joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100717e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2530]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a23cd], bl
je 0x10071a2e
lea eax, [ebx + 0x4d]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10071a2e
cmp dword [ebp + 8], 0x201
jne 0x10071836
mov eax, 1
pop esi
mov byte [0x103a2534], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a2534], bl
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x10071a2e
call esi
mov dword [0x103a2530], eax
cmp dword [0x103a0f54], ebx
je 0x10071969
mov dword [0x103a0f54], ebx
push 0x1009bec0
push 0x74cd50
mov bl, 0xe9
call fcn.100b6700
push 0x1009bee0
push 0x771328
call fcn.100b6700
push 0x55
mov esi, 0x6d9070
call fcn.100b6670
push 0x55
mov esi, 0x608fb0
call fcn.100b6670
add esp, 0x18
mov cl, 0xe8
mov eax, 0x6d9070
mov esi, 0x649131
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x72d1b0
mov esi, 0x64926d
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6eff10
mov esi, 0x6492e8
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6d9070
mov esi, 0x647e5f
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x72d1b0
mov esi, 0x647f9b
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6eff10
mov esi, 0x648016
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6d9070
mov esi, 0x5ae36e
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x72d1b0
mov esi, 0x5ae48c
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6eff10
mov esi, 0x5ae507
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6d9070
mov esi, 0x55c763
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x6097b0
mov esi, 0x57655b
call fcn.100b6500
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push edi
mov esi, 5
mov edi, 0x55c763
call fcn.100b6780
mov edi, 0x649131
call fcn.100b6780
mov edi, 0x64926d
call fcn.100b6780
mov edi, 0x6492e8
call fcn.100b6780
mov edi, 0x647e5f
call fcn.100b6780
mov edi, 0x647f9b
call fcn.100b6780
mov edi, 0x648016
call fcn.100b6780
mov edi, 0x5ae36e
call fcn.100b6780
mov edi, 0x5ae48c
call fcn.100b6780
mov edi, 0x5ae507
call fcn.100b6780
push 0xc3
mov esi, 0x6d9070
call fcn.100b6670
push 0xc3
mov esi, 0x608fb0
call fcn.100b6670
mov esi, 5
mov edi, 0x57655b
call fcn.100b6780
push 0x1009beb0
push 0x74cd50
mov bl, 0xe9
call fcn.100b6700
push 0x1009bed0
push 0x771328
call fcn.100b6700
add esp, 0x18
mov dword [0x103a0f54], 1
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x10071a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a26e0]
cmp byte [0x103a23cd], 0
mov edx, eax
je 0x10071b20
mov eax, 0x53
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10071b20
cmp dword [ebp + 8], 0x201
jne 0x10071a99
mov byte [0x103a26e4], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x103a26e4], 0
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x10071b20
call esi
cmp dword [0x103a0f5c], 0
mov dword [0x103a26e0], eax
je 0x10071af3
mov cl, 0xe8
mov eax, 0x5655c0
mov esi, 0x588661
mov dword [0x103a0f5c], 0
call fcn.100b6500
push 0x55
mov esi, 0x51ee20
call fcn.100b6670
add esp, 4
xor al, al
pop esi
pop ebp
ret 4
push edi
push 0xc3
mov esi, 0x51ee20
call fcn.100b6670
add esp, 4
mov esi, 5
mov edi, 0x588661
call fcn.100b6780
mov dword [0x103a0f5c], 1
pop edi
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10071b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2728]
cmp byte [0x103a23cd], 0
mov edx, eax
je 0x10071c0a
mov eax, 0x54
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10071c0a
cmp dword [ebp + 8], 0x201
jne 0x10071b89
mov byte [0x103a272c], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x103a272c], 0
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x10071c0a
call esi
cmp dword [0x103a0f60], 0
mov dword [0x103a2728], eax
je 0x10071be5
mov cl, 0xe8
mov eax, 0x5655c0
mov esi, 0x576ddb
mov dword [0x103a0f60], 0
call fcn.100b6500
mov cl, 0xe8
mov eax, 0x5655c0
mov esi, 0x5883f4
call fcn.100b6500
xor al, al
pop esi
pop ebp
ret 4
push edi
mov esi, 5
mov edi, 0x576ddb
call fcn.100b6780
mov edi, 0x5883f4
call fcn.100b6780
mov dword [0x103a0f60], 1
pop edi
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10071c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2770]
cmp byte [0x103a23cd], 0
mov edx, eax
je 0x10071cdf
mov eax, 0x55
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10071cdf
cmp dword [ebp + 8], 0x201
jne 0x10071c79
mov byte [0x103a2774], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x103a2774], 0
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x10071cdf
call esi
cmp dword [0x103a0f64], 0
mov dword [0x103a2770], eax
je 0x10071cc4
mov cl, 0xe8
mov eax, 0x95a1e0
mov esi, 0x5f8924
mov dword [0x103a0f64], 0
call fcn.100b6500
xor al, al
pop esi
pop ebp
ret 4
push edi
mov esi, 5
mov edi, 0x5f8924
call fcn.100b6780
mov dword [0x103a0f64], 1
pop edi
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10071cf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a27b8]
cmp byte [0x103a23cd], 0
mov edx, eax
je 0x10071da9
mov eax, 0x56
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10071da9
cmp dword [ebp + 8], 0x201
jne 0x10071d49
mov byte [0x103a27bc], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x103a27bc], 0
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x10071da9
call esi
cmp dword [0x103a0f68], 0
mov dword [0x103a27b8], eax
mov esi, 0x5edfe0
je 0x10071d92
push 0x55
mov dword [0x103a0f68], 0
call fcn.100b6670
add esp, 4
xor al, al
pop esi
pop ebp
ret 4
push 0xc3
call fcn.100b6670
mov dword [0x103a0f68], 1
add esp, 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10072250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100723cf
call fcn.10071db0
test al, al
jne 0x100723cf
call fcn.10071f20
test al, al
jne 0x100723cf
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
mov ebx, 4
test al, al
jne 0x100722d3
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072347
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072347
mov eax, 0xb7
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072347
mov eax, esi
sub eax, dword [0x103a4300]
cmp dword [ebp + 8], 0x201
jne 0x1007230f
pop edi
mov eax, 1
pop esi
mov byte [0x103a4304], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [0x103a4304], 0
mov dword [0xe8cb3c], 0
cmp eax, 0x1f4
jb 0x100723cc
call edi
mov dword [0x103a4300], eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov dword [ebp - 4], 0x47904c1
call fcn.100a8170
add esp, 4
push 0xd
mov ecx, 0x861110
call ecx
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100723cc
mov eax, 0xa3
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100723cc
sub esi, dword [0x103a3d60]
cmp dword [ebp + 8], 0x201
jne 0x10072397
pop edi
mov eax, 1
pop esi
mov byte [0x103a3d64], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [0x103a3d64], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100723cc
call edi
mov dword [0x103a3d60], eax
lea eax, [ebp + 8]
push eax
mov ecx, ebx
mov dword [ebp + 8], 0x47904c1
call fcn.100a8170
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100726a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100727ed
call fcn.10071db0
test al, al
jne 0x100727ed
call fcn.10071f20
test al, al
jne 0x100727ed
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007277d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007271d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007277d
mov eax, 0xa4
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100727eb
sub esi, dword [0x103a3da8]
cmp edi, 0x201
jne 0x10072757
mov eax, 1
pop esi
mov byte [0x103a3dac], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3dac], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100727eb
call ebx
mov dword [0x103a3da8], eax
lea eax, [ebp - 4]
push eax
jmp 0x100727d7
mov eax, 0xb8
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100727eb
sub esi, dword [0x103a4348]
cmp edi, 0x201
jne 0x100727b3
mov eax, 1
pop esi
mov byte [0x103a434c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a434c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100727eb
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4348], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x57904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10072800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007294d
call fcn.10071db0
test al, al
jne 0x1007294d
call fcn.10071f20
test al, al
jne 0x1007294d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100728dd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007287d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100728dd
mov eax, 0xa5
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007294b
sub esi, dword [0x103a3df0]
cmp edi, 0x201
jne 0x100728b7
mov eax, 1
pop esi
mov byte [0x103a3df4], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3df4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007294b
call ebx
mov dword [0x103a3df0], eax
lea eax, [ebp - 4]
push eax
jmp 0x10072937
mov eax, 0xb9
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007294b
sub esi, dword [0x103a4390]
cmp edi, 0x201
jne 0x10072913
mov eax, 1
pop esi
mov byte [0x103a4394], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4394], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007294b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4390], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x67904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10072960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10072aad
call fcn.10071db0
test al, al
jne 0x10072aad
call fcn.10071f20
test al, al
jne 0x10072aad
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072a3d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100729dd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072a3d
mov eax, 0xa6
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072aab
sub esi, dword [0x103a3e38]
cmp edi, 0x201
jne 0x10072a17
mov eax, 1
pop esi
mov byte [0x103a3e3c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3e3c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072aab
call ebx
mov dword [0x103a3e38], eax
lea eax, [ebp - 4]
push eax
jmp 0x10072a97
mov eax, 0xba
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072aab
sub esi, dword [0x103a43d8]
cmp edi, 0x201
jne 0x10072a73
mov eax, 1
pop esi
mov byte [0x103a43dc], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a43dc], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072aab
call ebx
lea edx, [ebp - 4]
mov dword [0x103a43d8], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x77904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10072ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10072c0d
call fcn.10071db0
test al, al
jne 0x10072c0d
call fcn.10071f20
test al, al
jne 0x10072c0d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072b9d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072b3d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072b9d
mov eax, 0xa7
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072c0b
sub esi, dword [0x103a3e80]
cmp edi, 0x201
jne 0x10072b77
mov eax, 1
pop esi
mov byte [0x103a3e84], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3e84], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072c0b
call ebx
mov dword [0x103a3e80], eax
lea eax, [ebp - 4]
push eax
jmp 0x10072bf7
mov eax, 0xbb
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072c0b
sub esi, dword [0x103a4420]
cmp edi, 0x201
jne 0x10072bd3
mov eax, 1
pop esi
mov byte [0x103a4424], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4424], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072c0b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4420], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x87904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10072c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10072d6d
call fcn.10071db0
test al, al
jne 0x10072d6d
call fcn.10071f20
test al, al
jne 0x10072d6d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072cfd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072c9d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072cfd
mov eax, 0xa8
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072d6b
sub esi, dword [0x103a3ec8]
cmp edi, 0x201
jne 0x10072cd7
mov eax, 1
pop esi
mov byte [0x103a3ecc], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3ecc], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072d6b
call ebx
mov dword [0x103a3ec8], eax
lea eax, [ebp - 4]
push eax
jmp 0x10072d57
mov eax, 0xbc
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072d6b
sub esi, dword [0x103a4468]
cmp edi, 0x201
jne 0x10072d33
mov eax, 1
pop esi
mov byte [0x103a446c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a446c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072d6b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4468], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x97904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10072d80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10072ecd
call fcn.10071db0
test al, al
jne 0x10072ecd
call fcn.10071f20
test al, al
jne 0x10072ecd
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072e5d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072dfd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072e5d
mov eax, 0xa9
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072ecb
sub esi, dword [0x103a3f10]
cmp ebx, 0x201
jne 0x10072e37
mov eax, 1
pop edi
mov byte [0x103a3f14], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x103a3f14], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072ecb
call edi
mov dword [0x103a3f10], eax
lea eax, [ebp - 4]
push eax
jmp 0x10072eb7
mov eax, 0xbd
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10072ecb
sub esi, dword [0x103a44b0]
cmp ebx, 0x201
jne 0x10072e93
mov eax, 1
pop edi
mov byte [0x103a44b4], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x103a44b4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10072ecb
call edi
lea edx, [ebp - 4]
mov dword [0x103a44b0], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x107904c1
call fcn.100a8170
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10072ee0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007302d
call fcn.10071db0
test al, al
jne 0x1007302d
call fcn.10071f20
test al, al
jne 0x1007302d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072fbd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10072f5d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10072fbd
mov eax, 0xaa
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007302b
sub esi, dword [0x103a3f58]
cmp edi, 0x201
jne 0x10072f97
mov eax, 1
pop esi
mov byte [0x103a3f5c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3f5c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007302b
call ebx
mov dword [0x103a3f58], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073017
mov eax, 0xbe
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007302b
sub esi, dword [0x103a44f8]
cmp edi, 0x201
jne 0x10072ff3
mov eax, 1
pop esi
mov byte [0x103a44fc], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a44fc], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007302b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a44f8], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x117904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10073040
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007318d
call fcn.10071db0
test al, al
jne 0x1007318d
call fcn.10071f20
test al, al
jne 0x1007318d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007311d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100730bd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007311d
mov eax, 0xab
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007318b
sub esi, dword [0x103a3fa0]
cmp edi, 0x201
jne 0x100730f7
mov eax, 1
pop esi
mov byte [0x103a3fa4], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3fa4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007318b
call ebx
mov dword [0x103a3fa0], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073177
mov eax, 0xbf
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007318b
sub esi, dword [0x103a4540]
cmp edi, 0x201
jne 0x10073153
mov eax, 1
pop esi
mov byte [0x103a4544], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4544], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007318b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4540], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x127904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100731a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100732ed
call fcn.10071db0
test al, al
jne 0x100732ed
call fcn.10071f20
test al, al
jne 0x100732ed
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007327d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007321d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007327d
mov eax, 0xac
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100732eb
sub esi, dword [0x103a3fe8]
cmp edi, 0x201
jne 0x10073257
mov eax, 1
pop esi
mov byte [0x103a3fec], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a3fec], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100732eb
call ebx
mov dword [0x103a3fe8], eax
lea eax, [ebp - 4]
push eax
jmp 0x100732d7
mov eax, 0xc0
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100732eb
sub esi, dword [0x103a4588]
cmp edi, 0x201
jne 0x100732b3
mov eax, 1
pop esi
mov byte [0x103a458c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a458c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100732eb
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4588], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x137904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10073300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007344d
call fcn.10071db0
test al, al
jne 0x1007344d
call fcn.10071f20
test al, al
jne 0x1007344d
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100733dd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007337d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100733dd
mov eax, 0xad
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007344b
sub esi, dword [0x103a4030]
cmp ebx, 0x201
jne 0x100733b7
mov eax, 1
pop edi
mov byte [0x103a4034], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x103a4034], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007344b
call edi
mov dword [0x103a4030], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073437
mov eax, 0xc1
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007344b
sub esi, dword [0x103a45d0]
cmp ebx, 0x201
jne 0x10073413
mov eax, 1
pop edi
mov byte [0x103a45d4], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x103a45d4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007344b
call edi
lea edx, [ebp - 4]
mov dword [0x103a45d0], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x147904c1
call fcn.100a8170
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret