joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006a60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b70f8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100d9f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 4]
mov dword [esi], 0x100c9a70
call fcn.10064df0
mov eax, 0x100dc684
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x5c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c4d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b70f8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100d9f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 4]
mov dword [esi], 0x100c9ca0
call fcn.10064df0
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov eax, 0x100dc684
mov dword [esi + 8], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x98], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10011390
Capabilities:
Read file via mapping

Disassembly:
push edi
push 0x100000
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
jne 0x100113be
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret
push 0
push 0
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
push 0x103
lea eax, [esi + 8]
push edi
push eax
mov dword [esi + 0x10c], 0x100000
call fcn.10049190
mov ecx, dword [esi + 4]
add esp, 0xc
push 0
push 0
push 0
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
test eax, eax
jne 0x10011412
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
mov eax, 1
ret

Function at 0x100131b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
mov edi, 0x16e1810
push edi
mov dword [esi], 0x16e1810
mov dword [esi + 4], 0x1002b520
call ebx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 1
push edi
mov byte [edi], 0xcc
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, esi
call fcn.100135b0
mov ecx, dword [esi + 4]
mov dword [eax], ecx
pop edi
mov byte [esi + 0x158], 1
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d5cb8
push 0x10052210
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d9f50]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebx + 5]
mov dword [ebp - 0x20], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push ebx
push esi
push edi
call fcn.1004af40
mov byte [edi + ebx], 0xe9
mov ecx, esi
sub ecx, edi
sub ecx, 5
mov dword [edi + ebx + 1], ecx
mov byte [esi], 0xe9
mov eax, dword [ebp + 8]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea edx, [ebx - 5]
push edx
push 0x90
lea eax, [esi + 5]
push eax
call fcn.1004c8a0
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push edi
call esi
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014770
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
add eax, 8
mov ebx, 0x10
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x108], 0
cmp dword [eax + 0x14], ebx
jb 0x100147a4
mov eax, dword [eax]
cmp dword [ecx + 0x14], ebx
jb 0x100147ab
mov ecx, dword [ecx]
cmp dword [edx + 0x14], ebx
jb 0x100147b2
mov edx, dword [edx]
cmp dword [edi + 0x14], ebx
jb 0x100147b9
mov edi, dword [edi]
push eax
push 0x100
lea eax, [ebp - 0x104]
push eax
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x104]
pop edi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
pop ebx
jmp 0x100147f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100147f0
sub eax, edx
push eax
lea ecx, [ebp - 0x104]
push ecx
mov ecx, esi
call fcn.100048f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.10047d85
mov esp, ebp
pop ebp
ret 8
Function at 0x10014970
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push esi
push edi
test eax, eax
je 0x10014998
push 0
push 2
call eax
mov esi, eax
jmp 0x1001499e
mov esi, dword [ebp - 0x134]
cmp esi, 0xffffffff
je 0x100149ee
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100149e7
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
call fcn.10049140
add esp, 8
test eax, eax
je 0x10014a00
lea edx, [ebp - 0x130]
push edx
push esi
call edi
test eax, eax
jne 0x100149c5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
pop edi
xor ecx, ebp
pop esi
call fcn.10047d85
mov esp, ebp
pop ebp
ret
Function at 0x10015890
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push str.ntdll.dll
mov edi, ecx
mov word [ebp - 0x5fc], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x100158cf
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push str.ZwQueryObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100158be
push esi
lea ecx, [ebp - 0xa14]
push ecx
push 0x20f
lea edx, [ebp - 0x214]
push edx
push 1
push edi
lea esi, [ebp - 0x804]
call eax
test eax, eax
je 0x10015914
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.__Device__LanmanRedirector
call ebx
push eax
lea eax, [ebp - 0x20c]
push str.__Device__LanmanRedirector
push eax
call fcn.100afd45
add esp, 0xc
test eax, eax
jne 0x10015960
push 0x100ca430
lea ecx, [ebp - 0x5fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.__Device__LanmanRedirector
call ebx
lea edx, [ebp + eax*2 - 0x20c]
jmp 0x10015a19
lea edx, [ebp - 0x804]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, 0x104
jb 0x1001598c
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x10015a27
nop
push 0x104
lea edx, [ebp - 0xa0c]
push edx
xor ecx, ecx
push esi
mov word [esi + edi*2 - 2], cx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x100159ef
cmp eax, 0x104
jge 0x100159ef
lea eax, [ebp - 0xa0c]
push eax
call ebx
push eax
lea ecx, [ebp - 0xa0c]
push ecx
lea edx, [ebp - 0x20c]
push edx
mov dword [ebp - 0xa10], eax
call fcn.100afd45
add esp, 0xc
test eax, eax
je 0x100159fe
lea esi, [esi + edi*2 + 2]
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x100159a0
jmp 0x10015a27
push esi
lea eax, [ebp - 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0xa10]
lea edx, [ebp + ecx*2 - 0x20c]
push edx
lea eax, [ebp - 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x5fc]
push ecx
mov ecx, 0x100e2338
call fcn.10014a20
mov ecx, dword [ebp - 4]
pop ebx
pop esi
xor ecx, ebp
mov eax, 0x100e2338
pop edi
call fcn.10047d85
mov esp, ebp
pop ebp
ret
Function at 0x10016d80
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7006
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100d9f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100dfe10]
mov ecx, eax
inc eax
mov dword [0x100dfe10], eax
test ecx, ecx
jne 0x10016ecb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100dfc7c], eax
cmp eax, 0xffffffff
jne 0x10016de2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100d5acc
lea edx, [ebp + 8]
mov dword [ebp + 8], eax
push edx
call fcn.1004ae38
push 0x18
call fcn.10047d9f
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x10016dff
push esi
call edi
jmp 0x10016e01
xor esi, esi
push 0x54
mov dword [0x100dfc80], esi
call fcn.10047d9f
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10016e3a
lea eax, [esi + 4]
push eax
mov dword [esi], 0x100ca458
call edi
mov byte [ebp - 4], 1
call fcn.10016f20
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
jmp 0x10016e3c
xor esi, esi
push 2
push ebx
push ebx
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [esi + 0x38]
push edi
mov dword [esi + 0x1c], 1
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x10016e86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push 0x100d5acc
lea eax, [ebp + 8]
push eax
call fcn.1004ae38
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x100dfc7c]
push esi
push ecx
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10016dcb
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10016ecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100d5acc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
push ecx
jmp 0x10016ddd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7f78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100d9f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, 0x10
cmp dword [ebp + 0x1c], edi
jae 0x1001b045
lea eax, [ebp + 8]
push 0x100c90c8
push eax
call fcn.1004860b
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001b05e
cmp dword [ebp + 0x1c], edi
jmp 0x1001b0c6
push 2
push 0
push esi
call fcn.10049829
lea edx, [ebp - 0x18]
push edx
push esi
call fcn.1004a792
mov ebx, dword [ebp - 0x18]
push 0
push 0
push esi
call fcn.10049829
lea eax, [ebx + 1]
push eax
call fcn.10035e95
push esi
push ebx
mov edi, eax
push 1
push edi
call fcn.10048e4e
push esi
mov byte [edi + ebx], 0
call fcn.10048883
mov eax, edi
add esp, 0x38
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001b0a6
mov ecx, dword [ebp - 0x10]
sub eax, edx
push eax
push edi
call fcn.100048f0
push edi
call fcn.10047d94
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x1001b0d4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10047d94
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x1001fdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100ca674]
mov ecx, dword [0x100ca678]
mov edx, dword [0x100ca67c]
mov dword [ebp - 0x14], eax
mov ax, word [0x100ca680]
mov dword [ebp - 0x10], ecx
mov cl, byte [0x100ca682]
mov dword [ebp - 0xc], edx
mov word [ebp - 8], ax
mov byte [ebp - 6], cl
test ebx, ebx
js 0x1001fe43
lea eax, [ebp - 0x14]
push edi
xor ecx, ecx
lea edi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001fe20
sub eax, edi
mov edi, eax
test ebx, ebx
jle 0x1001fe42
nop
mov eax, ecx
cdq
idiv edi
inc ecx
mov dl, byte [ebp + edx - 0x14]
xor byte [esi + ecx - 1], dl
cmp ecx, ebx
jl 0x1001fe30
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10047d85
mov esp, ebp
pop ebp
ret
Function at 0x1001fe60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edi, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
call fcn.10014ac0
mov eax, edi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001fe90
mov ecx, dword [str.sqlite.dll]
mov edx, dword [0x100ca688]
mov dword [eax], ecx
mov cx, word [0x100ca68c]
mov dword [eax + 4], edx
mov dl, byte [0x100ca68e]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x108]
push 0x100c90c8
push eax
call fcn.1004860b
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001fee7
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x108]
push 0x100c90c8
push ecx
call fcn.1004860b
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001ff07
or ebx, 0xffffffff
jmp 0x1001ff22
push 2
push 0
push edi
call fcn.10049829
push edi
call fcn.10049af6
push edi
mov ebx, eax
call fcn.10048883
add esp, 0x14
mov edi, dword [ebp - 0x10c]
push esi
push 1
push ebx
push edi
call fcn.10048e4e
push esi
call fcn.10048883
add esp, 0x14
mov esi, edi
call fcn.1001fdd0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.10047d85
mov esp, ebp
pop ebp
ret
Function at 0x10023bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0xe4]
mov ecx, esi
call edx
push 0x100ca788
push eax
call fcn.10048790
add esp, 8
test eax, eax
je 0x10023c1f
cmp edi, 0xcb
jne 0x10023bf4
mov edi, 0x1e
jmp 0x10023c1f
cmp edi, 0xcd
jne 0x10023c03
mov edi, 0x20
jmp 0x10023c1f
cmp edi, 0xc8
jne 0x10023c12
mov edi, 0x11
jmp 0x10023c1f
cmp edi, 0xd0
jne 0x10023c1f
mov edi, 0x1f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x58c], 0
mov dword [ebp - 4], eax
je 0x10023c5e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
ja 0x10023c5d
mov eax, dword [esi + 0x7b4]
push 0x64
mov byte [edi + eax], 0x80
call ebx
cmp dword [esi + 0x58c], 0
jne 0x10023c38
pop ebx
mov edx, dword [esi]
mov eax, dword [edx + 0xe0]
mov ecx, esi
call eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x100243d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx + 0x6b0]
mov edx, dword [ebx + 0x6b4]
sub edx, eax
xor ecx, ecx
sar edx, 2
push esi
push edi
mov dword [ebp - 4], ecx
test edx, edx
je 0x100244de
jmp 0x10024400
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x100244be
cmp dword [esi + 0x14], 0
je 0x100244be
lea edi, [esi + 0x18]
push 0x100ca800
push edi
call fcn.10048790
add esp, 8
test eax, eax
jne 0x10024437
cmp dword [ebx + 0x290], 0x1e
jb 0x100244be
sub esp, 0x1c
mov ecx, esp
mov eax, edi
lea edx, [eax + 1]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov dword [ebp - 0xc], esp
mov byte [ecx], 0
mov dword [ebp - 8], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10024458
sub eax, dword [ebp - 8]
push eax
push edi
call fcn.100048f0
lea edi, [ebx + 0x7d8]
call fcn.10001ec0
test al, al
je 0x100244be
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call edi
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jbe 0x100244be
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x10], eax
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x7b4]
push 0x3c
mov byte [esi + edx], 0x80
call edi
mov eax, dword [ebx + 0x7b4]
push 0x1e
mov byte [esi + eax], 0
call edi
mov eax, dword [ebx + 0x6b0]
mov edx, dword [ebx + 0x6b4]
mov ecx, dword [ebp - 4]
sub edx, eax
inc ecx
sar edx, 2
mov dword [ebp - 4], ecx
cmp ecx, edx
jb 0x10024400
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
call fcn.10024980
test eax, eax
je 0x10024c18
cmp dword [edi + 0x70c], 0
je 0x10024c18
call fcn.10023c80
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push edi
call fcn.10024a70
cmp dword [ebp - 0x10], 0
je 0x10024c18
mov ecx, dword [0x100e229c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], ecx
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x9c4
jbe 0x10024c18
call ebx
mov dword [0x100e229c], eax
mov eax, dword [edi + 0x208]
test esi, esi
jne 0x10024bf3
neg eax
add dword [ebp - 0x10], eax
push 0xa
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
mov ecx, edi
mov dword [ebp - 8], 0
call fcn.100244f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x71c], 0
je 0x10026faf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x58c], 0
mov dword [ebp - 4], eax
je 0x10026fa3
cmp dword [esi + 0x2ac], ebx
jne 0x10026f7f
cmp dword [esi + 0x2b0], edi
je 0x10026fa3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
mov edx, esi
cmp eax, 0xbb8
jbe 0x10026f97
mov eax, dword [ebp + 8]
push eax
jmp 0x10026f9b
mov ecx, dword [ebp + 8]
push ecx
push ebx
mov ecx, edi
call fcn.10026eb0
mov edx, dword [esi]
mov eax, dword [edx + 0xe0]
mov ecx, esi
call eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10028e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
lea edi, [ebp - 0x108]
mov ebx, ecx
mov dword [ebp - 0x10c], eax
call fcn.10014ac0
mov eax, edi
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10028e90
mov ecx, dword [0x100ca8c8]
mov edx, dword [0x100ca8cc]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [eax], ecx
mov ecx, dword [0x100ca8d0]
mov dword [eax + 4], edx
mov dl, byte [0x100ca8d4]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10c]
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x108]
push eax
push 0
push 0x100ca8d8
push ecx
call edi
lea edx, [ebp - 0x108]
push edx
push 0
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x10c]
push 0x100ca8e0
push eax
call edi
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x110]
push eax
mov ecx, esi
call edx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
push 0x1f4
call edi
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
add ecx, 3
push ecx
add edx, 2
push edx
mov ecx, esi
call eax
push 0x12c
call edi
mov eax, 0x2aaaaaab
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
mov ecx, eax
shl ecx, 4
add ecx, eax
lea ecx, [ecx + ecx + 0x1fd]
push ecx
lea eax, [eax + eax*2]
add eax, eax
sub ebx, eax
mov ecx, ebx
shl ecx, 5
sub ecx, ebx
add ecx, 0x268
push ecx
mov ecx, esi
call edx
push 0xc8
call edi
push 1
call dword [0x100dfb84]
push 0xc8
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10047d85
mov esp, ebp
pop ebp
ret 4
Function at 0x10028fb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edi, [ebp - 0x108]
mov esi, ecx
call fcn.10014ac0
mov eax, edi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10028fd5
mov ecx, dword [0x100ca8c8]
mov edx, dword [0x100ca8cc]
mov dword [eax], ecx
mov ecx, dword [0x100ca8d0]
mov dword [eax + 4], edx
mov dl, byte [0x100ca8d4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x108]
push eax
push 0
push 0x100ca8d8
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x100ca8e0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10c], eax
test edi, edi
jne 0x1002903e
test eax, eax
je 0x100290c6
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push 0x23e
push 0x15a
mov ecx, ebx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
push 1
call dword [0x100dfb88]
push 0x1f4
call esi
mov eax, dword [ebp - 0x10c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
push eax
push edi
mov ecx, ebx
call edx
push 0x1f4
call esi
push 1
call dword [0x100dfb88]
push 0x1f4
call esi
push 1
call dword [0x100dfb88]
push 0x1f4
call esi
mov eax, dword [ebx + 0x7b4]
push 0x3c
mov byte [eax + 1], 0x80
call esi
mov ecx, dword [ebx + 0x7b4]
push 0x1e
mov byte [ecx + 1], 0
call esi
push 0x1f4
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10047d85
mov esp, ebp
pop ebp
ret