joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10082a3e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101e5820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1007ca37
mov dword [ebp - 0x14], eax
cmp dword [0x101e9478], edi
jne 0x10082b2f
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10082abc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10082c0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10082c0f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10082c0f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x101e9478], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x101e947c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101e9480], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101e9488], eax
test eax, eax
je 0x10082b2c
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101e9484], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10082b54
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10082b47
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10082b69
push 4
pop eax
jmp 0x10082c11
cmp dword [ebp - 0x14], edi
je 0x10082b69
push dword [0x101e9478]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10082b4e
mov eax, dword [0x101e9484]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10082bc7
cmp dword [0x101e9488], esi
je 0x10082bc7
push eax
call ebx
push dword [0x101e9488]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10082bc7
test eax, eax
je 0x10082bc7
call ecx
test eax, eax
je 0x10082bbc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10082bbc
test byte [ebp - 8], 1
jne 0x10082bc7
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10082bf7
mov eax, dword [0x101e947c]
cmp eax, esi
je 0x10082bf4
push eax
call ebx
test eax, eax
je 0x10082bf4
call eax
mov edi, eax
test edi, edi
je 0x10082bf4
mov eax, dword [0x101e9480]
cmp eax, esi
je 0x10082bf4
push eax
call ebx
test eax, eax
je 0x10082bf4
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101e9478]
call ebx
test eax, eax
je 0x10082c0f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10082c11
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d7c0
leave
ret
Function at 0x10087bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0x101a4310
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.1006d8a8
add esp, 0xc
test eax, eax
je 0x10087c37
xor al, al
jmp 0x10087cb8
mov eax, dword [ebp + 0x10]
push eax
call fcn.1006d8ed
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10087c5c
mov ecx, dword [ebp - 8]
push ecx
call fcn.1006d9eb
add esp, 4
xor al, al
jmp 0x10087cb8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.1006dc25
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10087c91
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10087cc0
jmp 0x10087c5c
mov edx, dword [ebp - 4]
push edx
call fcn.1006dcd1
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.1006d9eb
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
xor edx, 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10087d80
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x4c11db7
mov dword [ebp - 4], 0
jmp 0x10087da2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xff
jg 0x10087e3c
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10087d20
shl eax, 0x18
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x10087ddb
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x10087e1a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
and edx, 0x80000000
je 0x10087dfa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x10087e01
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
shl eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10087dd2
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
push edx
mov ecx, dword [ebp - 8]
call fcn.10087d20
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10087d99
mov esp, ebp
pop ebp
ret
Function at 0x1008a010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.10080090
mov eax, dword [0x101e5820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075f70
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
jmp 0x1008a06f
mov ecx, dword [ebp - 0x1018]
add ecx, 1
mov dword [ebp - 0x1018], ecx
cmp dword [ebp - 0x1018], 0xa
jge 0x1008a126
mov edx, dword [ebp - 0x1018]
imul edx, edx, 0x16
add edx, dword [ebp - 0x1020]
mov dword [ebp - 0x1010], edx
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x102c], eax
mov ecx, dword [ebp - 0x1010]
mov dl, byte [ecx]
mov byte [ebp - 0x1009], dl
add dword [ebp - 0x1010], 1
cmp byte [ebp - 0x1009], 0
jne 0x1008a0a0
mov eax, dword [ebp - 0x1010]
sub eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1024], eax
je 0x1008a121
mov ecx, dword [ebp - 0x1018]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1020]
mov edx, dword [ebp - 0x1014]
lea eax, [ebp + edx - 0x1004]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov cx, word [ecx + 0x14]
mov word [eax + 0x14], cx
mov edx, dword [ebp - 0x1014]
add edx, 0x16
mov dword [ebp - 0x1014], edx
jmp 0x1008a060
mov dword [ebp - 0x1008], 0
jmp 0x1008a141
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1014]
jge 0x1008a1bf
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
sub eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x1008a132
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0xffffffff
jne 0x1008a1e9
jmp 0x1008a237
mov dword [ebp - 0x1028], 0
push 0
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1008a22a
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008a237
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d7c0
mov esp, ebp
pop ebp
ret 4
Function at 0x1008a250
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.10080090
mov eax, dword [0x101e5820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1024], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075f70
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.10075f70
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push connect
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0xffffffff
jne 0x1008a2cd
jmp 0x1008a4c3
push 0
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x102c], 0
push 0
lea ecx, [ebp - 0x102c]
push ecx
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1008a326
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008a4c3
mov dword [ebp - 0x1008], 0
jmp 0x1008a341
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1020]
jge 0x1008a3bf
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
add eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x1008a332
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x1020]
xor edx, edx
mov ecx, 0x16
div ecx
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x100c], 0
jmp 0x1008a408
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 0xa
jge 0x1008a4c3
mov eax, dword [ebp - 0x100c]
imul eax, eax, 0x16
add eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1028], ecx
mov edx, dword [ebp - 0x1014]
mov al, byte [edx]
mov byte [ebp - 0x100d], al
add dword [ebp - 0x1014], 1
cmp byte [ebp - 0x100d], 0
jne 0x1008a439
mov ecx, dword [ebp - 0x1014]
sub ecx, dword [ebp - 0x1028]
mov dword [ebp - 0x1030], ecx
je 0x1008a486
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx + 0xec]
add eax, 1
mov ecx, dword [ebp - 0x1024]
mov dword [ecx + 0xec], eax
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
mov eax, dword [ebp - 0x101c]
lea ecx, [eax + edx + 0xb]
push ecx
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
add edx, dword [ebp - 0x101c]
push edx
mov ecx, dword [ebp - 0x100c]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1024]
call fcn.10001d90
jmp 0x1008a3f9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d7c0
mov esp, ebp
pop ebp
ret 4
Function at 0x10096cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
push str.discord_rpc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101e9688], eax
cmp dword [0x101e9688], 0
je 0x10096d47
call fcn.10096d80
movzx ecx, al
test ecx, ecx
je 0x10096d47
mov ecx, dword [ebp - 4]
call fcn.10096cb0
push 0
push 0
push 0
push 0x100967c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov byte [edx + 8], 1
mov esp, ebp
pop ebp
ret
Function at 0x100a0670
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x101e5820]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
push 0x93
mov ecx, 0x10212c14
call fcn.1011de90
movzx eax, al
test eax, eax
je 0x100a06bc
jmp 0x100a084d
mov ecx, dword [ebp - 0x12c]
call fcn.1000a520
movzx ecx, al
test ecx, ecx
je 0x100a084d
push 0xd
mov ecx, 0x101eb298
call fcn.1014c5f0
movzx edx, al
test edx, edx
je 0x100a06f9
push 0x95
mov ecx, 0x10212c14
call fcn.1011de70
jmp 0x100a084d
push 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x44]
call fcn.100d9c00
mov byte [ebp - 0x110], 0
push 0xfe
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.10075f70
add esp, 0xc
push 0x24
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x44]
call fcn.100d9b50
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x128]
call fcn.1000a2f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.10006ed0
test eax, eax
jbe 0x100a0795
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x134], esp
lea edx, [ebp - 0x128]
push edx
call fcn.10001e20
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x34]
call fcn.1009fd50
jmp 0x100a083b
lea ecx, [ebp - 0x128]
call fcn.10006ed0
test eax, eax
je 0x100a07bb
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx + 0x34]
call fcn.10022c20
cmp eax, 0xffffffff
jle 0x100a083b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x12c]
sub eax, dword [edx + 0x4c]
cmp eax, 0x64
jae 0x100a07e3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.1000a4d0
jmp 0x100a084d
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x54], 0xffffffff
je 0x100a083b
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ecx + 0x34]
call fcn.1009fc90
mov edx, dword [ebp - 0x12c]
mov byte [edx + 0x50], 0
mov eax, dword [ebp - 0x12c]
mov dword [eax + 0x54], 0xffffffff
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + 0x58], 0xffffffff
mov ecx, dword [ebp - 0x12c]
call fcn.100a04a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.1000a4d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d7c0
mov esp, ebp
pop ebp
ret
Function at 0x100a2410
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194f38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x101e5820]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x10
mov ecx, 0x101eb298
call fcn.1014e080
movzx eax, al
cmp eax, 1
jne 0x100a2458
push 0x10
mov ecx, 0x101eb298
call fcn.1014c5c0
push 0xd
mov ecx, 0x101eb298
call fcn.1014e080
movzx ecx, al
test ecx, ecx
jne 0x100a2477
push 0xd
mov ecx, 0x101eb298
call fcn.1014c610
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x34]
call fcn.100a0260
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x34]
call fcn.1009fc90
push 0x10
call fcn.1006de48
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x100a24b4
mov ecx, dword [ebp - 0x14]
call fcn.100d9970
mov dword [ebp - 0x18], eax
jmp 0x100a24bb
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x44], eax
push 0
push 0x3c
push 0xe
push 0x69
mov ecx, dword [0xe8c578]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x44]
call fcn.100d9980
push 0xff
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
call fcn.100d9a00
push 0xd2
push 0xe6
push 0xff
push 0xff
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.100d9a30
mov edx, dword [0xe8c588]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
call fcn.100d9a60
push 0
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.100d9a80
push 0x101a4aff
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x44]
call fcn.100d9aa0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [eax + 0x10]
addss xmm0, dword [0x101c976c]
cvttss2si ecx, xmm0
push ecx
mov edx, dword [ebp - 0x10]
movss xmm0, dword [edx + 0xc]
addss xmm0, dword [0x101c9390]
cvttss2si eax, xmm0
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x44]
call fcn.100d9ac0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x50], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x54], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.100a04a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x4c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100a5db0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000c1e0
cmp eax, 1
jae 0x100a5dce
jmp 0x100a5f2d
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000c1e0
cmp eax, 1
jbe 0x100a5e3c
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
jne 0x100a5e3c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
cmp eax, 0x1388
jbe 0x100a5e3c
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000c1e0
sub eax, 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1c], eax
jne 0x100a5e1b
mov dword [ebp - 8], 0
jmp 0x100a5e27
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [0x7bc4f04]
movzx eax, byte [edx + 0x13]
push eax
mov ecx, 0x405230
call ecx
add esp, 4
cmp eax, 2
jne 0x100a5f1d
mov ecx, 0x1026c0dc
call fcn.1011bde0
movzx edx, al
test edx, edx
je 0x100a5f1d
mov eax, dword [0x8128ac4]
movzx ecx, word [eax + 0x1240]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x8128ac4]
movzx eax, word [edx + 0x12ab]
mov dword [ebp - 0x20], eax
mov ecx, 0x861110
call ecx
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 0xc], eax
push 0x80f
mov eax, 0x83be60
mov ecx, dword [ebp - 0xc]
call eax
mov dword [ebp - 0x14], eax
push 0x807
mov edx, 0x83be60
mov ecx, dword [ebp - 0xc]
call edx
mov dword [ebp - 0x1c], eax
mov eax, 0x5879e0
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x100a5ee4
cmp dword [ebp - 0x14], 0
jg 0x100a5ef9
cmp dword [ebp - 0x18], 0x80f
je 0x100a5ef9
cmp dword [ebp - 0x10], 2
jne 0x100a5f0b
cmp dword [ebp - 0x1c], 0
jg 0x100a5ef9
cmp dword [ebp - 0x20], 0x807
jne 0x100a5f0b
mov ecx, dword [ebp - 4]
movss xmm0, dword [0x101c94a8]
movss dword [ecx + 0x10], xmm0
jmp 0x100a5f1b
mov edx, dword [ebp - 4]
movss xmm0, dword [0x101c9480]
movss dword [edx + 0x10], xmm0
jmp 0x100a5f2d
mov eax, dword [ebp - 4]
movss xmm0, dword [0x101c9480]
movss dword [eax + 0x10], xmm0
mov esp, ebp
pop ebp
ret
Function at 0x100a68c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movss xmm0, dword [0x101c8ef0]
movss dword [eax + 0xc], xmm0
mov ecx, dword [ebp - 8]
movss xmm0, dword [0x101c9480]
movss dword [ecx + 0x10], xmm0
mov edx, dword [ebp - 8]
movss xmm0, dword [0x101c9418]
movss dword [edx + 0x14], xmm0
mov eax, dword [ebp - 8]
movss xmm0, dword [0x101c93a0]
movss dword [eax + 0x18], xmm0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
mov byte [edx + 0x21], 0
push 0x101a8220
push 0
push 0x101a8230
push 0x101a8238
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x100a693b
mov byte [ebp - 1], 1
jmp 0x100a693f
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x20], cl
movzx edx, byte [0x1027d3bd]
cmp edx, 1
jne 0x100a696a
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.10026530
movzx ecx, byte [0x1027d3c3]
cmp ecx, 1
jne 0x100a698c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.10026530
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.1000c1e0
test eax, eax
jbe 0x100a69cd
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.1000c630
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 8]
push eax
push 0x8d
mov ecx, 0x10212c14
call fcn.1011de20
push 1
mov ecx, dword [ebp - 8]
call fcn.100264f0
mov esp, ebp
pop ebp
ret

Function at 0x100aeda0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [0x1027d6d8], 1
jne 0x100aeed9
push 2
push 0x90
push 0x66842d
call fcn.10171cd0
add esp, 0xc
push 0x100ae600
push 0x6684a3
push 0xe8
call fcn.10171e60
add esp, 0xc
push 2
push 0x90
push 0x6684cd
call fcn.10171cd0
add esp, 0xc
push 0x100ae5b0
push 0x668512
push 0xe8
call fcn.10171e60
add esp, 0xc
push 0x101e73d8
push 0x777d6c
call fcn.10171db0
add esp, 8
push 0x101e73d8
push 0x777dac
call fcn.10171db0
add esp, 8
push 0x101e73d8
push 0x777dea
call fcn.10171db0
add esp, 8
push 0x101e73d8
push 0x777e17
call fcn.10171db0
add esp, 8
push 0x101e73d8
push 0x777e2c
call fcn.10171db0
add esp, 8
push 0x101e73d4
push 0x777d88
call fcn.10171db0
add esp, 8
push 0x101e73d4
push 0x777da2
call fcn.10171db0
add esp, 8
push 0x101e73d4
push 0x777dde
call fcn.10171db0
add esp, 8
push 0x100ae680
push 0x777dc8
push 0xe8
call fcn.10171e60
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10013570
push 0
push 0
push 0
push 0x100aeb90
push 0
push 0
call fcn.1006f550
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret