joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b2880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101925db
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x518], ecx
lea ecx, [ebp - 0x510]
call fcn.100873c0
mov dword [ebp - 4], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.100754c0
add esp, 0xc
lea ecx, [ebp - 0x514]
push ecx
mov ecx, dword [ebp - 0x518]
call fcn.10001110
jmp 0x100b2908
push 0
lea edx, [ebp - 0x520]
push edx
lea ecx, [ebp - 0x514]
call fcn.1002df30
lea eax, [ebp - 0x524]
push eax
mov ecx, dword [ebp - 0x518]
call fcn.10001140
push eax
lea ecx, [ebp - 0x514]
call fcn.10001350
movzx ecx, al
test ecx, ecx
je 0x100b2a93
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
mov ecx, dword [ebp - 0x518]
call fcn.100b2b60
movzx edx, al
test edx, edx
jne 0x100b29a4
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_File_is_Missing
lea eax, [ebp - 0x110]
push eax
call fcn.1006e259
add esp, 0xc
push 0x10
push 0x101a6cd4
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x400
lea edx, [ebp - 0x51c]
push edx
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
lea ecx, [ebp - 0x510]
call fcn.10087160
movzx eax, al
test eax, eax
jne 0x100b2a23
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_File_Check_Error
lea ecx, [ebp - 0x110]
push ecx
call fcn.1006e259
add esp, 0xc
push 0x10
push 0x101a6cec
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x514]
call fcn.100012e0
mov eax, dword [eax + 0x104]
cmp eax, dword [ebp - 0x51c]
je 0x100b2a8e
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_has_been_modified..._n_nReinstall_Client_or_contact_server_Administrator
lea ecx, [ebp - 0x110]
push ecx
call fcn.1006e259
add esp, 0xc
push 0x10
push 0x101a6d3c
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x100b28f4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.100873b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006cdc0
mov esp, ebp
pop ebp
ret
Function at 0x100b3650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2e3]
test ecx, ecx
jne 0x100b366a
jmp 0x100b36f3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2dc]
cmp eax, 0x46
jbe 0x100b36f3
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2d4]
test ecx, ecx
jne 0x100b36b9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2d8]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2d8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2d8], 0xa
jne 0x100b36b7
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d4], 1
jmp 0x100b36e4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2d8]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x2d8], edx
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2d8], 1
jne 0x100b36e4
mov edx, dword [ebp - 4]
mov byte [edx + 0x2d4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2dc], eax
mov esp, ebp
pop ebp
ret
Function at 0x100b6a90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0xcc]
cmp eax, 0x3e8
jae 0x100b6ab5
jmp 0x100b6b57
lea ecx, [ebp - 4]
call fcn.1000f790
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x80
call fcn.10001110
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x100b6ae4
push 0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
call fcn.100334d0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x80
call fcn.10001140
push eax
lea ecx, [ebp - 4]
call fcn.10001350
movzx eax, al
test eax, eax
je 0x100b6b48
lea ecx, [ebp - 4]
call fcn.100012e0
movzx esi, byte [eax]
mov ecx, dword [0x10272f10]
push ecx
mov ecx, 0x10206f88
call fcn.100dbcf0
movzx edx, al
cmp esi, edx
jne 0x100b6b46
lea ecx, [ebp - 4]
call fcn.100012e0
add eax, 0x78
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
sub ecx, 1
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
jmp 0x100b6b48
jmp 0x100b6ad6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xcc], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bb0e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 5]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 0x94]
call fcn.1002cba0
mov dword [ebp - 8], 0
jmp 0x100bb121
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 6]
cmp dword [ebp - 8], eax
jge 0x100bb16d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 5]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.100bb180
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x10], edx
jmp 0x100bb118
mov esp, ebp
pop ebp
ret 4
Function at 0x100c5150
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x100c518e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, dword [0x101df884]
push ecx
push 0x100c4c50
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x100c518e
xor al, al
jmp 0x100c51d7
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x100c51c5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov edx, dword [0x101df884]
push edx
push 0x100c4ef0
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x100c51c5
xor al, al
jmp 0x100c51d7
mov eax, dword [0x101df884]
push eax
mov ecx, 0x10262814
call fcn.1016fc50
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x100c8c30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
mov eax, 0x861110
call eax
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
jmp 0x100c8c6d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xcc
jge 0x100c8da3
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c3c0
mov ecx, dword [ebp - 0x14]
call edx
mov dword [ebp - 0x20], eax
mov eax, 0x83cbe0
mov ecx, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x28]
jne 0x100c8ca5
jmp 0x100c8da3
mov edx, dword [ebp - 0x20]
push edx
mov eax, 0x835720
mov ecx, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x30], eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c4b0
mov ecx, dword [ebp - 0x14]
call edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov edx, 0x7da660
mov ecx, dword [ebp - 0x30]
call edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100c8d9e
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
mov edx, dword [ebp + 8]
movsx eax, word [edx]
cmp ecx, eax
jne 0x100c8d9e
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 2]
cmp ecx, dword [eax + 2]
je 0x100c8d11
jmp 0x100c8c64
mov edx, dword [ebp - 8]
movsx eax, byte [edx + 0x17]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x17]
cmp eax, edx
je 0x100c8d28
jmp 0x100c8c64
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x18]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x18]
cmp ecx, eax
je 0x100c8d3f
jmp 0x100c8c64
cmp dword [ebp + 0xc], 0xffffffff
jle 0x100c8d6f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx*4 + 0x9c], 0xffffffff
jne 0x100c8d60
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c8d6d
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x16]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jmp 0x100c8d9e
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x16]
cmp ecx, 0xff
je 0x100c8d95
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x16]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x16]
cmp eax, edx
je 0x100c8d95
jmp 0x100c8c64
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c8c64
cmp dword [ebp + 0xc], 0xffffffff
jle 0x100c8df7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx*4 + 0x9c], 0xffffffff
je 0x100c8df7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + eax*4 + 0x4c], 0
jle 0x100c8df7
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4 + 0x9c]
cmp ecx, dword [ebp - 0x18]
jle 0x100c8de1
mov dword [ebp - 0x24], 0
jmp 0x100c8df2
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
cdq
idiv dword [esi + ecx*4 + 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
jmp 0x100c8dfa
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100c8e10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0
mov eax, 0x861110
call eax
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100c8e45
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xcc
jge 0x100c8ef2
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c3c0
mov ecx, dword [ebp - 8]
call edx
mov dword [ebp - 0x14], eax
mov eax, 0x83cbe0
mov ecx, dword [ebp - 8]
call eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jne 0x100c8e7a
jmp 0x100c8ef2
mov edx, dword [ebp - 0x14]
push edx
mov eax, 0x835720
mov ecx, dword [ebp - 8]
call eax
mov dword [ebp - 0x20], eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c4b0
mov ecx, dword [ebp - 8]
call edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov edx, 0x7da660
mov ecx, dword [ebp - 0x20]
call edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100c8eed
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
cmp ecx, dword [ebp + 8]
jne 0x100c8eed
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 2]
shr eax, 3
and eax, 0xf
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp + 0xc]
cmp ecx, 0xff
je 0x100c8ee4
movzx edx, byte [ebp + 0xc]
cmp edx, dword [ebp - 0x24]
jne 0x100c8eed
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c8e3c
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x100fa8c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 9
mov eax, 0x791050
call eax
add esp, 4
test eax, eax
je 0x100fa8f2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x100fa8f2
mov ecx, dword [ebp - 4]
call fcn.100fa2d0
mov esp, ebp
pop ebp
ret

Function at 0x10103f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101951e8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x48], 0
jmp 0x10103fcd
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x64
jge 0x101040b7
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x58], ecx
lea edx, [ebp - 0x58]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push str..DataCustomInterfaceRankUserRank:02.ozt
call fcn.10001fe0
lea eax, [ebp - 0x28]
push eax
call fcn.10001f20
add esp, 0xc
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
call fcn.10009b30
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10104020
mov dword [ebp - 0x4c], 1
jmp 0x10104027
mov dword [ebp - 0x4c], 0
mov cl, byte [ebp - 0x4c]
mov byte [ebp - 0x41], cl
lea ecx, [ebp - 0x28]
call fcn.1000a4d0
movzx edx, byte [ebp - 0x41]
test edx, edx
je 0x1010403f
jmp 0x10103fc4
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x5c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push str.CustomInterfaceRankUserRank:02.tga
call fcn.10001fe0
lea edx, [ebp - 0x40]
push edx
call fcn.10001f20
add esp, 0xc
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0
push 0
push 1
push 0x2901
push 0x2601
mov ecx, dword [ebp - 0x48]
add ecx, 0x1379a
push ecx
mov ecx, dword [ebp - 0x54]
call fcn.10009b30
push eax
mov edx, 0x772330
call edx
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000a4d0
jmp 0x10103fc4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006cdc0
mov esp, ebp
pop ebp
ret
Function at 0x10107c40
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
cmp dword [0xe609e8], 4
jne 0x10107eb8
movzx eax, byte [0x102733d7]
cmp eax, 1
jne 0x10107dc4
movzx ecx, byte [0x102733d2]
test ecx, ecx
jne 0x10107dc4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x24
imul edx, edx, 0x67
sub eax, dword [edx + 0x101e12b8]
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0x201
jne 0x10107c9a
jmp 0x10107eb8
cmp dword [ebp - 0x20], 0x1f4
jae 0x10107ca8
jmp 0x10107eb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x24
imul ecx, ecx, 0x67
mov dword [ecx + 0x101e12b8], eax
cmp dword [0x101dcd34], 0x280
je 0x10107cd1
mov dword [ebp - 8], 0x6d
jmp 0x10107cd8
mov dword [ebp - 8], 0
cvtsi2ss xmm0, dword [ebp - 8]
movss dword [ebp - 0x10], xmm0
movzx edx, byte [0x102735ec]
cmp edx, 1
je 0x10107cfa
movzx eax, byte [0x102735ec]
cmp eax, 0x61
jne 0x10107d5d
push 0x14
push 0x96
push 0x1c1
movss xmm0, dword [ebp - 0x10]
addss xmm0, dword [0x101c664c]
cvttss2si ecx, xmm0
push ecx
mov ecx, 0x101e1298
call fcn.1014cba0
movzx edx, al
test edx, edx
je 0x10107d5b
cmp dword [0x10261f28], 1
jne 0x10107d3b
mov dword [ebp - 0xc], 0
jmp 0x10107d42
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [0x10261f28], eax
mov ecx, dword [0x10261f28]
push ecx
mov ecx, 0x10261d20
call fcn.10106a40
jmp 0x10107dbf
push 0x14
push 0x96
push 0x1ad
movss xmm0, dword [ebp - 0x10]
addss xmm0, dword [0x101c664c]
cvttss2si edx, xmm0
push edx
mov ecx, 0x101e1298
call fcn.1014cba0
movzx eax, al
test eax, eax
je 0x10107dbf
cmp dword [0x10261f28], 1
jne 0x10107d9e
mov dword [ebp - 0x14], 0
jmp 0x10107da5
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x14]
mov dword [0x10261f28], ecx
mov edx, dword [0x10261f28]
push edx
mov ecx, 0x10261d20
call fcn.10106a40
jmp 0x10107eb8
movzx eax, byte [0x102733d2]
cmp eax, 1
jne 0x10107eb8
mov ecx, 0x10261d20
call fcn.10107b40
movzx ecx, al
cmp ecx, 1
jne 0x10107deb
jmp 0x10107eb8
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
je 0x10107eb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x24
imul ecx, ecx, 0x67
sub eax, dword [ecx + 0x101e12b8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x64
jae 0x10107e20
jmp 0x10107eb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x24
imul edx, edx, 0x67
mov dword [edx + 0x101e12b8], eax
cmp dword [0x879340c], 0x1d7
jl 0x10107eb8
cmp dword [0x8793410], 0x1f
jl 0x10107eb8
mov eax, dword [0x8793410]
sub eax, 0x1f
cdq
mov ecx, 0x25
idiv ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x10107eb8
mov edx, dword [0x10261f2c]
sub edx, 1
cmp dword [ebp - 4], edx
jg 0x10107eb8
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 0x1e0]
cmp ecx, dword [ebp - 4]
jne 0x10107eac
cmp dword [ebp - 0x18], 0x320
jae 0x10107eac
mov dword [0xe60b4c], 0
mov dword [0xe61730], 0
push 0
mov edx, 0x4d6a60
call edx
add esp, 4
jmp 0x10107eb8
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.10106c70
mov esp, ebp
pop ebp
ret 4
Function at 0x1010b490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx]
cmp eax, 0x1f4
jae 0x1010b4b0
jmp 0x1010b601
mov edx, dword [0xe61e18]
push edx
mov eax, 0x4e65a0
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x1010b5f6
mov edx, dword [ebp - 0x10]
add edx, 4
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1000ac20
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.1000ac40
jmp 0x1010b4f7
lea ecx, [ebp - 0xc]
call fcn.1000ae90
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc]
call fcn.1000af00
movzx eax, al
test eax, eax
je 0x1010b5f6
lea ecx, [ebp - 0xc]
call fcn.1000ae50
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
mov eax, 0x57d9a0
call eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, 0x402bc0
call edx
mov edx, 0x96a4c0
mov ecx, eax
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1010b54b
jmp 0x1010b4ef
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
je 0x1010b558
jmp 0x1010b4ef
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x78]
test eax, eax
je 0x1010b565
jmp 0x1010b4ef
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 8]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xac], edx
jne 0x1010b589
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 9]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], edx
je 0x1010b5f1
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x54ea80
call edx
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 8]
mov byte [eax + 0x2d], dl
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 9]
mov byte [eax + 0x2e], dl
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xac], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 9]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x78], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x276], 0
mov edx, dword [ebp - 4]
mov byte [edx + 0x274], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 1
jmp 0x1010b4ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10119e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
call fcn.1011ace0
cmp eax, 0x46
jle 0x10119e72
mov ecx, dword [ebp - 4]
call fcn.10119ca0
movzx eax, al
test eax, eax
jne 0x10119e85
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
xor al, al
jmp 0x10119fcc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x1c]
cmp eax, 0x190
jae 0x10119e9f
xor al, al
jmp 0x10119fcc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x10119eb8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x10119fca
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2d]
test edx, edx
jne 0x10119ed2
jmp 0x10119eaf
cmp dword [ebp - 8], 7
jne 0x10119f64
push 0x20
push 0x41
mov eax, dword [ebp - 4]
cvttss2si ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x23
cvtsi2ss xmm0, edx
mov eax, dword [ebp - 4]
addss xmm0, dword [eax + 0xc]
cvttss2si ecx, xmm0
push ecx
mov ecx, 0x101e1298
call fcn.1014cba0
movzx edx, al
test edx, edx
je 0x10119f62
push 0x8a
mov ecx, 0x10208c44
call fcn.1011c700
movzx eax, al
test eax, eax
je 0x10119f2e
xor al, al
jmp 0x10119fcc
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test eax, eax
je 0x10119f62
push 0x8e
mov ecx, 0x10208c44
call fcn.1011c830
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov al, 1
jmp 0x10119fcc
jmp 0x10119fbc
push 0x20
push 0x23
mov ecx, dword [ebp - 4]
cvttss2si edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x23
cvtsi2ss xmm0, eax
mov ecx, dword [ebp - 4]
addss xmm0, dword [ecx + 0xc]
cvttss2si edx, xmm0
push edx
mov ecx, 0x101e1298
call fcn.1014cba0
movzx eax, al
test eax, eax
je 0x10119fbc
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test eax, eax
je 0x10119fbc
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov ecx, dword [ebp - 4]
call fcn.10119c20
mov al, 1
jmp 0x10119fcc
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10119eaf
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10119fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
jne 0x10119fe4
jmp 0x1011a04c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
cmp eax, 0x3c
jbe 0x1011a04c
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2c]
test ecx, ecx
jne 0x1011a021
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0xb
jne 0x1011a01f
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 1
jmp 0x1011a040
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], edx
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 1
jne 0x1011a040
mov edx, dword [ebp - 4]
mov byte [edx + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov esp, ebp
pop ebp
ret

Function at 0x10142850
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx + 0xf4]
cmp eax, 0x3e8
jbe 0x101428be
mov edx, dword [ebp - 4]
cmp dword [edx + 0xec], 0
jle 0x1014288e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xec]
sub ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0xec], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf0], 0
jle 0x101428af
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xf0]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xf0], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf4], eax
mov esp, ebp
pop ebp
ret