joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [ebp + 0x10]
push ebx
push esi
fld st(0)
push edi
call fcn.100ac0e0
fld dword [ebp + 0xc]
fld st(0)
movzx ebx, ax
call fcn.100ac0e0
mov edi, dword [0x879340c]
fld dword [ebp + 0x18]
movzx eax, ax
fld dword [ebp + 0x14]
movsx esi, ax
cmp edi, esi
jl 0x100033d6
fld st(0)
fdiv dword [0xe7c3d4]
call fcn.100ac0e0
cwde
add eax, esi
cmp edi, eax
jg 0x100033d6
mov edi, dword [0x8793410]
movsx esi, bx
cmp edi, esi
jl 0x100033d6
fild dword [0xe61e58]
fild dword [0xe61e5c]
fmul qword [0x100b6fc8]
fdivp st(1)
fstp dword [ebp - 4]
fld dword [ebp - 4]
fld st(2)
fdiv dword [0xe7c3d4]
fmulp st(1)
call fcn.100ac0e0
movsx ecx, ax
add ecx, esi
cmp edi, ecx
jg 0x100033d6
fstp st(3)
push 1
fstp st(1)
fstp st(0)
fstp st(0)
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x20]
mov edx, 0x8000
fdiv dword [ebp + 0x28]
push ecx
test dx, ax
je 0x10003359
fldz
mov eax, 0x637c60
fst dword [esp]
push 1
fxch st(1)
fst dword [ebp + 0x20]
push 0
fld dword [ebp + 0x20]
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x1c]
fdiv dword [ebp + 0x24]
fstp dword [ebp + 0x20]
fld dword [ebp + 0x20]
fstp dword [esp + 0x18]
fadd st(0), st(0)
fstp dword [ebp + 0x20]
fld dword [ebp + 0x20]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x18]
fstp dword [esp + 0xc]
fld dword [ebp + 0x14]
fstp dword [esp + 8]
fld dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp + 0xc]
fstp dword [esp]
push 0x7abe
call eax
jmp 0x100033ae
fstp dword [ebp + 0x20]
mov ecx, 0x637c60
fldz
fst dword [esp]
fld dword [ebp + 0x20]
push 1
push 0
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x1c]
fdiv dword [ebp + 0x24]
fstp dword [ebp + 0x20]
fld dword [ebp + 0x20]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x18]
fstp dword [esp + 0xc]
fld dword [ebp + 0x14]
fstp dword [esp + 8]
fld dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp + 0xc]
fstp dword [esp]
push 0x7abe
call ecx
add esp, 0x30
push 1
mov edx, 0x791050
call edx
add esp, 4
test al, al
je 0x1000342d
mov eax, dword [ebp + 8]
push eax
call fcn.10002040
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
fldz
push ecx
fst dword [esp]
mov ecx, 0x637c60
fld dword [ebp + 0x20]
push 1
fdiv dword [ebp + 0x28]
push 0
sub esp, 0x20
fstp dword [ebp + 0x18]
fld dword [ebp + 0x18]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x1c]
fdiv dword [ebp + 0x24]
fstp dword [ebp + 0x18]
fld dword [ebp + 0x18]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
push 0x7abe
call ecx
add esp, 0x30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x10003b50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10128190]
cmp eax, 0x1f4
jb 0x10003bb6
call esi
mov dword [0x10128190], eax
mov eax, 1
cmp byte [0x10128195], al
jne 0x10003b92
mov dword [0xe8cb3c], 0
mov byte [0x1012819c], 0xf
mov byte [0x101281b1], al
pop esi
ret
mov byte [0x10128195], al
mov dword [0xe8cb3c], eax
mov dword [0x10128198], 0xfffffdda
mov byte [0x1012819c], 0x14
mov word [0x101281b1], 0x100
pop esi
ret

Function at 0x10004aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x1b
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x10004ad5
push 0
mov dword [0xe8cb3c], 0
push 0
push 0x19
mov eax, 0x6d6c20
mov byte [0x1012819c], 0xf
mov byte [0x101281b1], 1
call eax
add esp, 0xc
cmp byte [0x101281b1], 0
mov eax, dword [0x10128198]
jne 0x10004b13
test eax, eax
jns 0x10004b55
movzx ecx, byte [0x1012819c]
add eax, ecx
mov dword [0x10128198], eax
cmp eax, 0xffffff06
jl 0x10004b03
mov byte [0x1012819c], 0xf
test eax, eax
jle 0x10004b55
mov dword [0x10128198], 0
jmp 0x10004b55
cmp eax, 0xfffffe0c
jle 0x10004b55
movzx edx, byte [0x1012819c]
sub eax, edx
mov dword [0x10128198], eax
cmp eax, 0xffffff06
jg 0x10004b36
mov byte [0x1012819c], 0x14
cmp eax, 0xfffffe0c
jg 0x10004b55
mov byte [0x10128195], 0
mov dword [0xe8cb3c], 0
mov byte [0x101281b1], 0
cmp byte [0x1068a854], 0
je 0x10004b79
fld dword [0x100b70a0]
sub esp, 8
fstp dword [esp + 4]
fild dword [0x10128198]
fstp dword [esp]
call fcn.10003bc0
ret
Function at 0x10008340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1073c1f0]
fld qword [eax]
push esi
fsub qword [0x100b7770]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x1073c1f4]
lea ecx, [esp + 0xc]
fabs
push ecx
fstp qword [esp + 0x14]
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
fmul qword [0x100b7138]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
fadd qword [0x100b7768]
push eax
push 8
push edi
fstp qword [edi]
call esi
mov ecx, dword [0x1073c1f0]
fld qword [ecx]
mov edi, dword [0x1073c1f8]
fsub qword [0x100b7770]
lea edx, [esp + 0xc]
push edx
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
fmul qword [0x100b7138]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
fadd qword [0x100b7768]
push ecx
push 8
push edi
fstp qword [edi]
call esi
mov edx, dword [0x1073c1f0]
fld qword [edx]
mov edi, dword [0x1073c1fc]
fsub qword [0x100b7770]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0xc]
fmul qword [0x100b7138]
push ecx
push edx
push 4
fadd qword [0x100b7760]
push edi
fstp dword [edi]
call esi
mov eax, dword [0x1073c1f0]
fld qword [eax]
mov edi, dword [0x1073c200]
fsub qword [0x100b7770]
lea ecx, [esp + 0xc]
fabs
fstp qword [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
fld qword [esp + 0x10]
mov eax, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea edx, [esp + 0xc]
fmul qword [0x100b7138]
push edx
push eax
push 4
fadd qword [0x100b7760]
push edi
fstp dword [edi]
call esi
mov ecx, dword [0x1073c1f0]
fld qword [ecx]
mov edi, dword [0x1073c204]
fsub qword [0x100b7770]
lea edx, [esp + 0xc]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov ecx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea eax, [esp + 0xc]
fmul qword [0x100b7138]
push eax
push ecx
push 4
fadd qword [0x100b7758]
push edi
fstp dword [edi]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100084d0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x50], 0
push edi
je 0x10008674
mov ebx, dword [esi + 0x2c]
fld dword [esi + 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push ebx
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push ebx
call edi
fld dword [esi + 0x58]
mov ebx, dword [esi + 0x30]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push ebx
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push ebx
call edi
fld dword [esi + 0x5c]
mov ebx, dword [esi + 0x34]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push ebx
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push ebx
call edi
fld qword [esi + 0x60]
mov ebx, dword [esi + 0x38]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push ebx
call edi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push ebx
call edi
fld qword [esi + 0x68]
mov ebx, dword [esi + 0x3c]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push ebx
call edi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push ebx
call edi
fld qword [esi + 0x70]
mov ebx, dword [esi + 0x40]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push ebx
call edi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push ebx
call edi
fld dword [esi + 0x78]
mov ebx, dword [esi + 0x44]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push ebx
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push ebx
call edi
fld dword [esi + 0x7c]
mov ebx, dword [esi + 0x48]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push ebx
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push ebx
call edi
fld dword [esi + 0x80]
mov esi, dword [esi + 0x4c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push esi
call edi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push esi
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100097b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10009920
push 5
sub eax, 0x78b0c1
xor edi, edi
push 0x78b0bc
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1000980f
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x78b0bc
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x78b0bc
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10009815
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10009750
push 5
sub ecx, 0x78976c
push 0x789767
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009865
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x789767
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x789767
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1000986b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10009770
push 5
sub edx, 0x789a68
push 0x789a63
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100098bb
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x789a63
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x789a63
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100098c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10009790
push 5
sub edx, 0x789db1
push 0x789dac
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10009911
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x789dac
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x789dac
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10009917
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a4f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, eax
mov eax, 0x7b
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1000a541
cmp edi, 0x201
jne 0x1000a51f
mov byte [0x10125c94], 1
pop esi
ret
sub edx, dword [0x10125c90]
mov byte [0x10125c94], 0
cmp edx, 0x1f4
jb 0x1000a5c3
call esi
mov dword [0x10125c90], eax
pop esi
ret
mov eax, 0x7c
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1000a583
cmp edi, 0x201
jne 0x1000a565
mov byte [0x10125cd4], 1
pop esi
ret
sub edx, dword [0x10125cd0]
mov byte [0x10125cd4], 0
cmp edx, 0x1f4
jb 0x1000a5c3
call esi
mov dword [0x10125cd0], eax
pop esi
ret
mov eax, 0x7d
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1000a5c3
cmp edi, 0x201
jne 0x1000a5a7
mov byte [0x10125d14], 1
pop esi
ret
sub edx, dword [0x10125d10]
mov byte [0x10125d14], 0
cmp edx, 0x1f4
jb 0x1000a5c3
call esi
mov dword [0x10125d10], eax
pop esi
ret
Function at 0x1000f970
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4034]
mov dword [esi], 0x100b0220
test eax, eax
je 0x1000f9a3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x4034]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1000f9b9
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x1000f9ce
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x4038], 0
mov dword [esi + 0x4018], 0x100b0228
add esi, 0x401c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret

Function at 0x1000f9f0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x4034]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x1000fa18
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x4034]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4034], ebx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1000fa2e
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1000fa3f
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], ebx
mov byte [esi + 0x4038], bl
pop ebx
ret
Function at 0x1000fa50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.100ac190
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100cf30c
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100cb2f4], 0xffffffff
je 0x1000fab9
cmp byte [0x100cf328], 0
je 0x1000fab9
push esi
lea eax, [ebp - 0x2004]
push edi
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [0x100cf300]
add esp, 0xc
test eax, eax
jle 0x1000fb10
lea ecx, [eax + esi]
cmp ecx, 0x2000
jle 0x1000fad6
mov esi, 0x100cb2f0
call fcn.1000f9f0
push 0x100cf30c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
push esi
lea edx, [ebp - 0x2004]
push edx
lea eax, [eax + 0x100cd300]
push eax
call sub.MSVCR100.dll_memcpy
add dword [0x100cf300], esi
add esp, 0xc
push 0x100cf30c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
xor edi, edi
push ebx
test esi, esi
jle 0x1000fb41
mov ebx, dword [sym.imp.WS2_32.dll_send]
lea ecx, [ecx]
mov edx, dword [0x100cb2f4]
push 0
push esi
lea ecx, [ebp + edi - 0x2004]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x1000fb5f
sub esi, eax
add edi, eax
test esi, esi
jg 0x1000fb20
push 0x100cf30c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000fb9c
mov eax, dword [0x100cf300]
lea ecx, [eax + esi]
cmp ecx, 0x2000
jg 0x1000fb9c
push esi
lea edx, [ebp + edi - 0x2004]
push edx
lea eax, [eax + 0x100cd300]
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [0x100cf300], esi
jmp 0x1000fb41
mov esi, 0x100cb2f0
call fcn.1000f9f0
push 0x100cf30c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x10018000
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x1012bf55], 1
push ebx
jne 0x1001801a
xor ebx, ebx
mov byte [0x1012bf55], bl
mov dword [0xe8cb3c], ebx
pop ebx
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10123e50]
cmp eax, 0x5dc
jae 0x1001803a
pop esi
mov byte [0x1012bf55], 0
pop ebx
ret
xor ebx, ebx
mov byte [0x10129d55], bl
mov byte [0x1012a815], bl
mov byte [0x10123e55], bl
mov byte [0x10124295], bl
mov byte [0x101277d5], bl
mov byte [0x10127415], bl
mov byte [0x1012aad5], bl
mov byte [0x1012cb55], bl
mov dword [0xe8cb3c], ebx
call esi
mov dword [0x1012bf50], eax
mov byte [0x1012bf55], 1
pop esi
mov dword [0xe8cb3c], ebx
pop ebx
ret

Function at 0x10018100
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x1012bf55], 0
mov edx, eax
je 0x10018182
cmp dword [0x10689564], 0xffffffff
je 0x10018182
mov eax, 0x4d
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10018182
cmp dword [ebp + 8], 0x201
jne 0x1001814a
mov byte [0x10125114], 1
mov al, 1
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x10125110]
cmp eax, 0x3e8
jb 0x10018182
sub edx, dword [0x10125150]
cmp edx, 0x3e8
jb 0x10018182
inc dword [0x1073e770]
mov byte [0x10125114], 0
call esi
mov dword [0x10125110], eax
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10018190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x1012bf55], 0
mov edx, eax
je 0x10018216
cmp dword [0x10689568], 0xffffffff
je 0x10018216
mov eax, 0x4e
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10018216
cmp dword [ebp + 8], 0x201
jne 0x100181db
mov eax, 1
mov byte [0x10125154], al
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x10125150]
cmp eax, 0x3e8
jb 0x10018216
sub edx, dword [0x10125110]
cmp edx, 0x3e8
jb 0x10018216
mov byte [0x10125154], 0
call esi
mov dword [0x10125150], eax
mov eax, 1
sub dword [0x1073e770], eax
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10018320
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1073e85c]
cmp eax, 0x190
jb 0x10018362
test edi, edi
js 0x10018362
call esi
mov dword [0x1073e85c], eax
lea eax, [ebp - 8]
mov ecx, 8
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0xf5f308c1
call fcn.1008c360
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0xc
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0x15
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 1
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push 0x16
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10018efe
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1012cb50]
cmp eax, 0x1f4
jb 0x10018efd
call esi
cmp byte [0x1012cb55], 1
mov dword [0x1012cb50], eax
jne 0x10018ebe
xor eax, eax
mov byte [0x1012cb55], al
mov dword [0xe8cb3c], eax
pop esi
ret
mov eax, 0x10123c90
call fcn.10054eb0
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec50
mov ecx, eax
call edx
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
mov byte [0x1012cb55], 1
mov dword [0xe8cb3c], 1
pop esi
ret

Function at 0x10018f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x1012cb55], 0
mov edx, eax
je 0x10018f79
mov eax, 0x23c
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10018f79
cmp dword [ebp + 8], 0x201
jne 0x10018f41
mov byte [0x1012ccd4], 1
mov al, 1
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x1012ccd0]
cmp eax, 0x12c
jb 0x10018f79
sub edx, dword [0x1012cd10]
cmp edx, 0x12c
jb 0x10018f79
inc dword [0x1073e890]
mov byte [0x1012ccd4], 0
call esi
mov dword [0x1012ccd0], eax
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10018f80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x1012cb55], 0
mov edx, eax
je 0x10018ff9
mov eax, 0x23d
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10018ff9
cmp dword [ebp + 8], 0x201
jne 0x10018fc1
mov byte [0x1012cd14], 1
mov al, 1
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x1012cd10]
cmp eax, 0x12c
jb 0x10018ff9
sub edx, dword [0x1012ccd0]
cmp edx, 0x12c
jb 0x10018ff9
dec dword [0x1073e890]
mov byte [0x1012cd14], 0
call esi
mov dword [0x1012cd10], eax
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4