joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cd980
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x10a8891c]
mov edx, dword [ecx + 0x30]
add edx, 0x12c
cmp eax, edx
jb 0x100cd9e0
call esi
mov ecx, dword [0x10a8891c]
mov dword [ecx + 0x30], eax
mov eax, dword [0x10a8891c]
cmp byte [eax + 0x29], 0
jne 0x100cd9dc
lea edx, [ebp - 8]
mov ecx, 8
push edx
mov dword [ebp - 8], 0x9cd308c1
mov dword [ebp - 4], 1
call fcn.10100800
mov eax, dword [0x10a8891c]
add esp, 4
xor byte [eax + 0x29], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ce8b0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
call fcn.100ce030
call fcn.100cd9f0
call fcn.100cc8b0
cmp dword [0x10234acc], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x100ce8fe
push 0x73
call ebx
mov ecx, 0x4000
test cx, ax
je 0x100ce8fe
call esi
sub eax, dword [0x118c80cc]
cmp eax, 0x1f4
jb 0x100ce8fe
call fcn.100ca980
call fcn.100c90c0
call fcn.100c7e60
call fcn.100cadc0
call fcn.100cacc0
call fcn.100cb7d0
cmp byte [0x118c7f81], 0
je 0x100ce940
cmp dword [0x10150f28], 0xffffffff
je 0x100ce939
cmp byte [0x10a76d4f], 0
jne 0x100ce939
call fcn.10066e60
jmp 0x100ce951
call fcn.100666d0
jmp 0x100ce951
mov byte [0x10a76d4f], 0
mov dword [0x10a76e58], 0
call fcn.10065450
cmp dword [0x10234ab0], 0
jne 0x100ce99c
push 0x77
call ebx
mov edx, 0x4000
test dx, ax
je 0x100ce99c
call esi
mov ecx, dword [edi + 0x14d10]
add ecx, 0x190
cmp ecx, eax
ja 0x100ce99c
call fcn.100aaa90
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
add esp, 0xc
call esi
mov dword [edi + 0x14d10], eax
cmp dword [0x10234adc], 0
jne 0x100ce9ea
push 0x72
call ebx
mov ecx, 0x4000
test cx, ax
je 0x100ce9ea
call esi
mov edx, dword [edi + 0x14d10]
add edx, 0x190
cmp edx, eax
ja 0x100ce9ea
push 0
push 0
push 0x19
mov eax, 0x6d6c20
mov byte [0x118c846d], 1
call eax
add esp, 0xc
call esi
mov dword [edi + 0x14d10], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x23
mov ecx, 0x791070
call ecx
add esp, 4
test eax, eax
je 0x100cea23
call esi
sub eax, dword [0x118c908c]
cmp eax, 0x3e8
jb 0x100cea83
call esi
xor edx, edx
cmp dword [0x10a73738], edx
mov dword [0x118c908c], eax
sete dl
mov dword [0x10a73738], edx
jmp 0x100cea83
push 0x2d
mov ecx, 0x791070
call ecx
add esp, 4
test eax, eax
je 0x100cea5c
call esi
sub eax, dword [0x118c908c]
cmp eax, 0x3e8
jb 0x100cea83
call esi
xor edx, edx
cmp dword [0x10a7373c], edx
mov dword [0x118c908c], eax
sete dl
mov dword [0x10a7373c], edx
jmp 0x100cea83
push 0x75
mov ecx, 0x791070
call ecx
add esp, 4
test eax, eax
je 0x100cea93
call esi
mov edx, dword [edi + 0x14d10]
add edx, 0x190
cmp edx, eax
ja 0x100cea93
call fcn.100bd120
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d3050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x1190acb4]
sub eax, dword [ecx + 0x30]
cmp eax, 0x12c
jbe 0x100d3098
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ecx, 8
push eax
mov dword [ebp - 0xc], 0xb2d308c1
mov dword [ebp - 8], edx
call fcn.10100800
add esp, 4
call esi
mov ecx, dword [0x1190acb4]
mov dword [ecx + 0x30], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100d76a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
jmp dword [eax*4 + 0x100d7890]

Function at 0x100d7f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 7
mov ebx, 0x608cac
call fcn.1010cff0
mov ebx, 0x60954d
call fcn.1010cff0
mov ebx, 0x60f04c
call fcn.1010cff0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100d7da0
push 5
sub eax, 0x608cb1
mov bl, 0xe9
xor edi, edi
push 0x608cac
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100d7fd4
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x608cac
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x608cac
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100d7fda
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100d7e30
push 5
sub ecx, 0x609552
push 0x60954d
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100d8029
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x60954d
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x60954d
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100d802f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x100d7ec0
push 5
sub edx, 0x60f051
push 0x60f04c
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100d807e
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x60f04c
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x60f04c
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100d8084
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d8230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x1022ecfc]
jns 0x100d823d
jmp fcn.100d82e0
mov eax, dword [0x1022ecf8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x1022ecf8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x100db080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x100dacf0
push 0x63e71b
mov bl, 0xe8
call fcn.10110d60
push 0x100dacf0
push 0x63eeb6
call fcn.10110d60
push 0x100dacf0
push 0x6410ee
call fcn.10110d60
push 0x100db070
push 0x47e15a
call fcn.10110d60
push 0x100dac40
push 0x62f8a1
call fcn.10110d60
push 0x101103a0
push 0x520ecf
call fcn.10110d60
push 0x101103a0
push 0x520f1f
call fcn.10110d60
push 0x101103a0
push 0x63e743
call fcn.10110d60
add esp, 0x40
push 0x101103a0
push 0x640eb2
call fcn.10110d60
push 0x101103a0
push 0x7d2dd9
call fcn.10110d60
push 0x101103a0
push 0x7e6c0f
call fcn.10110d60
push 0x101103a0
push 0x84aef7
call fcn.10110d60
push 0x100d9a30
push 0x5d2c13
mov bl, 0xe9
call fcn.10110d60
mov esi, 0x83
mov ebx, 0x47fc85
call fcn.1010cff0
push 0x100d9db0
push ebx
mov bl, 0xe9
call fcn.10110d60
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x30
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf8], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebfe], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee42], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee48], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eeeb], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf7], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea ecx, [ebp - 4]
mov byte [0x62ee41], bl
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee4], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee4
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dc030
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
push str.DataCustomVIPCharRank.txt
lea ebx, [esi + 0xc]
push 0x100
push ebx
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push connect
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100dc08c
push ebx
push str.__s__Could_not_open_file
add esi, 0x218
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x100dc0b0
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
push eax
call fcn.1012baac
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x100dc0e9
push ebx
push str.__s__Could_not_alloc_file_buffer
add esi, 0x218
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100dc10e
push ebx
push str.__s__Could_not_read_file
jmp 0x100dc0c9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [esi + 0x214], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e33f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x100e27c0
push 0x900de9
mov bl, 0xe8
call fcn.10110d60
push 0x100e20a0
push 0x8c5bb5
call fcn.10110d60
add esp, 0x10
mov esi, 0xa
mov ebx, 0x56fc5e
call fcn.1010cff0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100e26a0
push 5
sub eax, 0x56fc63
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100e3477
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100e347d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x56fd1a
call fcn.1010cff0
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100e2740
push 5
sub ecx, 0x56fd1f
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100e34d3
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100e34d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e4540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 0x14]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x100e4665
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x14]
mov ecx, 0x8000
fld st(0)
fdiv dword [ebp + 0x1c]
push ecx
test cx, ax
je 0x100e45ec
fldz
mov edx, 0x637c60
fst dword [esp]
push 1
fxch st(1)
fst dword [ebp + 0x14]
push 1
fld dword [ebp + 0x14]
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fadd st(0), st(0)
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call edx
jmp 0x100e4643
fstp dword [ebp + 0x14]
mov eax, 0x637c60
fldz
fst dword [esp]
fld dword [ebp + 0x14]
push 1
push 1
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call eax
add esp, 0x30
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test al, al
je 0x100e46c4
push 0x10233b3c
call dword [ebp + 0x20]
add esp, 4
pop ebp
ret 0x1c
fldz
push ecx
fst dword [esp]
mov edx, 0x637c60
fld dword [ebp + 0x14]
push 1
fld st(0)
push 1
fdiv dword [ebp + 0x1c]
sub esp, 0x20
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(2)
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call edx
add esp, 0x30
pop ebp
ret 0x1c
Function at 0x100e5860
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 0x14]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x100e5985
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x14]
mov ecx, 0x8000
fld st(0)
fdiv dword [ebp + 0x1c]
push ecx
test cx, ax
je 0x100e590c
fldz
mov edx, 0x637c60
fst dword [esp]
push 1
fxch st(1)
fst dword [ebp + 0x14]
push 1
fld dword [ebp + 0x14]
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fadd st(0), st(0)
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call edx
jmp 0x100e5963
fstp dword [ebp + 0x14]
mov eax, 0x637c60
fldz
fst dword [esp]
fld dword [ebp + 0x14]
push 1
push 1
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call eax
add esp, 0x30
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test al, al
je 0x100e59e4
push 0x10233b6c
call dword [ebp + 0x20]
add esp, 4
pop ebp
ret 0x1c
fldz
push ecx
fst dword [esp]
mov edx, 0x637c60
fld dword [ebp + 0x14]
push 1
fld st(0)
push 1
fdiv dword [ebp + 0x1c]
sub esp, 0x20
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(2)
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0xc942
call edx
add esp, 0x30
pop ebp
ret 0x1c
Function at 0x100e6490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [0x1190fe9a], bl
je 0x100e656c
cmp dword [ebp + 8], 0x202
jne 0x100e656c
push esi
lea eax, [ebx + 0x2e]
mov ecx, 0x1190fde8
call fcn.100e69e0
test al, al
je 0x100e652a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1191079c]
mov byte [0x119107a0], bl
cmp eax, 0x1f4
jb 0x100e656b
call esi
cmp dword [0x1190fe9c], 1
mov dword [0x1191079c], eax
jne 0x100e655f
mov eax, dword [0x1190fea8]
mov ecx, dword [0x1190fea4]
push eax
push ecx
call dword [0x1190fea0]
add esp, 8
mov dword [0x1190fea0], ebx
mov dword [0x1190fea4], ebx
mov dword [0x1190fea8], ebx
mov byte [0x1190fe9a], bl
pop esi
mov dword [0xe8cb3c], ebx
pop ebx
pop ebp
ret 4
mov eax, 0x2f
mov ecx, 0x1190fde8
call fcn.100e69e0
test al, al
je 0x100e656b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x119107cc]
mov byte [0x119107d0], bl
cmp eax, 0x1f4
jb 0x100e656b
call esi
mov dword [0x119107cc], eax
mov byte [0x1190fe9a], bl
mov dword [0xe8cb3c], ebx
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100e8f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov dword [esp + 0x18], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100e919d
mov dword [esp + 0x1c], 0xbf
mov dword [esp + 0x20], 0xc0
mov dword [esp + 0x24], 0xc1
mov dword [esp + 0x28], 0xc2
mov dword [esp + 0x2c], 0xc3
mov dword [esp + 0x30], 0xc4
xor edi, edi
nop
movzx eax, word [esp + edi*4 + 0x1c]
mov ecx, 0x879340c
fild dword [ecx]
movsx ecx, ax
imul ecx, ecx, 0x54
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ecx + 0x118c4f84]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e908d
fld dword [ecx + 0x118c4f8c]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e908f
fild dword [0x8793410]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ecx + 0x118c4f88]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e908d
fld dword [ecx + 0x118c4f90]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e908f
mov esi, dword [esp + edi*4 + 0x1c]
imul esi, esi, 0x54
cmp byte [esi + 0x118c4f99], 0
je 0x100e908f
mov eax, dword [esp + 0x18]
sub eax, dword [esi + 0x118c4f94]
cmp dword [ebp + 8], 0x201
je 0x100e9134
mov byte [esi + 0x118c4f98], 0
cmp eax, 0x1f4
jb 0x100e919d
call ebx
mov dword [esi + 0x118c4f94], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.10100800
add esp, 4
jmp 0x100e908f
fstp st(0)
inc edi
cmp edi, 6
jl 0x100e8fc0
fild dword [0x879340c]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [0x118ca03c]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e919b
fld dword [0x118ca044]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e919d
fild dword [0x8793410]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [0x118ca040]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e919b
fld dword [0x118ca048]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e919d
cmp byte [0x118ca051], 0
je 0x100e919d
cmp dword [ebp + 8], 0x201
jne 0x100e9158
mov byte [0x118ca050], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + edi*4 + 0x1c]
imul ecx, ecx, 0x54
mov byte [ecx + 0x118c4f98], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x18]
sub eax, dword [0x118ca04c]
mov byte [0x118ca050], 0
cmp eax, 0x1f4
jb 0x100e919d
call ebx
lea edx, [esp + 0x10]
push edx
mov ecx, 8
mov dword [0x118ca04c], eax
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 7
call fcn.10100800
add esp, 4
jmp 0x100e919d
fstp st(0)
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
Function at 0x100e91c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov dword [esp + 0x18], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100e940d
mov dword [esp + 0x1c], 0xbf
mov dword [esp + 0x20], 0xc0
mov dword [esp + 0x24], 0xc1
mov dword [esp + 0x28], 0xc2
mov dword [esp + 0x2c], 0xc3
mov dword [esp + 0x30], 0xc4
xor edi, edi
nop
movzx eax, word [esp + edi*4 + 0x1c]
mov ecx, 0x879340c
fild dword [ecx]
movsx ecx, ax
imul ecx, ecx, 0x54
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ecx + 0x118c4f84]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e92fd
fld dword [ecx + 0x118c4f8c]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e92ff
fild dword [0x8793410]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ecx + 0x118c4f88]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e92fd
fld dword [ecx + 0x118c4f90]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e92ff
mov esi, dword [esp + edi*4 + 0x1c]
imul esi, esi, 0x54
cmp byte [esi + 0x118c4f99], 0
je 0x100e92ff
mov eax, dword [esp + 0x18]
sub eax, dword [esi + 0x118c4f94]
cmp dword [ebp + 8], 0x201
je 0x100e93a4
mov byte [esi + 0x118c4f98], 0
cmp eax, 0x1f4
jb 0x100e940d
call ebx
mov dword [esi + 0x118c4f94], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.10100800
add esp, 4
jmp 0x100e92ff
fstp st(0)
inc edi
cmp edi, 6
jl 0x100e9230
fild dword [0x879340c]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [0x118c9028]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e940b
fld dword [0x118c9030]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e940d
fild dword [0x8793410]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [0x118c902c]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100e940b
fld dword [0x118c9034]
fcompp
fnstsw ax
test ah, 5
jnp 0x100e940d
cmp byte [0x118c903d], 0
je 0x100e940d
cmp dword [ebp + 8], 0x201
jne 0x100e93c8
mov byte [0x118c903c], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + edi*4 + 0x1c]
imul ecx, ecx, 0x54
mov byte [ecx + 0x118c4f98], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x18]
sub eax, dword [0x118c9038]
mov byte [0x118c903c], 0
cmp eax, 0x1f4
jb 0x100e940d
call ebx
lea edx, [esp + 0x10]
push edx
mov ecx, 8
mov dword [0x118c9038], eax
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 6
call fcn.10100800
add esp, 4
jmp 0x100e940d
fstp st(0)
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4