joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008f580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.100889a0
mov edx, dword [eax + 4]
test edx, edx
je 0x1008f62d
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x1008f5fc
cmp eax, edx
jne 0x1008f5f4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1008f604
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x1008f604
cmp eax, edx
jne 0x1008f604
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 8]
mov eax, dword [edx + 4]
push 0x48
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.100a576e
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1008fc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfbf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.100889a0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1008fca8
mov dword [ebx], eax
xor al, al
jmp 0x1008fd9f
cmp dword [edi + 8], 0x15555555
je 0x1008fdb7
lea eax, [edi + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100a573e
mov esi, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov eax, dword [eax]
mov dword [esi + 8], eax
mov eax, dword [edi + 8]
fld dword [edi]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], eax
lea ecx, [eax + 1]
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
test ecx, ecx
jns 0x1008fd05
fadd dword [0x100d5b98]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test eax, eax
jns 0x1008fd1b
fadd dword [0x100d5b98]
fstp dword [ebp + 0xc]
fdiv dword [ebp + 0xc]
fcompi st(1)
fstp st(0)
ja 0x1008fd2f
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
jmp 0x1008fd56
push ecx
mov ecx, edi
call fcn.1008e4b0
push eax
mov ecx, edi
call fcn.1008e6b0
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100889a0
mov edx, dword [eax]
mov eax, dword [edi + 8]
mov ecx, dword [edx + 4]
inc eax
mov ebx, dword [ebp - 0x18]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 0xc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
jne 0x1008fd82
mov dword [ecx + eax*8], esi
jmp 0x1008fd94
cmp edi, edx
jne 0x1008fd8b
mov dword [ecx + eax*8], esi
jmp 0x1008fd98
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1008fd98
mov dword [ecx + eax*8 + 4], esi
mov ebx, dword [ebp + 8]
mov al, 1
mov dword [ebx], esi
mov byte [ebx + 4], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100a4817
int3
Function at 0x100908d0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
imul eax, edx, 0x70
push esi
lea esi, [ecx + 0x19]
mov dword [ebp - 8], ecx
push edi
mov edi, 4
add esi, eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
push edx
call fcn.100900d0
xor eax, eax
mov dword [esi - 0x19], eax
mov dword [esi - 0x15], eax
push eax
mov dword [esi - 0x11], eax
push 1
mov dword [esi - 0xd], eax
mov dword [esi - 9], eax
push 1
mov dword [esi - 5], eax
push eax
mov dword [esi - 1], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi - 5], eax
test eax, eax
je 0x10090997
push 0
push 0
push 0
push 0xe00
push 0xff
push 6
push 0x40000002
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi - 0x19], eax
cmp eax, 0xffffffff
je 0x10090997
lea ecx, [esi - 0x15]
mov byte [ecx + 0x14], 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10090997
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1009098f
cmp eax, 0x3e5
jne 0x10090997
mov byte [esi], 1
jmp 0x10090997
push dword [esi - 5]
mov byte [esi], 1
call ebx
mov ecx, dword [ebp - 8]
add esi, 0x1c
mov edx, dword [ebp + 8]
sub edi, 1
jne 0x100908f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10090c20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HidD_GetAttributes
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090c64
push 0x100924a0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090c64
push 0
push 0x1012f2e8
push 0x100924a0
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidD_GetPreparsedData
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090c99
push 0x10092500
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090c99
push 0
push 0x1012f2ec
push 0x10092500
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidD_FreePreparsedData
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090cce
push 0x10092470
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090cce
push 0
push 0x1012f2f0
push 0x10092470
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidD_GetProductString
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090d03
push 0x10092570
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090d03
push 0
push 0x1012f2f4
push 0x10092570
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetCaps
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090d38
push 0x100926a0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090d38
push 0
push 0x1012f2f8
push 0x100926a0
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetButtonCaps
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090d6d
push 0x10092600
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090d6d
push 0
push 0x1012f2fc
push 0x10092600
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetValueCaps
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090da2
push 0x100929c0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090da2
push 0
push 0x1012f300
push 0x100929c0
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_MaxDataListLength
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090dd7
push 0x10092b90
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090dd7
push 0
push 0x1012f304
push 0x10092b90
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetData
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090e0c
push 0x10092710
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090e0c
push 0
push 0x1012f308
push 0x10092710
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetUsages
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10090e41
push 0x100928e0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090e41
push 0
push 0x1012f30c
push 0x100928e0
push ebx
call fcn.100714b0
add esp, 0x10
push str.HidP_GetUsageValue
push esi
call edi
mov esi, eax
test esi, esi
je 0x10090e76
push 0x10092750
push esi
call fcn.10071f00
add esp, 8
test al, al
jne 0x10090e76
push 0
push 0x1012f310
push 0x10092750
push esi
call fcn.100714b0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100919d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfd5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push edi
push eax
mov ebx, ecx
mov ecx, 0x1010f4c8
push esi
call fcn.10082a70
mov eax, dword [ebp - 0x34]
mov ecx, 4
mov dword [ebp - 0x26], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e], eax
imul eax, esi, 0x70
lea esi, [ebx + 0x18]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x10], ecx
add esi, eax
mov eax, dword [esi - 0x18]
lea edi, [esi - 0x18]
test eax, eax
je 0x10091ada
cmp eax, 0xffffffff
je 0x10091ada
cmp byte [esi + 1], 0
je 0x10091a7f
push 0
push dword [esi - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10091a7c
test eax, eax
jne 0x10091a7c
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [esi - 0x14]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10091a7c
cmp byte [esi], 0
je 0x10091a78
mov byte [esi], 0
mov byte [esi + 1], 0
mov ecx, dword [ebp - 0x10]
cmp byte [esi], 0
jne 0x10091ada
cmp byte [esi + 1], 0
jne 0x10091ada
lea eax, [esi - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xe
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10091ab0
cmp dword [ebp - 0x14], 0xe
jne 0x10091ac3
mov byte [esi + 1], 0
jmp 0x10091ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10091ac3
mov byte [esi + 1], 1
jmp 0x10091ad7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
je 0x10091ad7
push edi
mov ecx, ebx
call fcn.10090650
mov ecx, dword [ebp - 0x10]
add esi, 0x1c
sub ecx, 1
mov dword [ebp - 0x10], ecx
jne 0x10091a28
cmp byte [ebx + 0x3000], 0
je 0x10091bb4
mov edi, dword [ebp + 8]
imul esi, edi, 0x284
add esi, 0x700
add esi, ebx
movzx ecx, word [esi + 0x280]
mov eax, ecx
shl eax, 8
movzx edx, ax
movzx eax, di
or edx, eax
lea eax, [ecx + 1]
or edx, 0xffff0000
mov word [esi + 0x280], ax
test ax, ax
jne 0x10091b3c
mov eax, 1
mov word [esi + 0x280], ax
mov eax, edx
shr eax, 8
and eax, 0x1f
lea eax, [eax + eax*4]
lea ecx, [esi + eax*4]
mov dword [ecx], edx
mov eax, dword [ebp - 0x28]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0xc], eax
mov ax, word [ebp - 0x1c]
mov word [ecx + 0x10], ax
lea ecx, [ebx + 0x3008]
call fcn.10099140
lea ecx, [ebx + 0x304c]
call fcn.10099000
test al, al
jne 0x10091bb4
lea esi, [ebx + 0x2fc0]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebx + 0x3000], 0
mov dword [ebp - 4], 0
je 0x10091bad
push 0
lea ecx, [ebx + 0x304c]
call fcn.10099170
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10093010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfd9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x78]
mov dword [ebp - 0x14], esi
push 0x30
mov dword [edi], vtable.CBaseOverlayRenderer.0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x80]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
push 0x28
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a573e
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push 0x1c
mov byte [ebp - 4], 1
mov dword [edi + 0x58], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov word [edi + 0x5c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
call fcn.100a573e
add esp, 0xc
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10093172
push 0x40000
mov ecx, eax
call fcn.10096b30
jmp 0x10093174
xor eax, eax
mov dword [edi + 0x54], eax
call fcn.1008fe70
mov ecx, dword [ebp - 0xc]
mov eax, edi
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fst dword [edi + 0x88]
fstp dword [edi + 0x8c]
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100976f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetupDiGetClassDevsA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10097734
push 0x10097ba0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10097734
push 0
push 0x1013241c
push 0x10097ba0
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiGetClassDevsW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10097769
push 0x10097bd0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10097769
push 0
push 0x10132420
push 0x10097bd0
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiEnumDeviceInterfaces
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1009779e
push 0x10097a20
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1009779e
push 0
push 0x10132424
push 0x10097a20
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiEnumDeviceInfo
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x100977d3
push 0x10097990
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x100977d3
push 0
push 0x10132428
push 0x10097990
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiEnumDriverInfoA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10097808
push 0x10097aa0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x10097808
push 0
push 0x1013242c
push 0x10097aa0
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiEnumDriverInfoW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1009783d
push 0x10097b20
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1009783d
push 0
push 0x10132430
push 0x10097b20
push ebx
call fcn.100714b0
add esp, 0x10
push str.SetupDiGetDeviceInterfaceDetailA
push esi
call edi
pop edi
pop esi
mov dword [0x10132434], eax
pop ebx
pop ebp
ret

Function at 0x10098ea0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [esi], vtable.CThread.0
je 0x10098f6f
cmp dword [esi + 0xc], 0xffffffff
push ebx
push edi
mov edi, 0x32
sete bl
test bl, bl
je 0x10098ed9
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0xc], 0xffffffff
sete bl
sub edi, 1
jne 0x10098ec1
mov eax, dword [0x10132450]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x10098ef1
push eax
call edi
mov eax, dword [0x10132450]
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10098f55
cmp eax, 0xffffffff
je 0x10098f0c
push eax
call edi
cmp eax, esi
je 0x10098f55
mov eax, dword [0x10132450]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10098f55
cmp eax, 0xffffffff
je 0x10098f1e
push eax
call edi
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10098f55
test eax, eax
je 0x10098f41
cmp eax, 0xffffffff
je 0x10098f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10098f55
mov eax, dword [esi + 4]
push eax
mov dword [esi + 4], 0
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10098f66
push eax
call ebx
mov dword [esi + 4], 0
pop edi
mov dword [esi + 8], 0
pop ebx
pop esi
ret
Function at 0x10099030
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1009908d
mov eax, dword [0x10132450]
cmp eax, 0xffffffff
je 0x10099051
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 4]
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10099094
test eax, eax
je 0x10099075
cmp eax, 0xffffffff
je 0x10099075
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10099094
mov eax, dword [esi + 4]
push eax
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10099170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cfecd
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
push edi
lea edi, [ebx + 4]
test eax, eax
je 0x100991c5
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x100991c5
cmp dword [ebp - 0x14], 0x103
jne 0x100991c5
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 0
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x20], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.100a573e
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10099213
lea eax, [ebp - 0x20]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
lea eax, [ebp - 0xd]
mov dword [ecx + 8], eax
jmp 0x10099215
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x10000
push eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x14]
push eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
test eax, eax
je 0x10099279
push 0xea60
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100992a0
cmp eax, 0x80
je 0x100992a0
test edi, edi
je 0x10099274
mov eax, dword [edi]
test eax, eax
je 0x10099274
push eax
call esi
mov dword [edi], 0
push dword [ebp + 8]
call esi
xor bl, bl
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1009928b
cmp byte [ebp - 0x1c], 0
je 0x1009928b
push ecx
call esi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 0xd], 0
jne 0x100992c7
test edi, edi
je 0x100992b9
mov eax, dword [edi]
test eax, eax
je 0x100992b9
push eax
call esi
mov dword [edi], 0
push dword [ebp + 8]
call esi
mov dword [ebx + 8], 0
jmp 0x10099279
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [edi], 0
setne bl
jmp 0x1009927b
Function at 0x10099e70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [0x1013245c], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x10132460], eax
mov eax, dword [ebp + 0x20]
mov dword [0x10132464], eax
mov eax, dword [ebp + 0x2c]
mov dword [0x10132470], eax
mov eax, dword [ebp + 0x24]
mov dword [0x10132468], eax
mov eax, dword [ebp + 0x28]
mov dword [0x10132458], ecx
mov dword [0x1013246c], eax
test ecx, ecx
je 0x10099f0f
mov eax, dword [0x10132510]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x10099eef
mov ecx, dword [0x10132514]
test ecx, ecx
je 0x10099eef
mov edx, dword [0x10132518]
test edx, edx
je 0x10099eef
cmp eax, ebx
jne 0x10099ee5
cmp ecx, edi
jne 0x10099ee5
cmp edx, esi
je 0x10099eef
mov ecx, 0x1010f4c8
call fcn.100811b0
mov dword [0x10132514], edi
mov ecx, 0x10132478
pop edi
mov dword [0x10132518], esi
pop esi
mov dword [0x10132510], ebx
pop ebx
pop ebp
jmp fcn.10094ec0
pop ebp
ret
Function at 0x1009d8d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, 0x1010f4c8
push eax
mov eax, dword [ebp + 8]
push dword [eax - 8]
call fcn.10082a70
cmp eax, 0x48f
jne 0x1009d8ff
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
push 0
push 0
mov ecx, 0x1010f4c8
call fcn.10081d10
test al, al
jne 0x1009d91f
call fcn.1009c9e0
test al, al
je 0x1009d91f
mov edx, dword [ebp - 0x14]
jmp 0x1009d92d
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
push esi
mov esi, 0xe
cmp dword [ebp + 0xc], esi
cmovbe esi, dword [ebp + 0xc]
xor ecx, ecx
test esi, esi
je 0x1009d964
push edi
mov edi, dword [ebp + 0x10]
jmp 0x1009d950
test word [ecx*2 + 0x1010a428], dx
setne al
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x1009d950
pop edi
mov edx, 6
cmp dword [ebp + 0x1c], edx
cmovbe edx, dword [ebp + 0x1c]
xor ecx, ecx
test edx, edx
je 0x1009da43
fldz
fld qword [0x100dd990]
mov esi, dword [ebp + 0x20]
fld qword [0x100d8ce8]
fld st(2)
cmp ecx, 5
ja case.default.0x1009d996
jmp dword [ecx*4 + 0x1009dab0]
movsx eax, word [ebp - 0xe]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009d996
movsx eax, word [ebp - 0x10]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009d996
movsx eax, word [ebp - 0xa]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009d996
movsx eax, word [ebp - 0xc]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009d996
movzx eax, byte [ebp - 0x12]
fstp st(0)
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
jmp 0x1009da2f
movzx eax, byte [ebp - 0x11]
fstp st(0)
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(1)
fstp qword [esi + ecx*8]
inc ecx
cmp ecx, edx
jb 0x1009d98b
fstp st(2)
fstp st(0)
fstp st(0)
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10133c64]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10132664]
cmp eax, dword [ecx + 0x408]
jg 0x1009da82
call esi
mov ecx, dword [ebp + 0x24]
sub eax, dword [0x10132660]
pop esi
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], 0
mov esp, ebp
pop ebp
ret 0x20
push 0x10132664
call fcn.100a58af
add esp, 4
cmp dword [0x10132664], 0xffffffff
jne 0x1009da65
call esi
dec eax
push 0x10132664
mov dword [0x10132660], eax
call fcn.100a5865
add esp, 4
jmp 0x1009da65