joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [0xe609e8], 4
je 0x10064e40
jmp 0x10065094
push 0x40
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x10064eba
mov ecx, 0x40
shl ecx, 6
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 8], edx
cmp dword [ebp + 8], 0x201
jne 0x10064e84
mov eax, 0x40
shl eax, 6
mov byte [eax + 0x104e1d64], 1
jmp 0x10065094
mov ecx, 0x40
shl ecx, 6
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 8], 0x1f4
jae 0x10064ea1
jmp 0x10065094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
shl edx, 6
mov dword [edx + 0x104e1d60], eax
jmp 0x10065094
push 0x41
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x10064f34
mov ecx, 0x40
imul edx, ecx, 0x41
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e1d60]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x201
jne 0x10064efe
mov ecx, 0x40
imul edx, ecx, 0x41
mov byte [edx + 0x104e1d64], 1
jmp 0x10065094
mov eax, 0x40
imul ecx, eax, 0x41
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x10064f1b
jmp 0x10065094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x41
mov dword [ecx + 0x104e1d60], eax
jmp 0x10065094
push 0x42
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx edx, al
test edx, edx
je 0x10064fae
mov eax, 0x40
imul ecx, eax, 0x42
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0x201
jne 0x10064f78
mov eax, 0x40
imul ecx, eax, 0x42
mov byte [ecx + 0x104e1d64], 1
jmp 0x10065094
mov edx, 0x40
imul eax, edx, 0x42
mov byte [eax + 0x104e1d64], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x10064f95
jmp 0x10065094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x42
mov dword [edx + 0x104e1d60], eax
jmp 0x10065094
push 0x43
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x10065025
mov ecx, 0x40
imul edx, ecx, 0x43
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e1d60]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0x201
jne 0x10064ff2
mov ecx, 0x40
imul edx, ecx, 0x43
mov byte [edx + 0x104e1d64], 1
jmp 0x10065094
mov eax, 0x40
imul ecx, eax, 0x43
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 0x14], 0x1f4
jae 0x1006500f
jmp 0x10065094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x43
mov dword [ecx + 0x104e1d60], eax
jmp 0x10065094
push 0x44
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx edx, al
test edx, edx
je 0x10065094
mov eax, 0x40
imul ecx, eax, 0x44
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 0x18], edx
cmp dword [ebp + 8], 0x201
jne 0x10065066
mov eax, 0x40
imul ecx, eax, 0x44
mov byte [ecx + 0x104e1d64], 1
jmp 0x10065094
mov edx, 0x40
imul eax, edx, 0x44
mov byte [eax + 0x104e1d64], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x10065080
jmp 0x10065094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x44
mov dword [edx + 0x104e1d60], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10066570
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
sub eax, dword [edx + 0x104e1d60]
cmp eax, 0x5dc
jae 0x100665a3
jmp 0x10066632
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
mov dword [edx + 0x104e1d60], eax
mov eax, 0x40
imul ecx, eax, 0x1e
movzx edx, byte [ecx + 0x104e1d65]
cmp edx, 1
jne 0x100665dc
mov eax, 0x40
imul ecx, eax, 0x1e
mov byte [ecx + 0x104e1d65], 0
jmp 0x10066632
mov ecx, dword [ebp - 0xc]
call fcn.10065d10
push 4
push 0xe8
push 0xf3
lea ecx, [ebp - 8]
call fcn.100285f0
movzx edx, byte [ebp - 7]
push edx
lea eax, [ebp - 8]
push eax
call fcn.10119730
add esp, 8
cmp dword [0x10544c58], 2
jne 0x1006661e
mov ecx, dword [0x104b8550]
mov byte [ecx + 0x29], 1
jmp 0x10066632
mov ecx, 0x1028a9f0
call fcn.10058020
mov dword [0x1028a9f0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret

Function at 0x1006ca20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
sub eax, dword [edx + 0x104e1d60]
cmp eax, 0x5dc
jae 0x1006ca53
jmp 0x1006cb21
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x1e
mov dword [edx + 0x104e1d60], eax
mov eax, 0x40
imul ecx, eax, 0x1e
movzx edx, byte [ecx + 0x104e1d65]
cmp edx, 1
jne 0x1006ca8f
mov eax, 0x40
imul ecx, eax, 0x1e
mov byte [ecx + 0x104e1d65], 0
jmp 0x1006cb21
mov ecx, dword [ebp - 0x14]
call fcn.1006c0b0
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], 0
push 4
push 0xe7
push 0xf3
lea ecx, [ebp - 0x10]
call fcn.100285f0
movzx eax, byte [ebp - 0xf]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10119730
add esp, 8
push 5
push 0xe6
push 0xf3
lea ecx, [ebp - 0xc]
call fcn.100285f0
mov edx, dword [ebp - 0x14]
mov dword [edx], 0
mov byte [ebp - 8], 0
movzx eax, byte [ebp - 0xb]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.10119730
add esp, 8
cmp dword [0x10544c58], 2
jne 0x1006cb0d
mov edx, dword [0x104b855c]
mov byte [edx + 0x29], 1
jmp 0x1006cb21
mov ecx, 0x1028a9f0
call fcn.10058020
mov dword [0x1028a9f0], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10078a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f4918
mov eax, dword [ebp + 8]
push eax
call fcn.101a2d9b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x10078c7e
mov dword [ebp - 0x218], 0x1c
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014c922
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a30dd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a30dd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a2e7b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10077d70
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x10078bb4
mov eax, dword [ebp + 8]
push eax
push 0x101f491c
lea ecx, [ebp - 0x104]
push ecx
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10078c36
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x10078bdb
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x10078c36
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 0x1c
add eax, 0x1028b410
push eax
call fcn.10199f40
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x10078bcc
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014c91d
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x10078c66
mov dword [ebp - 0x22c], 0
jmp 0x10078c7c
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x10078cc0
mov edx, dword [ebp + 8]
push edx
push 0x101f4934
lea eax, [ebp - 0x204]
push eax
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10078cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f494c
mov eax, dword [ebp + 8]
push eax
call fcn.101a2d9b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x10078ebe
mov dword [ebp - 0x218], 6
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014c922
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a30dd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a30dd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a2e7b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10077d70
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x10078df4
mov eax, dword [ebp + 8]
push eax
push 0x101f4950
lea ecx, [ebp - 0x104]
push ecx
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x10078e76
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x10078e1b
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x10078e76
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 6
add eax, 0x1028ad08
push eax
call fcn.10199f40
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x10078e0c
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014c91d
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x10078ea6
mov dword [ebp - 0x22c], 0
jmp 0x10078ebc
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x10078f00
mov edx, dword [ebp + 8]
push edx
push 0x101f4968
lea eax, [ebp - 0x204]
push eax
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10078f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x101f4980
mov eax, dword [ebp + 8]
push eax
call fcn.101a2d9b
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x100790fe
mov dword [ebp - 0x218], 0x68
imul ecx, dword [ebp - 0x218], 0x12c
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
push edx
call fcn.1014c922
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x210]
push ecx
push 1
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.101a30dd
add esp, 0x10
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 4
lea edx, [ebp - 0x208]
push edx
call fcn.101a30dd
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.101a2e7b
add esp, 4
push 0x3bb2
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.10077d70
add esp, 0xc
cmp dword [ebp - 0x208], eax
je 0x10079034
mov eax, dword [ebp + 8]
push eax
push str._s___File_corrupted.
lea ecx, [ebp - 0x104]
push ecx
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x100790b6
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x214], 0
jmp 0x1007905b
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12c
jge 0x100790b6
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
mov eax, 0x4071a0
call eax
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
imul eax, dword [ebp - 0x214], 0x68
add eax, 0x1028d4e0
push eax
call fcn.10199f40
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x1007904c
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.1014c91d
add esp, 4
cmp dword [ebp - 0x224], 0
jne 0x100790e6
mov dword [ebp - 0x22c], 0
jmp 0x100790fc
mov dword [ebp - 0x20c], 0x8123
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], ecx
jmp 0x10079140
mov edx, dword [ebp + 8]
push edx
push 0x101f499c
lea eax, [ebp - 0x204]
push eax
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov eax, dword [0xe8c578]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret
Function at 0x10081230
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0x59
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x100812bc
mov ecx, 0x40
imul edx, ecx, 0x59
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e1d60]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0x201
jne 0x10081286
mov ecx, 0x40
imul edx, ecx, 0x59
mov byte [edx + 0x104e1d64], 1
jmp 0x1008142b
mov eax, 0x40
imul ecx, eax, 0x59
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 8], 0x1f4
jae 0x100812a3
jmp 0x1008142b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x59
mov dword [ecx + 0x104e1d60], eax
jmp 0x1008142b
push 0x5a
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx edx, al
test edx, edx
je 0x10081336
mov eax, 0x40
imul ecx, eax, 0x5a
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 8], 0x201
jne 0x10081300
mov eax, 0x40
imul ecx, eax, 0x5a
mov byte [ecx + 0x104e1d64], 1
jmp 0x1008142b
mov edx, 0x40
imul eax, edx, 0x5a
mov byte [eax + 0x104e1d64], 0
cmp dword [ebp - 0xc], 0x1f4
jae 0x1008131d
jmp 0x1008142b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x5a
mov dword [edx + 0x104e1d60], eax
jmp 0x1008142b
push 0x5b
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx eax, al
test eax, eax
je 0x100813ad
mov ecx, 0x40
imul edx, ecx, 0x5b
mov eax, dword [ebp - 4]
sub eax, dword [edx + 0x104e1d60]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0x201
jne 0x1008137a
mov ecx, 0x40
imul edx, ecx, 0x5b
mov byte [edx + 0x104e1d64], 1
jmp 0x1008142b
mov eax, 0x40
imul ecx, eax, 0x5b
mov byte [ecx + 0x104e1d64], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x10081397
jmp 0x1008142b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x40
imul ecx, edx, 0x5b
mov dword [ecx + 0x104e1d60], eax
jmp 0x1008142b
push 0x8b
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx edx, al
test edx, edx
je 0x1008142b
mov eax, 0x40
imul ecx, eax, 0x8b
mov edx, dword [ebp - 4]
sub edx, dword [ecx + 0x104e1d60]
mov dword [ebp - 0x14], edx
cmp dword [ebp + 8], 0x201
jne 0x100813f7
mov eax, 0x40
imul ecx, eax, 0x8b
mov byte [ecx + 0x104e1d64], 1
jmp 0x1008142b
mov edx, 0x40
imul eax, edx, 0x8b
mov byte [eax + 0x104e1d64], 0
cmp dword [ebp - 0x14], 0x1f4
jae 0x10081414
jmp 0x1008142b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8b
mov dword [edx + 0x104e1d60], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10095310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
jne 0x1009532b
jmp 0x1009547c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 4]
xor edx, edx
mov ecx, 0xa
div ecx
mov byte [ebp - 1], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x61
ja case.0x1009536d.1
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x10095494]
jmp dword [edx*4 + 0x10095484]
cmp dword [ebp - 0xc], 0
je 0x100953bb
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae 0x100953bb
movsx ecx, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
sub eax, ecx
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
jmp case.0x1009536d.1
cmp dword [ebp - 0xc], 0
jne 0x100953ce
mov edx, dword [ebp + 8]
sub edx, 0x30
je 0x10095408
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae 0x10095408
imul ecx, dword [ebp - 0xc], 0xa
mov edx, dword [ebp + 8]
lea eax, [ecx + edx - 0x30]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x10], edx
jmp case.0x1009536d.1
cmp dword [ebp - 0xc], 0
jne 0x10095418
mov eax, dword [ebp + 8]
sub eax, 0x60
je case.0x1009536d.1
mov ecx, dword [ebp - 8]
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x10], eax
jae case.0x1009536d.1
imul edx, dword [ebp - 0xc], 0xa
mov eax, dword [ebp + 8]
lea ecx, [edx + eax - 0x60]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 8]
jbe 0x10095471
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [eax + 8]
mov dword [edx + 4], eax
jmp 0x1009547c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10095a90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x101f54f0
push 0x64
push 0x10214038
push str.Tahoma
push str.FontName
push str.FontConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push fcn.10095d10
push 0x4060d0
push 0xe8
call fcn.10121c00
add esp, 0xc
push fcn.10095bb0
push 0x4d2882
push 0xe8
call fcn.10121c00
add esp, 0xc
push fcn.10095d10
push 0x4d28eb
push 0xe8
call fcn.10121c00
add esp, 0xc
push fcn.10095d10
push 0x4d2957
push 0xe8
call fcn.10121c00
add esp, 0xc
push fcn.10095bb0
push 0x4d29c1
push 0xe8
call fcn.10121c00
add esp, 0xc
push 0x90
push 0x4060d5
call fcn.10121a70
add esp, 8
push 0x90
push 0x4d2887
call fcn.10121a70
add esp, 8
push 0x90
push 0x4d28f0
call fcn.10121a70
add esp, 8
push 0x90
push 0x4d295c
call fcn.10121a70
add esp, 8
push 0x90
push 0x4d29c6
call fcn.10121a70
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.10095d10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf0], eax
mov ecx, dword [ebp - 4]
call fcn.10095bb0
mov edx, dword [ebp - 4]
mov dword [edx + 0xf4], eax
mov esp, ebp
pop ebp
ret
Function at 0x10098eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xff
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.1019aa40
add esp, 0xc
push 0x101f559c
mov ecx, dword [ebp + 8]
push ecx
call fcn.101a2d9b
add esp, 8
mov dword [ebp - 0x110], eax
push 0x6d24
push 0
push 0x104ca50c
call fcn.1019aa40
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x10099053
mov dword [ebp - 0x108], 0
push 0x6d24
call fcn.1014c922
add esp, 4
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x110]
push eax
push 1
push 0x6d24
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.101a30dd
add esp, 0x10
mov edx, dword [ebp - 0x110]
push edx
push 1
push 4
lea eax, [ebp - 0x108]
push eax
call fcn.101a30dd
add esp, 0x10
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.101a2e7b
add esp, 4
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], 0x6e
mov dword [ebp - 0x114], 0
jmp 0x10098fb1
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfe
jge 0x1009900b
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call fcn.10098e50
add esp, 8
mov eax, dword [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
imul edx, dword [ebp - 0x114], 0x6e
add edx, 0x104ca50c
push edx
call fcn.10199f40
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x11c]
mov dword [ebp - 0x118], eax
jmp 0x10098fa2
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
push edx
call fcn.1014c91d
add esp, 4
cmp dword [ebp - 0x120], 0
jne 0x1009903b
mov dword [ebp - 0x128], 0
jmp 0x10099051
mov dword [ebp - 0x10c], 0x8123
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x128], eax
jmp 0x10099096
mov ecx, dword [ebp + 8]
push ecx
push str._s___File_not_exist.
lea edx, [ebp - 0x104]
push edx
call sym.Main.dll_sprintf
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 2
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret