joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006ddb
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [0x100125a0]
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
push dword [0x100125ac]
mov ebx, eax
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x17c]
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x28], 0xffffffff
mov edi, eax
call sym.net.dll__ipv6_available_0
mov dword [ebp - 0x30], eax
test ebx, ebx
jne 0x10006e4b
test edi, edi
jne 0x10006e62
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x10006f48
push dword [0x100121e0]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x190]
mov dword [ebp - 0x2c], eax
test edi, edi
je 0x10006e75
push dword [0x100121e0]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x190]
mov dword [ebp - 0x28], eax
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
jne 0x10006e8c
push str.address
push esi
call sub.java.dll__JNU_ThrowNullPointerException_8
jmp 0x10006f48
push dword [ebp - 0x24]
push esi
call fcn.1000ab66
mov eax, dword [esi]
pop ecx
pop ecx
push esi
call dword [eax + 0x390]
test al, al
jne 0x10006f48
push dword [ebp - 0x24]
push esi
call fcn.1000aba4
pop ecx
pop ecx
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x390]
test al, al
jne 0x10006f48
xor eax, eax
inc eax
cmp edi, 2
jne 0x10006edd
cmp dword [ebp - 0x30], ebx
jne 0x10006ee4
push str.Protocol_family_not_supported
jmp 0x10006e3b
cmp edi, eax
mov edi, dword [ebp - 0x2c]
je 0x10006ee7
mov edi, dword [ebp - 0x28]
cmp dword [0x10012208], ebx
je 0x10006f10
push ebx
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x9800000c
push edi
call dword [sym.imp.ws2_32.dll_WSAIoctl]
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push esi
call fcn.10004595
test eax, eax
jne 0x10006f48
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10006f48
push str.connect
push esi
call fcn.1000afaa
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0x10
Function at 0x10008ba1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x2c], 0xffffffff
and dword [ebp - 0x28], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call sym.net.dll__ipv6_available_0
push edi
mov ebx, eax
call fcn.100065bc
pop ecx
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x10008be0
push edi
call fcn.100065e8
pop ecx
jmp 0x10008be3
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
jge 0x10008c01
test eax, eax
jns 0x10008c01
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
jmp 0x10008c63
cmp dword [ebp + 0x10], 2
mov dword [ebp - 0x28], 0x10
je 0x10008c1a
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10008c24
cmp dword [ebp - 0x24], 0xffffffff
jne 0x10008c2a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x24], 0xffffffff
je 0x10008bed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10008c55
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x10008bfd
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10004595
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0xc
Function at 0x1000939b
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x10012588]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100093d1
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e6
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10009405
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e5
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x100094d2
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1000947c
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.10004595
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e4
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100094b6
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call fcn.10004595
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e4
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x100094e4
push 0
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1000a553
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
call fcn.100091ff
push edi
mov ebx, eax
call fcn.1000922b
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0x14
test ebx, ebx
jns 0x1000a5cd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jns 0x1000a5cd
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0x10
cmp dword [ebp + 0x10], 0xf
jne 0x1000a670
push 0x1c
pop eax
push eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1000a5fa
push edi
call fcn.1000922b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x1000a622
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x1000a5b9
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10004595
mov edi, eax
test edi, edi
je 0x1000a5b9
push dword [ebp - 0x38]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x1000a5b9
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x38]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x1000a5bc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x1000a68e
push str.Invalid_option
jmp 0x1000a5ae
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 4
cmp edi, 0x80
je 0x1000a6a4
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call fcn.10004595
test eax, eax
jns 0x1000a6ce
push str.getsockopt
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x1000a5b9
cmp edi, 8
jg 0x1000a6e9
je 0x1000a709
dec edi
je 0x1000a709
dec edi
dec edi
je 0x1000a71a
dec edi
je 0x1000a709
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x1000a5ae
cmp edi, 0x80
je 0x1000a722
cmp edi, 0x1000
jle 0x1000a6df
cmp edi, 0x1002
jle 0x1000a71a
cmp edi, 0x1003
jne 0x1000a6df
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x1000a5bc
mov eax, dword [ebp - 0x24]
jmp 0x1000a5bc
cmp word [ebp - 0x24], 0
je 0x1000a5b9
movzx eax, word [ebp - 0x22]
jmp 0x1000a5bc
Function at 0x403ba7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403bb6
pop dword [ebp - 0x28]
mov eax, 0x8ecf3e86
sub eax, 0x8e8f02d0
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3914e
push 0
mov eax, 0xd4d5dfcc
add eax, 0x2b6b00fc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4a89
xor edx, edx
add edx, eax
mov edi, 0x4ae22111
add edi, 0xb55f76ef
add edi, dword [ebp - 0x28]
mov esi, 0xd520226
sub dword [ebp - 0x18], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0x3517bcf8
sub ebx, esi
mov dword [ebp - 0x14], 0xad91ea50
mov dword [edx], ebx
sub dword [ebp - 4], ecx
add edx, 0xa3a7ac75
sub edx, 0xa3a7ac71
add edi, 0xe1a9809e
sub edi, 0xe1a9809a
loop 0x403c0b
add eax, 0x42e0a63d
add eax, 0xbd2076ba
mov ebx, eax
add eax, 0xc3010593
sub eax, 0xc301058e
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x438c8d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
push 0x5521acb7
pop edi
sub edi, edi
add eax, 0x5f5fd89c
call fcn.00438cc2
dec edi
add eax, eax
xor dword [esi], edx
inc eax
inc esi
mov edi, 0x544eabe2
sub edi, edi
cmp esi, ebx
jne fcn.00438c8d
and edi, edi
inc edi
mov eax, 0x7a144f65
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401bd7
pop dword [ebp - 0x2c]
mov eax, 0xf9e93055
sub eax, 0xf9a9147e
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x97ef35bd
sub dword [ebp - 0x3c], 0x499cf072
mov dword [ebp - 0x38], 0x38917ee8
sub dword [ebp - 0x38], 0x65e32a3
mov dword [ebp - 0x34], 0xac88d541
sub dword [ebp - 0x34], 0x603c9113
mov dword [ebp - 0x30], 0xafe789ef
sub dword [ebp - 0x30], 0xafe789ef
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xcd28ab26
add eax, 0x3317c53a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x83e9f25d
add dword [ebp - 0x3c], 0xf08876f9
mov dword [ebp - 0x38], 0x7d7093d8
sub dword [ebp - 0x38], 0x3c043263
mov dword [ebp - 0x34], 0xe0ef446b
sub dword [ebp - 0x34], 0x7d7fd7ff
mov dword [ebp - 0x30], 0xdc451bb0
add dword [ebp - 0x30], 0x23bae450
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x791f9c55
add eax, 0x8720d4ab
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3359b
push 0
call eax
mov ecx, 0x54c20924
sub ecx, 0x54c1ce0a
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x2c]
mov esi, 0x7e2dae8
mov dword [ebp - 0x24], 0xdd10903a
mov edx, dword [ebx]
mov dword [ebp - 0x14], 0x62e0b815
sub edx, esi
add dword [ebp - 0x10], 0x191a83c0
mov dword [edi], edx
xor dword [ebp - 0x10], esi
add edi, 4
add ebx, 0x48c8e2ec
sub ebx, 0x48c8e2e8
loop 0x401ced
add eax, 0xdf3b
xor ebx, ebx
add ebx, eax
add eax, 0x33ec27ce
add eax, 0xcc13d837
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10007c2e
pop dword [ebp - 0x38]
mov eax, 0xe33161b5
add eax, 0x2ccf1a79
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6e21a4c5
sub dword [ebp - 0x48], 0x1fcf5f7a
mov dword [ebp - 0x44], 0xa560733d
add dword [ebp - 0x44], 0x8cd2d908
mov dword [ebp - 0x40], 0x3af32fb6
add dword [ebp - 0x40], 0x11591478
mov dword [ebp - 0x3c], 0x521bcd27
sub dword [ebp - 0x3c], 0x521bcd27
lea eax, [ebp - 0x48]
push eax
mov eax, 0x57efc828
add eax, 0xb810b82c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x93dede65
sub dword [ebp - 0x48], 0x1f6c750f
mov dword [ebp - 0x44], 0x6f310c25
add dword [ebp - 0x44], 0xd23b5550
mov dword [ebp - 0x40], 0x5a46e02f
sub dword [ebp - 0x40], 0xf6d773c3
mov dword [ebp - 0x3c], 0x89ef2748
add dword [ebp - 0x3c], 0x7610d8b8
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x33006
push 0
call eax
mov ecx, 0xfbdf7a8d
add ecx, 0x420bec9
mov ebx, eax
mov esi, 0x89d56ce5
add esi, 0x862b8d1b
add esi, dword [ebp - 0x38]
mov edi, 0xe798b061
sub edi, 0x5142587a
add dword [ebp - 4], 0x3bc67081
mov edx, dword [esi]
xor dword [ebp - 8], 0x525b7f7
add edx, edi
xor dword [ebp - 0xc], 0xa999a47b
mov dword [ebx], edx
add dword [ebp - 0x14], 0xda117a08
add ebx, 0xd3fea10
add ebx, 0xf2c015f4
add esi, 0x82a660e2
sub esi, 0x82a660de
loop 0x10007d4b
add eax, 0xd82b
xor ebx, ebx
add ebx, eax
add eax, 0xc0fc9436
add eax, 0x3f036bcf
mov ecx, 0xfe035c31
sub ecx, 0xee035c31
invalid
invalid
invalid
invalid
invalid
Function at 0x622d6be0
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._BCryptHashData_16
mov eax, 1
sub esp, 0x10
leave
ret
Function at 0x10006b00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6375
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1012604c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10006d80
movzx eax, byte [0x101b136a]
test eax, eax
je 0x10006be3
mov ecx, dword [0x101b0da8]
call fcn.1000ea90
movzx ecx, al
test ecx, ecx
je 0x10006be3
mov edx, dword [0x101b0020]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [0x101b1388]
cmp edx, dword [ecx + 4]
jle 0x10006b9a
push 0x101b1388
call fcn.100cac66
add esp, 4
cmp dword [0x101b1388], 0xffffffff
jne 0x10006b9a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b138c], eax
push 0x101b1388
call fcn.100cac1c
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101b138c]
cmp eax, 0x7530
jbe 0x10006be3
push 0x1000e960
lea ecx, [ebp - 0x14]
call fcn.10006fe0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10006aa0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b138c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10006a50
movzx eax, byte [0x101b136b]
test eax, eax
je 0x10006c8e
mov ecx, dword [0x101b0020]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x101b1390]
cmp ecx, dword [eax + 4]
jle 0x10006c3e
push 0x101b1390
call fcn.100cac66
add esp, 4
cmp dword [0x101b1390], 0xffffffff
jne 0x10006c3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b1394], eax
push 0x101b1390
call fcn.100cac1c
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101b1394]
imul edx, dword [0x101b136c], 0x2710
cmp eax, edx
jbe 0x10006c8e
push 0x1000d8a0
lea ecx, [ebp - 0x1c]
call fcn.10006fe0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.10006aa0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b1394], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10006a50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10006d80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f63fd
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1012604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Russian
push 0
call fcn.100cfc81
add esp, 8
movzx eax, byte [0x101b1368]
test eax, eax
jne 0x10006dc7
jmp 0x10006f6a
call fcn.10006ca0
movzx ecx, al
test ecx, ecx
je 0x10006f5c
mov ecx, dword [0x101b0da8]
call fcn.1001fa70
movzx edx, byte [0x101b1369]
test edx, edx
je 0x10006ea0
movzx eax, byte [0x101b0d96]
test eax, eax
jne 0x10006ea0
call fcn.10076df0
mov ecx, dword [eax]
mov edx, 0xfc
imul eax, edx, 0x63
lea ecx, [ecx + eax + 0x152]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10008860
add esp, 8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x54], ecx
push str.9940_
lea edx, [ebp - 0x28]
push edx
call fcn.10008860
add esp, 8
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x64], esp
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push edx
call fcn.1000d1e0
add esp, 0xc
call fcn.1000cc10
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000dfc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000dfc0
mov byte [0x101b0d96], 1
movzx edx, byte [0x101b1368]
test edx, edx
je 0x10006f5a
movzx eax, byte [0x101b0d97]
test eax, eax
jne 0x10006f5a
mov ecx, dword [0x101b0020]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x101b1398]
cmp ecx, dword [eax + 4]
jle 0x10006f0a
push 0x101b1398
call fcn.100cac66
add esp, 4
cmp dword [0x101b1398], 0xffffffff
jne 0x10006f0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b139c], eax
push 0x101b1398
call fcn.100cac1c
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101b139c]
cmp eax, 0x1b58
jbe 0x10006f53
push 0x10008660
lea ecx, [ebp - 0x60]
call fcn.10006fe0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.10006aa0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b139c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10006a50
mov byte [0x101b0d97], 1
jmp 0x10006f6a
mov byte [0x101b0d96], 0
mov byte [0x101b0d97], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ca7cd
mov esp, ebp
pop ebp
ret
Function at 0x100070e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f643d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1012604c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.100063e0
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100071d0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x10007240
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.100063d0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.100cfe30
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x10007168
lea ecx, [ebp - 0x14]
call fcn.100071a0
jmp 0x10007179
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.100c898d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100065c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000efb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [0x101b11f1]
test eax, eax
je 0x1000f090
movzx ecx, byte [0x101b11f0]
test ecx, ecx
je 0x1000f090
movzx edx, byte [0x101b134c]
test edx, edx
je 0x1000f090
mov eax, dword [0x101b0020]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x101b13a0]
cmp eax, dword [edx + 4]
jle 0x1000f02d
push 0x101b13a0
call fcn.100cac66
add esp, 4
cmp dword [0x101b13a0], 0xffffffff
jne 0x1000f02d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b13a4], eax
push 0x101b13a0
call fcn.100cac1c
add esp, 4
push ecx
movss xmm0, dword [0x1011cbec]
movss dword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101b13a4]
mov dword [ebp - 4], eax
cvtsi2sd xmm0, dword [ebp - 4]
mov ecx, dword [ebp - 4]
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x1011cc40]
movsd qword [ebp - 0xc], xmm0
cvtsd2ss xmm0, qword [ebp - 0xc]
push ecx
movss dword [esp], xmm0
call fcn.1005a260
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101b13a4]
cmp eax, 0x3e80
jbe 0x1000f090
mov byte [0x101b11f1], 0
mov esp, ebp
pop ebp
ret