joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100652f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [0xe609e8], 4
je 0x10065310
jmp 0x10065564
push 0x40
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x1006538a
mov ecx, 0x40
shl ecx, 6
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 8], edx
cmp dword [ebp + 8], 0x201
jne 0x10065354
mov eax, 0x40
shl eax, 6
mov byte [eax + 0x104e2d9c], 1
jmp 0x10065564
mov ecx, 0x40
shl ecx, 6
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 8], 0x1f4
jae 0x10065371
jmp 0x10065564
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
shl edx, 6
mov dword [edx + 0x104e2d98], eax
jmp 0x10065564
push 0x41
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x10065404
mov ecx, 0x40
imul edx, ecx, 0x41
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e2d98]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x201
jne 0x100653ce
mov ecx, 0x40
imul edx, ecx, 0x41
mov byte [edx + 0x104e2d9c], 1
jmp 0x10065564
mov eax, 0x40
imul ecx, eax, 0x41
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x100653eb
jmp 0x10065564
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x41
mov dword [ecx + 0x104e2d98], eax
jmp 0x10065564
push 0x42
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx edx, al
test edx, edx
je 0x1006547e
mov eax, 0x40
imul ecx, eax, 0x42
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0x201
jne 0x10065448
mov eax, 0x40
imul ecx, eax, 0x42
mov byte [ecx + 0x104e2d9c], 1
jmp 0x10065564
mov edx, 0x40
imul eax, edx, 0x42
mov byte [eax + 0x104e2d9c], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x10065465
jmp 0x10065564
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x42
mov dword [edx + 0x104e2d98], eax
jmp 0x10065564
push 0x43
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x100654f5
mov ecx, 0x40
imul edx, ecx, 0x43
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e2d98]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0x201
jne 0x100654c2
mov ecx, 0x40
imul edx, ecx, 0x43
mov byte [edx + 0x104e2d9c], 1
jmp 0x10065564
mov eax, 0x40
imul ecx, eax, 0x43
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 0x14], 0x1f4
jae 0x100654df
jmp 0x10065564
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x43
mov dword [ecx + 0x104e2d98], eax
jmp 0x10065564
push 0x44
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx edx, al
test edx, edx
je 0x10065564
mov eax, 0x40
imul ecx, eax, 0x44
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 0x18], edx
cmp dword [ebp + 8], 0x201
jne 0x10065536
mov eax, 0x40
imul ecx, eax, 0x44
mov byte [ecx + 0x104e2d9c], 1
jmp 0x10065564
mov edx, 0x40
imul eax, edx, 0x44
mov byte [eax + 0x104e2d9c], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x10065550
jmp 0x10065564
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x44
mov dword [edx + 0x104e2d98], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10066a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
sub eax, dword [edx + 0x104e2d98]
cmp eax, 0x5dc
jae 0x10066a73
jmp 0x10066b02
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
mov dword [edx + 0x104e2d98], eax
mov eax, 0x40
imul ecx, eax, 0x1e
movzx edx, byte [ecx + 0x104e2d9d]
cmp edx, 1
jne 0x10066aac
mov eax, 0x40
imul ecx, eax, 0x1e
mov byte [ecx + 0x104e2d9d], 0
jmp 0x10066b02
mov ecx, dword [ebp - 0xc]
call fcn.100661e0
push 4
push 0xe8
push 0xf3
lea ecx, [ebp - 8]
call fcn.100285f0
movzx edx, byte [ebp - 7]
push edx
lea eax, [ebp - 8]
push eax
call fcn.1011a530
add esp, 8
cmp dword [0x10545c78], 2
jne 0x10066aee
mov ecx, dword [0x104b9570]
mov byte [ecx + 0x29], 1
jmp 0x10066b02
mov ecx, 0x1028ba00
call fcn.100584f0
mov dword [0x1028ba00], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret

Function at 0x1006cf00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
sub eax, dword [edx + 0x104e2d98]
cmp eax, 0x5dc
jae 0x1006cf33
jmp 0x1006d001
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
mov dword [edx + 0x104e2d98], eax
mov eax, 0x40
imul ecx, eax, 0x1e
movzx edx, byte [ecx + 0x104e2d9d]
cmp edx, 1
jne 0x1006cf6f
mov eax, 0x40
imul ecx, eax, 0x1e
mov byte [ecx + 0x104e2d9d], 0
jmp 0x1006d001
mov ecx, dword [ebp - 0x14]
call fcn.1006c590
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], 0
push 4
push 0xe7
push 0xf3
lea ecx, [ebp - 0x10]
call fcn.100285f0
movzx eax, byte [ebp - 0xf]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.1011a530
add esp, 8
push 5
push 0xe6
push 0xf3
lea ecx, [ebp - 0xc]
call fcn.100285f0
mov edx, dword [ebp - 0x14]
mov dword [edx], 0
mov byte [ebp - 8], 0
movzx eax, byte [ebp - 0xb]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.1011a530
add esp, 8
cmp dword [0x10545c78], 2
jne 0x1006cfed
mov edx, dword [0x104b957c]
mov byte [edx + 0x29], 1
jmp 0x1006d001
mov ecx, 0x1028ba00
call fcn.100584f0
mov dword [0x1028ba00], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10079060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f5a04
mov eax, dword [ebp + 8]
push eax
call fcn.101a3c8b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x1007924e
mov dword [ebp - 0x218], 0x1c
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014d816
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a3fcd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a3fcd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a3d6b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10078230
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x10079184
mov eax, dword [ebp + 8]
push eax
push 0x101f5a08
lea ecx, [ebp - 0x104]
push ecx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10079206
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x100791ab
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x10079206
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 0x1c
add eax, 0x1028c420
push eax
call fcn.1019b090
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x1007919c
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014d811
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x10079236
mov dword [ebp - 0x22c], 0
jmp 0x1007924c
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x10079290
mov edx, dword [ebp + 8]
push edx
push 0x101f5a20
lea eax, [ebp - 0x204]
push eax
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100792a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f5a38
mov eax, dword [ebp + 8]
push eax
call fcn.101a3c8b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x1007948e
mov dword [ebp - 0x218], 6
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014d816
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a3fcd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a3fcd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a3d6b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10078230
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x100793c4
mov eax, dword [ebp + 8]
push eax
push 0x101f5a3c
lea ecx, [ebp - 0x104]
push ecx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10079446
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x100793eb
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x10079446
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 6
add eax, 0x1028bd18
push eax
call fcn.1019b090
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x100793dc
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014d811
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x10079476
mov dword [ebp - 0x22c], 0
jmp 0x1007948c
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x100794d0
mov edx, dword [ebp + 8]
push edx
push 0x101f5a54
lea eax, [ebp - 0x204]
push eax
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x100794e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f5a6c
mov eax, dword [ebp + 8]
push eax
call fcn.101a3c8b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x100796ce
mov dword [ebp - 0x218], 0x68
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014d816
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a3fcd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a3fcd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a3d6b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10078230
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x10079604
mov eax, dword [ebp + 8]
push eax
push str._s___File_corrupted.
lea ecx, [ebp - 0x104]
push ecx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10079686
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x1007962b
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x10079686
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 0x68
add eax, 0x1028e4f0
push eax
call fcn.1019b090
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x1007961c
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014d811
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x100796b6
mov dword [ebp - 0x22c], 0
jmp 0x100796cc
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x10079710
mov edx, dword [ebp + 8]
push edx
push 0x101f5a88
lea eax, [ebp - 0x204]
push eax
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret
Function at 0x10081b50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0x59
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x10081bdc
mov ecx, 0x40
imul edx, ecx, 0x59
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e2d98]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0x201
jne 0x10081ba6
mov ecx, 0x40
imul edx, ecx, 0x59
mov byte [edx + 0x104e2d9c], 1
jmp 0x10081d4b
mov eax, 0x40
imul ecx, eax, 0x59
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 8], 0x1f4
jae 0x10081bc3
jmp 0x10081d4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x59
mov dword [ecx + 0x104e2d98], eax
jmp 0x10081d4b
push 0x5a
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx edx, al
test edx, edx
je 0x10081c56
mov eax, 0x40
imul ecx, eax, 0x5a
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 8], 0x201
jne 0x10081c20
mov eax, 0x40
imul ecx, eax, 0x5a
mov byte [ecx + 0x104e2d9c], 1
jmp 0x10081d4b
mov edx, 0x40
imul eax, edx, 0x5a
mov byte [eax + 0x104e2d9c], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x10081c3d
jmp 0x10081d4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x5a
mov dword [edx + 0x104e2d98], eax
jmp 0x10081d4b
push 0x5b
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx eax, al
test eax, eax
je 0x10081ccd
mov ecx, 0x40
imul edx, ecx, 0x5b
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e2d98]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0x201
jne 0x10081c9a
mov ecx, 0x40
imul edx, ecx, 0x5b
mov byte [edx + 0x104e2d9c], 1
jmp 0x10081d4b
mov eax, 0x40
imul ecx, eax, 0x5b
mov byte [ecx + 0x104e2d9c], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x10081cb7
jmp 0x10081d4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x5b
mov dword [ecx + 0x104e2d98], eax
jmp 0x10081d4b
push 0x8b
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx edx, al
test edx, edx
je 0x10081d4b
mov eax, 0x40
imul ecx, eax, 0x8b
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e2d98]
mov dword [ebp - 0x14], edx
cmp dword [ebp + 8], 0x201
jne 0x10081d17
mov eax, 0x40
imul ecx, eax, 0x8b
mov byte [ecx + 0x104e2d9c], 1
jmp 0x10081d4b
mov edx, 0x40
imul eax, edx, 0x8b
mov byte [eax + 0x104e2d9c], 0
cmp dword [ebp - 0x14], 0x1f4
jae 0x10081d34
jmp 0x10081d4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8b
mov dword [edx + 0x104e2d98], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10095c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
jne 0x10095c4b
jmp 0x10095d9c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 4]
xor edx, edx
mov ecx, 0xa
div ecx
mov byte [ebp - 1], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x61
ja case.0x10095c8d.1
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x10095db4]
jmp dword [edx*4 + 0x10095da4]
cmp dword [ebp - 0xc], 0
je 0x10095cdb
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae 0x10095cdb
movsx ecx, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
sub eax, ecx
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
jmp case.0x10095c8d.1
cmp dword [ebp - 0xc], 0
jne 0x10095cee
mov edx, dword [ebp + 8]
sub edx, 0x30
je 0x10095d28
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae 0x10095d28
imul ecx, dword [ebp - 0xc], 0xa
mov edx, dword [ebp + 8]
lea eax, [ecx + edx - 0x30]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x10], edx
jmp case.0x10095c8d.1
cmp dword [ebp - 0xc], 0
jne 0x10095d38
mov eax, dword [ebp + 8]
sub eax, 0x60
je case.0x10095c8d.1
mov ecx, dword [ebp - 8]
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae case.0x10095c8d.1
imul edx, dword [ebp - 0xc], 0xa
mov eax, dword [ebp + 8]
lea ecx, [edx + eax - 0x60]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 8]
jbe 0x10095d91
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [eax + 8]
mov dword [edx + 4], eax
jmp 0x10095d9c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100963b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x101f65e4
push 0x64
push 0x10215048
push str.Tahoma
push str.FontName
push str.FontConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push fcn.10096630
push 0x4060d0
push 0xe8
call fcn.10122ae0
add esp, 0xc
push fcn.100964d0
push 0x4d2882
push 0xe8
call fcn.10122ae0
add esp, 0xc
push fcn.10096630
push 0x4d28eb
push 0xe8
call fcn.10122ae0
add esp, 0xc
push fcn.10096630
push 0x4d2957
push 0xe8
call fcn.10122ae0
add esp, 0xc
push fcn.100964d0
push 0x4d29c1
push 0xe8
call fcn.10122ae0
add esp, 0xc
push 0x90
push 0x4060d5
call fcn.10122950
add esp, 8
push 0x90
push 0x4d2887
call fcn.10122950
add esp, 8
push 0x90
push 0x4d28f0
call fcn.10122950
add esp, 8
push 0x90
push 0x4d295c
call fcn.10122950
add esp, 8
push 0x90
push 0x4d29c6
call fcn.10122950
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.10096630
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf0], eax
mov ecx, dword [ebp - 4]
call fcn.100964d0
mov edx, dword [ebp - 4]
mov dword [edx + 0xf4], eax
mov esp, ebp
pop ebp
ret
Function at 0x10099850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xff
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.1019bb90
add esp, 0xc
push 0x101f6690
mov ecx, dword [ebp + 8]
push ecx
call fcn.101a3c8b
add esp, 8
mov dword [ebp - 0x110], eax
push 0x6d24
push 0
push 0x104cb514
call fcn.1019bb90
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x100999f3
mov dword [ebp - 0x108], 0
push 0x6d24
call fcn.1014d816
add esp, 4
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x110]
push eax
push 1
push 0x6d24
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.101a3fcd
add esp, 0x10
mov edx, dword [ebp - 0x110]
push edx
push 1
push 4
lea eax, [ebp - 0x108]
push eax
call fcn.101a3fcd
add esp, 0x10
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.101a3d6b
add esp, 4
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], 0x6e
mov dword [ebp - 0x114], 0
jmp 0x10099951
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfe
jge 0x100999ab
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call fcn.100997f0
add esp, 8
mov eax, dword [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
imul edx, dword [ebp - 0x114], 0x6e
add edx, 0x104cb514
push edx
call fcn.1019b090
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x11c]
mov dword [ebp - 0x118], eax
jmp 0x10099942
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
push edx
call fcn.1014d811
add esp, 4
cmp dword [ebp - 0x120], 0
jne 0x100999db
mov dword [ebp - 0x128], 0
jmp 0x100999f1
mov dword [ebp - 0x10c], 0x8123
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x128], eax
jmp 0x10099a36
mov ecx, dword [ebp + 8]
push ecx
push str._s___File_not_exist.
lea edx, [ebp - 0x104]
push edx
call sym.Client_Clean_.dll_sprintf
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret