joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a17a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0x40
imul ecx, eax, 0xbf
movzx edx, byte [ecx + 0x104e2d9d]
test edx, edx
jne 0x100a17c4
jmp 0x100a193c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0xc4
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x100a17f7
mov ecx, 0x40
imul edx, ecx, 0xc4
mov byte [edx + 0x104e2d9e], 1
jmp 0x100a1809
mov eax, 0x40
imul ecx, eax, 0xc4
mov byte [ecx + 0x104e2d9e], 0
push 0xc5
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx edx, al
test edx, edx
je 0x100a18b9
mov eax, 0x40
imul ecx, eax, 0xc5
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 8], edx
cmp dword [ebp + 8], 0x201
jne 0x100a185a
mov eax, 0x40
imul ecx, eax, 0xc5
mov byte [ecx + 0x104e2d9c], 1
jmp 0x100a193c
mov edx, 0x40
imul eax, edx, 0xc5
mov byte [eax + 0x104e2d9c], 0
cmp dword [ebp - 8], 0x1f4
jae 0x100a187a
jmp 0x100a193c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0xc5
mov dword [edx + 0x104e2d98], eax
mov eax, 0x40
imul ecx, eax, 0xc4
add ecx, 0x104e2da7
push ecx
mov edx, dword [0x104e12ac]
push edx
mov ecx, 0x104dfe50
call fcn.100a1fa0
call fcn.100a1740
push 0xc3
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x100a193c
mov ecx, 0x40
imul edx, ecx, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e2d98]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x201
jne 0x100a1903
mov ecx, 0x40
imul edx, ecx, 0xc3
mov byte [edx + 0x104e2d9c], 1
jmp 0x100a193c
mov eax, 0x40
imul ecx, eax, 0xc3
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x100a1920
jmp 0x100a193c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0xc3
mov dword [ecx + 0x104e2d98], eax
call fcn.100a1740
mov esp, ebp
pop ebp
ret 4

Function at 0x100a2050
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0x10c]
push ecx
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x104]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp eax, 1
jne 0x100a20ba
mov ax, word [ebp - 0x108]
jmp 0x100a20bc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100a6dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
call fcn.100146a0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f6994
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100a6e1f
xor al, al
jmp 0x100a6e61
mov ecx, dword [ebp + 0xc]
call fcn.100103a0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.100103a0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret

Function at 0x100a6e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f69b0
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100a6ebb
xor al, al
jmp 0x100a6ef2
mov ecx, dword [ebp + 8]
call fcn.100103a0
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100a8c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x101f6a2c
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a8dc7
mov dword [0x104e1430], 0
mov dword [ebp - 0x48], 0
jmp 0x100a8c5c
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 5
jge 0x100a8d96
cmp dword [ebp - 0x48], 0
je 0x100a8c86
mov eax, dword [ebp - 0x48]
add eax, 1
push eax
push str.ID__d
lea ecx, [ebp - 0x38]
push ecx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
jmp 0x100a8c97
push 0x101f6a50
lea edx, [ebp - 0x38]
push edx
call sym.Client_Clean_.dll_sprintf
add esp, 8
mov dword [ebp - 0x3c], 0xb
lea eax, [ebp - 0x3c]
push eax
imul ecx, dword [0x104e1430], 0x1c
add ecx, 0x104e1434
push ecx
push 0
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a8ccc
cmp dword [ebp - 0x3c], 1
jae 0x100a8cec
xor ecx, ecx
imul edx, dword [0x104e1430], 0x1c
add edx, 0x104e1434
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
mov byte [edx + 0xa], cl
jmp 0x100a8c53
cmp dword [ebp - 0x48], 0
je 0x100a8d0c
mov eax, dword [ebp - 0x48]
add eax, 1
push eax
push str.PW__d
lea ecx, [ebp - 0x38]
push ecx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
jmp 0x100a8d1d
push 0x101f6a5c
lea edx, [ebp - 0x38]
push edx
call sym.Client_Clean_.dll_sprintf
add esp, 8
mov dword [ebp - 0x3c], 0xb
lea eax, [ebp - 0x3c]
push eax
imul ecx, dword [0x104e1430], 0x1c
add ecx, 0x104e143f
push ecx
push 0
push 0
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a8d52
cmp dword [ebp - 0x3c], 1
jae 0x100a8d72
xor ecx, ecx
imul edx, dword [0x104e1430], 0x1c
add edx, 0x104e143f
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
mov byte [edx + 0xa], cl
jmp 0x100a8c53
imul eax, dword [0x104e1430], 0x1c
mov ecx, dword [ebp - 0x48]
mov dword [eax + 0x104e144c], ecx
mov edx, dword [0x104e1430]
add edx, 1
mov dword [0x104e1430], edx
jmp 0x100a8c53
mov dword [ebp - 0x3c], 4
lea eax, [ebp - 0x3c]
push eax
push 0x104e13e8
push 0
push 0
push str.SavePass
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100a8dc7
mov dword [0x104e13e8], 0
mov dword [0x104e13e8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100a90c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
call fcn.100a6aa0
add esp, 4
call fcn.101d5570
mov word [ebp - 2], ax
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
call fcn.100a6a80
add esp, 4
call fcn.101d5570
mov word [ebp - 4], ax
movzx eax, word [ebp - 2]
push eax
movzx ecx, word [ebp - 4]
push ecx
cvttss2si edx, dword [ebp + 0x10]
movzx eax, dx
push eax
cvttss2si ecx, dword [ebp + 0xc]
movzx edx, cx
push edx
call fcn.100a6b10
add esp, 0x10
movzx eax, al
test eax, eax
je 0x100a91f1
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x637c60
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100a91db
movzx edx, byte [ebp + 0x30]
test edx, edx
je 0x100a91ed
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x100a91ed
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0xc]
add esp, 4
jmp 0x100a926a
jmp 0x100a926a
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x100b1e40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x9cc]
sub ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x9cc], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9cc], 0
jge 0x100b1e74
mov ecx, dword [ebp - 8]
call fcn.100b1ff0
jmp 0x100b1ecf
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c8]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c8]
add edx, 4
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c8], edx
mov ecx, dword [ebp - 4]
shr ecx, 0xb
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100b2850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
xor eax, eax
mov word [ebp - 4], ax
mov dword [ebp - 8], 0
jmp 0x100b286f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jae 0x100b28a3
mov edx, dword [ebp - 8]
movsx ecx, byte [edx + 0x1054582d]
mov eax, dword [ebp - 8]
xor edx, edx
mov esi, 0x11
div esi
movsx edx, byte [edx + 0x10545878]
xor ecx, edx
movzx eax, cl
movzx ecx, word [ebp - 4]
add ecx, eax
mov word [ebp - 4], cx
jmp 0x100b2866
mov byte [0x102150e9], 0xe2
mov byte [0x102150e8], 0xcf
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x102150e9]
add ecx, eax
mov byte [0x102150e9], cl
movzx edx, word [ebp - 4]
shr edx, 8
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x102150e8]
add ecx, eax
mov byte [0x102150e8], cl
mov edx, dword [0xd227b0]
mov dword [0x102150f0], edx
mov eax, dword [0xd227f8]
mov dword [0x102150ec], eax
push 0x100b2380
push 0xd227b0
call fcn.101229f0
add esp, 8
push 0x100b23f0
push 0xd227f8
call fcn.101229f0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b7bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, 0x104e2ce0
call fcn.100b7b30
movzx ecx, al
test ecx, ecx
jne 0x100b7bd5
xor al, al
jmp 0x100b7c8b
movzx edx, byte [ebp + 0x10]
cmp edx, 1
jne 0x100b7bfa
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0xbe]
test edx, edx
jne 0x100b7bfa
xor al, al
jmp 0x100b7c8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, dword [ecx + eax + 0xb8]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 8], 0x201
jne 0x100b7c48
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0xbc]
test edx, edx
jne 0x100b7c48
mov eax, dword [ebp + 0xc]
shl eax, 6
mov ecx, dword [ebp - 4]
mov byte [ecx + eax + 0xbc], 1
cmp dword [ebp + 8], 0x202
je 0x100b7c55
xor al, al
jmp 0x100b7c8b
cmp dword [ebp - 0xc], 0x1f4
jae 0x100b7c62
xor al, al
jmp 0x100b7c8b
mov edx, dword [ebp + 0xc]
shl edx, 6
mov eax, dword [ebp - 4]
mov byte [eax + edx + 0xbc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
shl ecx, 6
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0xb8], eax
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100ba050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 8
jae 0x100ba064
mov eax, dword [ebp + 0x10]
jmp 0x100ba15e
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x42
je 0x100ba15b
push 8
push 0x101f7098
mov ecx, dword [ebp + 8]
push ecx
call fcn.1019bd9d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100ba0a0
mov eax, dword [ebp + 0x10]
jmp 0x100ba15e
mov dword [ebp - 8], 0
jmp 0x100ba0b2
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
sub eax, 8
cmp dword [ebp - 8], eax
jge 0x100ba14d
mov dword [ebp - 0xc], 0x10545ce1
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 1], 0
jne 0x100ba0d1
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp - 0x18]
movsx eax, byte [edx + 0x10545ce1]
xor edx, edx
mov ecx, 0x10
div ecx
movzx edx, byte [edx + 0x101f7088]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
sub ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 8], cl
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x10
div ecx
movzx edx, byte [edx + 0x101f7088]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 8], cl
jmp 0x100ba0a9
mov eax, dword [ebp + 0x10]
add eax, 8
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
jmp 0x100ba15e
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x100d2f10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100d2f4c
xor al, al
jmp 0x100d2ffb
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x100d2f86
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.1014d811
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call fcn.1014d816
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x100d2fb8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d2ffb
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100d2fef
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d2ffb
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret 4

Function at 0x100d3140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call fcn.101a432a
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.DataItem_vorks_d.lua
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100d31a2
xor al, al
jmp 0x100d31f0
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
sub eax, 8
push eax
mov ecx, 1
shl ecx, 3
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 4]
push ecx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d31e4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100d31f0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100d3200
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x101f1edf
mov eax, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax]
jne 0x100d3256
cmp byte [ebp - 1], 0
je 0x100d324d
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax + 1]
jne 0x100d3256
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
jne 0x100d3219
mov dword [ebp - 0x14], 0
jmp 0x100d325e
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jne 0x100d326c
jmp 0x100d32be
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x100d327f
jmp 0x100d32be
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1014d811
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
push 0x100
push 0
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call fcn.1019bb90
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100ea780
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0xe
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx eax, al
test eax, eax
jne 0x100ea7ac
xor al, al
jmp 0x100ea94f
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x30], 0x21
mov dword [ebp - 0x2c], 0x22
mov dword [ebp - 0x28], 0x23
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x25
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 4], 0
jmp 0x100ea7ef
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 7
jge 0x100ea8b5
mov edx, dword [ebp - 4]
movzx eax, word [ebp + edx*4 - 0x34]
push eax
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx ecx, al
test ecx, ecx
je 0x100ea8b0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
movzx ecx, byte [eax + 0x104e2d9d]
test ecx, ecx
je 0x100ea8b0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e2d98]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0x201
jne 0x100ea867
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov byte [eax + 0x104e2d9c], 1
mov al, 1
jmp 0x100ea94f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x34]
shl edx, 6
mov byte [edx + 0x104e2d9c], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x100ea888
xor al, al
jmp 0x100ea94f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x34]
shl ecx, 6
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x104e2d98], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100eab40
jmp 0x100ea7e6
push 0x17
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx ecx, al
test ecx, ecx
je 0x100ea94d
mov edx, 0x40
imul eax, edx, 0x17
movzx ecx, byte [eax + 0x104e2d9d]
test ecx, ecx
jne 0x100ea8e3
xor al, al
jmp 0x100ea94f
mov edx, 0x40
imul eax, edx, 0x17
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e2d98]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x201
jne 0x100ea913
mov edx, 0x40
imul eax, edx, 0x17
mov byte [eax + 0x104e2d9c], 1
mov al, 1
jmp 0x100ea94f
mov ecx, 0x40
imul edx, ecx, 0x17
mov byte [edx + 0x104e2d9c], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x100ea92f
xor al, al
jmp 0x100ea94f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x17
mov dword [edx + 0x104e2d98], eax
push 8
mov ecx, dword [ebp - 0xc]
call fcn.100eab40
xor al, al
mov esp, ebp
pop ebp
ret 4