
call fcn.10086eb4
jmp 0x10087c41
push eax
mov ecx, ebx
call fcn.10086051
mov eax, dword [0x109be228]
and byte [eax + 0x71d], 0
jmp 0x10087c41
mov ecx, dword [0x109be20c]
call fcn.1005b365
jmp 0x10087c41
mov ecx, dword [0x109be24c]
call fcn.1009e7cb
mov al, 1
jmp 0x10087b18
Function at 0x100892c2
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
fld1
push ebx
fstp dword [ebp - 0x20]
push esi
fld dword [0x10139218]
push edi
fst dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
fld dword [0x10142528]
mov dword [ebp - 4], 1
fst dword [ebp - 0x18]
mov dword [ebp - 0x14], 0x3f666666
fld1
mov dword [ebp - 0x24], 0x3f666666
fstp dword [ebp - 0x30]
mov dword [ebp - 8], 0x14
fld st(1)
mov ebx, 0xee
fstp dword [ebp - 0x2c]
fst dword [ebp - 0x28]
fstp st(0)
fstp st(0)
mov esi, dword [ebp - 4]
mov ecx, dword [0x109be284]
lea eax, [esi + 2]
push eax
push ebx
call fcn.100831fa
mov ecx, dword [0x109be284]
push esi
push ebx
call fcn.10083592
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
push 0x13
push 0x13b
lea eax, [eax + ecx - 0x14]
push eax
push 8
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
sub esp, 0x100
movsd dword es:[edi], dword [esi]
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x101374ba
movsd dword es:[edi], dword [esi]
call fcn.1010f770
mov eax, dword [ebp - 4]
mov ecx, dword [0x109be284]
add eax, 2
push eax
push ebx
call fcn.10087595
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
push 0x13
push 0x13b
push 0x5dc
push 9
push 9
lea eax, [eax + ecx - 0x14]
mov ecx, dword [0x109be284]
push eax
push 8
push 0
push dword [ebp - 4]
push ebx
call fcn.10088b09
push dword [ebp - 4]
mov ecx, dword [0x109be284]
push ebx
call fcn.10083602
add dword [ebp - 8], 0x14
inc dword [ebp - 4]
cmp dword [ebp - 8], 0xc8
jle 0x10089317
push 3
pop esi
mov ecx, dword [0x109be284]
push 1
lea eax, [esi - 3]
push eax
push ebx
call fcn.100835ad
inc esi
cmp esi, 0xd
jl 0x100893e7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009542f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x53c]
push edi
mov dword [ebp - 8], esi
jmp 0x100954f1
mov eax, dword [ebx + 0x424]
cmp eax, dword [ebp + 8]
je 0x1009550a
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x100954eb
mov ecx, dword [0x109b242c]
lea esi, [ebx + 0x42c]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [ebp - 0x18]
fadd dword [0x10139afc]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
fstp dword [ebp - 0x18]
push eax
call fcn.10016f33
mov ecx, dword [ebp + 0xc]
lea eax, [ecx - 0x32]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fcomp dword [ebp - 0x10]
fnstsw ax
test ah, 5
jp 0x100954e8
add ecx, 0x32
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fcomp dword [ebp - 0x10]
fnstsw ax
test ah, 0x41
jne 0x100954e8
mov ecx, dword [ebp + 0x10]
lea eax, [ecx - 0xf]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fcomp dword [ebp - 0xc]
fnstsw ax
test ah, 5
jp 0x100954e8
add ecx, 0xf
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fcomp dword [ebp - 0xc]
fnstsw ax
test ah, 0x41
je 0x10095503
mov esi, dword [ebp - 8]
mov ebx, dword [ebx + 0x53c]
cmp ebx, dword [esi + 8]
jne 0x1009544b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov byte [ebx + 0x439], 1
sub esp, 0x100
lea eax, [ebx + 0x43a]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
mov byte [ebx + 0x53a], 1
call fcn.1010f730
mov ecx, dword [0x109be280]
call fcn.1009c9aa
mov eax, dword [ebx + 0x424]
jmp 0x100954fc
Function at 0x100d2054
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x240c], 0
je 0x100d21a7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
lea edi, [esi + 0x21b0]
mov ecx, dword [edi]
add ecx, 0x44c
cmp eax, ecx
jb 0x100d21a5
call ebx
mov ecx, dword [esi + 0x2418]
mov dword [edi], eax
call fcn.100d4a18
mov ecx, dword [0x109be284]
push 0xd6
call fcn.10086051
xor ebx, ebx
inc ebx
cmp byte [esi + 0x139], bl
jne 0x100d2107
and byte [esi + 0x139], 0
fld1
xor eax, eax
push eax
push eax
push ecx
fstp dword [esp]
push ebx
push eax
mov ecx, esi
mov dword [esi + 0x23d4], 7
call fcn.100cf7c5
mov ecx, dword [esi + 0x2418]
lea eax, [ebp - 8]
push eax
call fcn.100d4a7c
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
push ebx
call fcn.100d0ea1
push 0x10
call fcn.10115900
mov esi, eax
mov byte [esi + 0xc], 2
jmp 0x100d2191
mov ecx, esi
call fcn.100d07d0
mov ecx, dword [esi + 0x2418]
lea eax, [ebp - 8]
push eax
call fcn.100d4a7c
fld1
mov ax, word [ebp - 8]
xor edi, edi
push edi
push edi
push ecx
fstp dword [esp]
mov word [esi + 0x21b6], ax
mov ax, word [ebp - 4]
push ebx
push edi
mov ecx, esi
mov word [esi + 0x21b8], ax
mov byte [esi + 0x139], bl
mov dword [esi + 0x23d4], 4
call fcn.100cf7c5
mov ecx, dword [0x109b242c]
push edi
push ebx
push 0x792d
call fcn.10012493
mov ecx, dword [esi + 0x2418]
lea eax, [ebp - 0x10]
push eax
call fcn.100d4a7c
push dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 0x10]
push edi
call fcn.100d0ea1
push 0x10
call fcn.10115900
mov esi, eax
mov byte [esi + 0xc], bl
pop ecx
mov ecx, dword [0x109be0d0]
push esi
call fcn.100f65ce
push esi
call fcn.10116c74
pop ecx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100d7d04
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov esi, ecx
inc ebx
cmp dword [esi + 0x90], ebx
jne 0x100d7e26
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
test edi, edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x11c], eax
mov ecx, dword [0x109b242c]
push dword [ebp + 0x10]
jne 0x100d7d40
push dword [ebp + 0xc]
jmp 0x100d7d41
push edi
call fcn.1001d8a1
fld1
fstp dword [ebp - 0x10]
push ecx
mov ecx, dword [0x109b242c]
fldz
fstp dword [ebp - 8]
lea eax, [ebp - 0x10]
fld1
mov dword [ebp - 0xc], 0x3dcccccd
fstp dword [ebp - 4]
fld dword [0x10138a30]
fstp dword [esp]
push eax
push dword [esi + 4]
call fcn.100125ce
mov ecx, dword [0x109b242c]
push 0
push dword [esi + 4]
lea eax, [ebp + 0x14]
push 0x10cccf
push eax
call fcn.1001d35b
and byte [ebp + 0x13], 0
test edi, edi
je 0x100d7db0
mov ecx, dword [0x109be1e0]
lea eax, [ebp + 0x13]
push eax
push ebx
push edi
call fcn.100052ac
cmp byte [ebp + 0x13], 0
jne 0x100d7e19
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100d7ddb
cmp eax, 3
je 0x100d7ddb
cmp eax, 9
je 0x100d7ddb
mov eax, dword [esi]
movsx eax, word [eax + 0x8a]
push dword [esi + 4]
mov ecx, dword [0x109b242c]
push eax
call fcn.10018234
jmp 0x100d7e19
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
cmp eax, ebx
jl 0x100d7df4
cmp eax, 0x3e7
jg 0x100d7df4
mov dword [esi + 0x18], 5
jmp 0x100d7dfb
mov dword [esi + 0x18], 0xa
push 0
fldz
push ecx
fstp dword [esp]
push ebx
mov ecx, esi
call fcn.100d7280
mov ecx, dword [esi + 0x10]
mov byte [esi + 0x228], bl
call fcn.100da63d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x98], eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100e0709
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
mov eax, dword [0x10169ccc]
xor eax, dword [ebp + 0x7c]
push ebx
push esi
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp + 0x64]
push eax
mov edi, ecx
call fcn.10118775
lea eax, [ebp + 0x64]
push eax
call fcn.10118575
pop ecx
pop ecx
mov esi, eax
add dword [esi + 0x14], 0x76c
inc dword [esi + 0x10]
xor ebx, ebx
push ebx
push str.ScreenShot
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10116190
push dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push dword [esi + 0x10]
push dword [esi + 0x14]
push str.ScreenShotChatLog__d__d__d
push eax
call fcn.10115d5d
push 0x40
lea eax, [ebp + 0x24]
push ebx
push eax
call fcn.10116190
add esp, 0x2c
xor esi, esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x24]
push str._s__d.txt
push eax
call fcn.10115d5d
lea eax, [ebp + 0x24]
push 0x1013adb8
push eax
call fcn.1011617b
add esp, 0x18
cmp eax, ebx
je 0x100e07b8
push eax
call fcn.10116014
pop ecx
inc esi
jmp 0x100e0786
lea eax, [ebp + 0x24]
push 0x101443e8
push eax
call fcn.1011617b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x100e089e
push str._ChatLog__n
push esi
call fcn.101174b9
pop ecx
lea eax, [edi + 0x24184]
mov dword [ebp + 0x70], ebx
pop ecx
mov dword [ebp + 0x6c], eax
mov ebx, 0x101344ec
mov eax, dword [ebp + 0x6c]
add eax, 0xffffff70
push eax
push esi
call fcn.101174b9
pop ecx
pop ecx
mov ecx, dword [ebp + 0x6c]
call fcn.1010f460
push eax
push esi
call fcn.101174b9
push ebx
push esi
call fcn.101174b9
mov eax, dword [ebp + 0x70]
add esp, 0x10
cmp eax, dword [edi + 0x86b10]
jge 0x100e0838
inc dword [ebp + 0x70]
add dword [ebp + 0x6c], 0x194
cmp dword [ebp + 0x70], 0x3e8
jl 0x100e07f0
push 0x101443d0
push esi
call fcn.101174b9
and dword [ebp + 0x70], 0
pop ecx
lea eax, [edi + 0x24184]
pop ecx
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x6c]
add eax, 0x6299c
push eax
push esi
call fcn.101174b9
pop ecx
pop ecx
mov ecx, dword [ebp + 0x6c]
call fcn.1010f460
push eax
push esi
call fcn.101174b9
push ebx
push esi
call fcn.101174b9
mov eax, dword [ebp + 0x70]
add esp, 0x10
cmp eax, dword [edi + 0x908ec]
jge 0x100e0897
inc dword [ebp + 0x70]
add dword [ebp + 0x6c], 0x194
cmp dword [ebp + 0x70], 0x64
jl 0x100e0852
push esi
call fcn.10116014
pop ecx
mov ecx, dword [ebp + 0x74]
xor ecx, dword [ebp + 0x7c]
pop edi
pop esi
pop ebx
call fcn.10115a7a
add ebp, 0x78
leave
ret
Function at 0x100eb778
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x10132f71
call fcn.1011695c
sub esp, 0x204
mov eax, dword [0x10169ccc]
xor eax, dword [ebp + 4]
cmp byte [0x109be1cc], 0
mov dword [ebp - 0x10], eax
jne 0x100eb954
mov eax, dword [0x109be1f8]
cmp byte [eax + 1], 0
jne 0x100eb954
push 0x101374ba
lea ecx, [ebp - 0x110]
call fcn.1010f770
and dword [ebp - 4], 0
cmp dword [0x109be2a8], 1
mov ecx, dword [0x109be1e4]
je 0x100eb7e4
test ecx, ecx
je 0x100eb7f9
lea eax, [ebp - 0x110]
push eax
push 0x3f0
jmp 0x100eb7f4
test ecx, ecx
je 0x100eb7f9
lea eax, [ebp - 0x110]
push eax
push 0x3ef
call fcn.1004036a
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [0x109be0c8]
sub edi, eax
cmp edi, 0x7a120
jbe 0x100eb944
test eax, eax
push ebx
mov ebx, 0x3e8
je 0x100eb912
push esi
lea ecx, [ebp - 0x110]
call fcn.1010f480
lea ecx, [ebp - 0x210]
call fcn.1010f720
mov ecx, dword [0x109be1e4]
test ecx, ecx
mov byte [ebp - 4], 1
mov esi, 0x3f1
je 0x100eb887
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.1004036a
cmp al, 1
jne 0x100eb887
mov eax, 0x7c830
sub eax, edi
xor edx, edx
mov ecx, ebx
div ecx
lea ecx, [ebp - 0x210]
push eax
call fcn.1010f460
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1010f490
add esp, 0xc
cmp dword [0x109be2a8], 5
jge 0x100eb8be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x109be1e4]
test ecx, ecx
mov dword [0x109be0c8], eax
je 0x100eb8b6
lea eax, [ebp - 0x110]
push eax
push 0x3f0
call fcn.1004036a
inc dword [0x109be2a8]
jmp 0x100eb902
mov ecx, dword [0x109be1e4]
test ecx, ecx
je 0x100eb902
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.1004036a
cmp al, 1
jne 0x100eb902
mov eax, 0x7c830
sub eax, edi
xor edx, edx
mov ecx, ebx
div ecx
lea ecx, [ebp - 0x210]
push eax
call fcn.1010f460
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1010f490
add esp, 0xc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x210]
call fcn.1010f440
pop esi
mov eax, 0x7c830
sub eax, edi
xor edx, edx
div ebx
pop ebx
test eax, eax
ja 0x100eb944
cmp dword [0x109be0c8], 0
je 0x100eb944
mov ecx, dword [0x109be0d0]
and dword [0x109be0c8], 0
mov byte [0x109b8880], 0x50
call fcn.100f6404
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.1010f440
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.10115a7a
leave
ret
Function at 0x100ebde8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10169ccc]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
cmp byte [esi + 0x78], 0
mov dword [ebp - 4], eax
je 0x100ebe20
cmp byte [0x109b8880], 0xa
jne 0x100ebe6a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x68], eax
mov byte [0x109b8881], 3
jmp 0x100ebe6a
mov ecx, dword [0x109be0d0]
call fcn.100f63cb
cmp ax, 2
jne 0x100ebe6a
mov al, byte [0x109b8880]
cmp al, 0x50
je 0x100ebe0e
cmp al, 0x51
jne 0x100ebe50
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x68], eax
mov byte [0x109b8881], 2
jmp 0x100ebe6a
lea ecx, [ebp - 0x104]
mov byte [esi + 0x78], 1
call fcn.1010f720
lea ecx, [ebp - 0x104]
call fcn.1010f440
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.10115a7a
leave
ret