joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x1012cb55], 0
mov dword [ebp - 0x10], eax
jne 0x10019090
xor al, al
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x1073e890]
imul eax, eax, 0x19
push ebx
push esi
push edi
mov edi, eax
add eax, 0x19
mov dword [ebp - 8], edi
cmp edi, eax
jge 0x1001924d
mov edx, edi
shl edx, 6
add edx, 0x1012cd50
lea esi, [edi - 0x28]
mov dword [ebp - 4], edx
lea esp, [esp]
lea eax, [edi + 0x23e]
movzx eax, ax
mov ecx, 0x879340c
fild dword [ecx]
movsx ecx, ax
shl ecx, 6
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
fld dword [ecx + 0x10123dc0]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x1001922f
fld dword [ecx + 0x10123dc8]
fcompp
fnstsw ax
test ah, 5
jnp 0x10019231
fild dword [0x8793410]
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
fld dword [ecx + 0x10123dc4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x1001922f
fld dword [ecx + 0x10123dcc]
fcompp
fnstsw ax
test ah, 5
jnp 0x10019231
cmp dword [ebp + 8], 0x201
je 0x10019258
mov ecx, dword [ebp - 0x10]
sub ecx, dword [edx]
mov byte [edx + 4], 0
cmp ecx, 0x12c
jb 0x1001924d
lea ecx, [esi - 5]
xor ebx, ebx
or eax, 0xffffffff
cmp ecx, 4
ja 0x10019168
lea ebx, [eax + 0xa]
mov eax, ecx
cmp esi, 4
ja 0x10019174
mov ebx, 8
mov eax, esi
lea ecx, [esi + 5]
cmp ecx, 4
ja 0x10019183
mov ebx, 7
mov eax, ecx
lea ecx, [esi + 0xa]
cmp ecx, 4
ja 0x10019192
mov ebx, 6
mov eax, ecx
lea ecx, [esi + 0xf]
cmp ecx, 4
ja 0x100191a1
mov ebx, 5
mov eax, ecx
lea ecx, [esi + 0x14]
cmp ecx, 4
ja 0x100191b0
mov ebx, 4
mov eax, ecx
lea ecx, [esi + 0x19]
cmp ecx, 4
ja 0x100191bf
mov ebx, 3
mov eax, ecx
lea ecx, [esi + 0x1e]
cmp ecx, 4
ja 0x100191ce
mov ebx, 2
mov eax, ecx
lea ecx, [esi + 0x23]
cmp ecx, 4
ja 0x100191dd
mov ebx, 1
mov eax, ecx
lea edx, [esi + 0x28]
cmp edx, 4
ja 0x100191e9
xor ebx, ebx
mov eax, edi
test eax, eax
jne 0x100191f2
lea edi, [eax + 1]
jmp 0x10019218
cmp eax, 1
jne 0x100191fc
lea edi, [eax + 9]
jmp 0x10019218
cmp eax, 2
jne 0x10019206
lea edi, [eax + 0x12]
jmp 0x10019218
cmp eax, 3
jne 0x10019210
lea edi, [eax + 0x1b]
jmp 0x10019218
cmp eax, 4
jne 0x1001924d
lea edi, [eax + 0x5f]
call fcn.10019270
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [ecx], eax
mov edx, ecx
jmp 0x10019231
fstp st(0)
mov eax, dword [0x1073e890]
inc eax
imul eax, eax, 0x19
inc edi
add edx, 0x40
inc esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edx
cmp edi, eax
jl 0x100190c0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
shl edi, 6
mov al, 1
mov byte [edi + 0x1012cd54], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10019270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1073e85c]
cmp eax, 0x190
jb 0x100192c8
call esi
sub eax, dword [0x1012cb50]
cmp eax, 0x190
jb 0x100192c8
test ebx, ebx
js 0x100192c8
test edi, edi
js 0x100192c8
call esi
mov dword [0x1073e85c], eax
lea eax, [ebp - 0xc]
mov ecx, 0xc
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 0xf6f30cc1
call fcn.1008c360
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10019380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 4
mov ebx, 0x7e7827
call fcn.10098e00
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10019450
push 5
sub eax, 0x7e782c
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100193e4
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100193ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x5f479e
call fcn.10098e00
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10019580
push 5
sub ecx, 0x5f47a3
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10019440
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x10019446
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100199d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10019da0
push 0x100b09b4
push str.Data_Custom_ServerListInfo.txt
call dword [sym.imp.MSVCR100.dll_fopen]
xor edi, edi
add esp, 8
mov dword [0x106106f0], eax
cmp eax, edi
je 0x10019a01
call fcn.10019b70
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
mov eax, 0x10019c70
push 5
sub eax, 0x9540bd
mov bl, 0xe8
push 0x9540b8
mov byte [ebp - 8], bl
mov dword [ebp - 7], eax
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x10019a57
mov edx, dword [ebp - 8]
mov cl, byte [ebp - 4]
mov eax, 0x9540b8
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
push edx
push eax
push 5
push 0x9540b8
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10019a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0xc]
push edx
push 0x40
mov ecx, 0x10019c70
push 5
sub ecx, 0x9540f3
push 0x9540ee
mov byte [ebp - 8], bl
mov dword [ebp - 7], ecx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x10019aac
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov eax, 0x9540ee
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push ecx
push 5
push 0x9540ee
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10019ab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0xc]
push eax
push 0x40
mov edx, 0x10019c70
push 5
sub edx, 0x954126
push 0x954121
mov byte [ebp - 8], bl
mov dword [ebp - 7], edx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x10019b01
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov eax, 0x954121
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push ecx
push 5
push 0x954121
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10019b07
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0xc]
push eax
push 0x40
mov edx, 0x10019c70
push 5
sub edx, 0x954159
push 0x954154
mov byte [ebp - 8], bl
mov dword [ebp - 7], edx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x10019b56
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov eax, 0x954154
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push ecx
push 5
push 0x954154
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x10019b5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100214c0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
mov eax, 0x635fd0
call eax
fld1
mov esi, dword [sym.imp.OPENGL32.dll_glColor3f]
fst dword [esp]
sub esp, 8
fst dword [esp + 4]
fstp dword [esp]
call esi
fld dword [ebp + 0x10]
fmul qword [0x100b7280]
mov ecx, dword [0x1061085c]
mov edx, dword [0x10610858]
mov eax, dword [0x10610860]
push str.Tahoma
fdiv qword [0x100b6f18]
push 0
push ecx
mov ecx, dword [0x1061086c]
push 0
push 0
push 1
push edx
mov edx, dword [0x10610864]
push eax
mov eax, dword [ebp + 0x14]
push ecx
push 0x2bc
push 0
push 0
push edx
push eax
mov byte [ebp - 1], 0
fstp dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateFontA]
fld dword [ebp + 0x10]
mov edi, eax
call fcn.100ac0e0
fld dword [ebp + 8]
mov ebx, eax
call fcn.100ac0e0
fld dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.100ac0e0
fld dword [ebp + 0xc]
push eax
push ebx
call fcn.100ac0e0
mov ecx, dword [ebp - 0xc]
push eax
push ecx
mov edx, 0x790b10
call edx
add esp, 0x10
sub esp, 0xc
cmp al, 1
jne 0x100215f3
fld dword [0x100b73d8]
fstp dword [esp + 8]
fld dword [0x100b7bc8]
fstp dword [esp + 4]
fld1
fstp dword [esp]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10123dd0]
cmp eax, 0x12c
jbe 0x10021602
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10021602
fld dword [0x100b7bc4]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x100b7bc0]
fstp dword [esp + 4]
fld dword [0x100b7bbc]
fstp dword [esp]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10123dd0], eax
mov byte [ebp - 1], 1
jmp 0x10021602
fld1
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
call esi
fldz
push ecx
fst dword [esp]
mov edx, 0x637c60
fld dword [0x100b6f6c]
push 1
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [0x100b7bb8]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp - 8]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7b4b
call edx
fld dword [ebp - 8]
fmul qword [0x100b6ee8]
mov eax, dword [ebp + 0x18]
add esp, 0x30
push eax
fadd dword [ebp + 0xc]
push 0
fild dword [ebp + 0x14]
push ebx
push 0
push 0xe6fcf7ff
fdiv qword [0x100b7f58]
fsubp st(1)
call fcn.100ac0e0
mov ecx, dword [ebp - 0xc]
push eax
push ecx
push edi
mov cl, 3
call fcn.1001c7a0
fld1
add esp, 0x14
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call esi
mov edx, dword [ebp + 0x18]
push edx
call esi
mov eax, 0x635f50
call eax
push 0
mov ecx, 0x635fd0
call ecx
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10022f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x1061bfb8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x10022b50
push 2
call esi
cmp dword [0x10610a30], 0
mov dword [0x10610a20], eax
jne 0x10022fa0
call edi
push eax
mov eax, dword [0x10610a2c]
push eax
push 0x10022670
push 7
call esi
mov dword [0x10610a30], eax
test eax, eax
je 0x10023004
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10022630
push 5
sub ecx, 0x4d0e34
push 0x4d0e2f
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10022ffe
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d0e2f
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d0e2f
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x10023004
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024220
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x69
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10024268
cmp esi, 0x201
jne 0x10024243
mov byte [0x10125814], 1
ret
sub edx, dword [0x10125810]
mov byte [0x10125814], 0
cmp edx, 0x1f4
jb 0x1002437f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10125810], eax
ret
mov eax, 0x6a
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100242b0
cmp esi, 0x201
jne 0x1002428b
mov byte [0x10125854], 1
ret
sub edx, dword [0x10125850]
mov byte [0x10125854], 0
cmp edx, 0x1f4
jb 0x1002437f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10125850], eax
ret
mov eax, 0x6b
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100242f8
cmp esi, 0x201
jne 0x100242d3
mov byte [0x10125894], 1
ret
sub edx, dword [0x10125890]
mov byte [0x10125894], 0
cmp edx, 0x1f4
jb 0x1002437f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10125890], eax
ret
mov eax, 0x6c
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1002433c
cmp esi, 0x201
jne 0x1002431b
mov byte [0x101258d4], 1
ret
sub edx, dword [0x101258d0]
mov byte [0x101258d4], 0
cmp edx, 0x1f4
jb 0x1002437f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101258d0], eax
ret
mov eax, 0x6d
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1002437f
cmp esi, 0x201
jne 0x1002435f
mov byte [0x10125914], 1
ret
sub edx, dword [0x10125910]
mov byte [0x10125914], 0
cmp edx, 0x1f4
jb 0x1002437f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10125910], eax
ret
Function at 0x10024e90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10024630
push 0x5914ab
mov bl, 0xe8
call fcn.10098b80
push 0x10024630
push 0x5914c7
call fcn.10098b80
push 0x10024630
push 0x5a0652
call fcn.10098b80
push 0x10024630
push 0x5a0775
call fcn.10098b80
push 0x10024630
push 0x5b6cf4
call fcn.10098b80
push 0x10024630
push 0x7e05a8
call fcn.10098b80
push 0x10024690
push 0x6f2ddc
call fcn.10098b80
push 0x10024690
push 0x74a6c3
call fcn.10098b80
add esp, 0x40
push 0x10024690
push 0x74a791
call fcn.10098b80
push 0x10024690
push 0x74a7cc
call fcn.10098b80
push 0x10024690
push 0x74a807
call fcn.10098b80
push 0x10024690
push 0x74a842
call fcn.10098b80
push 0x10024690
push 0x74a87d
call fcn.10098b80
push 0x10024690
push 0x74a8d7
call fcn.10098b80
push 0x10024690
push 0x74a912
call fcn.10098b80
push 0x10024690
push 0x74a94d
call fcn.10098b80
add esp, 0x40
push 0x10024690
push 0x74a988
call fcn.10098b80
push 0x10024690
push 0x74aa05
call fcn.10098b80
push 0x10024690
push 0x74aa40
call fcn.10098b80
push 0x10024690
push 0x74aa7b
call fcn.10098b80
push 0x10024690
push 0x74aab6
call fcn.10098b80
push 0x10024690
push 0x74aaf8
call fcn.10098b80
push 0x10024690
push 0x74ab33
call fcn.10098b80
push 0x10024690
push 0x74ab6e
call fcn.10098b80
add esp, 0x40
push 0x10024690
push 0x74abad
call fcn.10098b80
add esp, 8
mov esi, 7
mov ebx, 0x566178
call fcn.10098e00
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10024530
push 5
sub eax, 0x56617d
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10025079
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1002507f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 6
mov ebx, 0x56595e
call fcn.10098e00
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100245b0
push 5
sub ecx, 0x565963
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100250d5
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100250db
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x15
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 1
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 0x49
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100271ca
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10124290]
cmp eax, 0x1f4
jb 0x100271c9
call esi
cmp byte [0x10124295], 1
mov dword [0x10124290], eax
jne 0x10027191
xor eax, eax
mov byte [0x10124295], al
mov dword [0xe8cb3c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10123c90
call fcn.10054eb0
call fcn.10025de0
lea eax, [ebp - 4]
mov ecx, 4
push eax
mov dword [ebp - 4], 0xe8f304c1
call fcn.1008c360
mov byte [0x10124295], 1
add esp, 4
mov dword [0xe8cb3c], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10027360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x100273dd
cmp dword [0x1068957c], 0xffffffff
je 0x100273dd
mov eax, 0x4f
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100273dd
cmp dword [ebp + 8], 0x201
jne 0x100273aa
mov byte [0x10125194], 1
mov al, 1
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x10125190]
cmp eax, 0x64
jb 0x100273dd
sub edx, dword [0x101251d0]
cmp edx, 0x64
jb 0x100273dd
inc dword [0x107427b8]
mov byte [0x10125194], 0
call esi
mov dword [0x10125190], eax
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x100273f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x10027471
cmp dword [0x10689580], 0xffffffff
je 0x10027471
mov eax, 0x50
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10027471
cmp dword [ebp + 8], 0x201
jne 0x1002743b
mov eax, 1
mov byte [0x101251d4], al
pop esi
pop ebp
ret 4
mov eax, edx
sub eax, dword [0x101251d0]
cmp eax, 0x64
jb 0x10027471
sub edx, dword [0x10125190]
cmp edx, 0x64
jb 0x10027471
mov byte [0x101251d4], 0
call esi
mov dword [0x101251d0], eax
mov eax, 1
sub dword [0x107427b8], eax
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4
Function at 0x100274f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x1002757d
mov eax, 0x112
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1002757d
cmp dword [ebp + 8], 0x201
jne 0x10027534
mov al, 1
mov byte [0x10128254], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x10128250]
mov byte [0x10128254], 0
cmp edx, 0x1f4
jb 0x1002757d
call esi
mov dword [0x10128250], eax
lea eax, [ebp - 0xc]
mov ecx, 0xc
push eax
mov byte [0x10129d55], 0
mov dword [ebp - 0xc], 0x27f30cc1
mov dword [ebp - 8], 1
call fcn.1008c360
add esp, 4
mov byte [0x10124295], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10027590
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x1002761d
mov eax, 0x113
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1002761d
cmp dword [ebp + 8], 0x201
jne 0x100275d4
mov al, 1
mov byte [0x10128294], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x10128290]
mov byte [0x10128294], 0
cmp edx, 0x1f4
jb 0x1002761d
call esi
mov dword [0x10128290], eax
lea eax, [ebp - 0xc]
mov ecx, 0xc
push eax
mov byte [0x10129d55], 0
mov dword [ebp - 0xc], 0x27f30cc1
mov dword [ebp - 8], 2
call fcn.1008c360
add esp, 4
mov byte [0x10124295], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10027630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x100276bd
mov eax, 0x114
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100276bd
cmp dword [ebp + 8], 0x201
jne 0x10027674
mov al, 1
mov byte [0x101282d4], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x101282d0]
mov byte [0x101282d4], 0
cmp edx, 0x1f4
jb 0x100276bd
call esi
mov dword [0x101282d0], eax
lea eax, [ebp - 0xc]
mov ecx, 0xc
push eax
mov byte [0x10129d55], 0
mov dword [ebp - 0xc], 0x27f30cc1
mov dword [ebp - 8], 3
call fcn.1008c360
add esp, 4
mov byte [0x10124295], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100276d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10124295], 0
mov edx, eax
je 0x1002775d
mov eax, 0x115
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1002775d
cmp dword [ebp + 8], 0x201
jne 0x10027714
mov al, 1
mov byte [0x10128314], al
pop esi
mov esp, ebp
pop ebp
ret 4
sub edx, dword [0x10128310]
mov byte [0x10128314], 0
cmp edx, 0x1f4
jb 0x1002775d
call esi
mov dword [0x10128310], eax
lea eax, [ebp - 0xc]
mov ecx, 0xc
push eax
mov byte [0x10129d55], 0
mov dword [ebp - 0xc], 0x27f30cc1
mov dword [ebp - 8], 4
call fcn.1008c360
add esp, 4
mov byte [0x10124295], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4