joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034e90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
mov esi, ecx
push 0
push eax
call fcn.10425c00
add esp, 0xc
cmp byte [esi], 0
je 0x100350cd
push 0
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10034ee9
call edi
cmp eax, 0xb7
jne 0x100350a3
mov eax, dword [0x11cd302c]
test al, 1
je 0x10034f57
push esi
lea eax, [ebp - 0x110]
push 0x104692f0
push eax
call fcn.10098560
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x10469300
push eax
call fcn.10434f0b
add esp, 8
mov dword [esi + 0x81c], eax
test eax, eax
jne 0x10034f34
mov eax, dword [0x11cd302c]
and eax, 0xfffffffe
mov dword [0x11cd302c], eax
jmp 0x10034f57
push 0x10469310
push eax
call fcn.1003a100
push 0x10469330
push dword [esi + 0x81c]
call fcn.1003a100
mov eax, dword [0x11cd302c]
add esp, 0x10
test eax, 0x4000000
je 0x10034fa6
push esi
lea eax, [ebp - 0x110]
mov byte [ebp - 0x110], 0
push 0x10469350
push eax
call fcn.10098560
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10034fa1
call edi
cmp eax, 0xb7
je 0x10034fa1
test byte [0x11cd302c], bl
jmp 0x10035087
mov eax, dword [0x11cd302c]
test eax, 0x8000000
je 0x10034ff7
push esi
lea eax, [ebp - 0x110]
mov byte [ebp - 0x110], 0
push 0x10469390
push eax
call fcn.10098560
add esp, 0xc
lea eax, [ebp - 0x110]
mov bl, 1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10034ff2
call edi
cmp eax, 0xb7
je 0x10034ff2
test byte [0x11cd302c], bl
jmp 0x10035087
mov eax, dword [0x11cd302c]
test al, 0xc0
je 0x100350b9
test al, 0x10
je 0x1003504a
push esi
lea eax, [ebp - 0x110]
mov byte [ebp - 0x110], 0
push 0x104693a0
push eax
call fcn.10098560
add esp, 0xc
lea eax, [ebp - 0x110]
mov bl, 1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10035045
call edi
cmp eax, 0xb7
je 0x10035045
test byte [0x11cd302c], bl
jmp 0x10035087
mov eax, dword [0x11cd302c]
test al, 0xc0
je 0x100350b9
test al, 0x20
je 0x100350b9
push esi
lea eax, [ebp - 0x110]
mov byte [ebp - 0x110], 0
push 0x104693c0
push eax
call fcn.10098560
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call fcn.10034e50
mov bl, al
test bl, bl
jne 0x100350b9
test byte [0x11cd302c], 1
je 0x100350a3
lea eax, [ebp - 0x110]
push eax
push 0x10469360
push dword [esi + 0x81c]
call fcn.1003a100
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
movzx eax, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x1003e430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4024
call fcn.10451050
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4000]
push edi
push 0x3ffc
push 0
push eax
mov ebx, edx
mov dword [ebp - 0x4010], 0
mov edi, ecx
call fcn.10425c00
add esp, 0xc
mov dword [ebp - 0x4014], 0
xorps xmm0, xmm0
mov dword [ebp - 0x4004], 0x4e
movups xmmword [ebp - 0x4024], xmm0
mov dword [ebp - 0x4008], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp + 0x10]
lea edx, [ebp - 0x4008]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x4004]
push esi
push ebx
push edi
call fcn.1003e2a0
test al, al
je 0x1003e52e
push 0
push 0x40000000
push 3
push 0
push 0
push 0x40000000
push 0x1046a450
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003e52e
push 0
push 0
lea eax, [ebp - 0x400c]
mov dword [ebp - 0x400c], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1003e527
lea eax, [ebp - 0x4024]
push eax
lea eax, [ebp - 0x4010]
push eax
mov eax, dword [ebp - 0x4008]
add eax, eax
push eax
lea eax, [ebp - 0x4004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003ef50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
sub eax, 0
je 0x1003f01a
sub eax, 1
jne 0x1003f0b8
mov edi, dword [ebx + 8]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x10]
mov ecx, esi
sub ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, edx
sbb eax, dword [edi + 4]
add dword [edi + 8], ecx
mov dword [edi + 4], edx
adc dword [edi + 0xc], eax
mov dword [edi], esi
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + 8]
add dword [ebx + 0x10], eax
mov eax, dword [ecx + 0xc]
adc dword [ebx + 0x14], eax
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
call fcn.104511a0
movaps xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x11d0d388]
movlpd qword [esp + 0x10], xmm0
movsd xmm0, qword [0x1122d530]
comisd xmm1, xmm0
jb 0x1003eff6
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x1003eff6
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esi, 0
adc edi, 0x80000000
jmp 0x1003effe
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
movaps xmm0, xmm1
call fcn.104510f0
add eax, esi
mov dword [ebx + 0x48], eax
adc edx, edi
mov dword [esp + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebx + 8]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x10]
mov ecx, esi
sub ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, edx
sbb eax, dword [edi + 4]
add dword [edi + 8], ecx
mov dword [edi + 4], edx
adc dword [edi + 0xc], eax
mov dword [edi], esi
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + 8]
add dword [ebx + 0x10], eax
mov eax, dword [ecx + 0xc]
adc dword [ebx + 0x14], eax
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
call fcn.104511a0
movaps xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x11d0d388]
movlpd qword [esp + 0x10], xmm0
movsd xmm0, qword [0x1122d530]
comisd xmm1, xmm0
jb 0x1003f09d
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x1003f09d
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esi, 0
adc edi, 0x80000000
jmp 0x1003f0a5
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
movaps xmm0, xmm1
call fcn.104510f0
add eax, esi
mov dword [ebx + 0x44], eax
adc edx, edi
mov dword [esp + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003fc70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
call ebx
test esi, esi
je 0x1003fd76
movzx eax, word [esi]
cmp eax, 0x5c
je 0x1003fcc9
cmp eax, 0x2f
je 0x1003fcc9
push eax
call fcn.1043a2f0
add esp, 4
test eax, eax
je 0x1003fd76
cmp word [esi + 2], 0x3a
jne 0x1003fd76
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x1003fcc9
cmp eax, 0x2f
jne 0x1003fd76
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003fd67
test al, 0x50
jne 0x1003fd67
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1003fd0e
push 0x20
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 4]
mov dword [ebp - 4], edi
mov ecx, esi
call fcn.100417e0
test eax, eax
je 0x1003fd3a
cmp dword [ebp - 4], edi
jne 0x1003fd2d
push 0x80092009
call ebx
jmp 0x1003fd3a
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp dword [ebp - 8], 0
je 0x1003fd54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
test edi, edi
je 0x1003fd7d
push 0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x7e
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xa0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003fd90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
test edi, edi
je 0x1003fe57
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call esi
mov ecx, edi
mov edx, eax
mov dword [ebp - 4], edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fdc0
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x1003fdf2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
cmp word [ebx + esi*2 - 2], 0x5c
je 0x1003fe0c
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
mov ecx, edi
xor edx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fe16
sub ecx, dword [ebp - 4]
sar ecx, 1
je 0x1003fe57
lea esi, [ebx + esi*2]
nop dword [eax + eax]
mov ax, word [edi + edx*2]
lea esi, [esi + 2]
mov word [esi - 2], ax
inc edx
mov eax, edi
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003fe41
sub eax, ebx
sar eax, 1
cmp edx, eax
jb 0x1003fe30
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003fff0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ecx
xor esi, esi
mov dword [ebp - 0x14], 0
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], 0x26
mov dword [ebp - 8], 0x2a
cmp dword [0x11d220c8], ebx
jne 0x10040094
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push 3
push 1
push 3
push 2
push ebx
push ebx
call edi
push edx
push eax
call edi
push edx
push eax
call edi
push edx
push eax
push 0x23
xor ecx, ecx
mov dword [0x11d220c8], 0x11c
push 0x11d220c8
mov dword [0x11d220cc], 6
mov dword [0x11d220d0], 1
mov word [0x11d221dc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ecx, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [0x11cd3034], eax
jmp 0x10040099
mov eax, dword [0x11cd3034]
test eax, eax
je 0x100400b3
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x100401e2
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
test edi, edi
je 0x100401e2
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100401e2
push 0
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, eax
jbe 0x100401e2
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov ecx, dword [ebp + ebx*4 - 0x10]
cmp ecx, 0x26
jne 0x10040177
push 0
push 0
push 0x1046a5d0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
xor esi, esi
test edi, edi
je 0x100401df
lea ecx, [edi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x100401df
push edi
push esi
push 0x1046a5d0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp edi, eax
jne 0x100401df
push esi
push 0x1046a5d0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10040184
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call edi
mov ecx, 0x26
call fcn.1003fe60
mov esi, eax
test esi, esi
je 0x100401df
jmp 0x100401a1
cmp word [esi + edi*2 - 4], 0x5c
je 0x1004019b
push 0x1046a5c0
lea edx, [edi + 1]
mov ecx, esi
call fcn.1003f500
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100401a6
sub ecx, edx
sar ecx, 1
push ecx
push esi
push dword [ebp - 0x14]
call fcn.10433fe8
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x100401df
push esi
call edi
inc ebx
xor esi, esi
cmp ebx, 3
jl 0x10040106
mov ebx, dword [ebp - 0x1c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x1004b0d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x11d0c5b8]
sub esp, 0x10
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [eax + ecx*4]
push edi
cmp byte [esi + 8], 0
jne 0x1004b0f6
call fcn.10450c0b
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0xbe2c]
test byte [eax + 0xf5c], 4
je 0x1004b165
cmp byte [esi + 8], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
jne 0x1004b124
call fcn.10450c0b
mov eax, dword [esi + 0x10]
mov edi, dword [eax + 0xbe2c]
mov eax, dword [edi]
cmp dword [eax + 0xd45c], 1
jne 0x1004b156
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov eax, dword [edi + 0x1128]
lea ecx, [ebp + 8]
push ecx
jmp 0x1004b1a2
mov eax, dword [edi + 0x1128]
lea ecx, [ebp + 8]
push ecx
jmp 0x1004b1f5
cmp byte [esi + 8], 0
jne 0x1004b173
call fcn.10450c0b
mov eax, dword [esi + 0x10]
mov edi, dword [eax + 0xbe2c]
mov eax, dword [edi]
cmp dword [eax + 0xd45c], 1
jne 0x1004b1ec
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov eax, dword [edi + 0x10b0]
push dword [ebp + 8]
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
mov ebx, eax
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0xc], xmm0
push eax
call esi
mov ecx, dword [ebp - 0xc]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 8]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x10b0]
push dword [ebp + 8]
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
pop edi
mov ebx, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ea50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x30]
test edx, edx
jne 0x1004eb3c
mov edx, dword [0x11d0c5b8]
xor ecx, ecx
mov eax, dword fs:[0x2c]
mov edi, dword [eax + edx*4]
mov edx, 4
mov dword [esp + 0xc], edi
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0xf944]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10450898
mov ecx, eax
add esp, 4
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x1004eb31
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0xf944]
shl eax, 2
push eax
push 0
push ecx
call fcn.10425c00
mov ecx, dword [esp + 0x18]
xor edi, edi
add esp, 0xc
mov ecx, dword [ecx + 0x10]
cmp dword [ecx + 0xf944], edi
jbe 0x1004eb85
mov ecx, dword [ecx + 0xbe2c]
cmp edi, ebx
sete al
movzx eax, al
push eax
call fcn.101d2be0
mov ecx, eax
mov eax, dword [esi + 0x30]
mov dword [eax + edi*4], ecx
mov eax, dword [esi + 0x30]
cmp dword [eax + edi*4], 0
je 0x1004eb26
movzx eax, byte [esi + 0x2c]
bts eax, edi
inc edi
mov byte [esi + 0x2c], al
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x10]
cmp edi, dword [ecx + 0xf944]
jb 0x1004eae2
jmp 0x1004eb85
mov ecx, esi
call fcn.1004ee00
mov byte [esi + 0x2c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
je 0x1004eb85
mov eax, 1
mov ecx, ebx
shl eax, cl
test byte [esi + 0x2c], al
je 0x1004eb85
mov eax, dword [edx + ebx*4]
mov ecx, dword [0x11d0c5b8]
mov dword [esp + 0xc], eax
mov eax, dword fs:[0x2c]
push 1
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0xbe2c]
lea eax, [esp + 0x10]
push eax
push ebx
push dword [ecx + 0x11d8]
call fcn.101d3000
movzx ecx, byte [esi + 0x2c]
mov eax, dword [esi + 0x30]
bts ecx, ebx
pop edi
mov byte [esi + 0x2c], cl
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004ee00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x1004ee3a
mov ecx, dword fs:[0x2c]
push eax
mov eax, dword [0x11d0c5b8]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0xbe2c]
call fcn.101d2ce0
mov dword [ebx + 0x34], 0
cmp dword [ebx + 0x30], 0
je 0x1004ef3c
mov ecx, dword fs:[0x2c]
xor edi, edi
mov eax, dword [0x11d0c5b8]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0xf944], edi
jbe 0x1004ef2a
mov edx, dword fs:[0x2c]
nop
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1004ef0e
mov esi, dword [ecx + 0xbe2c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp dword [eax + 0xd45c], 1
jne 0x1004eeec
lea eax, [esi + 0x1428]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0x10d4]
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0x11cc]
call eax
push eax
push ecx
mov ecx, esi
call fcn.101c9e10
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [esi + 0x1428]
mov eax, dword [ebp - 0xc]
sbb eax, dword [esi + 0x142c]
add dword [esi + 0x1420], ecx
adc dword [esi + 0x1424], eax
jmp 0x1004ef07
mov eax, dword [esi + 0x10d4]
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0x11cc]
call eax
push eax
push ecx
mov ecx, esi
call fcn.101c9e10
mov edx, dword fs:[0x2c]
mov ecx, dword [0x11d0c5b8]
inc edi
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 0x10]
cmp edi, dword [ecx + 0xf944]
jb 0x1004ee70
push dword [ebx + 0x30]
call fcn.10450877
add esp, 4
mov dword [ebx + 0x30], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005cc60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [0x11d0c5b8]
xor esi, esi
mov eax, dword fs:[0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [eax + ecx*4]
mov ecx, dword [ebx + 0x10]
mov eax, 0x3e8
test ecx, ecx
je 0x1005cca6
add dword [ecx + 0xd84c], eax
pause
dec eax
test eax, 0xfffff
jne 0x1005cca6
lea eax, [ebp - 0x18]
push eax
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x1005ccd0
add dword [ecx + 0xd84c], eax
nop dword [eax]
pause
dec eax
test eax, 0xfffff
jne 0x1005ccd0
lea eax, [ebp - 0x10]
push eax
call edi
test byte [0x11d0c74c], 1
je 0x1005ccee
call fcn.1028da30
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sbb edx, dword [ebp - 0x14]
call fcn.10451200
movaps xmm1, xmm0
movd xmm0, dword [ebp - 4]
cvtdq2pd xmm0, xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
divsd xmm1, xmm0
movsd qword [ebp - 0x28], xmm1
call fcn.10451200
divsd xmm0, qword [0x1122d4a8]
movsd xmm1, qword [ebp - 0x28]
divsd xmm1, xmm0
movsd xmm0, qword [0x1122d2d8]
comisd xmm0, xmm1
jbe 0x1005cd48
comisd xmm1, xmmword [0x1122d1f0]
ja 0x1005cd5e
inc esi
cmp esi, 3
jb 0x1005cc91
mov eax, 0x40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
divsd xmm0, xmm1
call fcn.104510f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [0x11d0c5b8]
mov word [esi + 0x10], ax
mov eax, dword [esi + 0x10]
and eax, 0x9400ffff
mov dword [esi], 0x11228390
or eax, 0x14000000
mov dword [esi + 8], 0
mov dword [esi + 0x10], eax
mov eax, dword fs:[0x2c]
mov dword [esi + 0xc], 0
mov dword [esi + 4], 1
mov edx, dword [eax + ecx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xbe30]
mov eax, dword [ebp + 0xc]
and byte [esi + 0x54], 0xc0
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 8], ecx
mov dword [esi + 0x14], 0
mov dword [esi], 0x11227f50
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov word [esi + 0x2c], ax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
cmp byte [ebp + 8], al
je 0x1006f9d5
test ecx, ecx
jne 0x1006f9d5
mov ecx, dword [edx + 0x10]
add ecx, 0x3066c
push ecx
call fcn.1007ba40
test eax, eax
je 0x1006f9d5
inc dword [eax + 0xb98]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
cmp edx, 0x10024f90
jne 0x1006f9d0
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop ecx
pop ebp
ret 8
push eax
mov ecx, esi
call edx
mov eax, esi
pop esi
pop ecx
pop ebp
ret 8
Function at 0x10072340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [0x11d0c5b8]
push edi
push 0x2c0
mov word [esi + 0x10], ax
lea edi, [esi + 0x30]
mov eax, dword [esi + 0x10]
and eax, 0xac00ffff
mov dword [esi], 0x11228390
or eax, 0x2c000000
mov dword [esi + 8], 0
mov dword [esi + 0x10], eax
mov eax, dword fs:[0x2c]
mov dword [esi + 0xc], 0
mov dword [esi + 4], 1
push 0
mov ebx, dword [eax + ecx*4]
push edi
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0xbe30]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], eax
mov dword [esi], 0x11228050
call fcn.10425c00
mov eax, 0x14
add esp, 0xc
mov word [edi + 0x10], ax
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + 0x7b30], 0
jne 0x100723db
mov dword [ecx + 0x7b30], edi
mov eax, dword [ecx + 0x7b2c]
test eax, eax
je 0x100723e7
mov dword [eax], edi
mov dword [edi], 0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x7b2c]
mov dword [edi + 4], eax
inc dword [ecx + 0x7b34]
mov dword [ecx + 0x7b2c], edi
mov ecx, dword [ebx + 0x10]
add ecx, 0x3066c
cmp dword [esi + 8], 0
jne 0x10072441
push ecx
call fcn.1007ba40
test eax, eax
je 0x10072441
inc dword [eax + 0xb98]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
cmp edx, 0x10024f90
jne 0x1007243c
mov dword [esi + 8], eax
jmp 0x10072441
push eax
mov ecx, esi
call edx
xor eax, eax
mov byte [esi + 0x1c], 0
and byte [esi + 0x1d], 0xf0
mov word [esi + 0x1e], ax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x10]
pop edi
mov eax, dword [eax + 0x7d14]
mov dword [esi + 0x24], eax
mov eax, esi
mov dword [esi + 0x2f0], 0
mov dword [esi + 0x2f4], 0
mov dword [esi + 0x2f8], 0
mov dword [esi + 0x2fc], 0
pop esi
pop ebx
pop ebp
ret 4