joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100308c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10087609
call fcn.100839c0
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.page9.0
mov dword [ebp - 4], 0x2b
mov edi, dword [sym.imp.mfc100.dll_Ordinal_915]
lea ecx, [esi + 0x165c]
call edi
lea ecx, [esi + 0x15e4]
mov byte [ebp - 4], 0x2a
call edi
lea ecx, [esi + 0x156c]
mov byte [ebp - 4], 0x29
call edi
lea ecx, [esi + 0x14f4]
mov byte [ebp - 4], 0x28
call edi
lea ecx, [esi + 0x1464]
mov byte [ebp - 4], 0x27
call fcn.100012f7
lea ecx, [esi + 0x13ec]
mov byte [ebp - 4], 0x26
call edi
lea ecx, [esi + 0x1374]
mov byte [ebp - 4], 0x25
call edi
lea ecx, [esi + 0x12e8]
mov byte [ebp - 4], 0x24
call fcn.100012f7
lea ecx, [esi + 0x1270]
mov byte [ebp - 4], 0x23
call edi
lea ecx, [esi + 0x11f4]
mov byte [ebp - 4], 0x22
call edi
lea ecx, [esi + 0x1180]
mov byte [ebp - 4], 0x21
call edi
mov byte [ebp - 4], 0x20
lea ecx, [esi + 0x10c4]
call fcn.10001ae5
lea ecx, [esi + 0x104c]
mov byte [ebp - 4], 0x1f
call edi
lea ecx, [esi + 0xfd0]
mov byte [ebp - 4], 0x1e
call edi
lea ecx, [esi + 0xf4c]
mov byte [ebp - 4], 0x1d
call fcn.10004f8a
lea ecx, [esi + 0xe88]
mov byte [ebp - 4], 0x1c
call fcn.1000550b
lea ecx, [esi + 0xdfc]
mov byte [ebp - 4], 0x1b
call fcn.100012f7
lea ecx, [esi + 0xd70]
mov byte [ebp - 4], 0x1a
call fcn.100012f7
lea ecx, [esi + 0xce4]
mov byte [ebp - 4], 0x19
call fcn.100012f7
lea ecx, [esi + 0xc58]
mov byte [ebp - 4], 0x18
call fcn.100012f7
lea ecx, [esi + 0xbcc]
mov byte [ebp - 4], 0x17
call fcn.100012f7
lea ecx, [esi + 0xb40]
mov byte [ebp - 4], 0x16
call fcn.100012f7
lea ecx, [esi + 0xacc]
mov byte [ebp - 4], 0x15
call edi
lea ecx, [esi + 0xa1c]
mov byte [ebp - 4], 0x14
call fcn.10001ae5
lea ecx, [esi + 0x9a8]
mov byte [ebp - 4], 0x13
call edi
lea ecx, [esi + 0x934]
mov byte [ebp - 4], 0x12
call edi
lea ecx, [esi + 0x8c0]
mov byte [ebp - 4], 0x11
call edi
lea ecx, [esi + 0x84c]
mov byte [ebp - 4], 0x10
call edi
lea ecx, [esi + 0x7d8]
mov byte [ebp - 4], 0xf
call edi
lea ecx, [esi + 0x764]
mov byte [ebp - 4], 0xe
call edi
lea ecx, [esi + 0x6f0]
mov byte [ebp - 4], 0xd
call edi
lea ecx, [esi + 0x67c]
mov byte [ebp - 4], 0xc
call edi
lea ecx, [esi + 0x608]
mov byte [ebp - 4], 0xb
call edi
lea ecx, [esi + 0x594]
mov byte [ebp - 4], 0xa
call edi
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 9
call edi
lea ecx, [esi + 0x4ac]
mov byte [ebp - 4], 8
call edi
lea ecx, [esi + 0x438]
mov byte [ebp - 4], 7
call edi
lea ecx, [esi + 0x3c4]
mov byte [ebp - 4], 6
call edi
mov byte [ebp - 4], 5
lea ecx, [esi + 0x350]
call edi
lea ecx, [esi + 0x2dc]
mov byte [ebp - 4], 4
call edi
lea ecx, [esi + 0x268]
mov byte [ebp - 4], 3
call edi
lea ecx, [esi + 0x1f4]
mov byte [ebp - 4], 2
call edi
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 1
call edi
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 0
call fcn.100012f7
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_946]
call fcn.10083a98
ret
Function at 0x100360da
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x1003613b
and dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x10036132
push 0x32
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 8]
jne 0x10036132
lea eax, [ebp - 0x38]
push 0x10098564
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1003614e
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x100360f5
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008344f
leave
ret
mov eax, esi
jmp 0x10036141

Function at 0x10036206
Capabilities:
Delete file
Download url
Encode data using xor
Receive data

Disassembly:
call fcn.10409acc
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, dword [sym.imp.MSVCR100.dll_strlen]
test eax, eax
jne 0x10036310
mov esi, 0x103d71cc
call fcn.1000102f
lea eax, [ebp - 0x1e4]
push 0x1008c724
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x1fc], eax
cmp eax, edi
je 0x10036310
push eax
jmp 0x100362d9
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCR100.dll_fputs]
lea eax, [ebp - 0x11c]
push eax
call ebx
lea edi, [eax - 1]
lea eax, [ebp - 0x11c]
push eax
mov esi, eax
call fcn.100064da
lea eax, [ebp - 0x11c]
push eax
xor esi, esi
call ebx
add esp, 0x14
test eax, eax
je 0x100362c2
xor byte [ebp + esi - 0x11c], 1
lea eax, [ebp - 0x11c]
push eax
inc esi
call ebx
pop ecx
cmp esi, eax
jb 0x100362ab
lea eax, [ebp - 0x11c]
push eax
mov esi, 0x103d71cc
call fcn.10001109
push dword [ebp - 0x1fc]
lea eax, [ebp - 0x11c]
push 0xc8
push eax
call dword [sym.imp.MSVCR100.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x10036268
push dword [ebp - 0x1fc]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
lea eax, [ebp - 0x1e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 8
pop ecx
mov esi, str.ivwt_._gkro__52ccab_offno_buzw
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 0x100982ac
movsw word es:[edi], word [esi]
pushfd
push ebx
push 0xd28dd285
xor byte [esp], 0x36
neg dword [esp]
mov ebx, 0xd4912f30
push dword [esp + ebx*2 + 0x56dda1a8]
popfd
mov dword [esp + 8], 0x1d408380
mov ebx, dword [esp + ebx + 0x2b6ed0d4]
call fcn.103fc75a
Function at 0x10036a5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008867a
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 4]
mov edi, dword [eax + 8]
mov esi, 0x101
mov dword [esp + 0x30], edi
cmp ebx, esi
jne 0x10036adc
cmp edi, 0x7a
jne 0x10036abb
mov ecx, dword [0x1012fca4]
test ecx, ecx
je 0x10036c56
call fcn.10074697
jmp 0x10036c14
cmp edi, 0x7b
jne 0x10036adc
cmp dword [0x103d20c0], 0
jbe 0x10036c14
mov ecx, 0x103d20a0
call fcn.1007b838
jmp 0x10036c14
cmp edi, 0x24
je 0x10036aea
cmp edi, 0x2e
jne 0x10036bc9
cmp ebx, esi
jne 0x10036bc9
mov eax, dword [0x1012fca4]
test eax, eax
je 0x10036b0c
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [0x1012fca4]
jmp 0x10036b24
mov eax, dword [0x1012fca8]
test eax, eax
je 0x10036b3a
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [0x1012fca8]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
call dword [sym.imp.mfc100.dll_Ordinal_12962]
jmp 0x10036bc9
cmp dword [0x307809c], 0
je 0x10036bc9
call fcn.100831f3
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_322]
and dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4345]
push 0x2a4
mov edi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1294]
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x50], 1
test eax, eax
je 0x10036b8c
push eax
call fcn.100028c8
jmp 0x10036b8e
xor eax, eax
mov byte [esp + 0x50], 0
mov edx, dword [eax]
push edi
push 0x1b57
mov ecx, eax
mov dword [0x1012fca8], eax
call dword [edx + 0x168]
mov ecx, dword [0x1012fca8]
push 5
call dword [sym.imp.mfc100.dll_Ordinal_12962]
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_13518]
mov edi, dword [esp + 0x30]
cmp edi, 0x5a
jne 0x10036bff
cmp dword [0x1012fca4], 0
je 0x10036c56
cmp ebx, esi
jne 0x10036c14
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x10036c14
push 0
push 0
push 0x22b8
push dword [0x103c8b50]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10036c14
cmp edi, 0x70
jb 0x10036c14
cmp edi, 0x78
ja 0x10036c14
cmp ebx, esi
jne 0x10036c14
mov eax, edi
call fcn.1008131a
cmp dword [0x1012fca4], 0
je 0x10036c56
cmp ebx, esi
jne 0x10036c56
cmp edi, 0x10
je 0x10036c56
cmp edi, 0x11
je 0x10036c56
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jns 0x10036c41
mov ecx, str.Ctrl
jmp 0x10036c4f
push 0x10
call esi
test ax, ax
jns 0x10036c56
mov ecx, str.Shift
push edi
call fcn.100275db
pop ecx
call fcn.100364ae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x10114154]
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003a5c2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103d4d50], 1
push ebx
push esi
push edi
jne 0x1003a5e2
cmp dword [0x1035ff94], 1
jne 0x1003a5e2
mov edx, dword [ebp + 8]
call fcn.1003a870
call fcn.1003a0b9
xor edi, edi
cmp dword [ebp + 8], edi
jl 0x1003a60c
pushal
mov ecx, dword ds:[0xf39a68]
mov ecx, dword ds:[ecx + 0x39c]
push 0
push dword [ebp + 8]
mov eax, 0x950460
call eax
popal
jmp 0x1003a66b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1012fcfc]
cmp eax, 0x2bc
jae 0x1003a629
cmp dword [0x103c3d18], edi
je 0x1003a66b
call esi
cmp dword [0x103c3d18], 1
mov dword [0x1012fcfc], eax
jne 0x1003a650
cmp dword [0x101127e0], edi
ja 0x1003a66b
mov eax, dword [0x307809c]
mov dword [eax + 0x1d44], 0xff
pushal
mov ecx, dword ds:[0x307809c]
mov eax, 0x712080
call eax
popal
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101127e0], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003a870
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x307809c]
mov eax, dword [eax + 0x1d20]
mov ecx, 0xe26ae0
call fcn.10006651
test eax, eax
je 0x1003a95f
push ebx
mov ebx, dword [eax + 0x14]
mov eax, dword [0x305b214]
mov eax, dword [eax + edx*4 + 0x53c]
test eax, eax
jne 0x1003a8aa
cmp edx, 0xffffffff
jne 0x1003a95e
push edi
cmp edx, 0xffffffff
je 0x1003a8c0
lea edi, [eax + 0x64]
call fcn.10037bce
test eax, eax
jns 0x1003a95d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103c24a4]
cmp eax, 0xbb8
jb 0x1003a8e4
push ebx
call fcn.10039f26
pop ecx
call esi
mov dword [0x103c24a4], eax
cmp byte [ebx + 0x102ffcf0], 0
jbe 0x1003a916
cmp dword [0x103d5758], 0
jne 0x1003a916
call esi
sub eax, dword [0x103d8a1c]
cmp eax, 0x3e8
jb 0x1003a916
push 2
mov edi, ebx
call fcn.10040304
pop ecx
call esi
mov dword [0x103d8a1c], eax
call esi
mov ecx, dword [0x1035ff00]
sub eax, dword [ecx*4 + 0x1031fcf0]
cmp eax, 0x1388
ja 0x1003a93c
call esi
sub eax, dword [ebx*4 + 0x1031fcf0]
cmp eax, 0x3e8
jae 0x1003a95c
call esi
sub eax, dword [0x103d8a20]
cmp eax, 0x3e8
jb 0x1003a95c
push 1
mov edi, ebx
call fcn.10040304
pop ecx
call esi
mov dword [0x103d8a20], eax
pop esi
pop edi
pop ebx
ret
Function at 0x1003bd07
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
sub eax, dword [0x103d8a28]
cmp eax, 0x7d0
jbe 0x1003bdab
call esi
mov dword [0x103d8a28], eax
mov eax, dword [0xf39a68]
mov eax, dword [eax + 0x4cc]
movzx eax, word [eax + 0x37c]
mov esi, dword [sym.imp.MSVCR100.dll_memmove]
mov dword [ebp - 0x30], eax
push 7
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x60030
mov byte [ebp - 0x24], 1
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 2
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x22]
push eax
call esi
push 2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x2c]
add esp, 0x18
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x2a
push dword [ebp - 0x38]
push dword [ebp - 0x34]
mov ecx, 0xf34f30
mov ecx, dword [ecx]
mov eax, 0x6bdcb0
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008344f
leave
ret

Function at 0x1003be63
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
sub eax, dword [0x1035fda0]
cmp eax, 0x2710
jbe 0x1003bf27
call esi
mov dword [0x1035fda0], eax
mov eax, dword [0x307809c]
mov ecx, dword [eax + 0x1f6c]
mov esi, dword [sym.imp.MSVCR100.dll_memmove]
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 0x1f70]
mov dword [ebp - 0x28], ecx
mov eax, dword [eax + 0x1f74]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp + 8], 1
push 6
pop ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40048
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
sete al
add al, 0x63
mov byte [ebp - 0x1c], al
push 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
push 4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
push 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 0x24]
add esp, 0x24
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x22
push dword [ebp - 0x38]
push dword [ebp - 0x34]
mov ecx, 0xf34f30
mov ecx, dword [ecx]
mov eax, 0x6bdcb0
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008344f
leave
ret
Function at 0x1003eebf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1035ffb8], 1
jne 0x1003f011
and dword [ebp - 4], 0
cmp dword [0x103d7138], 0
jle 0x1003f011
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_strcmp]
mov eax, dword [0x103d7130]
mov esi, dword [ebp - 4]
push dword [eax + esi*4]
call fcn.1000648e
pop ecx
test eax, eax
jne 0x1003effc
mov eax, dword [0x103d7130]
push 0x10098bd0
push dword [eax + esi*4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1003ef31
call ebx
sub eax, dword [0x1035fda8]
cmp eax, 0x927c0
jb 0x1003effc
mov eax, dword [0x103d7130]
push 0x10098bdc
push dword [eax + esi*4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1003ef59
call ebx
sub eax, dword [0x1035fdac]
cmp eax, 0x927c0
jb 0x1003effc
mov eax, dword [0x103d7130]
push 0x10098be8
push dword [eax + esi*4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1003ef7d
call ebx
sub eax, dword [0x1035fdb0]
cmp eax, 0x927c0
jb 0x1003effc
mov eax, dword [0x103d7130]
push 0x10098bf4
push dword [eax + esi*4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1003efa1
call ebx
sub eax, dword [0x1035fdb4]
cmp eax, 0x1b7740
jb 0x1003effc
mov eax, dword [0x103d7130]
push 0x10098bfc
push dword [eax + esi*4]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1003efc5
call ebx
sub eax, dword [0x1035fdb8]
cmp eax, 0x124f80
jb 0x1003effc
mov eax, dword [0x103d7130]
push 0
push dword [eax + esi*4]
call fcn.100061e0
pop ecx
pop ecx
cmp al, 1
jne 0x1003effc
mov eax, dword [0x103d7130]
push dword [eax + esi*4]
mov esi, 0x10112128
push 0x10098c04
push esi
call dword [sym.imp.MSVCR100.dll_sprintf]
push esi
call fcn.100060db
add esp, 0x10
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x103d7138]
jl 0x1003eef0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003faba
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x103ccc5c], 1
push esi
jne 0x1003fb3e
cmp dword [0x359aa1c], 0x780
jg 0x1003fb3e
push edi
push 0x19
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x103ccc64
call dword [sym.imp.mfc100.dll_Ordinal_6969]
mov eax, dword [0xf359f4]
xor edi, edi
lea esi, [eax + 0x53c]
mov eax, dword [esi]
cmp eax, ebx
je 0x1003fb1c
lea ecx, [ebp - 0x20]
push ecx
add eax, 0x64
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x1003fb27
inc edi
add esi, 4
cmp edi, 0x10
jl 0x1003fb02
jmp 0x1003fb31
xor ecx, ecx
push edi
inc ecx
call fcn.1003adfb
pop ecx
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100061e0
pop ecx
pop ecx
pop edi
cmp dword [0x103c54e8], 1
jne 0x1003fbef
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1035fd28]
cmp eax, 0xbb8
jb 0x1003fbef
call esi
sub eax, dword [0x1035fd58]
cmp eax, 0x7d0
jb 0x1003fbef
mov eax, dword [0x103c3ebc]
cmp eax, 1
jne 0x1003fbb8
cmp dword [0x101127c4], 2
je 0x1003fb8e
cmp dword [0x1035fef4], ebx
jne 0x1003fbef
mov eax, dword [0x307809c]
cmp dword [eax + 0x298c], ebx
jne 0x1003fbef
mov eax, dword [0x103c562c]
sub eax, ebx
je 0x1003fbe2
dec eax
je 0x1003fbcc
dec eax
je 0x1003fbc4
dec eax
je 0x1003fbbc
dec eax
jne 0x1003fbef
push ebx
push 0xf468e
jmp 0x1003fbe8
cmp eax, ebx
jmp 0x1003fb8c
push ebx
push 0xf468d
jmp 0x1003fbe8
push ebx
push 0x92c0f
jmp 0x1003fbe8
push ebx
push 0x92c0e
call fcn.1003c172
pop ecx
pop ecx
call esi
mov dword [0x1035fd28], eax
jmp 0x1003fbef
push ebx
push 0x92c0d
call fcn.1003c172
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1008344f
leave
ret
Function at 0x1003fd1a
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x103c9390], ebx
jne 0x1003fd4e
mov eax, dword [0x1035fea0]
cmp eax, dword [0x103c939c]
jl 0x1003fd4e
push 0x10098d30
call fcn.100060db
and dword [0x10112bcc], 0
pop ecx
jmp 0x1003fe6b
cmp dword [0x103c9394], ebx
jne 0x1003fd75
mov eax, dword [0x103c93a0]
cdq
cmp dword [0x1035fd24], edx
jl 0x1003fd75
jg 0x1003fd6e
cmp dword [0x1035fd20], eax
jb 0x1003fd75
push 0x10098d54
jmp 0x1003fd3c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, 0x10098d78
cmp dword [0x103c938c], ebx
jne 0x1003fdfa
cmp dword [0x1035ff0c], 0x64
jl 0x1003fdb4
cmp dword [0x1035ff94], 0
jne 0x1003fdb4
cmp dword [0x103ca880], ebx
jne 0x1003fdb4
push edi
call fcn.100060db
pop ecx
push ebx
push dword [0x100e08d4]
call esi
mov eax, dword [0xf34f30]
cmp dword [eax + 0x30], 0xffffffff
je 0x1003fdc7
cmp dword [0x1035ff8c], ebx
jne 0x1003fdd7
push edi
call fcn.100060db
pop ecx
push ebx
push dword [0x100e08d4]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1035fd44]
cmp eax, 0x1d4c0
jb 0x1003fdfa
push edi
call fcn.100060db
pop ecx
push ebx
push dword [0x100e08d4]
call esi
cmp dword [0x103c9388], ebx
jne 0x1003fe69
cmp dword [0x1035ff40], ebx
jne 0x1003fe1e
and dword [0x1035ff40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1017fcfc], eax
jmp 0x1003fe69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1017fcfc]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
test eax, eax
jns 0x1003fe4a
fadd dword [0x1009ee18]
fild dword [0x103c9398]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1003fe69
push edi
call fcn.100060db
pop ecx
push ebx
push dword [0x100e08d4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10052452
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x64
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b578
push str.D5CHECK1
mov edi, str.config
push edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103c79f0], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b588
push str.D5CHECK2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103c76c0], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b588
push str.D5CHECK3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103c76c4], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b588
push str.D5CHECK4
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103c79ec], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b588
push str.D5RADI01
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
mov dword [0x103c76bc], eax
mov ebx, 0xbb8
push ebx
push 0
push dword [ebp - 0x70]
call dword [sym.imp.MSVCR100.dll_memset]
add esp, 0x10
push dword [ebp - 0x6c]
push ebx
push dword [ebp - 0x70]
push 0x1008ade4
push str.D5LIST1
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x184
push dword [0x103c7794]
call esi
mov edi, dword [sym.imp.MSVCR100.dll_strtok]
mov ebx, 0x100938e0
push ebx
push dword [ebp - 0x70]
jmp 0x1005259b
push eax
push 0
push 0x180
push dword [0x103c7794]
call esi
push ebx
push 0
call edi
pop ecx
pop ecx
test eax, eax
jne 0x10052588
push dword [0x103c7648]
call dword [sym.imp.USER32.dll_IsWindowVisible]
pop edi
pop esi
pop ebx
cmp eax, 1
jne 0x100525c4
push 0
mov ecx, 0x103c7628
call dword [sym.imp.mfc100.dll_Ordinal_13219]
call fcn.1001320a
mov ecx, 0x103cd538
call fcn.10012e60
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008344f
leave
ret
Function at 0x100525df
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x64
lea eax, [ebp - 0x68]
mov ebx, ecx
mov edi, edx
push 0
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x103d7190
call fcn.1000102f
push ebx
push 0xbb8
push edi
push 0x1008ade4
push str.ZYWP
mov byte [edi], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, str.config
push ebx
call edi
push 0x10099b04
push dword [ebp - 0x70]
jmp 0x1005264f
push eax
call fcn.10001109
push 0x10099b04
push 0
call dword [sym.imp.MSVCR100.dll_strtok]
pop ecx
pop ecx
test eax, eax
jne 0x10052642
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x64
push eax
mov esi, 0x1008b588
push esi
push str.D38CHECK1
push ebx
call edi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103d0640], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push esi
push str.D38CHECK3
push ebx
call edi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103d0644], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push esi
push str.D38EDIT2
push ebx
call edi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103d063c], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push esi
push str.D38EDIT3
push ebx
call edi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll__atoi64]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x103d0648], eax
mov dword [0x103d064c], edx
pop ebx
call fcn.1008344f
leave
ret