joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045c99
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x26c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10045cd8
or eax, 0xffffffff
jmp 0x10045de0
cmp byte [ebp - 0x26c], 1
jne 0x10045dd7
mov eax, dword [ebp - 0x26c]
shr eax, 8
cmp al, 1
jne 0x10045dd7
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x10045cd0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
mov dword [ebp - 0xd8], eax
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0xdc], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xda], ax
push 0x10
lea eax, [ebp - 0xdc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
or esi, 0xffffffff
cmp eax, esi
jne 0x10045d56
mov eax, esi
jmp 0x10045de0
push 0
push dword [ebp - 0x270]
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push dword [ebp - 0x270]
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
je 0x10045d4f
xor eax, eax
inc eax
cmp dword [ebp + 0x14], eax
je 0x10045de0
mov esi, 0xc8
push esi
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push esi
lea eax, [ebp - 0xcc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0xcc]
push 0x1008b754
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10045dc5
push 1
call fcn.10045bcf
pop ecx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
jmp 0x10045de0
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10083e24
leave
ret
Function at 0x10045e9f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d2764]
cmp eax, 0x64
ja 0x10045ecd
mov al, 1
jmp 0x100460a8
push ebx
push edi
call esi
mov dword [0x103d2764], eax
push 0x46
xor eax, eax
pop ecx
mov edi, 0x103be390
rep stosd dword es:[edi], eax
mov eax, dword [0x2f9845c]
xor ebx, ebx
mov byte [ebp - 0x25d], bl
mov dword [ebp - 0x268], ebx
lea edi, [eax + 0x53c]
mov dword [ebp - 0x264], ebx
mov eax, dword [ebp - 0x268]
cmp dword [eax*4 + 0x10112378], 1
jne 0x1004607f
cmp byte [ebp + 8], 1
jne 0x10045fb9
mov esi, dword [edi]
push 0xc8
lea eax, [ebp - 0x25c]
push ebx
push eax
call sub.MSVCR100.dll_memset
push 0x64
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
cmp esi, ebx
je 0x10045f6d
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.1000be93
lea eax, [ebp - 0x68]
push eax
add esi, 0x64
push esi
lea eax, [ebp - 0x25c]
push 0x1008d83c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov esi, dword [ebp - 0x264]
lea esi, [esi + 0x101112f0]
lea eax, [ebp - 0x25c]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x1004607f
push esi
call fcn.10045dee
mov esi, eax
pop ecx
cmp esi, ebx
jl 0x1004607f
mov eax, dword [ebp - 0x264]
lea eax, [eax + 0x10110d78]
push eax
lea eax, [ebp - 0x25c]
jmp 0x10046058
cmp byte [ebp + 8], bl
jne 0x1004607f
mov esi, dword [edi]
push 0xc8
lea eax, [ebp - 0x194]
push ebx
push eax
call sub.MSVCR100.dll_memset
push 0x64
lea eax, [ebp - 0xcc]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
cmp esi, ebx
je 0x10046019
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.1000be93
lea eax, [ebp - 0xcc]
push eax
add esi, 0x64
push esi
lea eax, [ebp - 0x194]
push 0x1008d83c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov esi, dword [ebp - 0x264]
lea esi, [esi + 0x10110d78]
lea eax, [ebp - 0x194]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x1004607f
push esi
call fcn.10045dee
mov esi, eax
pop ecx
cmp esi, ebx
jl 0x1004607f
mov eax, dword [ebp - 0x264]
lea eax, [eax + 0x101112f0]
push eax
lea eax, [ebp - 0x194]
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1004607f
push 1
push 1
push ebx
push dword [ebp - 0x268]
push esi
call fcn.10039730
mov byte [ebp - 0x25d], 1
add esp, 0x14
inc dword [ebp - 0x268]
add dword [ebp - 0x264], 0x64
add edi, 4
cmp dword [ebp - 0x268], 0xe
jl 0x10045f01
cmp byte [ebp - 0x25d], 1
pop edi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10083e24
leave
ret
Function at 0x100460b5
Capabilities:
Act as tcp client
Check for time delay via gettickcount
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1b4], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100460fb
or eax, 0xffffffff
jmp 0x100461fb
cmp byte [ebp - 0x1b0], 1
jne 0x100461f2
mov eax, dword [ebp - 0x1b0]
shr eax, 8
cmp al, 1
jne 0x100461f2
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x1004612e
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x100460f3
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 2
mov dword [ebp - 0x1c], eax
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
push 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
or esi, 0xffffffff
cmp eax, esi
jne 0x1004617f
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
jmp 0x100461fb
lea eax, [edi + 4]
push 0
push eax
call sub.MSVCR100.dll_strlen
pop ecx
add eax, 4
push eax
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
je 0x1004616e
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1b4]
cmp eax, 0x3a980
jb 0x100461bc
push 0x14
pop esi
jmp 0x1004616e
push 0
push 0xa
pop esi
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0x10]
push 0x1008b754
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x1004616e
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x14
jmp 0x100461fa
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083e24
leave
ret
Function at 0x100518de
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b754
push str.D5CHECK1
mov edi, str.config
push edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abed8], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK2
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abba8], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK3
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abbac], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5CHECK4
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
pop ecx
push dword [ebp - 0x6c]
mov dword [0x103abed4], eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D5RADI01
push edi
call esi
lea eax, [ebp - 0x68]
push eax
call ebx
mov dword [0x103abba4], eax
mov ebx, 0xbb8
push ebx
push 0
push dword [ebp - 0x70]
call sub.MSVCR100.dll_memset
add esp, 0x10
push dword [ebp - 0x6c]
push ebx
push dword [ebp - 0x70]
push 0x1008aec4
push str.D5LIST1
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x184
push dword [0x103abc7c]
call esi
mov edi, dword [sym.imp.MSVCR100.dll_strtok]
mov ebx, 0x10093a5c
push ebx
push dword [ebp - 0x70]
jmp 0x10051a27
push eax
push 0
push 0x180
push dword [0x103abc7c]
call esi
push ebx
push 0
call edi
pop ecx
pop ecx
test eax, eax
jne 0x10051a14
push dword [0x103abb30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x10051a4c
push 0
mov ecx, 0x103abb10
call sub.mfc100.dll_Ordinal_13219
mov esi, 0x103b1930
mov ecx, esi
call fcn.10013685
mov ecx, esi
call fcn.10013301
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083e24
leave
ret
Function at 0x1005485d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str..ini
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
test eax, eax
setne al
push 0x64
mov byte [0x10342a92], al
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
push 0x14c08
call sub.mfc100.dll_Ordinal_265
mov edi, eax
push edi
push esi
call fcn.1004ead2
push edi
push esi
call fcn.1004f601
push edi
push esi
call fcn.1005090c
push edi
push esi
call fcn.10050f5d
push edi
push esi
call fcn.100518de
add esp, 0x40
push edi
push esi
call fcn.10051d76
push edi
push esi
call fcn.1003e86f
push edi
push esi
call fcn.100529e2
push edi
push esi
call fcn.10052e5c
push edi
push esi
call fcn.1005331e
push edi
push esi
call fcn.1003e5fe
push edi
push esi
call fcn.10051a6e
push edi
push esi
call fcn.1003e4dc
add esp, 0x40
push edi
push esi
call fcn.1003e2d4
push edi
push esi
call fcn.10052032
push edi
push esi
call fcn.100536ef
push edi
push esi
call fcn.1003eaa2
push edi
push esi
call fcn.10053b32
add esp, 0x28
push esi
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x1008b74c
push str.D12CHECK1
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
push edi
mov dword [0x103b0ea4], eax
call sub.mfc100.dll_Ordinal_1296
pop ecx
pop ecx
push 0
mov ecx, 0x103ad018
call sub.mfc100.dll_Ordinal_13219
push 0
mov ecx, 0x103b0d28
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10083e24
leave
ret
Function at 0x10056fe5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2fb6ac4]
fld dword [esi + 0x1f60]
call fcn.10083f90
fld dword [esi + 0x1f68]
mov dword [ebp - 8], eax
call fcn.10083f90
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x103d2180
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10057040
mov eax, dword [0x103be1c0]
add eax, 0x44
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10062817
jmp 0x100570f5
push 0x1008c6d4
call fcn.10006509
pop ecx
cmp eax, 1
jne 0x10057060
push str.ClickBox1
call fcn.1003892a
pop ecx
jmp 0x100570f5
fild dword [ebp + 0xc]
push ecx
push ecx
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10054981
fcomp qword [0x1009a928]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x100570d6
fild dword [ebp + 0x14]
push ecx
push ecx
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10054981
fcomp qword [0x1009a928]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x100570d6
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d2784]
cmp eax, 0xbb8
jbe 0x100570d6
push dword [ebp + 0x18]
push 1
call fcn.10038fcc
pop ecx
pop ecx
call esi
mov dword [0x103d2784], eax
jmp 0x100570f5
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1003823d
add esp, 0xc
pop esi
leave
ret

Function at 0x100570f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2fb6ac4]
fld dword [esi + 0x1f60]
call fcn.10083f90
fld dword [esi + 0x1f68]
mov dword [ebp - 8], eax
call fcn.10083f90
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x103d2180
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10057155
mov eax, dword [0x103be1c0]
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.100608b6
jmp 0x1005720a
push 0x1008c6d4
call fcn.10006509
pop ecx
cmp eax, 1
jne 0x10057175
push str.ClickBox1
call fcn.1003892a
pop ecx
jmp 0x1005720a
fild dword [ebp + 0xc]
push ecx
push ecx
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10054981
fcomp qword [0x1009a928]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x100571eb
fild dword [ebp + 0x14]
push ecx
push ecx
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10054981
fcomp qword [0x1009a928]
pop ecx
pop ecx
fnstsw ax
test ah, 5
jp 0x100571eb
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d2788]
cmp eax, 0xbb8
jbe 0x100571eb
push dword [ebp + 0x18]
push 1
call fcn.10038fcc
pop ecx
pop ecx
call esi
mov dword [0x103d2788], eax
jmp 0x1005720a
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.1003823d
add esp, 0xc
pop esi
leave
ret
Function at 0x100591f0
Capabilities:
Copy file
Enumerate files on windows
Get common file path

Disassembly:
push 0x604
mov eax, 0x10087899
call fcn.10083e9c
lea eax, [ebp - 0x268]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x268]
push 0x1009a9dc
push eax
call sub.MSVCR100.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x604]
call dword [sym.imp.mfc100.dll_Ordinal_310]
and dword [ebp - 4], 0
push str..scs
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x610]
push eax
call fcn.10016e71
add esp, 0xc
lea ecx, [ebp - 0x600]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x60c], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov esi, dword [sym.imp.MSVCR100.dll_strstr]
mov edi, 0x34d18e8
lea eax, [ebp - 0x5d4]
push edi
push eax
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
pop ecx
pop ecx
test eax, eax
je 0x10059378
lea eax, [ebp - 0x5d4]
push eax
call sub.MSVCR100.dll_strlen
add eax, 0xfffffffa
push edi
mov dword [ebp - 0x608], eax
call sub.MSVCR100.dll_strlen
cmp dword [ebp - 0x608], eax
jmp 0x1005933f
mov word [eax + 4], 0x74
lea eax, [ebp - 0x268]
push 0x1009a9dc
push eax
call sub.MSVCR100.dll_strcat
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MSVCR100.dll_strcat
add esp, 0x10
push 0
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x1005939f
lea eax, [ebp - 0x5d4]
push edi
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x10059378
lea eax, [ebp - 0x5d4]
push eax
call sub.MSVCR100.dll_strlen
add eax, 0xfffffffa
push edi
mov dword [ebp - 0x608], eax
call sub.MSVCR100.dll_strlen
cmp dword [ebp - 0x608], eax
pop ecx
pop ecx
jne 0x10059378
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x4c0]
push 0x1008d83c
push eax
call ebx
lea eax, [ebp - 0x268]
push str.lien
push eax
call esi
add esp, 0x18
test eax, eax
jne 0x100592c6
lea eax, [ebp - 0x600]
push eax
push dword [ebp - 0x60c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1005930e
push dword [ebp - 0x60c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x604]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.10083f1f
ret
Function at 0x1005a2ff
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2fb6ac4]
push 0xd730a0
push dword [eax + 0x1d20]
call fcn.1000631c
pop ecx
pop ecx
test eax, eax
je 0x1005a3f4
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x14]
mov eax, dword [0x2f99f10]
mov eax, dword [eax + ecx*4 + 0x53c]
test eax, eax
jne 0x1005a341
cmp ecx, 0xffffffff
jne 0x1005a3f3
cmp ecx, 0xffffffff
je 0x1005a358
add eax, 0x64
push eax
call fcn.1003789b
pop ecx
test eax, eax
jns 0x1005a3f3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103d238c]
cmp eax, 0xbb8
jb 0x1005a37c
push edi
call fcn.10037e51
pop ecx
call esi
mov dword [0x103d238c], eax
cmp byte [edi + 0x102e2858], 0
push ebx
mov ebx, 0x3e8
jbe 0x1005a3b1
cmp dword [0x103b9a50], 0
jne 0x1005a3b1
call esi
sub eax, dword [0x103d2794]
cmp eax, ebx
jb 0x1005a3b1
push 2
push edi
call fcn.100497d1
pop ecx
pop ecx
call esi
mov dword [0x103d2794], eax
call esi
mov ecx, dword [0x10342a60]
sub eax, dword [ecx*4 + 0x10302858]
cmp eax, 0x1388
ja 0x1005a3d4
call esi
sub eax, dword [edi*4 + 0x10302858]
cmp eax, ebx
jae 0x1005a3f1
call esi
sub eax, dword [0x103d2790]
cmp eax, ebx
jb 0x1005a3f1
push 1
push edi
call fcn.100497d1
pop ecx
pop ecx
call esi
mov dword [0x103d2790], eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1005aa8d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x2f91a04], 0x64
push esi
mov esi, dword [ebp + 8]
jge 0x1005aadd
push esi
push 0x103d2250
call sub.MSVCR100.dll_strcpy
mov eax, dword [0x103be1c0]
pop ecx
pop ecx
push 0x10043f2f
push 0x3e8
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005acf2
and dword [0x103429f8], 0
push ebx
push edi
push dword [0x2f91a04]
lea eax, [ebp - 0x6c]
push eax
call fcn.10006884
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
push esi
push 0x100992d4
push 0x10342b58
call edi
mov ebx, dword [0x2f91a04]
lea eax, [ebx - 0x59da]
add esp, 0x14
cmp eax, 0x3e5
ja 0x1005ab81
push esi
call fcn.10006846
pop ecx
cmp eax, 0x59d9
jl 0x1005ab3a
push esi
call fcn.10006846
pop ecx
cmp eax, 0x5dbf
jle 0x1005ab81
push 0x32
lea eax, [ebp - 0x38]
push 0
push eax
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x38]
push 0x10095100
push eax
call edi
mov edi, 0x10368780
push edi
push dword [0x1037c3ec]
lea eax, [ebp - 0x38]
push eax
call fcn.100448bf
push edi
push dword [0x1037c3ec]
push 0x1009aa88
call fcn.100448bf
add esp, 0x30
jmp 0x1005aca2
push esi
call fcn.10006846
push eax
call fcn.10043e82
push ebx
mov byte [ebp - 0x6d], al
call fcn.10043e82
add esp, 0xc
cmp al, byte [ebp - 0x6d]
je 0x1005abb4
push 1
push esi
call fcn.10006846
pop ecx
push eax
call fcn.10058122
pop ecx
pop ecx
jmp 0x1005aca2
cmp dword [0x103ae880], 1
jne 0x1005ac19
push esi
call fcn.10006846
push eax
call fcn.10043f5d
pop ecx
pop ecx
cmp al, 1
jne 0x1005ac19
mov eax, dword [0x2fb6ac4]
cmp byte [eax + 0x4884], 0
jne 0x1005ac19
push esi
call fcn.10006846
push esi
mov dword [0x103d2294], eax
call fcn.10006846
push eax
call fcn.1003a748
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103d2298], eax
mov eax, dword [0x103be1c0]
push 0x10041ed7
push 0x3e8
add eax, 0x44
jmp 0x1005acb3
mov ebx, 0x10342b58
push ebx
call fcn.10006150
pop ecx
test eax, eax
je 0x1005ac64
mov eax, dword [0x2fb6ac4]
cmp byte [eax + 0x4884], 0
jne 0x1005ac64
push esi
call fcn.10006846
push 1
push ebx
mov dword [0x103d2294], eax
call fcn.10005fbb
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10041f64
mov dword [0x103d2298], eax
push 0x3e8
jmp 0x1005aca9
lea eax, [ebp - 0x6c]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1005ac8d
push esi
push 0x1009aa74
mov esi, 0x10111d48
push esi
call edi
push esi
call fcn.10006e54
add esp, 0x10
jmp 0x1005aca2
push 1
push esi
call fcn.10006846
pop ecx
push eax
call fcn.10058122
pop ecx
pop ecx
cmp al, 1
jne 0x1005acc2
push 0x100627c9
push 0x64
mov eax, dword [0x103be1c0]
add eax, 0x93
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1005acf0
push esi
push 0x1009aa4c
mov esi, 0x10111d48
push esi
call edi
push esi
call fcn.10006e54
push 1
push 0x1008c4f4
call fcn.10005fbb
mov ecx, dword [0x1011280c]
add esp, 0x18
call fcn.1006eb87
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10083e24
leave
ret
Function at 0x1005c58f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x103b9048], 1
push ebx
push esi
push edi
jne 0x1005c5b0
cmp byte [0x10342a8e], 1
jne 0x1005c5b0
push dword [ebp + 8]
call fcn.1005a2ff
pop ecx
call fcn.10037fa5
xor edi, edi
cmp dword [ebp + 8], edi
jl 0x1005c5da
pushal
mov ecx, dword ds:[0xe7b850]
mov ecx, dword ds:[ecx + 0x39c]
push 0
push dword [ebp + 8]
mov eax, 0x901970
call eax
popal
jmp 0x1005c639
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101123e0]
cmp eax, 0x2bc
jae 0x1005c5f7
cmp dword [0x103a8200], edi
je 0x1005c639
call esi
cmp dword [0x103a8200], 1
mov dword [0x101123e0], eax
jne 0x1005c61e
cmp dword [0x101123dc], edi
ja 0x1005c639
mov eax, dword [0x2fb6ac4]
mov dword [eax + 0x1d44], 0xff
pushal
mov ecx, dword ds:[0x2fb6ac4]
mov eax, 0x6d02f0
call eax
popal
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101123dc], eax
pop edi
pop esi
pop ebx
pop ebp
ret