joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bf640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call edi
xor ebx, ebx
mov edx, eax
mov dword [ebp - 4], edx
cmp byte [esi + 0x8585], bl
je 0x100bf7e5
mov eax, 0x19d
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
setne al
mov byte [0x118cd71e], al
mov eax, 0x19d
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100bf6d4
cmp dword [ebp + 8], 0x201
jne 0x100bf6aa
mov byte [esi + 0x88cc], 1
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub edx, dword [esi + 0x88c8]
mov byte [esi + 0x88cc], bl
cmp edx, 0x1f4
jb 0x100bf7e5
call edi
mov edx, dword [ebp - 4]
mov dword [esi + 0x88c8], eax
mov byte [esi + 0x88ce], 1
mov eax, 0x19e
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100bf7e5
cmp dword [ebp + 8], 0x201
jne 0x100bf703
mov byte [esi + 0x8920], 1
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub edx, dword [esi + 0x891c]
mov byte [esi + 0x8920], bl
cmp edx, 0x1f4
jb 0x100bf7e5
call edi
mov edi, dword [sym.imp.MSVCR100.dll_atoi]
mov dword [esi + 0x891c], eax
mov byte [esi + 0x8585], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x85b5], bl
lea ebx, [esi + 0x8799]
push ebx
call edi
mov dword [ebp - 0x20], eax
lea eax, [esi + 0x87ed]
push eax
mov dword [ebp + 8], eax
call edi
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x8841]
push eax
mov dword [ebp - 4], eax
call edi
mov dword [ebp - 0x18], eax
lea eax, [esi + 0x8895]
push eax
mov dword [ebp - 8], eax
call edi
add esi, 0x88e9
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], esi
call edi
mov edx, dword [ebp - 0x24]
push ecx
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], eax
call fcn.10100a10
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push 0x10135e76
push ebx
call esi
mov eax, dword [ebp + 8]
push 0x10135e76
push eax
call esi
mov ecx, dword [ebp - 4]
push 0x10135e76
push ecx
call esi
mov edx, dword [ebp - 8]
push 0x10135e76
push edx
call esi
mov eax, dword [ebp - 0xc]
push 0x10135e76
push eax
call esi
add esp, 0x40
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100bfea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
call fcn.100c0010
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov ecx, edx
sub ecx, dword [esi + 0x7f44]
mov dword [esp + 0x18], edx
cmp ecx, 0x1f4
jb 0x100bfffa
cmp byte [esi + 0x7f49], 0
je 0x100bfffa
mov dword [esp + 0x1c], 0x186
mov dword [esp + 0x20], 0x187
mov dword [esp + 0x24], 0x188
mov dword [esp + 0x28], 0x189
mov dword [esp + 0x2c], 0x18a
mov dword [esp + 0x30], 0x18b
mov dword [esp + 0x34], 0x18c
mov dword [esp + 0x38], 0x18d
xor ebx, ebx
mov ax, word [esp + ebx*4 + 0x1c]
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100bffcd
mov edi, dword [esp + ebx*4 + 0x1c]
imul edi, edi, 0x54
mov eax, edx
sub eax, dword [edi + esi + 0x144]
cmp dword [ebp + 8], 0x201
je 0x100bffeb
mov byte [edi + esi + 0x148], 0
cmp eax, 0x1f4
jb 0x100bfffa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x10]
push ecx
mov ecx, 8
mov dword [edi + esi + 0x144], eax
mov dword [esp + 0x14], 0x8ff08c1
mov dword [esp + 0x18], ebx
call fcn.10100800
mov edx, dword [esp + 0x1c]
mov byte [esi + 0x7f49], 0
mov dword [0xe8cb3c], 0
add esp, 4
mov dword [esi + 0x7f4c], 0x1e0
mov byte [esi + 0x7f50], 0x14
mov byte [esi + 0x7f79], 0
inc ebx
cmp ebx, 8
jl 0x100bff31
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + ebx*4 + 0x1c]
imul edx, edx, 0x54
mov byte [edx + esi + 0x148], 1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4

Function at 0x100c0010
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x7f49], bl
je 0x100c008e
mov eax, 0x185
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c008e
cmp dword [ebp + 8], 0x201
jne 0x100c004f
pop edi
mov byte [esi + 0x80ec], 1
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x80e8]
mov byte [esi + 0x80ec], bl
cmp edx, 0x1f4
jb 0x100c008e
call edi
mov dword [esi + 0x80e8], eax
mov byte [esi + 0x7f49], bl
mov dword [0xe8cb3c], ebx
mov dword [esi + 0x7f4c], 0x1e0
mov byte [esi + 0x7f50], 0x14
mov byte [esi + 0x7f79], bl
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100c1210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7a09], 0
push ebx
push edi
je 0x100c1467
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a88894]
push 0x170
mov ecx, 0x108f5340
call fcn.100303e0
fld dword [0x1013faa8]
mov eax, dword [0x10a88894]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c12fe
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c12fe
push 0
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a88894]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a88894]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a88894]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a88894]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a88894]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014990
mov byte [esi + 0x7c56], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c1470
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7a5d], 0
push ebx
push edi
je 0x100c16c7
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a8888c]
push 0x171
mov ecx, 0x108f57f0
call fcn.10030d40
fld dword [0x1013faa8]
mov eax, dword [0x10a8888c]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c155e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c155e
push 0x10
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a8888c]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a8888c]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a8888c]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a8888c]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a8888c]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014800
mov byte [esi + 0x7caa], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c16d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7ab1], 0
push ebx
push edi
je 0x100c1927
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a88890]
push 0x172
mov ecx, 0x108f5a48
call fcn.100316a0
fld dword [0x1013faa8]
mov eax, dword [0x10a88890]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c17be
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c17be
push 0x20
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a88890]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a88890]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a88890]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a88890]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a88890]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014b20
mov byte [esi + 0x7cfe], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c1930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7b05], 0
push ebx
push edi
je 0x100c1b87
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a88898]
push 0x173
mov ecx, 0x108f5ca0
call fcn.10032040
fld dword [0x1013faa8]
mov eax, dword [0x10a88898]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c1a1e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c1a1e
push 0x30
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a88898]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a88898]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a88898]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a88898]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a88898]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014ca0
mov byte [esi + 0x7d52], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c1b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7b59], 0
push ebx
push edi
je 0x100c1de7
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a888a4]
push 0x174
mov ecx, 0x108f5ef8
call fcn.100329a0
fld dword [0x1013faa8]
mov eax, dword [0x10a888a4]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c1c7e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c1c7e
push 0x40
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a888a4]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a888a4]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a888a4]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a888a4]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a888a4]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014e10
mov byte [esi + 0x7da6], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c1e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [esi + 0x7bad], 0
push ebx
push edi
je 0x100c2057
mov dword [0xe8cb3c], 1
mov ebx, dword [0x10a888a0]
push 0x175
mov ecx, 0x108f6150
call fcn.10033300
fld dword [0x1013faa8]
mov eax, dword [0x10a888a0]
add esp, 4
push 0x108f5598
push 0
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x1013f550]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013ff78]
fld qword [0x1013f918]
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax + 0x18]
fmul qword [0x1013f510]
fadd dword [eax]
fsubrp st(1)
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
push 0x10a887f8
call fcn.10026050
add esp, 0x1c
test al, al
je 0x100c1eee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100c1eee
push 0x50
call fcn.10090d20
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
call edi
mov dword [esi + 0x14d10], eax
mov eax, dword [0x10a888a0]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013fd40]
mov ecx, esi
fsub qword [0x1013f918]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x165
fstp dword [esp]
call fcn.100b8700
mov eax, dword [0x10a888a0]
fld dword [eax + 0x24]
sub esp, 8
fsub qword [0x1013f918]
mov ecx, esi
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 4]
fld dword [eax]
mov eax, 0x167
fadd qword [0x1013fa48]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.100b8700
mov edi, dword [0x10a888a0]
fld dword [edi + 0x24]
mov eax, dword [0x101726b8]
fld qword [0x1013f580]
push eax
fadd st(1), st(0)
push 0x108fb358
fxch st(1)
push 0xd2
fsub qword [0x1013f918]
call fcn.1012e5b0
fadd dword [edi]
mov dword [esp + 0x18], eax
call fcn.1012e5b0
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
mov ebx, 3
call fcn.100bb860
fldz
mov eax, dword [0x10a888a0]
add esp, 0x14
push 0
sub esp, 0x14
fstp dword [esp + 0x10]
mov ecx, 0x1079f300
fld dword [0x1013fd08]
fstp dword [esp + 0xc]
fld dword [0x10140308]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x1013f7c0]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.101046f0
fld dword [0x1013fd08]
mov eax, dword [0x10a888a0]
sub esp, 0x10
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [eax + 0x24]
fsub qword [0x1013f9b0]
fsub qword [0x1013f918]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [eax]
fadd qword [0x10140948]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10014fa0
mov byte [esi + 0x7dfa], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret