joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10044860
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x102e9418]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x194]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1c4]
test dword [eax + 0x44], 0x800
jne 0x1004498e
push 0x80
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x80
push 0
push eax
call fcn.10056ce0
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1004491a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x8c]
push 0x100
push eax
push esi
call fcn.10039b50
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.10028d00
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10053c7f
add esp, 0x188
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
call fcn.10029fe0
add esp, 0x10
test al, al
jne 0x1004498e
push edi
call fcn.1005dd25
mov esi, eax
call fcn.1005dd25
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push dword [esi]
call fcn.10039b50
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10028d00
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10053c7f
add esp, 0x188
ret
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.10053c7f
add esp, 0x188
ret

Function at 0x10044c10
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x102e9418]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x67f], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10044c5f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d:_errno__d
jmp 0x10044ccd
push dword [esi + 0x628]
mov dword [esp + 0x14], 1
call fcn.1002b160
push dword [esi + 0x62c]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.1002b160
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10044cd6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:_errno__d
push esi
call fcn.10028dd0
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.10053c7f
add esp, 0x18
ret
Function at 0x10044cf0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
mov eax, dword [0x102e9418]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push 4
push eax
push 1
push 6
push dword [esp + 0x124]
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10044d55
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.10039b50
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.10028dd0
add esp, 0x18
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.10053c7f
add esp, 0x108
ret
Function at 0x1004dea0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x102e9418]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.1006add1
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1004df18
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10039c40
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.10028d00
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x1004e057
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x1004df6a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10039c40
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.10028d00
add esp, 0x1c
mov esi, 0x4d
jmp 0x1004e057
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1004dfaa
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10039c40
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.10028d00
add esp, 0x1c
mov esi, 0x4d
jmp 0x1004e04d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x1004dfd8
jg 0x1004dfbe
cmp edi, 0x100000
jbe 0x1004dfd8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.10028d00
add esp, 0xc
mov esi, 0x4d
jmp 0x1004e04d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1004dff0
lea esi, [eax + 0x1b]
jmp 0x1004e04d
test edi, edi
je 0x1004e034
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004e091
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004e08d
add esi, eax
cmp esi, edi
jb 0x1004e000
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.1004dca0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x102e9004]
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x1004e072
push eax
call fcn.1005cfd2
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10053c7f
add esp, 0x120
ret
mov edi, esi
jmp 0x1004e034
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10039c40
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.10028d00
add esp, 0x1c
mov esi, 0x4d
jmp 0x1004e04d
Function at 0x10051750
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10051777
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x100517bf
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x20], ebx
jmp 0x100517c3
mov ebp, dword [esp + 0x1c]
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10051825
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100517e4
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x10051857
nop word [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x102d7d21
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x102d7d22
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x10051830
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100519d0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
lea eax, [esp]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100519f5
mov eax, 0x1b
add esp, 8
ret
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10051a25
push eax
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 8
ret
push dword [esp + 0x14]
call fcn.1002b140
add esp, 4
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [esp]
push ecx
push dword [esp + 0x10]
call fcn.10051970
add esp, 8
xor eax, eax
add esp, 8
ret

Function at 0x100702d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10070156

Function at 0x1007497f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007463f
Function at 0x1007a800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x30
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x47
ja case.0x1007a829.10
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x1007a8a0]
jmp dword [eax*4 + 0x1007a894]
mov dword [ebp + 0xc], 0
jmp 0x1007a849
mov dword [ebp + 0xc], 4
jmp 0x1007a849
mov dword [ebp + 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1007a851
jmp 0x1007a88d
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x1007a874
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.10001c10
mov dword [eax], esi
jmp 0x1007a88d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.10001c10
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1007db40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0xff
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0xff
push 0
push 0x102e4634
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1007db7e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1007e950
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x102e9418]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
xor eax, eax
mov word [ebp - 0x110], ax
push 0x7e
push 0
lea ecx, [ebp - 0x10e]
push ecx
call fcn.10056ce0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x90], dx
push 0x7e
push 0
lea eax, [ebp - 0x8e]
push eax
call fcn.10056ce0
add esp, 0xc
mov dword [ebp - 0x124], 0x80
mov dword [ebp - 0x120], 0x80
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0xff
mov byte [ebp - 5], 0xff
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx + 9]
test edx, edx
je 0x1007ea39
push 4
mov eax, dword [ebp - 0x114]
add eax, 0xc
push eax
push 0x1b
push 0x29
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1007ea39
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1007eb76
push 0
push 0
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnectByNameA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x1007ea97
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1007eb76
push 0
push 0
push 0x7010
push 0xffff
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1007eadb
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1007eb76
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx + 9]
test edx, edx
je 0x1007eb30
lea eax, [ebp - 0x90]
mov dword [ebp - 0x12c], eax
push 0xc
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x12c]
add edx, 8
push edx
call fcn.10056ef6
add esp, 0xc
test eax, eax
jne 0x1007eb1a
mov byte [ebp - 0x115], 0
jmp 0x1007eb21
mov byte [ebp - 0x115], 1
mov eax, dword [ebp - 0x114]
mov cl, byte [ebp - 0x115]
mov byte [eax + 0x10], cl
push 0x23
push 0x400
mov edx, dword [0x102eb568]
push edx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1007eb71
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1007eb76
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10053c7f
mov esp, ebp
pop ebp
ret 8
Function at 0x1007eca0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x102e9418]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x198]
movzx ecx, byte [eax + 8]
test ecx, ecx
jne 0x1007ed6e
mov edx, dword [ebp - 0x198]
mov byte [edx + 8], 1
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x1007ed0e
push str.Winsock_DLL_Initialize_error._r_n
push 0x1855d10
mov ecx, 0xf598fb
call ecx
add esp, 8
xor eax, eax
jmp 0x1007ed73
movzx edx, word [ebp - 0x194]
and edx, 0xff
movzx eax, dl
cmp eax, 2
jne 0x1007ed3b
movzx ecx, word [ebp - 0x194]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
cmp edx, 2
je 0x1007ed59
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Winsock_version_low._r_n
push 0x1855d10
mov eax, 0xf598fb
call eax
add esp, 8
xor eax, eax
jmp 0x1007ed73
mov dword ds:[0xa6a1774], 0
movzx eax, word [ebp - 0xe]
mov dword ds:[0xa6a1770], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10053c7f
mov esp, ebp
pop ebp
ret

Function at 0x1007fbc0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1007fc11
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x1007fc0f
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov edx, dword [0x102eb574]
push edx
push 0x1007fa30
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x1007fc0f
xor eax, eax
jmp 0x1007fc25
jmp 0x1007fc20
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
jmp 0x1007fc25
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x102c7260
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x102eb760], 0x11223344
jne 0x102c7277
call fcn.10080c10
push 0
push str.ScreenShots
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0xc], 0
jmp 0x102c7296
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc
jge 0x102c72ba
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 0x102e4b00]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x12441fd
push eax
call fcn.102caea0
add esp, 8
jmp 0x102c728d
mov dword [ebp - 0x10], 0
jmp 0x102c72cc
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx*8 + 0x102e9df0], 0
je 0x102c72fa
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax*8 + 0x102e9df4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx*8 + 0x102e9df0]
push eax
call fcn.102caea0
add esp, 8
jmp 0x102c72c3
mov dword [ebp - 0x14], 0
jmp 0x102c730c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx*8 + 0x102e9fe0], 0
je 0x102c7339
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax*8 + 0x102e9fe4]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx*8 + 0x102e9fe0]
push eax
call fcn.102caee0
add esp, 8
jmp 0x102c7303
mov dword [ebp - 4], 0
jmp 0x102c734b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
imul edx, dword [ebp - 4], 0xc
cmp dword [edx + 0x102e4a70], 0
je 0x102c7383
imul eax, dword [ebp - 4], 0xc
mov ecx, dword [eax + 0x102e4a78]
push ecx
imul edx, dword [ebp - 4], 0xc
mov eax, dword [edx + 0x102e4a74]
push eax
imul ecx, dword [ebp - 4], 0xc
mov edx, dword [ecx + 0x102e4a70]
push edx
call fcn.102cad90
add esp, 0xc
jmp 0x102c7342
mov dword [ebp - 8], 0
jmp 0x102c7395
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
imul ecx, dword [ebp - 8], 0xc
cmp dword [ecx + 0x102e4a58], 0
je 0x102c73cd
imul edx, dword [ebp - 8], 0xc
mov eax, dword [edx + 0x102e4a60]
push eax
imul ecx, dword [ebp - 8], 0xc
mov edx, dword [ecx + 0x102e4a5c]
push edx
imul eax, dword [ebp - 8], 0xc
mov ecx, dword [eax + 0x102e4a58]
push ecx
call fcn.102caf20
add esp, 0xc
jmp 0x102c738c
push fcn.1007d230
push 0xceb249
push 0xff
call fcn.102cade0
add esp, 0xc
push fcn.1007d230
push 0xceb37c
push 0xff
call fcn.102cade0
add esp, 0xc
push fcn.1007d230
push 0xceb415
push 0xff
call fcn.102cade0
add esp, 0xc
push fcn.102c8d60
push 0xd5dd56
push 0xff
call fcn.102cade0
add esp, 0xc
call fcn.1007dc30
call fcn.1007fc60
call fcn.102c81b0
call fcn.102ca510
call fcn.1007f6d0
call fcn.102c7ae0
mov ecx, 0x102ed7f8
call fcn.1007a9b0
call fcn.102c7ae0
mov dword [0x181d390], 0x4e4
mov ecx, 0x102ee270
call fcn.1007f310
push 0
push 0
push 0
push 0x102c7490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x102c99d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x102e9418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102eada4]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x102eecfc]
cmp eax, dword [edx + 4]
jle 0x102c9a2a
push 0x102eecfc
call fcn.1005415d
add esp, 4
cmp dword [0x102eecfc], 0xffffffff
jne 0x102c9a2a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102eed00], eax
push 0x102eecfc
call fcn.1005411e
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102eed00]
cmp eax, 0x2710
jbe 0x102c9a77
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102eed00], eax
mov ecx, 0x102ed8d0
call fcn.1007cc30
push eax
mov ecx, 0x102ed8d0
call fcn.1007cd40
push eax
lea ecx, [ebp - 0x10]
call fcn.10014380
movzx ecx, byte [ebp - 0xf]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.102c9a90
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10053c7f
mov esp, ebp
pop ebp
ret

Function at 0x102cad90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10056ce0
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x102cade0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, byte [ebp + 8]
cmp edx, 0xff
je 0x102cae0c
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 8]
mov byte [eax], cl
lea edx, [ebp + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 1], edx
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x102caea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x102caee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x102caf20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100561e0
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret