joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bd50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld dword [0x1006029c]
push ebx
fstp dword [0x100c00bc]
push esi
fld dword [0x10060040]
xor eax, eax
fstp dword [0x100c00c0]
push edi
fld dword [0x10060644]
push 0x1000bfb0
fstp dword [0x100c00c4]
mov edi, 0xc942
fld dword [0x10060640]
push 0x4d5ee6
fstp dword [0x100c00c8]
mov bl, 0xe8
fld dword [0x1006063c]
mov dword [0x100c00d4], eax
fstp dword [0x100c00cc]
mov word [0x100c00d8], ax
fld dword [0x10060638]
mov dword [0x100c00b8], edi
fstp dword [0x100c00d0]
mov byte [0x100c00da], al
fld dword [0x10060630]
mov dword [0x100c011c], eax
fstp dword [0x100c0104]
mov word [0x100c0120], ax
fld dword [0x1006032c]
mov dword [0x100c0100], 0xc943
fstp dword [0x100c0108]
mov byte [0x100c0122], al
fld dword [0x1005fdac]
fst dword [0x100c010c]
fstp dword [0x100c0110]
fld dword [0x1006062c]
fstp dword [0x100c0114]
fld dword [0x10060628]
fstp dword [0x100c0118]
call fcn.10056900
push 0x1000bf60
push 0x4d6c3e
call fcn.10056900
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push 4
xor ebx, ebx
push 0x4d7530
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000be76
mov ecx, 0x4d7530
mov dword [ecx], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000be7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x4d7564
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000bead
mov edx, 0x4d7564
mov dword [edx], edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push edx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000beb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x4053a3
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000bee4
mov eax, 0x4053a3
mov dword [eax], edi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push eax
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000beea
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x401d30
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000bf1b
mov ecx, 0x401d30
mov dword [ecx], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000bf21
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x4053d4
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1000bf52
mov edx, 0x4053d4
mov byte [edx], bl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 1
push edx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000bf58
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
fld dword [0x100bff5c]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100bff60]
mov esi, eax
call fcn.100596f0
fld dword [0x100bff54]
mov edi, eax
call fcn.100596f0
fld dword [0x100bff58]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000d88e
cmp dword [ebp + 8], 0x201
jne 0x1000d861
pop edi
pop esi
mov byte [0x100bff70], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bff6c]
mov byte [0x100bff70], 0
cmp eax, 0x1f4
jb 0x1000da3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bff6c], eax
pop ebx
pop ebp
ret 8
fld dword [0x100bffa4]
call fcn.100596f0
fld dword [0x100bffa8]
mov esi, eax
call fcn.100596f0
fld dword [0x100bff9c]
mov edi, eax
call fcn.100596f0
fld dword [0x100bffa0]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov ecx, 0x790b10
call ecx
add esp, 0x10
test al, al
je 0x1000d916
cmp dword [ebp + 8], 0x201
jne 0x1000d8e9
pop edi
pop esi
mov byte [0x100bffb8], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bffb4]
mov byte [0x100bffb8], 0
cmp eax, 0x1f4
jb 0x1000da3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bffb4], eax
pop ebx
pop ebp
ret 8
fld dword [0x100bffec]
call fcn.100596f0
fld dword [0x100bfff0]
mov esi, eax
call fcn.100596f0
fld dword [0x100bffe4]
mov edi, eax
call fcn.100596f0
fld dword [0x100bffe8]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1000d99e
cmp dword [ebp + 8], 0x201
jne 0x1000d971
pop edi
pop esi
mov byte [0x100c0000], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100bfffc]
mov byte [0x100c0000], 0
cmp eax, 0x1f4
jb 0x1000da3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100bfffc], eax
pop ebx
pop ebp
ret 8
mov eax, 0x94
mov ecx, 0x100bd618
call fcn.10029610
test al, al
je 0x1000d9f1
cmp dword [ebp + 8], 0x201
jne 0x1000d9c8
pop edi
pop esi
mov byte [0x100c0048], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100c0044]
mov byte [0x100c0048], 0
cmp eax, 0x1f4
jb 0x1000da3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x100c0044], eax
pop ebx
pop ebp
ret 8
mov eax, 0x95
mov ecx, 0x100bd618
call fcn.10029610
test al, al
je 0x1000da3d
cmp dword [ebp + 8], 0x201
jne 0x1000da1b
pop edi
pop esi
mov byte [0x100c0090], 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
sub eax, dword [0x100c008c]
mov byte [0x100c0090], 0
cmp eax, 0x1f4
jb 0x1000da3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100c008c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100101c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100bdd64]
cmp eax, 0x5dc
jae 0x100101df
mov byte [0x100be939], 0
pop esi
ret
xor eax, eax
mov byte [0x100be591], al
mov dword [0xe8cb3c], eax
mov byte [0x100bde89], al
mov dword [0xe8cb3c], eax
mov byte [0x100bdd69], al
mov byte [0x100be351], al
mov byte [0x100c0511], al
mov byte [0x100be939], al
mov dword [0xe8cb3c], eax
call esi
mov dword [0x100be934], eax
mov eax, 1
mov byte [0x100be939], al
mov dword [0xe8cb3c], eax
pop esi
ret

Function at 0x100102d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bf594]
sub esi, dword [0x100bf54c]
cmp byte [0x100be939], 0
mov dword [ebp - 8], eax
je 0x10010399
cmp dword [0x100cfda4], 0xffffffff
je 0x10010399
fld dword [0x100bf53c]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bf540]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf534]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bf538]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x10010399
cmp dword [ebp + 8], 0x201
jne 0x1001036d
mov byte [0x100bf550], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x64
jb 0x10010399
cmp dword [ebp - 8], 0x64
jb 0x10010399
inc dword [0x100d5720]
mov byte [0x100bf550], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bf54c], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100103b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bf54c]
sub esi, dword [0x100bf594]
cmp byte [0x100be939], 0
mov dword [ebp - 8], eax
je 0x1001047d
cmp dword [0x100cfda8], 0xffffffff
je 0x1001047d
fld dword [0x100bf584]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bf588]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf57c]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bf580]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x1001047d
cmp dword [ebp + 8], 0x201
jne 0x1001044e
mov eax, 1
mov byte [0x100bf598], al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x64
jb 0x1001047d
cmp dword [ebp - 8], 0x64
jb 0x1001047d
mov byte [0x100bf598], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bf594], eax
mov eax, 1
sub dword [0x100d5720], eax
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100113e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x15
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 1
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 0x49
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1001153a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100be34c]
cmp eax, 0x1f4
jb 0x10011539
call esi
cmp byte [0x100be351], 1
mov dword [0x100be34c], eax
jne 0x10011501
xor eax, eax
mov byte [0x100be351], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x100bd618
call fcn.1002c1a0
call fcn.10010ca0
lea eax, [ebp - 4]
mov ecx, 4
push eax
mov dword [ebp - 4], 0xe8f304c1
call fcn.10052330
mov byte [0x100be351], 1
add esp, 4
mov dword [0xe8cb3c], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10011540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bf624]
sub esi, dword [0x100bf5dc]
cmp byte [0x100be351], 0
mov dword [ebp - 8], eax
je 0x10011609
cmp dword [0x100cfdac], 0xffffffff
je 0x10011609
fld dword [0x100bf5cc]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bf5d0]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf5c4]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bf5c8]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x10011609
cmp dword [ebp + 8], 0x201
jne 0x100115dd
mov byte [0x100bf5e0], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x64
jb 0x10011609
cmp dword [ebp - 8], 0x64
jb 0x10011609
inc dword [0x100d5fc0]
mov byte [0x100bf5e0], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bf5dc], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10011620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bf5dc]
sub esi, dword [0x100bf624]
cmp byte [0x100be351], 0
mov dword [ebp - 8], eax
je 0x100116ed
cmp dword [0x100cfdb0], 0xffffffff
je 0x100116ed
fld dword [0x100bf614]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bf618]
mov edi, eax
call fcn.100596f0
fld dword [0x100bf60c]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bf610]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x100116ed
cmp dword [ebp + 8], 0x201
jne 0x100116be
mov eax, 1
mov byte [0x100bf628], al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x64
jb 0x100116ed
cmp dword [ebp - 8], 0x64
jb 0x100116ed
mov byte [0x100bf628], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bf624], eax
mov eax, 1
sub dword [0x100d5fc0], eax
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10013bd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4f1317
call esi
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [0x4f1317], ecx
mov eax, dword [ebp - 4]
push eax
push 4
push 0x4f1317
call esi
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x4f8b80
call edx
add esp, 4
lea eax, [ebp + 0xc]
push eax
push 0x40
push 4
push 0x4f1317
call esi
lea ecx, [ebp + 0xc]
push ecx
mov dword [0x4f1317], 0xe3
mov edx, dword [ebp + 0xc]
push edx
push 4
push 0x4f1317
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100248f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bde3c]
sub esi, dword [0x100bddf4]
cmp byte [0x100bdd69], 0
mov dword [ebp - 0xc], eax
je 0x100249e4
cmp dword [0x100cfdb4], 0xffffffff
je 0x100249e4
fld dword [0x100bdde4]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bdde8]
mov edi, eax
call fcn.100596f0
fld dword [0x100bdddc]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bdde0]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x100249e4
cmp dword [ebp + 8], 0x201
jne 0x1002498d
mov byte [0x100bddf8], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x3e8
jb 0x100249e4
cmp dword [ebp - 0xc], 0x3e8
jb 0x100249e4
call fcn.10024280
mov byte [0x100bddf8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bddf4], eax
mov eax, dword [0x100d6058]
inc eax
lea edx, [ebp - 0xc]
mov ecx, 5
push edx
mov dword [ebp - 0xc], 0xe6f305c1
mov dword [0x100d6058], eax
mov byte [ebp - 8], al
call fcn.10052330
add esp, 4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100249f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub eax, dword [0x100bde3c]
sub esi, dword [0x100bddf4]
cmp byte [0x100bdd69], 0
mov dword [ebp - 0xc], eax
je 0x10024ae4
cmp dword [0x100cfdb8], 0xffffffff
je 0x10024ae4
fld dword [0x100bde2c]
push ebx
push edi
call fcn.100596f0
fld dword [0x100bde30]
mov edi, eax
call fcn.100596f0
fld dword [0x100bde24]
mov ebx, eax
call fcn.100596f0
fld dword [0x100bde28]
mov dword [ebp - 4], eax
call fcn.100596f0
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push edi
mov ecx, 0x790b10
call ecx
add esp, 0x10
pop edi
pop ebx
test al, al
je 0x10024ae4
cmp dword [ebp + 8], 0x201
jne 0x10024a8d
mov byte [0x100bde40], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x3e8
jb 0x10024ae4
cmp dword [ebp - 0xc], 0x3e8
jb 0x10024ae4
call fcn.10024280
mov byte [0x100bde40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bde3c], eax
mov eax, dword [0x100d6058]
dec eax
lea edx, [ebp - 0xc]
mov ecx, 5
push edx
mov dword [ebp - 0xc], 0xe6f305c1
mov dword [0x100d6058], eax
mov byte [ebp - 8], al
call fcn.10052330
add esp, 4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10024b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x100bdd64]
cmp eax, 0x5dc
jb 0x10024c5e
push ebx
call esi
xor ebx, ebx
cmp byte [0x100bdd69], 1
mov dword [0x100bdd64], eax
jne 0x10024bd5
mov byte [0x100bdd69], bl
mov dword [0xe8cb3c], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x100be591], bl
mov dword [0xe8cb3c], ebx
mov byte [0x100bde89], bl
mov dword [0xe8cb3c], ebx
mov byte [0x100bdd69], bl
mov byte [0x100be351], bl
mov byte [0x100c0511], bl
mov byte [0x100be939], bl
mov dword [0xe8cb3c], ebx
call fcn.10024280
lea eax, [ebp - 8]
mov ecx, 4
push eax
mov dword [0x100d6060], ebx
mov dword [ebp - 8], 0xe7f304c1
call fcn.10052330
lea edx, [ebp - 8]
mov ecx, 5
push edx
mov dword [ebp - 8], 0xe6f305c1
mov dword [0x100d6058], ebx
mov byte [ebp - 4], bl
call fcn.10052330
add esp, 8
mov byte [0x100bdd69], 1
mov dword [0xe8cb3c], 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10025680
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10025190
push 5
sub eax, 0x5509d3
xor edi, edi
push 0x5509ce
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100256df
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x5509ce
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x5509ce
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100256e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10025670
push 5
sub ecx, 0x551578
push 0x551573
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10025735
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x551573
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x551573
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1002573b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10029500
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x100bdd1c]
cmp eax, 0x3e8
jb 0x1002956a
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1002956a
call edi
mov dword [0x100bdd1c], eax
cmp byte [esi + 0x709], 0
je 0x10029554
push str.Time_Window__OFF_
push 1
call fcn.100296d0
add esp, 8
mov byte [esi + 0x709], 0
pop edi
ret
push str.Time_Window__ON_
push 1
call fcn.100296d0
mov byte [esi + 0x709], 1
add esp, 8
pop edi
ret
Function at 0x1002a110
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100bdfec]
cmp byte [0x100bde89], 0
mov dword [ebp - 4], eax
je 0x1002a1bc
fld dword [0x100bdfdc]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100bdfe0]
mov esi, eax
call fcn.100596f0
fld dword [0x100bdfd4]
mov edi, eax
call fcn.100596f0
fld dword [0x100bdfd8]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002a1bc
cmp dword [ebp + 8], 0x201
jne 0x1002a190
mov al, 1
mov byte [0x100bdff0], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100bdff0], 0
jb 0x1002a1bc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bdfec], eax
mov byte [0x100bde89], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002a1d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be034]
cmp byte [0x100bde89], 0
mov dword [ebp - 4], eax
je 0x1002a29d
fld dword [0x100be024]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be028]
mov esi, eax
call fcn.100596f0
fld dword [0x100be01c]
mov edi, eax
call fcn.100596f0
fld dword [0x100be020]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002a29d
cmp dword [ebp + 8], 0x201
jne 0x1002a252
mov al, 1
mov byte [0x100be038], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be038], 0
jb 0x1002a29d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 8]
mov ecx, 8
push edx
mov dword [0x100be034], eax
mov dword [ebp - 8], 0xf0f308c1
mov dword [ebp - 4], 1
call fcn.10052330
mov byte [0x100bde89], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1002a2b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100be07c]
cmp byte [0x100bde89], 0
mov dword [ebp - 4], eax
je 0x1002a375
fld dword [0x100be06c]
push ebx
push esi
push edi
call fcn.100596f0
fld dword [0x100be070]
mov esi, eax
call fcn.100596f0
fld dword [0x100be064]
mov edi, eax
call fcn.100596f0
fld dword [0x100be068]
mov ebx, eax
call fcn.100596f0
push eax
push ebx
push edi
push esi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
je 0x1002a375
mov ecx, dword [0x100cb10c]
cmp dword [ecx + 0x2dc], 2
jb 0x1002a375
cmp dword [ebp + 8], 0x201
jne 0x1002a33f
mov al, 1
mov byte [0x100be080], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0x1f4
mov byte [0x100be080], 0
jb 0x1002a375
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100be07c], eax
mov eax, 2
call fcn.1000f110
mov byte [0x100bde89], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4