joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b474
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b4d8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040453c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004074b4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b4df
lea eax, [ebp - 0xc]
call fcn.004042cc
ret

Function at 0x412c1c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x412c70
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x412c9c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x413114
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov dl, 1
mov eax, 0x4131a8
call fcn.00413054
test al, al
je 0x413196
mov eax, dword [ebp - 4]
push eax
push 0
push 0xf0001
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41318f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jbe 0x41316c
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413196
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor edx, edx
mov eax, 0x4131a8
call fcn.00413054
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x41f4a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f4e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f4e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f4e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f4e2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f4e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4316c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4316ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4316ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401bd7
pop dword [ebp - 0x48]
mov eax, 0x401bd7
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7f1a6e1f
add dword [ebp - 0x58], 0xcf37d72c
mov dword [ebp - 0x54], 0x2e5e7f47
sub dword [ebp - 0x54], 0xfc2b3302
mov dword [ebp - 0x50], 0x975cdee9
add dword [ebp - 0x50], 0xb4ef6545
mov dword [ebp - 0x4c], 0xbd6f7bae
add dword [ebp - 0x4c], 0x42908452
lea eax, [ebp - 0x58]
push eax
mov eax, 0x19622599
add eax, 0xe6de4ac7
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xec2928e4
sub dword [ebp - 0x58], 0x77b6bf8e
mov dword [ebp - 0x54], 0x773c9760
sub dword [ebp - 0x54], 0x35d035eb
mov dword [ebp - 0x50], 0xeab32647
add dword [ebp - 0x50], 0x78bc4625
mov dword [ebp - 0x4c], 0xc883a2b3
add dword [ebp - 0x4c], 0x377c5d4d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x52b1093
sub eax, 0x4ea9f93
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x349af
push 0
call eax
mov ecx, 0x89c59ffa
add ecx, 0x763aa025
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x48]
mov edi, 0xc7baaff3
add edi, 0x8a3a3ffe
xor dword [ebp - 0xc], edx
mov ebx, dword [edx]
add dword [ebp - 4], 0x305c1ac9
add ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x38], eax
add esi, 0x4f5591a9
add esi, 0xb0aa6e5b
add edx, 0x40b6b1e
add edx, 0xfbf494e6
loop 0x401cee
add eax, 0xf34f
mov ebx, eax
add eax, 0x8d87ddd8
add eax, 0x7278222d
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x416f0c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x416fa3
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x416fbc
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416faa
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x4248ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x42490c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x4248f6
push 3
push 0x424918
push 0x424918
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x42491c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424913
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x428834
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffd4
mov eax, 0x4288c0
mov dword [esp], eax
mov eax, 0x4288e0
mov dword [esp + 4], eax
mov eax, 0x428900
mov dword [esp + 8], eax
mov eax, 0x428920
mov dword [esp + 0xc], eax
mov eax, 0x428944
mov dword [esp + 0x10], eax
mov eax, 0x428964
mov dword [esp + 0x14], eax
mov eax, 0x428988
mov dword [esp + 0x18], eax
mov eax, 0x4289a8
mov dword [esp + 0x1c], eax
mov eax, 0x4289c8
mov dword [esp + 0x20], eax
mov eax, 0x4289e8
mov dword [esp + 0x24], eax
mov eax, 0x428a08
mov dword [esp + 0x28], eax
mov eax, esp
mov edx, 0xa
call fcn.0041d41c
mov edx, 0x428a28
mov eax, 0x429d80
call fcn.0041d7dc
add esp, 0x2c
ret
Function at 0x429d94
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffdc
mov eax, 0x429e10
mov dword [esp], eax
mov eax, 0x429e2c
mov dword [esp + 4], eax
mov eax, 0x429e4c
mov dword [esp + 8], eax
mov eax, 0x429e6c
mov dword [esp + 0xc], eax
mov eax, 0x429e8c
mov dword [esp + 0x10], eax
mov eax, 0x429ea8
mov dword [esp + 0x14], eax
mov eax, 0x429ec8
mov dword [esp + 0x18], eax
mov eax, 0x429ee8
mov dword [esp + 0x1c], eax
mov eax, 0x429f0c
mov dword [esp + 0x20], eax
mov eax, esp
mov edx, 8
call fcn.0041d41c
mov edx, 0x429f2c
mov eax, 0x42b3b0
call fcn.0041d7dc
add esp, 0x24
ret
Function at 0x10002d30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
push 0x10
push 0x1602178
call ebx
mov edi, dword [ebp + 8]
mov ecx, 0x1602178
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov eax, dword [edi + 8]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x160218c
call ebx
push 0x20
lea esi, [edi + 0x14]
push esi
push 0x160218c
call fcn.1029c630
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x160218c
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x16021a8
call ebx
mov eax, dword [edi + 4]
mov ecx, 0x16021a8
mov dword [ecx], eax
mov eax, dword [edi + 8]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x16021c4
call ebx
push 0x20
push esi
push 0x16021c4
call fcn.1029c630
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x16021c4
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x1602204
call ebx
mov eax, dword [edi + 0x54]
mov ecx, 0x1602204
mov dword [ecx], eax
mov eax, dword [edi + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x5c]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x60]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x1602218
call ebx
push 0x20
lea esi, [edi + 0x64]
push esi
push 0x1602218
call fcn.1029c630
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x1602218
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x10
push 0x1602234
call ebx
mov eax, dword [edi + 0x54]
mov ecx, 0x1602234
mov dword [ecx], eax
mov eax, dword [edi + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x5c]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x60]
mov dword [ecx + 0xc], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x10
push ecx
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0x20
push 0x1602250
call ebx
push 0x20
push esi
push 0x1602250
call fcn.1029c630
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x20
push 0x1602250
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006b00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c0326
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102dd418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x102d8664
call fcn.10299a53
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10297aa4
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x102dd418]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10009e40
test al, al
je 0x100097ff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x102e200c]
add ecx, dword [0x102e2008]
cmp eax, ecx
jbe 0x100096cf
mov byte [0x102e2004], 0xff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret
call esi
sub eax, dword [0x102e2008]
sub esp, 0x10
movss xmm2, dword [0x102d8da0]
mov esi, 0x83f98c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov eax, dword [0x102e200c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov dword [esp + 0xc], 0x42a00000
mov dword [esp + 8], 0x43510000
mov dword [esp + 4], 0x42960000
mov dword [esp], 0x43570000
cvtpd2ps xmm0, xmm0
push 0x7b14
divss xmm1, xmm0
minss xmm2, xmm1
movss dword [ebp - 0x108], xmm2
call esi
add esp, 4
mov dword [esp + 0xc], 0x41900000
mov dword [esp + 8], 0x43200000
mov dword [esp + 4], 0x42e60000
mov dword [esp], 0x43700000
push 0x7a65
call esi
movss xmm0, dword [ebp - 0x108]
add esp, 4
mov dword [esp + 0xc], 0x41000000
movss dword [esp + 8], xmm0
mov dword [esp + 4], 0x42f00000
mov dword [esp], 0x43750000
push 0x7a66
call esi
cmp dword [0x102e2024], 0x10
mov eax, 0x102e2010
cmovae eax, dword [0x102e2010]
push eax
lea eax, [ebp - 0x104]
push 0x102d8574
push eax
call fcn.100092d0
add esp, 0x20
lea eax, [ebp - 0x104]
push 0
push ecx
mov dword [esp], 0x43200000
push 3
push 0
push 0xffffffffffffffff
push 0x64
push 0xf0
push eax
mov eax, 0x89627a
call eax
add esp, 0x20
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret
Function at 0x100098c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x102dd418]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10009e40
test al, al
je 0x10009a3f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x102e2030]
add ecx, dword [0x102e202c]
cmp eax, ecx
jbe 0x1000990f
mov byte [0x102e2028], 0xff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret
call esi
sub eax, dword [0x102e202c]
sub esp, 0x10
movss xmm2, dword [0x102d8da0]
mov esi, 0x83f98c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov eax, dword [0x102e2030]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov dword [esp + 0xc], 0x42a00000
mov dword [esp + 8], 0x43510000
mov dword [esp + 4], 0x42960000
mov dword [esp], 0x43570000
cvtpd2ps xmm0, xmm0
push 0x7b14
divss xmm1, xmm0
minss xmm2, xmm1
movss dword [ebp - 0x108], xmm2
call esi
add esp, 4
mov dword [esp + 0xc], 0x41900000
mov dword [esp + 8], 0x43200000
mov dword [esp + 4], 0x42e60000
mov dword [esp], 0x43700000
push 0x7a65
call esi
movss xmm0, dword [ebp - 0x108]
add esp, 4
mov dword [esp + 0xc], 0x41000000
movss dword [esp + 8], xmm0
mov dword [esp + 4], 0x42f00000
mov dword [esp], 0x43750000
push 0x7a66
call esi
cmp dword [0x102e2048], 0x10
mov eax, 0x102e2034
cmovae eax, dword [0x102e2034]
push eax
lea eax, [ebp - 0x104]
push 0x102d8574
push eax
call fcn.100092d0
add esp, 0x20
lea eax, [ebp - 0x104]
push 0
push ecx
mov dword [esp], 0x43200000
push 3
push 0
push 0xffffffffffffffff
push 0x64
push 0xf0
push eax
mov eax, 0x89627a
call eax
add esp, 0x20
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret
Function at 0x10009a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x102dd418]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov byte [0x102e204c], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x102e2084], 0x10
mov dword [0x102e2050], eax
mov eax, 0x102e2070
cmovae eax, dword [0x102e2070]
mov dword [0x102e2054], 0xbb8
mov dword [0x102e2080], 0
mov byte [eax], 0
mov eax, 0x102e2058
cmp dword [0x102e206c], 0x10
mov dword [0x102e2068], 0
cmovae eax, dword [0x102e2058]
mov byte [eax], 0
movzx eax, byte [0x102e204c]
sub eax, 0
je 0x10009b73
sub eax, 1
je 0x10009b4c
sub eax, 1
jne 0x10009bfe
push 0x5d3
call fcn.10009e70
add esp, 4
push eax
lea eax, [ebp - 0x208]
push 0x102d8574
push eax
call fcn.100092d0
mov eax, 0x10624dd3
add esp, 0xc
mul dword [ebp + 0xc]
lea eax, [ebp - 0x108]
shr edx, 6
push edx
push str._Accumulated_time:__d_seconds_
push eax
call fcn.100092d0
add esp, 0xc
cmp byte [ebp - 0x108], 0
jne 0x10009b30
xor ecx, ecx
jmp 0x10009bec
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009b40
jmp 0x10009bea
push 0x5d2
call fcn.10009e70
add esp, 4
push eax
lea eax, [ebp - 0x208]
push 0x102d8574
push eax
call fcn.100092d0
add esp, 0xc
jmp 0x10009bfe
push 0x5d1
call fcn.10009e70
add esp, 4
push eax
lea eax, [ebp - 0x208]
push 0x102d8574
push eax
call fcn.100092d0
mov eax, 0x10624dd3
add esp, 0xc
mul dword [ebp + 0xc]
lea eax, [ebp - 0x108]
shr edx, 6
push edx
push str._Accumulated_time:__d_seconds_
push eax
call fcn.100092d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102e2050], eax
mov eax, 0xee48
sub eax, dword [ebp + 0xc]
cmp byte [ebp - 0x108], 0
mov dword [0x102e2054], eax
jne 0x10009bda
xor ecx, ecx
jmp 0x10009bec
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009be3
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, 0x102e2070
push eax
call fcn.10009150
cmp byte [ebp - 0x208], 0
jne 0x10009c0b
xor ecx, ecx
jmp 0x10009c1d
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009c14
sub ecx, edx
push ecx
lea eax, [ebp - 0x208]
mov ecx, 0x102e2058
push eax
call fcn.10009150
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret 8
Function at 0x10009c40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x102dd418]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10009e40
test al, al
je 0x10009e28
mov al, byte [0x102e204c]
cmp al, 3
je 0x10009e28
cmp al, 4
je 0x10009e28
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x102e2054]
add ecx, dword [0x102e2050]
cmp eax, ecx
jbe 0x10009ca4
mov byte [0x102e204c], 0xff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret
call esi
sub eax, dword [0x102e2050]
sub esp, 0x10
movss xmm2, dword [0x102d8da0]
mov esi, 0x83f98c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov eax, dword [0x102e2054]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x102d8db0]
mov dword [esp + 0xc], 0x42a00000
mov dword [esp + 8], 0x43510000
mov dword [esp + 4], 0x42960000
mov dword [esp], 0x43570000
cvtpd2ps xmm0, xmm0
push 0x7b14
divss xmm1, xmm0
minss xmm2, xmm1
movss dword [ebp - 0x208], xmm2
call esi
add esp, 4
mov dword [esp + 0xc], 0x41900000
mov dword [esp + 8], 0x43200000
mov dword [esp + 4], 0x42e60000
mov dword [esp], 0x43700000
push 0x7a65
call esi
movss xmm0, dword [ebp - 0x208]
add esp, 4
mov dword [esp + 0xc], 0x41000000
movss dword [esp + 8], xmm0
mov dword [esp + 4], 0x42f00000
mov dword [esp], 0x43750000
push 0x7a66
call esi
cmp dword [0x102e206c], 0x10
mov eax, 0x102e2058
cmovae eax, dword [0x102e2058]
push eax
lea eax, [ebp - 0x104]
push 0x102d8574
push eax
call fcn.100092d0
add esp, 0x20
lea eax, [ebp - 0x104]
mov esi, 0x89627a
push 0
push ecx
mov dword [esp], 0x43200000
push 3
push 0
push 0xffffffffffffffff
push 0x5f
push 0xf0
push eax
call esi
add esp, 0x20
cmp dword [0x102e2080], 0
je 0x10009e27
cmp dword [0x102e2084], 0x10
mov eax, 0x102e2070
cmovae eax, dword [0x102e2070]
push eax
lea eax, [ebp - 0x204]
push 0x102d8574
push eax
call fcn.100092d0
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push ecx
mov dword [esp], 0x43200000
push 3
push 0
push 0xffffffffffffffff
push 0x69
push 0xf0
push eax
call esi
add esp, 0x20
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102996ff
mov esp, ebp
pop ebp
ret