joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a0d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0x40
imul ecx, eax, 0xbf
movzx edx, byte [ecx + 0x104e1d65]
test edx, edx
jne 0x100a0d54
jmp 0x100a0ecc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0xc4
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x100a0d87
mov ecx, 0x40
imul edx, ecx, 0xc4
mov byte [edx + 0x104e1d66], 1
jmp 0x100a0d99
mov eax, 0x40
imul ecx, eax, 0xc4
mov byte [ecx + 0x104e1d66], 0
push 0xc5
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx edx, al
test edx, edx
je 0x100a0e49
mov eax, 0x40
imul ecx, eax, 0xc5
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 8], edx
cmp dword [ebp + 8], 0x201
jne 0x100a0dea
mov eax, 0x40
imul ecx, eax, 0xc5
mov byte [ecx + 0x104e1d64], 1
jmp 0x100a0ecc
mov edx, 0x40
imul eax, edx, 0xc5
mov byte [eax + 0x104e1d64], 0
cmp dword [ebp - 8], 0x1f4
jae 0x100a0e0a
jmp 0x100a0ecc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0xc5
mov dword [edx + 0x104e1d60], eax
mov eax, 0x40
imul ecx, eax, 0xc4
add ecx, 0x104e1d6f
push ecx
mov edx, dword [0x104e02a4]
push edx
mov ecx, 0x104dee48
call fcn.100a1530
call fcn.100a0cd0
push 0xc3
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x100a0ecc
mov ecx, 0x40
imul edx, ecx, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e1d60]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x201
jne 0x100a0e93
mov ecx, 0x40
imul edx, ecx, 0xc3
mov byte [edx + 0x104e1d64], 1
jmp 0x100a0ecc
mov eax, 0x40
imul ecx, eax, 0xc3
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x100a0eb0
jmp 0x100a0ecc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0xc3
mov dword [ecx + 0x104e1d60], eax
call fcn.100a0cd0
mov esp, ebp
pop ebp
ret 4

Function at 0x100a15e0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0x10c]
push ecx
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x104]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp eax, 1
jne 0x100a164a
mov ax, word [ebp - 0x108]
jmp 0x100a164c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x100a6370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
call fcn.100146a0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f58a0
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100a63bf
xor al, al
jmp 0x100a6401
mov ecx, dword [ebp + 0xc]
call fcn.100103a0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.100103a0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret

Function at 0x100a6410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f58bc
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100a645b
xor al, al
jmp 0x100a6492
mov ecx, dword [ebp + 8]
call fcn.100103a0
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x100a8190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f5938
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a8357
mov dword [0x104e0408], 0
mov dword [ebp - 0x48], 0
jmp 0x100a81ec
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 5
jge 0x100a8326
cmp dword [ebp - 0x48], 0
je 0x100a8216
mov eax, dword [ebp - 0x48]
add eax, 1
push eax
push str.ID__d
lea ecx, [ebp - 0x38]
push ecx
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x100a8227
push 0x101f595c
lea edx, [ebp - 0x38]
push edx
call sym.Main.dll_sprintf
add esp, 8
mov dword [ebp - 0x3c], 0xb
lea eax, [ebp - 0x3c]
push eax
imul ecx, dword [0x104e0408], 0x1c
add ecx, 0x104e040c
push ecx
push 0
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a825c
cmp dword [ebp - 0x3c], 1
jae 0x100a827c
xor ecx, ecx
imul edx, dword [0x104e0408], 0x1c
add edx, 0x104e040c
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
mov byte [edx + 0xa], cl
jmp 0x100a81e3
cmp dword [ebp - 0x48], 0
je 0x100a829c
mov eax, dword [ebp - 0x48]
add eax, 1
push eax
push str.PW__d
lea ecx, [ebp - 0x38]
push ecx
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x100a82ad
push 0x101f5968
lea edx, [ebp - 0x38]
push edx
call sym.Main.dll_sprintf
add esp, 8
mov dword [ebp - 0x3c], 0xb
lea eax, [ebp - 0x3c]
push eax
imul ecx, dword [0x104e0408], 0x1c
add ecx, 0x104e0417
push ecx
push 0
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a82e2
cmp dword [ebp - 0x3c], 1
jae 0x100a8302
xor ecx, ecx
imul edx, dword [0x104e0408], 0x1c
add edx, 0x104e0417
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
mov byte [edx + 0xa], cl
jmp 0x100a81e3
imul eax, dword [0x104e0408], 0x1c
mov ecx, dword [ebp - 0x48]
mov dword [eax + 0x104e0424], ecx
mov edx, dword [0x104e0408]
add edx, 1
mov dword [0x104e0408], edx
jmp 0x100a81e3
mov dword [ebp - 0x3c], 4
lea eax, [ebp - 0x3c]
push eax
push 0x104e03c0
push 0
push 0
push str.SavePass
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100a8357
mov dword [0x104e03c0], 0
mov dword [0x104e03c0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x100a8650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
call fcn.100a6040
add esp, 4
call fcn.101d4670
mov word [ebp - 2], ax
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
call fcn.100a6020
add esp, 4
call fcn.101d4670
mov word [ebp - 4], ax
movzx eax, word [ebp - 2]
push eax
movzx ecx, word [ebp - 4]
push ecx
cvttss2si edx, dword [ebp + 0x10]
movzx eax, dx
push eax
cvttss2si ecx, dword [ebp + 0xc]
movzx edx, cx
push edx
call fcn.100a60b0
add esp, 0x10
movzx eax, al
test eax, eax
je 0x100a8781
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x637c60
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100a876b
movzx edx, byte [ebp + 0x30]
test edx, edx
je 0x100a877d
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x100a877d
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0xc]
add esp, 4
jmp 0x100a87fa
jmp 0x100a87fa
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x100b1360
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x9cc]
sub ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x9cc], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9cc], 0
jge 0x100b1394
mov ecx, dword [ebp - 8]
call fcn.100b1510
jmp 0x100b13ef
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c8]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c8]
add edx, 4
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c8], edx
mov ecx, dword [ebp - 4]
shr ecx, 0xb
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100b1d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
xor eax, eax
mov word [ebp - 4], ax
mov dword [ebp - 8], 0
jmp 0x100b1d8f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jae 0x100b1dc3
mov edx, dword [ebp - 8]
movsx ecx, byte [edx + 0x1054480d]
mov eax, dword [ebp - 8]
xor edx, edx
mov esi, 0x11
div esi
movsx edx, byte [edx + 0x10544858]
xor ecx, edx
movzx eax, cl
movzx ecx, word [ebp - 4]
add ecx, eax
mov word [ebp - 4], cx
jmp 0x100b1d86
mov byte [0x102140d9], 0xe2
mov byte [0x102140d8], 0xcf
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x102140d9]
add ecx, eax
mov byte [0x102140d9], cl
movzx edx, word [ebp - 4]
shr edx, 8
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x102140d8]
add ecx, eax
mov byte [0x102140d8], cl
mov edx, dword [0xd227b0]
mov dword [0x102140e0], edx
mov eax, dword [0xd227f8]
mov dword [0x102140dc], eax
push 0x100b18a0
push 0xd227b0
call fcn.10121b10
add esp, 8
push 0x100b1910
push 0xd227f8
call fcn.10121b10
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b70f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, 0x104e1ca8
call fcn.100b7070
movzx ecx, al
test ecx, ecx
jne 0x100b7115
xor al, al
jmp 0x100b71cb
movzx edx, byte [ebp + 0x10]
cmp edx, 1
jne 0x100b713a
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0xbe]
test edx, edx
jne 0x100b713a
xor al, al
jmp 0x100b71cb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, dword [ecx + eax + 0xb8]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 8], 0x201
jne 0x100b7188
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0xbc]
test edx, edx
jne 0x100b7188
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
mov byte [ecx + eax + 0xbc], 1
cmp dword [ebp + 8], 0x202
je 0x100b7195
xor al, al
jmp 0x100b71cb
cmp dword [ebp - 0xc], 0x1f4
jae 0x100b71a2
xor al, al
jmp 0x100b71cb
mov edx, dword [ebp + 0xc]
shl edx, 6
mov eax, dword [ebp - 4]
mov byte [eax + edx + 0xbc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
shl ecx, 6
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0xb8], eax
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100b9590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 8
jae 0x100b95a4
mov eax, dword [ebp + 0x10]
jmp 0x100b969e
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x42
je 0x100b969b
push 8
push 0x101f5fa4
mov ecx, dword [ebp + 8]
push ecx
call fcn.1019ac4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100b95e0
mov eax, dword [ebp + 0x10]
jmp 0x100b969e
mov dword [ebp - 8], 0
jmp 0x100b95f2
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
sub eax, 8
cmp dword [ebp - 8], eax
jge 0x100b968d
mov dword [ebp - 0xc], 0x10544cc1
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 1], 0
jne 0x100b9611
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp - 0x18]
movsx eax, byte [edx + 0x10544cc1]
xor edx, edx
mov ecx, 0x10
div ecx
movzx edx, byte [edx + 0x101f5f94]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
sub ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 8], cl
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x10
div ecx
movzx edx, byte [edx + 0x101f5f94]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 8], cl
jmp 0x100b95e9
mov eax, dword [ebp + 0x10]
add eax, 8
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
jmp 0x100b969e
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x100d2420
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100d245c
xor al, al
jmp 0x100d250b
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x100d2496
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.1014c91d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call fcn.1014c922
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x100d24c8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d250b
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100d24ff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d250b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret 4

Function at 0x100d2650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call fcn.101a343a
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.DataItem_vorks_d.lua
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100d26b2
xor al, al
jmp 0x100d2700
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
sub eax, 8
push eax
mov ecx, 1
shl ecx, 3
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 4]
push ecx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d26f4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d2700
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x100d2710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x101f0ecf
mov eax, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax]
jne 0x100d2766
cmp byte [ebp - 1], 0
je 0x100d275d
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax + 1]
jne 0x100d2766
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
jne 0x100d2729
mov dword [ebp - 0x14], 0
jmp 0x100d276e
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jne 0x100d277c
jmp 0x100d27ce
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x100d278f
jmp 0x100d27ce
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1014c91d
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
push 0x100
push 0
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call fcn.1019aa40
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100e99a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0xe
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx eax, al
test eax, eax
jne 0x100e99cc
xor al, al
jmp 0x100e9b6f
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x30], 0x21
mov dword [ebp - 0x2c], 0x22
mov dword [ebp - 0x28], 0x23
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x25
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 4], 0
jmp 0x100e9a0f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 7
jge 0x100e9ad5
mov edx, dword [ebp - 4]
movzx eax, word [ebp + edx*4 - 0x34]
push eax
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx ecx, al
test ecx, ecx
je 0x100e9ad0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
movzx ecx, byte [eax + 0x104e1d65]
test ecx, ecx
je 0x100e9ad0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e1d60]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0x201
jne 0x100e9a87
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov byte [eax + 0x104e1d64], 1
mov al, 1
jmp 0x100e9b6f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x34]
shl edx, 6
mov byte [edx + 0x104e1d64], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x100e9aa8
xor al, al
jmp 0x100e9b6f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x34]
shl ecx, 6
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x104e1d60], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100e9d60
jmp 0x100e9a06
push 0x17
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx ecx, al
test ecx, ecx
je 0x100e9b6d
mov edx, 0x40
imul eax, edx, 0x17
movzx ecx, byte [eax + 0x104e1d65]
test ecx, ecx
jne 0x100e9b03
xor al, al
jmp 0x100e9b6f
mov edx, 0x40
imul eax, edx, 0x17
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e1d60]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x201
jne 0x100e9b33
mov edx, 0x40
imul eax, edx, 0x17
mov byte [eax + 0x104e1d64], 1
mov al, 1
jmp 0x100e9b6f
mov ecx, 0x40
imul edx, ecx, 0x17
mov byte [edx + 0x104e1d64], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x100e9b4f
xor al, al
jmp 0x100e9b6f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x17
mov dword [edx + 0x104e1d60], eax
push 8
mov ecx, dword [ebp - 0xc]
call fcn.100e9d60
xor al, al
mov esp, ebp
pop ebp
ret 4