joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10073460
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100735ad
call fcn.10071db0
test al, al
jne 0x100735ad
call fcn.10071f20
test al, al
jne 0x100735ad
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007353d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100734dd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007353d
mov eax, 0xae
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100735ab
sub esi, dword [0x103a4078]
cmp edi, 0x201
jne 0x10073517
mov eax, 1
pop esi
mov byte [0x103a407c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a407c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100735ab
call ebx
mov dword [0x103a4078], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073597
mov eax, 0xc2
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100735ab
sub esi, dword [0x103a4618]
cmp edi, 0x201
jne 0x10073573
mov eax, 1
pop esi
mov byte [0x103a461c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a461c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100735ab
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4618], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x157904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100735c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007370d
call fcn.10071db0
test al, al
jne 0x1007370d
call fcn.10071f20
test al, al
jne 0x1007370d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007369d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007363d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007369d
mov eax, 0xaf
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007370b
sub esi, dword [0x103a40c0]
cmp edi, 0x201
jne 0x10073677
mov eax, 1
pop esi
mov byte [0x103a40c4], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a40c4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007370b
call ebx
mov dword [0x103a40c0], eax
lea eax, [ebp - 4]
push eax
jmp 0x100736f7
mov eax, 0xc3
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007370b
sub esi, dword [0x103a4660]
cmp edi, 0x201
jne 0x100736d3
mov eax, 1
pop esi
mov byte [0x103a4664], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4664], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007370b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4660], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x167904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10073720
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x1007386d
call fcn.10071db0
test al, al
jne 0x1007386d
call fcn.10071f20
test al, al
jne 0x1007386d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100737fd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007379d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100737fd
mov eax, 0xb0
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007386b
sub esi, dword [0x103a4108]
cmp edi, 0x201
jne 0x100737d7
mov eax, 1
pop esi
mov byte [0x103a410c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a410c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007386b
call ebx
mov dword [0x103a4108], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073857
mov eax, 0xc4
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007386b
sub esi, dword [0x103a46a8]
cmp edi, 0x201
jne 0x10073833
mov eax, 1
pop esi
mov byte [0x103a46ac], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a46ac], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1007386b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a46a8], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x177904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10073880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100739cd
call fcn.10071db0
test al, al
jne 0x100739cd
call fcn.10071f20
test al, al
jne 0x100739cd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007395d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100738fd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007395d
mov eax, 0xb1
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100739cb
sub esi, dword [0x103a4150]
cmp edi, 0x201
jne 0x10073937
mov eax, 1
pop esi
mov byte [0x103a4154], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4154], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100739cb
call ebx
mov dword [0x103a4150], eax
lea eax, [ebp - 4]
push eax
jmp 0x100739b7
mov eax, 0xc5
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100739cb
sub esi, dword [0x103a46f0]
cmp edi, 0x201
jne 0x10073993
mov eax, 1
pop esi
mov byte [0x103a46f4], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a46f4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100739cb
call ebx
lea edx, [ebp - 4]
mov dword [0x103a46f0], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x187904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100739e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10073b2d
call fcn.10071db0
test al, al
jne 0x10073b2d
call fcn.10071f20
test al, al
jne 0x10073b2d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073abd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10073a5d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073abd
mov eax, 0xb2
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073b2b
sub esi, dword [0x103a4198]
cmp edi, 0x201
jne 0x10073a97
mov eax, 1
pop esi
mov byte [0x103a419c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a419c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073b2b
call ebx
mov dword [0x103a4198], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073b17
mov eax, 0xc6
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073b2b
sub esi, dword [0x103a4738]
cmp edi, 0x201
jne 0x10073af3
mov eax, 1
pop esi
mov byte [0x103a473c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a473c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073b2b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4738], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x197904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10073b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10073c8d
call fcn.10071db0
test al, al
jne 0x10073c8d
call fcn.10071f20
test al, al
jne 0x10073c8d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073c1d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10073bbd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073c1d
mov eax, 0xb3
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073c8b
sub esi, dword [0x103a41e0]
cmp edi, 0x201
jne 0x10073bf7
mov eax, 1
pop esi
mov byte [0x103a41e4], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a41e4], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073c8b
call ebx
mov dword [0x103a41e0], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073c77
mov eax, 0xc7
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073c8b
sub esi, dword [0x103a4780]
cmp edi, 0x201
jne 0x10073c53
mov eax, 1
pop esi
mov byte [0x103a4784], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4784], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073c8b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4780], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x207904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10073ca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10073ded
call fcn.10071db0
test al, al
jne 0x10073ded
call fcn.10071f20
test al, al
jne 0x10073ded
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073d7d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10073d1d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073d7d
mov eax, 0xb4
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073deb
sub esi, dword [0x103a4228]
cmp edi, 0x201
jne 0x10073d57
mov eax, 1
pop esi
mov byte [0x103a422c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a422c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073deb
call ebx
mov dword [0x103a4228], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073dd7
mov eax, 0xc8
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073deb
sub esi, dword [0x103a47c8]
cmp edi, 0x201
jne 0x10073db3
mov eax, 1
pop esi
mov byte [0x103a47cc], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a47cc], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073deb
call ebx
lea edx, [ebp - 4]
mov dword [0x103a47c8], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x217904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10073e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x10073f4d
call fcn.10071db0
test al, al
jne 0x10073f4d
call fcn.10071f20
test al, al
jne 0x10073f4d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073edd
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10073e7d
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10073edd
mov eax, 0xb5
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073f4b
sub esi, dword [0x103a4270]
cmp edi, 0x201
jne 0x10073eb7
mov eax, 1
pop esi
mov byte [0x103a4274], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4274], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073f4b
call ebx
mov dword [0x103a4270], eax
lea eax, [ebp - 4]
push eax
jmp 0x10073f37
mov eax, 0xc9
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10073f4b
sub esi, dword [0x103a4810]
cmp edi, 0x201
jne 0x10073f13
mov eax, 1
pop esi
mov byte [0x103a4814], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a4814], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10073f4b
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4810], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x227904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10073f60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x103a3b6d], 0
je 0x100740ad
call fcn.10071db0
test al, al
jne 0x100740ad
call fcn.10071f20
test al, al
jne 0x100740ad
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007403d
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10073fdd
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1007403d
mov eax, 0xb6
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100740ab
sub esi, dword [0x103a42b8]
cmp edi, 0x201
jne 0x10074017
mov eax, 1
pop esi
mov byte [0x103a42bc], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a42bc], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100740ab
call ebx
mov dword [0x103a42b8], eax
lea eax, [ebp - 4]
push eax
jmp 0x10074097
mov eax, 0xca
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100740ab
sub esi, dword [0x103a4858]
cmp edi, 0x201
jne 0x10074073
mov eax, 1
pop esi
mov byte [0x103a485c], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x103a485c], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100740ab
call ebx
lea edx, [ebp - 4]
mov dword [0x103a4858], eax
push edx
mov ecx, 4
mov dword [ebp - 4], 0x237904c1
call fcn.100a8170
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10074c80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2380]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a221d], bl
je 0x10074cf5
lea eax, [ebx + 0x47]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x10074cf5
cmp dword [ebp + 8], 0x201
jne 0x10074cce
mov eax, 1
pop esi
mov dword [0xe8cb3c], eax
mov byte [0x103a2384], al
pop ebx
pop ebp
ret 4
mov byte [0x103a2384], bl
mov dword [0xe8cb3c], ebx
cmp edx, 0x1f4
jb 0x10074cf5
call esi
mov dword [0x103a2380], eax
mov byte [0x103a221d], bl
mov dword [0xe8cb3c], ebx
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x10075aa0
Capabilities:
Read .ini file

Disassembly:
cmp dword [0x103a0310], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
jne 0x10075bc3
cmp dword [0xe61e58], 0x550
jge 0x10075cc3
cmp dword [0x10283000], 1
push 0x41
mov eax, 0x861110
jne 0x10075b43
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x48
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push str..Config.ini
push 0
push 0x100c8f68
jmp 0x10075b96
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 2
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push str..Config.ini
push 0
push str.ServerTime
push str.Other
call edi
test eax, eax
jne 0x10075bc3
fld dword [esi + 0x2824]
sub esp, 8
fstp dword [esp + 4]
mov eax, 0x8e
fld dword [esi + 0x2820]
mov ecx, esi
fstp dword [esp]
call fcn.1006fbd0
cmp dword [0x103a0310], 0
jne 0x10075cc3
cmp dword [0x10283000], 1
push 0x41
mov eax, 0x861110
jne 0x10075c4f
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x48
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push str..Config.ini
push 0
push 0x100c8f68
jmp 0x10075c96
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push 2
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10075cc3
push str..Config.ini
push 0
push str.ServerTime
push str.Other
call edi
test eax, eax
jne 0x10075cc3
fld dword [esi + 0x2824]
sub esp, 8
fstp dword [esp + 4]
mov eax, 0x8e
fld dword [esi + 0x2820]
mov ecx, esi
fstp dword [esp]
call fcn.1006fbd0
pop edi
ret
Function at 0x1007f930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1c30]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a1b15], bl
je 0x1007f9da
lea eax, [ebx + 0x2d]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007f9da
cmp dword [ebp + 8], 0x201
jne 0x1007f982
mov eax, 1
pop esi
mov byte [0x103a1c34], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a1c34], bl
mov dword [0xe8cb3c], ebx
cmp edx, 0x1f4
jb 0x1007f9da
call esi
push 0x2f
mov ecx, 0x101fb628
mov dword [0x103a1c30], eax
call fcn.10030b40
push eax
mov eax, 0x5bde40
call eax
add esp, 4
mov byte [0x103a1b15], bl
push 0xe
mov ecx, 0x861110
mov dword [0xe8cb3c], ebx
call ecx
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x1007f9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1c78]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a1b15], bl
je 0x1007fa7f
lea eax, [ebx + 0x2e]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007fa7f
cmp dword [ebp + 8], 0x201
jne 0x1007fa3e
mov eax, 1
pop esi
mov byte [0x103a1c7c], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a1c7c], bl
mov dword [0xe8cb3c], ebx
cmp edx, 0x1f4
jb 0x1007fa7f
call esi
mov dword [0x103a1c78], eax
mov byte [0x103a1b15], bl
push 0xe
mov eax, 0x861110
mov dword [0xe8cb3c], ebx
call eax
mov edx, 0x85f9a0
mov ecx, eax
call edx
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x1007fc20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1e28]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a1d0d], bl
je 0x1007fcac
lea eax, [ebx + 0x34]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007fcac
cmp dword [ebp + 8], 0x201
jne 0x1007fc6e
mov eax, 1
pop esi
mov byte [0x103a1e2c], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a1e2c], bl
mov dword [0xe8cb3c], ebx
cmp edx, 0x1f4
jb 0x1007fcac
call esi
push 0x33
mov ecx, 0x101fb628
mov dword [0x103a1e28], eax
call fcn.10030b40
push eax
mov eax, 0x5bde40
call eax
mov byte [0x103a1d0d], bl
add esp, 4
mov dword [0xe8cb3c], ebx
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x1007fcc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1e70]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a1d0d], bl
je 0x1007fd35
lea eax, [ebx + 0x35]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007fd35
cmp dword [ebp + 8], 0x201
jne 0x1007fd0e
mov eax, 1
pop esi
mov byte [0x103a1e74], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a1e74], bl
mov dword [0xe8cb3c], ebx
cmp edx, 0x1f4
jb 0x1007fd35
call esi
mov dword [0x103a1e70], eax
mov byte [0x103a1d0d], bl
mov dword [0xe8cb3c], ebx
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x1007fee0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1007ff96
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1eb8]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a1ebd], bl
je 0x1007ff8e
lea eax, [ebx + 0x36]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007ff8e
cmp dword [ebp + 8], 0x201
jne 0x1007ff48
mov eax, 1
pop esi
mov dword [0xe8cb3c], eax
mov byte [0x103a1ebc], al
pop ebx
pop ebp
ret 4
mov byte [0x103a1ebc], bl
cmp edx, 0x1f4
jb 0x1007ff8e
call esi
mov dword [0x103a1eb8], eax
cmp byte [0x103a1d0d], bl
je 0x1007ff79
mov byte [0x103a1d0d], bl
pop esi
mov dword [0xe8cb3c], ebx
xor al, al
pop ebx
pop ebp
ret 4
mov eax, 1
mov dword [0xe8cb3c], ebx
mov byte [0x103a1d0d], al
mov dword [0xe8cb3c], eax
pop esi
xor al, al
pop ebx
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x10083000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x7dc216
call esi
mov edi, 0x1039eb0c
lea ecx, [ebp - 4]
push ecx
mov dword [0x7dc216], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x7dc216
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x835273
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x835273], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x835273
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x8353ad
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x8353ad], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x8353ad
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x8376e9
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x8376e9], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x8376e9
call esi
push 0x10082fc0
push 0x772932
mov bl, 0xe9
call fcn.100b6700
push 0x10082f80
push 0x7d9f2b
mov bl, 0xe8
call fcn.100b6700
push 0x10082f80
push 0x8335a0
call fcn.100b6700
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10083110
Capabilities:
Terminate process

Disassembly:
push ebx
push 0x100830f0
push 0x7e52e5
mov bl, 0xe8
call fcn.100b6700
add esp, 8
cmp dword [0x10283064], 1
jne 0x100831d3
push 0x10083720
push 0x633fcb
or bl, 0xff
call fcn.100b6700
push 0x10083b90
push 0x633fe3
or bl, 0xff
call fcn.100b6700
push 0x10084090
push 0x57ac07
or bl, 0xff
call fcn.100b6700
push 0x10084090
push 0x6083b9
or bl, 0xff
call fcn.100b6700
push 0x10084150
push 0x777ff2
or bl, 0xff
call fcn.100b6700
push 0x10084150
push 0x778003
or bl, 0xff
call fcn.100b6700
push 0x10084160
push 0x5f7c2f
mov bl, 0xe9
call fcn.100b6700
push 0x10084190
push 0x968137
call fcn.100b6700
add esp, 0x40
push 0x100841b0
push 0x968157
call fcn.100b6700
add esp, 8
cmp dword [0x10283084], 1
jne 0x100831ff
push 0x10083550
push 0x57ad82
mov bl, 0xe9
call fcn.100b6700
push 0x100835c0
push 0x57adc8
call fcn.100b6700
add esp, 0x10
push 0x100ca564
push str.DataCustomScriptScript.RenderMesh
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
pop ebx
test eax, eax
jne 0x10083232
push 0x10
push str.Error
push str.Failed_to_load_RenderMesh_Script_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.DataCustomScriptScript.RenderMesh
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x100cfbe8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10083255
push 0x100cfbe8
call eax
pop ecx
ret