joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100480f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x100482b1
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x100482af
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x100482af
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x100482af
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x100482af
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x100482af
push 0x39
call fcn.10039dd0
test al, al
jne 0x100482af
push 0x48
call fcn.10039dd0
test al, al
jne 0x100482af
push 2
call fcn.10039dd0
test al, al
jne 0x100482af
push 0xd
call fcn.10039dd0
test al, al
je 0x100481ae
push 0x4d
call fcn.10039dd0
test al, al
je 0x100481ae
push 0xe
call fcn.10039dd0
test al, al
jne 0x100482af
push 0xd
call fcn.10039dd0
test al, al
je 0x100481d3
push 8
call fcn.10039dd0
test al, al
je 0x100481d3
push 0x4e
call fcn.10039dd0
test al, al
jne 0x100482af
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10048247
push 0xd3
call fcn.10039e30
test al, al
je 0x100482af
sub esi, dword [0x101f98c4]
cmp dword [ebp + 8], 0x201
jne 0x10048225
pop edi
mov byte [0x101f98c8], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f98c8], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100482af
call edi
mov dword [0x101f98c4], eax
jmp 0x1004829b
push 0xbd
call fcn.10039e30
test al, al
je 0x100482af
sub esi, dword [0x101f9294]
cmp dword [ebp + 8], 0x201
jne 0x1004827b
pop edi
mov byte [0x101f9298], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9298], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100482af
call edi
mov dword [0x101f9294], eax
mov edx, 4
mov dword [ebp + 8], 0x227904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10048490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10048651
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x1004864f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004864f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004864f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004864f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004864f
push 0x39
call fcn.10039dd0
test al, al
jne 0x1004864f
push 0x48
call fcn.10039dd0
test al, al
jne 0x1004864f
push 2
call fcn.10039dd0
test al, al
jne 0x1004864f
push 0xd
call fcn.10039dd0
test al, al
je 0x1004854e
push 0x4d
call fcn.10039dd0
test al, al
je 0x1004854e
push 0xe
call fcn.10039dd0
test al, al
jne 0x1004864f
push 0xd
call fcn.10039dd0
test al, al
je 0x10048573
push 8
call fcn.10039dd0
test al, al
je 0x10048573
push 0x4e
call fcn.10039dd0
test al, al
jne 0x1004864f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x100485e7
push 0xd4
call fcn.10039e30
test al, al
je 0x1004864f
sub esi, dword [0x101f990c]
cmp dword [ebp + 8], 0x201
jne 0x100485c5
pop edi
mov byte [0x101f9910], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9910], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004864f
call edi
mov dword [0x101f990c], eax
jmp 0x1004863b
push 0xbe
call fcn.10039e30
test al, al
je 0x1004864f
sub esi, dword [0x101f92dc]
cmp dword [ebp + 8], 0x201
jne 0x1004861b
pop edi
mov byte [0x101f92e0], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f92e0], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004864f
call edi
mov dword [0x101f92dc], eax
mov edx, 4
mov dword [ebp + 8], 0x237904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x1004d670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, 0x1004d880
mov byte [ebp - 0x10], 0xe8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebx - 0x58b783]
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x58b77e
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1004d6d8
mov eax, dword [ebp - 0x10]
mov ecx, 0x58b77e
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d6da
call esi
lea eax, [ebx - 0x5c7838]
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5c7833
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x1004d728
mov eax, dword [ebp - 0x10]
mov ecx, 0x5c7833
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d72a
call esi
lea eax, [ebx - 0x5c7d76]
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5c7d71
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x1004d778
mov eax, dword [ebp - 0x10]
mov ecx, 0x5c7d71
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d77a
call esi
lea eax, [ebx - 0x5c7f20]
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5c7f1b
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x1004d7c8
mov eax, dword [ebp - 0x10]
mov ecx, 0x5c7f1b
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d7ca
call esi
lea eax, [ebx - 0x5c80c3]
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5c80be
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x1004d818
mov eax, dword [ebp - 0x10]
mov ecx, 0x5c80be
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d81a
call esi
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
sub ebx, 0x7e22bf
mov dword [ebp - 4], 0
push 0x7e22ba
mov dword [ebp - 0xf], ebx
call edi
test eax, eax
je 0x1004d868
mov eax, dword [ebp - 0x10]
mov ecx, 0x7e22ba
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1004d86a
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004df50
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0xff
push 0
push eax
call fcn.10066f50
push 0x10085a90
push edi
call fcn.100681c8
push 0x6d24
push 0
push 0x100fa368
mov esi, eax
call fcn.10066f50
add esp, 0x20
test esi, esi
je 0x1004e15c
push ebx
push 0x6d24
mov dword [ebp - 0x114], 0
call fcn.10064b54
push esi
push 1
mov ebx, eax
push 0x6d24
push ebx
mov dword [ebp - 0x128], ebx
call fcn.100684f3
push esi
push 1
lea eax, [ebp - 0x114]
push 4
push eax
call fcn.100684f3
push esi
call fcn.100682a7
mov esi, ebx
add esp, 0x28
mov ebx, 0x100fa368
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], ebx
nop dword [eax]
mov eax, 1
mov word [ebp - 0x108], 0xcffc
sub eax, esi
mov byte [ebp - 0x106], 0xab
mov dword [ebp - 0x118], eax
xor ebx, ebx
mov eax, 2
mov edi, esi
sub eax, esi
mov dword [ebp - 0x11c], eax
mov eax, 3
sub eax, esi
mov dword [ebp - 0x120], eax
mov eax, 4
sub eax, esi
mov esi, dword [ebp - 0x118]
mov dword [ebp - 0x124], eax
nop
mov eax, 0xaaaaaaab
mov ecx, ebx
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x108]
lea ecx, [esi + edi]
xor byte [edi], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x107]
xor byte [edi + 1], al
mov eax, 0xaaaaaaab
mov ecx, dword [ebp - 0x11c]
lea ecx, [ecx + edi]
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x106]
xor byte [edi + 2], al
mov eax, 0xaaaaaaab
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx + edi]
mul ecx
mov ecx, ebx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x105]
xor byte [edi + 3], al
mov eax, 0xaaaaaaab
mov ecx, dword [ebp - 0x124]
lea ecx, [ecx + edi]
mul ecx
mov ecx, ebx
lea edi, [edi + 5]
shr edx, 1
add ebx, 5
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x104]
xor byte [edi - 1], al
cmp ebx, 0x6e
jl 0x1004e050
mov esi, dword [ebp - 0x10c]
mov ebx, dword [ebp - 0x110]
push 0x6e
push esi
push ebx
call fcn.100669d0
add ebx, 0x6e
add esi, 0x6e
add esp, 0xc
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], ebx
cmp ebx, 0x1010108c
jl 0x1004e000
push dword [ebp - 0x128]
call fcn.10064b5d
add esp, 4
mov al, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x104]
push str._s___File_not_exist.
push eax
call fcn.10021e00
add esp, 0xc
lea eax, [ebp - 0x104]
push 0
push 0
push eax
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
push dword [0xe8c578]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
Function at 0x10050420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x128
push 0
push eax
call fcn.10066f50
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100504af
mov ebx, dword [ebp + 0xc]
nop dword [eax]
lea eax, [ebp - 0x10c]
push str.main.exe
push eax
call fcn.1006afb1
add esp, 8
test eax, eax
jne 0x1005049d
inc esi
cmp esi, ebx
jg 0x100504cb
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10050480
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006459b
mov esp, ebp
pop ebp
ret 8
Function at 0x10052fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x63
push 0
push 0x101fa4e8
call fcn.10066f50
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x63e7e4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x63e7e4
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 2
push 0x63e7e4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10053080
push 0x62eb26
push 0xff
call fcn.10063f10
push 0x10053090
push 0x888d5f
push 0xe8
call fcn.10063f10
push 0x10053140
push 0x886cd7
push 0xff
call fcn.10063f10
push 0x10053140
push 0x7d3cbd
push 0xff
call fcn.10063f10
add esp, 0x30
mov esp, ebp
pop ebp
ret

Function at 0x100544a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x10053b50
push 0x900de9
push 0xe8
call fcn.10063f10
push fcn.10053330
push 0x40487d
push 0xe8
call fcn.10063f10
push fcn.10053330
push 0x48e56c
push 0xe8
call fcn.10063f10
push fcn.10053330
push 0x57d4ff
push 0xe8
call fcn.10063f10
push fcn.10053330
push 0x57d513
push 0xe8
call fcn.10063f10
push 0x10053170
push 0x8c5bb5
push 0xe8
call fcn.10063f10
add esp, 0x44
mov edx, 0xa
mov ecx, 0x56fc5e
call fcn.10063b20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov eax, 0x10053a30
mov byte [ebp - 0x10], 0xe9
sub eax, 0x56fc63
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x56fc5e
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10054593
mov eax, dword [ebp - 0x10]
mov ecx, 0x56fc5e
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x10054595
call esi
push ecx
mov edx, 0xa
mov ecx, 0x56fd1a
call fcn.10063b20
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x10053ad0
mov dword [ebp - 4], 0
sub eax, 0x56fd1f
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x56fd1a
call edi
test eax, eax
je 0x100545fa
mov eax, dword [ebp - 0x10]
mov ecx, 0x56fd1a
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x100545fc
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10054650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push ecx
mov edx, 0xf
mov ecx, 0x47e1c4
call fcn.10063b20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov eax, 0x10054610
mov byte [ebp - 0x10], 0xe9
sub eax, 0x47e1c9
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x47e1c4
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100546c9
mov eax, dword [ebp - 0x10]
mov ecx, 0x47e1c4
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x100546cb
call esi
push ecx
mov edx, 0xf
mov ecx, 0x6339e7
call fcn.10063b20
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x10054630
mov dword [ebp - 4], 0
sub eax, 0x6339ec
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x6339e7
call edi
test eax, eax
je 0x10054730
mov eax, dword [ebp - 0x10]
mov ecx, 0x6339e7
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x10054732
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10054a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..Settings.ini
push 0xc8
push 0x101fa878
push str.Tahoma
push str.FontName1
push str.Font
call esi
push str..Settings.ini
push 0xc8
push 0x101fa7b0
push str.Tahoma
push str.FontName2
push str.Font
call esi
push str..Settings.ini
push 0xc8
push 0x101fa6e8
push str.Tahoma
push str.FontName3
push str.Font
call esi
push str..Settings.ini
push 0xc8
push 0x101fa620
push str.Tahoma
push str.FontName4
push str.Font
call esi
push str..Settings.ini
push 0xc8
push 0x101fa558
push str.Tahoma
push str.FontName5
push str.Font
call esi
push 0x10054ce0
push 0x4060d0
push 0xe8
call fcn.10063f10
push 0x10054ce0
push 0x4d2882
push 0xe8
call fcn.10063f10
push 0x10054ce0
push 0x4d28eb
push 0xe8
call fcn.10063f10
push 0x10054ce0
push 0x4d2957
push 0xe8
call fcn.10063f10
push 0x10054ce0
push 0x4d29c1
push 0xe8
call fcn.10063f10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
add esp, 0x3c
push eax
push 0x40
push 1
push 0x4060d5
call esi
lea eax, [ebp - 4]
mov byte [0x4060d5], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4060d5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
mov byte [0x4d2887], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
mov byte [0x4d28f0], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
mov byte [0x4d295c], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea eax, [ebp - 4]
mov byte [0x4d29c6], 0x90
push eax
push dword [ebp - 4]
push 1
push 0x4d29c6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x958d4f
call esi
lea eax, [ebp - 4]
mov byte [0x958d4f], 0xa8
push eax
push dword [ebp - 4]
push 1
push 0x958d4f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x958d50
call esi
lea eax, [ebp - 4]
mov byte [0x958d50], 3
push eax
push dword [ebp - 4]
push 1
push 0x958d50
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4215a7
call esi
lea eax, [ebp - 4]
mov byte [0x4215a7], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x4215a7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x507aeb
call esi
lea eax, [ebp - 4]
mov byte [0x507aeb], 0x72
push eax
push dword [ebp - 4]
push 1
push 0x507aeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x507afd
call esi
lea eax, [ebp - 4]
mov byte [0x507afd], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x507afd
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10055ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, 0x861110
push 0xe
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055b00
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
movaps xmm0, xmmword [str.CDEF]
mov ecx, dword [0x101fcab4]
mov edx, dword [0x101fcaac]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x47
xor edi, edi
mov dword [ebp - 8], 0x48
push esi
nop dword [eax]
movzx eax, word [ebp + edi*4 - 0x1c]
cwde
movd xmm1, edx
cvtdq2ps xmm1, xmm1
lea eax, [eax + eax*8]
shl eax, 3
movss xmm0, dword [eax + 0x101f5d5c]
comiss xmm0, xmm1
ja 0x10055be8
comiss xmm1, dword [eax + 0x101f5d64]
ja 0x10055be8
movss xmm0, dword [eax + 0x101f5d60]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055be8
comiss xmm1, dword [eax + 0x101f5d68]
ja 0x10055be8
mov eax, dword [ebp + edi*4 - 0x1c]
lea esi, [eax + eax*8]
cmp byte [esi*8 + 0x101f5d71], 0
je 0x10055be8
mov eax, ebx
sub eax, dword [esi*8 + 0x101f5d6c]
cmp dword [ebp + 8], 0x201
je 0x10055c6e
mov byte [esi*8 + 0x101f5d70], 0
cmp eax, 0x1f4
jb 0x10055ccd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 8
mov dword [esi*8 + 0x101f5d6c], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xebf308c1
mov dword [ebp - 0x20], edi
call fcn.1005d410
mov ecx, dword [0x101fcab4]
mov edx, dword [0x101fcaac]
inc edi
cmp edi, 6
jl 0x10055b30
movss xmm0, dword [0x101f7f64]
movd xmm1, edx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055ccd
comiss xmm1, dword [0x101f7f6c]
ja 0x10055ccd
movss xmm0, dword [0x101f7f68]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055ccd
comiss xmm1, dword [0x101f7f70]
ja 0x10055ccd
cmp byte [0x101f7f79], 0
je 0x10055ccd
cmp dword [ebp + 8], 0x201
jne 0x10055c92
pop esi
pop edi
mov byte [0x101f7f78], 1
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + edi*4 - 0x1c]
pop esi
pop edi
pop ebx
lea eax, [eax + eax*8]
mov byte [eax*8 + 0x101f5d70], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
sub ebx, dword [0x101f7f74]
mov byte [0x101f7f78], 0
cmp ebx, 0x1f4
jb 0x10055ccd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 8
mov dword [0x101f7f74], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xebf308c1
mov dword [ebp - 0x20], 7
call fcn.1005d410
mov ecx, dword [ebp - 4]
xor al, al
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
Function at 0x10055cf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, 0x861110
push 0xe
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10055d30
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
movaps xmm0, xmmword [str.CDEF]
mov ecx, dword [0x101fcab4]
mov edx, dword [0x101fcaac]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x47
xor edi, edi
mov dword [ebp - 8], 0x48
push esi
nop dword [eax]
movzx eax, word [ebp + edi*4 - 0x1c]
cwde
movd xmm1, edx
cvtdq2ps xmm1, xmm1
lea eax, [eax + eax*8]
shl eax, 3
movss xmm0, dword [eax + 0x101f5d5c]
comiss xmm0, xmm1
ja 0x10055e18
comiss xmm1, dword [eax + 0x101f5d64]
ja 0x10055e18
movss xmm0, dword [eax + 0x101f5d60]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055e18
comiss xmm1, dword [eax + 0x101f5d68]
ja 0x10055e18
mov eax, dword [ebp + edi*4 - 0x1c]
lea esi, [eax + eax*8]
cmp byte [esi*8 + 0x101f5d71], 0
je 0x10055e18
mov eax, ebx
sub eax, dword [esi*8 + 0x101f5d6c]
cmp dword [ebp + 8], 0x201
je 0x10055e9e
mov byte [esi*8 + 0x101f5d70], 0
cmp eax, 0x1f4
jb 0x10055efd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 8
mov dword [esi*8 + 0x101f5d6c], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xebf308c1
mov dword [ebp - 0x20], edi
call fcn.1005d410
mov ecx, dword [0x101fcab4]
mov edx, dword [0x101fcaac]
inc edi
cmp edi, 6
jl 0x10055d60
movss xmm0, dword [0x101f71e4]
movd xmm1, edx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055efd
comiss xmm1, dword [0x101f71ec]
ja 0x10055efd
movss xmm0, dword [0x101f71e8]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10055efd
comiss xmm1, dword [0x101f71f0]
ja 0x10055efd
cmp byte [0x101f71f9], 0
je 0x10055efd
cmp dword [ebp + 8], 0x201
jne 0x10055ec2
pop esi
pop edi
mov byte [0x101f71f8], 1
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + edi*4 - 0x1c]
pop esi
pop edi
pop ebx
lea eax, [eax + eax*8]
mov byte [eax*8 + 0x101f5d70], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
sub ebx, dword [0x101f71f4]
mov byte [0x101f71f8], 0
cmp ebx, 0x1f4
jb 0x10055efd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 8
mov dword [0x101f71f4], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xebf308c1
mov dword [ebp - 0x20], 6
call fcn.1005d410
mov ecx, dword [ebp - 4]
xor al, al
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4