joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100269f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x100269e0
mov byte [ebp - 0x10], 0xe8
sub eax, 0x8369b4
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x8369af
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10026a50
mov eax, dword [ebp - 0x10]
mov ecx, 0x8369af
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10026a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10026a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x100269b0
mov byte [ebp - 0x10], 0xe8
sub eax, 0x77ebb5
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x77ebb0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10026ac0
mov eax, dword [ebp - 0x10]
mov ecx, 0x77ebb0
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10026ac6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10026ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x100269c0
mov byte [ebp - 0x10], 0xe8
sub eax, 0x77ec5e
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x77ec59
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10026b30
mov eax, dword [ebp - 0x10]
mov ecx, 0x77ec59
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10026b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x10026b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x100269d0
mov byte [ebp - 0x10], 0xe8
sub eax, 0x77ece7
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x77ece2
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10026ba0
mov eax, dword [ebp - 0x10]
mov ecx, 0x77ece2
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10026ba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
Function at 0x10026c60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10026d00
push ebx
mov bl, byte [0x101f536e]
mov bh, byte [0x101f532f]
cmp edx, 0x20
jb 0x10026ceb
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10026c8f
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10026cc0
pop edi
cmp eax, edx
jge 0x10026cff
nop
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10026cf0
pop ebx
pop esi
ret

Function at 0x10026d10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10026db0
push ebx
mov bl, byte [0x101f532f]
mov bh, byte [0x101f536e]
cmp edx, 0x20
jb 0x10026d9b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10026d3f
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10026d70
pop edi
cmp eax, edx
jge 0x10026daf
nop
mov cl, byte [eax + esi]
add cl, bl
xor cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10026da0
pop ebx
pop esi
ret
Function at 0x10027130
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 8], 1
mov ebx, 2
nop
lea ecx, [ebx + 1]
mov eax, 0xf0f0f0f1
mul ecx
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x10113adb]
xor al, byte [ebx + 0x10113a8e]
movzx esi, al
mov eax, 0xf0f0f0f1
mul ebx
mov eax, edi
add ebx, 4
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
movzx eax, byte [eax + 0x10113ada]
xor al, byte [ecx + 0x10113a8e]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul ecx
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x10113ad9]
xor al, byte [edi + 0x10113a8e]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul edi
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x10113ad8]
xor al, byte [edi + 0x10113a8d]
add edi, 4
movzx eax, al
add si, ax
add word [ebp - 4], si
cmp ebx, 0x22
jb 0x10027150
mov al, byte [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub al, 0x1d
mov byte [0x101f536e], al
mov eax, dword [ebp - 4]
shr eax, 8
add al, 0x69
mov byte [0x101f532f], al
mov eax, dword [0xd227b0]
mov dword [0x101f53d8], eax
mov eax, dword [0xd227f8]
mov dword [0x101f53d4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd227b0
call esi
lea eax, [ebp - 8]
mov dword [0xd227b0], 0x10026e40
push eax
push dword [ebp - 8]
push 4
push 0xd227b0
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd227f8
call esi
lea eax, [ebp - 8]
mov dword [0xd227f8], 0x10026e90
push eax
push dword [ebp - 8]
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a850
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6744]
cmp byte [0x101f65e1], 0
je 0x1003a8ee
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6734]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003a8ee
comiss xmm1, dword [0x101f673c]
ja 0x1003a8ee
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6738]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003a8ee
comiss xmm1, dword [0x101f6740]
ja 0x1003a8ee
cmp dword [ebp + 8], 0x201
jne 0x1003a8c4
mov byte [0x101f6748], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6748], 0
cmp eax, 0x1f4
jb 0x1003a8ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6744], eax
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x1003a900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f678c]
cmp byte [0x101f65e1], 0
je 0x1003a9c2
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f677c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003a9c2
comiss xmm1, dword [0x101f6784]
ja 0x1003a9c2
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6780]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003a9c2
comiss xmm1, dword [0x101f6788]
ja 0x1003a9c2
cmp dword [ebp + 8], 0x201
jne 0x1003a97d
mov byte [0x101f6790], 1
mov al, 1
mov esp, ebp
pop ebp
ret 4
mov byte [0x101f6790], 0
cmp eax, 0x1f4
jb 0x1003a9c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 8
mov dword [0x101f678c], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xf0f308c1
mov dword [ebp - 4], 1
call fcn.1005d410
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a9d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f67d4]
cmp byte [0x101f65e1], 0
je 0x1003aa7f
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f67c4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003aa7f
comiss xmm1, dword [0x101f67cc]
ja 0x1003aa7f
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f67c8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003aa7f
comiss xmm1, dword [0x101f67d0]
ja 0x1003aa7f
cmp word [0x10113c6c], 2
jb 0x1003aa7f
cmp dword [ebp + 8], 0x201
jne 0x1003aa4e
mov byte [0x101f67d8], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f67d8], 0
cmp eax, 0x1f4
jb 0x1003aa7f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 2
mov dword [0x101f67d4], eax
call fcn.10017f80
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4
Function at 0x1003aa90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f681c]
cmp byte [0x101f65e1], 0
je 0x1003ab3f
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f680c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003ab3f
comiss xmm1, dword [0x101f6814]
ja 0x1003ab3f
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6810]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003ab3f
comiss xmm1, dword [0x101f6818]
ja 0x1003ab3f
cmp word [0x10113c6c], 3
jb 0x1003ab3f
cmp dword [ebp + 8], 0x201
jne 0x1003ab0e
mov byte [0x101f6820], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6820], 0
cmp eax, 0x1f4
jb 0x1003ab3f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 3
mov dword [0x101f681c], eax
call fcn.10017f80
mov byte [0x101f65e1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x1003b220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6aa4]
cmp byte [0x101f6aa9], 0
je 0x1003b2fa
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6a94]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003b2fa
comiss xmm1, dword [0x101f6a9c]
ja 0x1003b2fa
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6a98]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003b2fa
comiss xmm1, dword [0x101f6aa0]
ja 0x1003b2fa
cmp dword [ebp + 8], 0x201
jne 0x1003b2a6
mov dword [0xe8cb3c], 1
mov al, 1
mov byte [0x101f6aa8], 1
pop ebp
ret 4
mov byte [0x101f6aa8], 0
cmp eax, 0x1f4
jb 0x1003b2fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101f6b39], 0
mov dword [0x101f6aa4], eax
je 0x1003b2df
mov byte [0x101f6b39], 0
xor al, al
mov dword [0xe8cb3c], 0
pop ebp
ret 4
mov ecx, 0x101f5d40
call fcn.1003c2b0
mov byte [0x101f6b39], 1
mov dword [0xe8cb3c], 1
xor al, al
pop ebp
ret 4

Function at 0x1003bdd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6c9c]
cmp byte [0x101f6b39], 0
je 0x1003be6e
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6c8c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003be6e
comiss xmm1, dword [0x101f6c94]
ja 0x1003be6e
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6c90]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003be6e
comiss xmm1, dword [0x101f6c98]
ja 0x1003be6e
cmp dword [ebp + 8], 0x201
jne 0x1003be44
mov byte [0x101f6ca0], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6ca0], 0
cmp eax, 0x1f4
jb 0x1003be6e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6c9c], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4
Function at 0x1003be80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6ce4]
cmp byte [0x101f6b39], 0
je 0x1003bf23
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6cd4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003bf23
comiss xmm1, dword [0x101f6cdc]
ja 0x1003bf23
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6cd8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003bf23
comiss xmm1, dword [0x101f6ce0]
ja 0x1003bf23
cmp dword [ebp + 8], 0x201
jne 0x1003bef4
mov byte [0x101f6ce8], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6ce8], 0
cmp eax, 0x1f4
jb 0x1003bf23
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6ce4], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
call fcn.100196a0
xor al, al
pop ebp
ret 4

Function at 0x1003bf30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6d2c]
cmp byte [0x101f6b39], 0
je 0x1003bfd8
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6d1c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003bfd8
comiss xmm1, dword [0x101f6d24]
ja 0x1003bfd8
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6d20]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003bfd8
comiss xmm1, dword [0x101f6d28]
ja 0x1003bfd8
cmp dword [ebp + 8], 0x201
jne 0x1003bfa4
mov byte [0x101f6d30], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6d30], 0
cmp eax, 0x1f4
jb 0x1003bfd8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x101f5d40
mov dword [0x101f6d2c], eax
call fcn.1003c2b0
mov byte [0x101f65e1], 1
mov dword [0xe8cb3c], 1
xor al, al
pop ebp
ret 4

Function at 0x1003bfe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6d74]
cmp byte [0x101f6b39], 0
je 0x1003c083
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6d64]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c083
comiss xmm1, dword [0x101f6d6c]
ja 0x1003c083
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6d68]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c083
comiss xmm1, dword [0x101f6d70]
ja 0x1003c083
cmp dword [ebp + 8], 0x201
jne 0x1003c054
mov byte [0x101f6d78], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6d78], 0
cmp eax, 0x1f4
jb 0x1003c083
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6d74], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
call fcn.10024c80
xor al, al
pop ebp
ret 4
Function at 0x1003c090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6dbc]
cmp byte [0x101f6b39], 0
je 0x1003c133
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6dac]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c133
comiss xmm1, dword [0x101f6db4]
ja 0x1003c133
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6db0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c133
comiss xmm1, dword [0x101f6db8]
ja 0x1003c133
cmp dword [ebp + 8], 0x201
jne 0x1003c104
mov byte [0x101f6dc0], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6dc0], 0
cmp eax, 0x1f4
jb 0x1003c133
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6dbc], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
call fcn.10018880
xor al, al
pop ebp
ret 4

Function at 0x1003c140
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6e04]
cmp byte [0x101f6b39], 0
je 0x1003c1ef
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6df4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c1ef
comiss xmm1, dword [0x101f6dfc]
ja 0x1003c1ef
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6df8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c1ef
comiss xmm1, dword [0x101f6e00]
ja 0x1003c1ef
cmp dword [ebp + 8], 0x201
jne 0x1003c1b4
mov byte [0x101f6e08], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6e08], 0
cmp eax, 0x1f4
jb 0x1003c1ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6e04], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f8639], 1
mov dword [0xe8cb3c], 1
xor al, al
pop ebp
ret 4

Function at 0x1003c200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f6e4c]
cmp byte [0x101f6b39], 0
je 0x1003c2a5
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f6e3c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c2a5
comiss xmm1, dword [0x101f6e44]
ja 0x1003c2a5
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f6e40]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003c2a5
comiss xmm1, dword [0x101f6e48]
ja 0x1003c2a5
cmp dword [ebp + 8], 0x201
jne 0x1003c274
mov byte [0x101f6e50], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f6e50], 0
cmp eax, 0x1f4
jb 0x1003c2a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f6e4c], eax
mov byte [0x101f6b39], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f8099], 1
xor al, al
pop ebp
ret 4
Function at 0x1003c9b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f7704]
cmp byte [0x101f76c1], 0
je 0x1003ca73
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f76f4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003ca73
comiss xmm1, dword [0x101f76fc]
ja 0x1003ca73
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f76f8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003ca73
comiss xmm1, dword [0x101f7700]
ja 0x1003ca73
cmp dword [ebp + 8], 0x201
jne 0x1003ca2d
mov byte [0x101f7708], 1
mov al, 1
mov esp, ebp
pop ebp
ret 4
mov byte [0x101f7708], 0
cmp eax, 0x1f4
jb 0x1003ca73
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f7704], eax
lea ecx, [ebp - 8]
mov al, byte [0x101f5d4c]
mov edx, 5
mov dword [ebp - 8], 0xedf305c1
mov byte [ebp - 4], al
call fcn.1005d410
mov byte [0x101f76c1], 0
mov dword [0xe8cb3c], 0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ca80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f774c]
cmp byte [0x101f76c1], 0
je 0x1003cb1e
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f773c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003cb1e
comiss xmm1, dword [0x101f7744]
ja 0x1003cb1e
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f7740]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1003cb1e
comiss xmm1, dword [0x101f7748]
ja 0x1003cb1e
cmp dword [ebp + 8], 0x201
jne 0x1003caf4
mov byte [0x101f7750], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f7750], 0
cmp eax, 0x1f4
jb 0x1003cb1e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f774c], eax
mov byte [0x101f76c1], 0
mov dword [0xe8cb3c], 0
xor al, al
pop ebp
ret 4

Function at 0x1003cb30
Capabilities:
Read .ini file

Disassembly:
cmp word [0x10113cae], 1
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x861110
push 0x41
jne 0x1003cb8f
call edi
mov ebx, 0x85ec20
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push 0x48
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push 0x21
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push 0x39
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push str..Settings.ini
push 0
push 0x100880a8
jmp 0x1003cbc2
call edi
mov ebx, 0x85ec20
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push 0x39
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push 2
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1003cbea
push str..Settings.ini
push 0
push str.ServerTime
push str.Other
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x1003cbea
movss xmm3, dword [esi + 0x1e80]
mov ecx, esi
movss xmm2, dword [esi + 0x1e7c]
push 0x6c
call fcn.10038f90
pop edi
pop esi
pop ebx
ret
Function at 0x10041fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f894c]
cmp byte [0x101f8639], 0
je 0x1004210a
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f893c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1004210a
comiss xmm1, dword [0x101f8944]
ja 0x1004210a
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8940]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1004210a
comiss xmm1, dword [0x101f8948]
ja 0x1004210a
cmp dword [ebp + 8], 0x201
jne 0x1004204e
mov byte [0x101f8950], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8950], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x1004210a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101f474c], 0
mov dword [0x101f894c], eax
je 0x100420bd
push ecx
mov edx, 7
mov dword [0x101f474c], 0
mov ecx, 0x60f04c
call fcn.10063b20
mov edx, 7
mov ecx, 0x60954d
call fcn.10063b20
mov edx, 7
mov ecx, 0x608cac
call fcn.10063b20
add esp, 4
pop ebp
ret 4
push 0xe9
mov edx, 0x10041e20
mov dword [0x101f474c], 1
mov ecx, 0x608cac
call fcn.10063ab0
push 0xe9
mov edx, 0x10041e90
mov ecx, 0x60954d
call fcn.10063ab0
push 0xe9
mov edx, 0x10041f00
mov ecx, 0x60f04c
call fcn.10063ab0
add esp, 0xc
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x10042110
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8a24]
cmp byte [0x101f8639], 0
je 0x1004223e
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8a14]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1004223e
comiss xmm1, dword [0x101f8a1c]
ja 0x1004223e
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8a18]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1004223e
comiss xmm1, dword [0x101f8a20]
ja 0x1004223e
cmp dword [ebp + 8], 0x201
jne 0x1004219e
mov byte [0x101f8a28], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8a28], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x1004223e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa49c], 0
mov dword [0x101f8a24], eax
je 0x10042219
push 0x100643a0
push 0x60b36a
push 0xe9
mov dword [0x101fa49c], 0
call fcn.10063f10
add esp, 8
mov edx, 0xa
mov ecx, 0x60b36a
call fcn.10063b20
push 0x100643c0
push 0x60b36a
push 0xe9
call fcn.10063f10
add esp, 0x10
pop ebp
ret 4
push 0x10064250
push 0x60b36a
push 0xe9
call fcn.10063f10
add esp, 0xc
mov dword [0x101fa49c], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4