joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x1029926d], 1
jne 0x10022a4b
mov byte [0x1029926d], 0
mov dword [0xe8cb3c], 0
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10297b88]
cmp eax, 0x5dc
jae 0x10022a66
mov byte [0x1029926d], 0
ret
mov ecx, 0x10297260
call fcn.1006f3c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10299268], eax
mov byte [0x1029926d], 1
mov dword [0xe8cb3c], 1
ret
Function at 0x10023fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x102bc134], 2
je 0x100240d2
push esi
push edi
push 0x15
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 0x21
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 1
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 0x49
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 0x4f
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 0xe
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 7
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x100240d0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10298488]
cmp eax, 0x3e8
jb 0x100240d0
call esi
cmp byte [0x1029848d], 1
mov dword [0x10298488], eax
jne 0x10024082
pop edi
mov byte [0x1029848d], 0
mov dword [0xe8cb3c], 0
pop esi
ret
mov ecx, 0x10297260
call fcn.1006f3c0
mov eax, 0x1084cda0
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x1084d3e0
jl 0x10024091
mov dword [0x1084cd98], 0
mov dword [0x1084d3f0], 0
mov dword [0x1084d3e0], 2
mov byte [0x1029848d], 1
mov dword [0xe8cb3c], 1
pop edi
pop esi
ret
Function at 0x10027780
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10297be8]
cmp eax, 0x5dc
jb 0x10027805
cmp byte [0x10297bed], 1
jne 0x100277bb
mov byte [0x10297bed], 0
mov dword [0xe8cb3c], 0
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [0x1085aefc]
lea ecx, [ebp - 8]
mov dword [ebp - 7], 0
mov edx, 6
mov byte [ebp - 3], 0
mov dword [ebp - 8], 0xd0f306c1
mov byte [ebp - 4], al
mov byte [ebp - 3], 0
call fcn.100aba10
call esi
mov dword [0x1085af00], eax
call esi
mov dword [0x10297be8], eax
mov byte [0x10297bed], 1
mov dword [0xe8cb3c], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x102bc1e4], 2
jne 0x1002fa5a
push esi
push edi
push 0x39
mov edi, 0x861110
call edi
mov esi, 0x85ec20
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0xc
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x15
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x21
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 1
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x49
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x4f
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0xe
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 8
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 7
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x41
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
push 0x16
call edi
mov ecx, eax
call esi
test al, al
jne 0x1002fa58
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10297ca8]
cmp eax, 0x3e8
jb 0x1002fa58
call esi
cmp byte [0x10297cad], 1
mov dword [0x10297ca8], eax
jne 0x1002f9df
pop edi
mov byte [0x10297cad], 0
mov dword [0xe8cb3c], 0
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x10297260
call fcn.1006f3c0
push 0xd
call edi
mov edx, 0x85ec50
mov ecx, eax
call edx
push 0x10
call edi
mov edx, 0x85f9a0
mov ecx, eax
call edx
mov dword [ebp - 7], 0
lea ecx, [ebp - 8]
mov edx, 5
mov dword [ebp - 8], 0xe8f305c1
mov byte [ebp - 4], 4
call fcn.100aba10
call esi
mov dword [0x1011d8e8], eax
mov byte [0x10297cad], 1
mov dword [0xe8cb3c], 1
mov dword [0x1011d8c4], 0
mov dword [0x1011d8c8], 0xffffffff
mov dword [0x1011d8cc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x102bc1e4], 1
jne 0x1002f8c0
push esi
push edi
push 0x39
mov edi, 0x861110
call edi
mov esi, 0x85ec20
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0xc
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x15
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x21
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 1
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x49
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x4f
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0xe
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 8
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 7
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x41
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
push 0x16
call edi
mov ecx, eax
call esi
test al, al
jne 0x1003274f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1029aa68]
cmp eax, 0x1f4
jb 0x1003274f
call esi
cmp byte [0x1029aa6d], 1
mov dword [0x1029aa68], eax
jne 0x1003271a
pop edi
mov byte [0x1029aa6d], 0
mov dword [0xe8cb3c], 0
pop esi
ret
mov ecx, 0x10297260
call fcn.1006f3c0
push 0xd
call edi
mov edx, 0x85ec50
mov ecx, eax
call edx
push 0x10
call edi
mov edx, 0x85f9a0
mov ecx, eax
call edx
mov byte [0x1029aa6d], 1
mov dword [0xe8cb3c], 1
pop edi
pop esi
ret
Function at 0x10035f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 9
mov edi, 0x861110
call edi
mov ebx, 0x85ec20
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 8
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 0xc
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 7
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 0xe
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 0xf
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 0x3c
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push 0x3d
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036077
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10297d08]
cmp eax, 0x5dc
jb 0x10036076
cmp byte [0x10297d0d], 1
jne 0x10036019
pop esi
pop edi
mov byte [0x10297d0d], 0
mov dword [0xe8cb3c], 0
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x1085efd0]
lea ecx, [ebp - 8]
mov dword [ebp - 7], 0
add al, 5
mov edx, 5
mov dword [ebp - 8], 0xe8f305c1
mov byte [ebp - 4], al
call fcn.100aba10
call esi
mov dword [0x1085efd8], eax
call esi
mov dword [0x10297d08], eax
mov byte [0x10297d0d], 1
push 0xd
mov dword [0xe8cb3c], 1
call edi
mov ecx, eax
call ebx
test al, al
jne 0x10036076
push 0xd
call edi
mov edx, 0x85ec50
mov ecx, eax
call edx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100378b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push fcn.10037cc0
push 0x520ecf
push 0xe8
call fcn.100b54d0
push fcn.10037cc0
push 0x520f1f
push 0xe8
call fcn.100b54d0
push fcn.10037cc0
push 0x63e743
push 0xe8
call fcn.100b54d0
push fcn.10037cc0
push 0x640eb2
push 0xe8
call fcn.100b54d0
push fcn.10037cc0
push 0x7d2dd9
push 0xe8
call fcn.100b54d0
push fcn.10037cc0
push 0x7e6c0f
push 0xe8
call fcn.100b54d0
add esp, 0x48
push fcn.10037cc0
push 0x84aef7
push 0xe8
call fcn.100b54d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
add esp, 0xc
push eax
push 0x40
push 0x83
push 0x47fc85
call esi
push 0x83
push 0x90
push 0x47fc85
call fcn.100b99d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x83
push 0x47fc85
call esi
push 0x10036080
push 0x47fc85
push 0xe9
call fcn.100b54d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
mov byte [0x62ebf8], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
mov byte [0x62ebfe], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
mov byte [0x62ee42], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
mov byte [0x62ee48], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
mov byte [0x62eee5], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
mov byte [0x62eeeb], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
mov byte [0x62ebf7], 0x77
push eax
push dword [ebp - 4]
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
mov byte [0x62ee41], 0x77
push eax
push dword [ebp - 4]
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea eax, [ebp - 4]
mov byte [0x62eee4], 0x77
push eax
push dword [ebp - 4]
push 1
push 0x62eee4
call esi
push 0x100374b0
push 0x4dada4
push 0xe8
call fcn.100b54d0
push 0x10037b30
push 0x542ef0
push 0xe9
call fcn.100b54d0
add esp, 0x18
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1003f150
push 0x868986
push 0xe8
call fcn.100b54d0
push 0x1003f8b0
push 0x8685c0
push 0xe9
call fcn.100b54d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
add esp, 0x18
push eax
push 0x40
push 0x20b
push 0x8689a0
call esi
push 0x20b
push 0x90
push 0x8689a0
call fcn.100b99d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x20b
push 0x8689a0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0xb4
push 0x868cf0
call esi
push 0xb4
push 0x90
push 0x868cf0
call fcn.100b99d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xb4
push 0x868cf0
call esi
cmp dword [0x102bc29c], 0
je 0x1003803a
push 0x1003f0f0
push 0x772960
push 0xe8
call fcn.100b54d0
push 0x1003f110
push 0x7729b3
push 0xe8
call fcn.100b54d0
push 0x10038090
push 0x8494b0
push 0xe9
call fcn.100b54d0
add esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x40
push 0x2a4
push 0x849730
call esi
push 0x2a4
push 0x90
push 0x849730
call fcn.100b99d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x2a4
push 0x849730
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x3b7
push 0x8499e0
call esi
push 0x3b7
push 0x90
push 0x8499e0
call fcn.100b99d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x3b7
push 0x8499e0
call esi
push 0x10037d80
push 0x8490f5
push 0xe8
call fcn.100b54d0
push 0x10037db0
push 0x848e5d
push 0xe8
call fcn.100b54d0
push 0x10037db0
push 0x848eb2
push 0xe8
call fcn.100b54d0
push 0x10037db0
push 0x848f07
push 0xe8
call fcn.100b54d0
push 0x10037dc0
push 0x848f4b
push 0xe8
call fcn.100b54d0
push 0x10037db0
push 0x849087
push 0xe8
call fcn.100b54d0
add esp, 0x48
push 0x848e31
push 0x848e09
push 0xe9
call fcn.100b54d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x849007
call esi
lea eax, [ebp - 4]
mov byte [0x849007], 0x5a
push eax
push dword [ebp - 4]
push 1
push 0x849007
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003ebc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0xe60974], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1003ed61
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [0xe61e58], edi
mov dword [0xe61e5c], esi
movd xmm0, edi
cvtdq2pd xmm0, xmm0
push 0x116
lea eax, [esi + 0x1e]
push eax
push edi
push 0
push 0
divsd xmm0, qword [0x100e7390]
push 0
push dword [0xe8c578]
cvtpd2ps xmm0, xmm0
movss dword [0xe7c3d4], xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x100e7360]
cvtpd2ps xmm0, xmm0
movss dword [0xe7c3d8], xmm0
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 0x630bc0
call eax
push 1
mov eax, 0x596ac0
call eax
add esp, 4
mov eax, 0x482b70
call eax
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov eax, 0x407b20
call eax
mov dword [eax + 0x28], edi
mov edi, 0x861110
mov dword [eax + 0x2c], esi
call edi
mov esi, eax
mov eax, 0x785870
push 0x17e
push 0
push dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push dword [esi]
call eax
call edi
mov edx, 0x861ac0
mov ecx, eax
call edx
mov edx, 0x7f0d40
mov ecx, eax
call edx
mov ecx, dword [esi + 0x138]
mov eax, 0x7f0c80
push 0
push 0x1c2
push dword [esi]
call eax
mov eax, dword [0x107d6e58]
push 1
mov dword [0x81c0380], eax
mov eax, 0x830b70
mov ecx, dword [esi + 0xb4]
push 1
push dword [esi]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push 0xd2c848
call esi
movsd xmm0, qword [0x100e73a0]
lea eax, [ebp + 8]
push eax
movsd qword [0xd2c848], xmm0
push dword [ebp + 8]
push 8
push 0xd2c848
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push 0xd2c898
call esi
movsd xmm0, qword [0x100e7398]
lea eax, [ebp + 8]
push eax
movsd qword [0xd2c898], xmm0
push dword [ebp + 8]
push 8
push 0xd2c898
call esi
mov eax, dword [0x102bc1bc]
cmp eax, 4
jne 0x1003ed4a
push eax
mov ecx, ebx
call fcn.1003d7f0
mov eax, dword [0x102bc1bc]
cmp eax, 1
je 0x1003ed59
cmp eax, 2
je 0x1003ed59
cmp eax, 3
jne 0x1003ed61
push eax
mov ecx, ebx
call fcn.1003d7f0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x10040200
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100ef018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push 0xff
push 0
push eax
call fcn.100b99d0
add esp, 0xc
push 0x100e2a7c
push esi
call fcn.100bb12a
add esp, 8
mov dword [ebp - 0x3e8], eax
test eax, eax
je 0x1004043b
mov esi, eax
lea eax, [ebp - 0x3fc]
push esi
push 1
push 6
push eax
call fcn.100bb474
mov eax, 0x5447
add esp, 0x10
cmp word [ebp - 0x3fc], ax
jne 0x1004041f
xor eax, eax
mov dword [ebp - 0x3f4], 0
cmp ax, word [ebp - 0x3fa]
jge 0x1004041f
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x3e4], 0xcffc
mov byte [ebp - 0x3e2], 0xab
nop
push esi
push 1
lea eax, [ebp - 0x3f0]
push 8
push eax
call fcn.100bb474
mov eax, dword [ebp - 0x3ec]
inc eax
push eax
call fcn.100b7ea1
add esp, 0x14
mov ebx, eax
push esi
push dword [ebp - 0x3ec]
push 1
push ebx
call fcn.100bb474
mov esi, dword [ebp - 0x3ec]
add esp, 0x10
xor ecx, ecx
test esi, esi
jle 0x10040306
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [ebp + edx - 0x3e4]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jl 0x100402e1
mov esi, dword [ebp - 0x3ec]
mov byte [esi + ebx], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x3ec]
push ebx
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x268]
push 0x15e
push eax
call fcn.100bf2ed
add esp, 0xc
cmp edi, 1
jne 0x10040376
mov eax, dword [ebp - 0x270]
lea esi, [ebp - 0x270]
mov dword [ebp - 0x3e0], eax
lea edi, [ebp - 0x3dc]
lea eax, [ebp - 0x3e0]
mov ecx, 0x5a
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x404]
mov ecx, 0x101cf39c
push eax
call fcn.100404e0
mov edi, dword [ebp + 0xc]
cmp edi, 2
jne 0x100403b5
mov eax, dword [ebp - 0x270]
lea esi, [ebp - 0x270]
mov dword [ebp - 0x3e0], eax
lea edi, [ebp - 0x3dc]
lea eax, [ebp - 0x3e0]
mov ecx, 0x5a
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40c]
mov ecx, 0x101cf38c
push eax
call fcn.100404e0
mov edi, dword [ebp + 0xc]
cmp edi, 3
jne 0x100403f4
mov eax, dword [ebp - 0x270]
lea esi, [ebp - 0x270]
mov dword [ebp - 0x3e0], eax
lea edi, [ebp - 0x3dc]
lea eax, [ebp - 0x3e0]
mov ecx, 0x5a
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x414]
mov ecx, 0x101cf394
push eax
call fcn.100404e0
mov edi, dword [ebp + 0xc]
push ebx
call fcn.100b7eaa
mov ecx, dword [ebp - 0x3f4]
add esp, 4
movsx eax, word [ebp - 0x3fa]
inc ecx
mov esi, dword [ebp - 0x3e8]
mov dword [ebp - 0x3f4], ecx
cmp ecx, eax
jl 0x100402a0
push esi
call fcn.100bb20a
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b7755
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x108]
push str._s___File_not_exist.
push eax
call fcn.10010150
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0
push eax
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b7755
mov esp, ebp
pop ebp
ret 8
Function at 0x10047e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push esi
push edi
call fcn.1006e7e0
test al, al
je 0x10047e46
push 0x22
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100480e9
call fcn.1006ed10
test al, al
jne 0x100480e9
cmp dword [0x1083d52c], 0
jl 0x10047fbd
push 1
mov edi, 0x635fd0
call edi
mov esi, dword [sym.imp.OPENGL32.dll_glColor4f]
mov dword [esp], 0x3f4ccccd
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
movd xmm0, dword [0x107dce40]
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
push 0
sub esp, 0x14
addss xmm0, dword [0x100e7820]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41700000
mov dword [esp + 8], 0x43160000
mov dword [esp + 4], 0
movss dword [esp], xmm0
call eax
mov eax, 0x636070
call eax
lea eax, [edi - 0x80]
call eax
add esp, 8
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call esi
push 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
call esi
mov ecx, dword [0x1083d534]
sub eax, dword [0x1083d538]
inc ecx
mov dword [0x1083d534], ecx
cmp eax, 0x3e8
jbe 0x10047f46
mov dword [0x1083d530], ecx
mov dword [0x1083d534], 0
call esi
mov dword [0x1083d538], eax
push dword [0x1083d52c]
mov ecx, 0x101a8848
push 0xae
call fcn.1003fea0
push eax
mov eax, dword [0x107dce40]
push 1
push 0x64
push 4
add eax, 0x1f4
push eax
push 0xff19bdff
push 0x10297260
call fcn.1006a050
add esp, 0x20
mov ecx, 0x101a8848
push dword [0x1083d524]
push 0xaf
call fcn.1003fea0
push eax
mov eax, dword [0x107dce40]
push 1
push 0x64
push 4
add eax, 0x226
push eax
push 0xff19bdff
push 0x10297260
call fcn.1006a050
add esp, 0x20
jmp 0x100480b0
cmp dword [0x102bc1c4], 2
jne 0x100480e9
push 1
mov edi, 0x635fd0
call edi
mov esi, dword [sym.imp.OPENGL32.dll_glColor4f]
mov dword [esp], 0x3f4ccccd
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
movd xmm0, dword [0x107dce40]
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
push 0
sub esp, 0x14
addss xmm0, dword [0x100e784c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41700000
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0
movss dword [esp], xmm0
call eax
mov eax, 0x636070
call eax
lea eax, [edi - 0x80]
call eax
add esp, 8
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call esi
push 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
call esi
mov ecx, dword [0x1083d534]
sub eax, dword [0x1083d538]
inc ecx
mov dword [0x1083d534], ecx
cmp eax, 0x3e8
jbe 0x100480b0
mov dword [0x1083d530], ecx
mov dword [0x1083d534], 0
call esi
mov dword [0x1083d538], eax
push dword [0x1083d530]
mov ecx, 0x101a8848
push 0xb0
call fcn.1003fea0
push eax
mov eax, dword [0x107dce40]
push 1
push 0x64
push 4
add eax, 0x258
push eax
push 0xff19bdff
push 0x10297260
call fcn.1006a050
add esp, 0x20
pop edi
pop esi
pop ecx
ret
Function at 0x100483f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x100ef018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x10898cb0]
mov esi, 0x861110
push 7
call esi
mov ebx, 0x85ec20
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 8
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 0xc
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 0xe
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 0xf
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 0x41
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
push 0x4e
call esi
mov ecx, eax
call ebx
test al, al
jne 0x100485c9
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x102bc224]
add ecx, dword [0x1023b724]
cmp eax, ecx
jbe 0x100485c9
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
call esi
bt ax, 0xf
jae 0x100485c9
push 0x10
call esi
bt ax, 0xf
jae 0x100485c9
push 0x59
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.100b99d0
push dword [0x7e452a]
lea eax, [ebp - 0x60]
push 0x59
push eax
call fcn.100bf2ed
add esp, 0x14
lea eax, [ebp - 0x60]
push str.Excellent
push eax
call fcn.10048280
push 0x59
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.100bebd0
add esp, 8
lea eax, [ebp - 0x60]
push str.Excelente
push eax
call fcn.10048280
push 0x59
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.100bebd0
add esp, 0xc
lea eax, [ebp - 0x60]
mov ecx, 0x101a8848
push eax
push 0x47
call fcn.1003fea0
push eax
lea eax, [ebp - 0x126]
push eax
call fcn.10048df0
mov ecx, dword [0x107dcee0]
add esp, 0xc
movq xmm0, qword [ecx]
movq qword [ebp - 0x131], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x129], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x127], al
test edi, edi
je 0x1004857f
mov esi, edi
mov ecx, 0x1a
lea edi, [ebp - 0xcd]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x100485a2
push 0x6b
lea eax, [ebp - 0xcd]
push 0
push eax
call fcn.100b99d0
add esp, 0xc
call fcn.100c014a
mov dword [eax], 0x16
call fcn.100bf1ad
mov edx, 0xd2
mov word [ebp - 0x134], 0xd2c1
lea ecx, [ebp - 0x134]
mov byte [ebp - 0x132], 0x78
call fcn.100aba10
call ebx
mov dword [0x1023b724], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b7755
mov esp, ebp
pop ebp
ret