joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c2380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c23ee
mov eax, 0x168
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c23ee
cmp dword [ebp + 8], 0x201
jne 0x100c23c0
mov al, 1
pop edi
mov byte [esi + 0x7768], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x7764]
mov byte [esi + 0x7768], bl
cmp edx, 0x1f4
jb 0x100c23ee
call edi
mov dword [esi + 0x7764], eax
mov byte [esi + 0x751d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x754d], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100c2400
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c24e3
mov eax, 0x169
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c24e3
cmp byte [esi + 0x77be], bl
je 0x100c24e3
cmp dword [ebp + 8], 0x201
jne 0x100c2454
mov al, 1
pop edi
mov byte [esi + 0x77bc], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x77b8]
mov byte [esi + 0x77bc], bl
cmp edx, 0x1f4
jb 0x100c24e3
call edi
mov dword [esi + 0x77b8], eax
xor byte [0x118cc859], 1
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100c24f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c25d3
mov eax, 0x16a
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c25d3
cmp byte [esi + 0x7812], bl
je 0x100c25d3
cmp dword [ebp + 8], 0x201
jne 0x100c2544
mov al, 1
pop edi
mov byte [esi + 0x7810], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x780c]
mov byte [esi + 0x7810], bl
cmp edx, 0x1f4
jb 0x100c25d3
call edi
mov dword [esi + 0x780c], eax
xor byte [0x118cc8ad], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x100c25e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c26c3
mov eax, 0x16b
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c26c3
cmp byte [esi + 0x7866], bl
je 0x100c26c3
cmp dword [ebp + 8], 0x201
jne 0x100c2634
mov al, 1
pop edi
mov byte [esi + 0x7864], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x7860]
mov byte [esi + 0x7864], bl
cmp edx, 0x1f4
jb 0x100c26c3
call edi
mov dword [esi + 0x7860], eax
xor byte [0x118cc901], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100c26d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c27b3
mov eax, 0x16c
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c27b3
cmp byte [esi + 0x78ba], bl
je 0x100c27b3
cmp dword [ebp + 8], 0x201
jne 0x100c2724
mov al, 1
pop edi
mov byte [esi + 0x78b8], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x78b4]
mov byte [esi + 0x78b8], bl
cmp edx, 0x1f4
jb 0x100c27b3
call edi
mov dword [esi + 0x78b4], eax
xor byte [0x118cc955], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x100c27c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
mov edx, eax
cmp byte [esi + 0x751d], bl
je 0x100c28a3
mov eax, 0x16d
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c28a3
cmp byte [esi + 0x790e], bl
je 0x100c28a3
cmp dword [ebp + 8], 0x201
jne 0x100c2814
mov al, 1
pop edi
mov byte [esi + 0x790c], al
pop ebx
pop ebp
ret 4
sub edx, dword [esi + 0x7908]
mov byte [esi + 0x790c], bl
cmp edx, 0x1f4
jb 0x100c28a3
call edi
mov dword [esi + 0x7908], eax
xor byte [0x118cc9a9], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop edi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100c28b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x102349a0], 6
mov edx, eax
jae 0x100c28ce
xor al, al
pop edi
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x751d], bl
je 0x100c29a3
mov eax, 0x16e
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c29a3
cmp byte [esi + 0x7962], bl
je 0x100c29a3
cmp dword [ebp + 8], 0x201
jne 0x100c2914
mov al, 1
pop ebx
mov byte [esi + 0x7960], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x795c]
mov byte [esi + 0x7960], bl
cmp edx, 0x1f4
jb 0x100c29a3
call edi
mov dword [esi + 0x795c], eax
xor byte [0x118cc9fd], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7c01], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7c31], bl
pop ebx
xor al, al
pop edi
pop ebp
ret 4
Function at 0x100c29b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x102349a0], 7
mov edx, eax
jae 0x100c29ce
xor al, al
pop edi
pop ebp
ret 4
push ebx
xor ebx, ebx
cmp byte [esi + 0x751d], bl
je 0x100c2aa3
mov eax, 0x16f
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2aa3
cmp byte [esi + 0x79b6], bl
je 0x100c2aa3
cmp dword [ebp + 8], 0x201
jne 0x100c2a14
mov al, 1
pop ebx
mov byte [esi + 0x79b4], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x79b0]
mov byte [esi + 0x79b4], bl
cmp edx, 0x1f4
jb 0x100c2aa3
call edi
mov dword [esi + 0x79b0], eax
xor byte [0x118cca51], 1
mov byte [esi + 0x7a09], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a39], bl
mov byte [esi + 0x7a5d], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7a8d], bl
mov byte [esi + 0x7ab1], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7ae1], bl
mov byte [esi + 0x7b05], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b35], bl
mov byte [esi + 0x7b59], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7b89], bl
mov byte [esi + 0x7bad], bl
mov dword [0xe8cb3c], ebx
mov byte [esi + 0x7bdd], bl
pop ebx
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [esi + 0x7a09], 0
mov edx, eax
je 0x100c2b21
mov eax, 0x177
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2b21
cmp byte [esi + 0x7c56], 0
je 0x100c2b21
cmp dword [ebp + 8], 0x201
jne 0x100c2af6
mov al, 1
mov byte [esi + 0x7c54], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7c50]
mov byte [esi + 0x7c54], 0
cmp edx, 0x1f4
jb 0x100c2b21
call edi
mov dword [esi + 0x7c50], eax
xor byte [0x118cc859], 1
push 0
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [esi + 0x7a5d], 0
mov edx, eax
je 0x100c2ba1
mov eax, 0x178
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2ba1
cmp byte [esi + 0x7caa], 0
je 0x100c2ba1
cmp dword [ebp + 8], 0x201
jne 0x100c2b76
mov al, 1
mov byte [esi + 0x7ca8], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7ca4]
mov byte [esi + 0x7ca8], 0
cmp edx, 0x1f4
jb 0x100c2ba1
call edi
mov dword [esi + 0x7ca4], eax
xor byte [0x118cc8ad], 1
push 0x10
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4
Function at 0x100c2bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [esi + 0x7ab1], 0
mov edx, eax
je 0x100c2c21
mov eax, 0x179
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2c21
cmp byte [esi + 0x7cfe], 0
je 0x100c2c21
cmp dword [ebp + 8], 0x201
jne 0x100c2bf6
mov al, 1
mov byte [esi + 0x7cfc], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7cf8]
mov byte [esi + 0x7cfc], 0
cmp edx, 0x1f4
jb 0x100c2c21
call edi
mov dword [esi + 0x7cf8], eax
xor byte [0x118cc901], 1
push 0x20
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [esi + 0x7b05], 0
mov edx, eax
je 0x100c2ca1
mov eax, 0x17a
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2ca1
cmp byte [esi + 0x7d52], 0
je 0x100c2ca1
cmp dword [ebp + 8], 0x201
jne 0x100c2c76
mov al, 1
mov byte [esi + 0x7d50], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7d4c]
mov byte [esi + 0x7d50], 0
cmp edx, 0x1f4
jb 0x100c2ca1
call edi
mov dword [esi + 0x7d4c], eax
xor byte [0x118cc955], 1
push 0x30
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [esi + 0x7b59], 0
mov edx, eax
je 0x100c2d21
mov eax, 0x17b
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2d21
cmp byte [esi + 0x7da6], 0
je 0x100c2d21
cmp dword [ebp + 8], 0x201
jne 0x100c2cf6
mov al, 1
mov byte [esi + 0x7da4], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7da0]
mov byte [esi + 0x7da4], 0
cmp edx, 0x1f4
jb 0x100c2d21
call edi
mov dword [esi + 0x7da0], eax
xor byte [0x118cc9a9], 1
push 0x40
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x102349a0], 6
mov edx, eax
jb 0x100c2daa
cmp byte [esi + 0x7bad], 0
je 0x100c2daa
mov eax, 0x17c
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2daa
cmp byte [esi + 0x7dfa], 0
je 0x100c2daa
cmp dword [ebp + 8], 0x201
jne 0x100c2d7f
mov al, 1
mov byte [esi + 0x7df8], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7df4]
mov byte [esi + 0x7df8], 0
cmp edx, 0x1f4
jb 0x100c2daa
call edi
mov dword [esi + 0x7df4], eax
xor byte [0x118cc9fd], 1
push 0x50
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4
Function at 0x100c2dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x102349a0], 7
mov edx, eax
jb 0x100c2e3a
cmp byte [esi + 0x7c01], 0
je 0x100c2e3a
mov eax, 0x17d
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2e3a
cmp byte [esi + 0x7e4e], 0
je 0x100c2e3a
cmp dword [ebp + 8], 0x201
jne 0x100c2e0f
mov al, 1
mov byte [esi + 0x7e4c], al
pop edi
pop ebp
ret 4
sub edx, dword [esi + 0x7e48]
mov byte [esi + 0x79b4], 0
cmp edx, 0x1f4
jb 0x100c2e3a
call edi
mov dword [esi + 0x7e48], eax
xor byte [0x118cca51], 1
push 0x60
call fcn.10090d20
xor al, al
pop edi
pop ebp
ret 4

Function at 0x100c2e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov edi, eax
push 0x10
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100c2ebf
mov eax, 0x1a3
mov ecx, esi
call fcn.100bb9d0
test al, al
je 0x100c2ebf
cmp dword [ebp + 8], 0x201
jne 0x100c2e9b
pop edi
mov byte [esi + 0x8ac4], 1
pop ebx
pop ebp
ret 4
sub edi, dword [esi + 0x8ac0]
mov byte [esi + 0x8ac4], 0
cmp edi, 0x1f4
jb 0x100c2ebf
call ebx
mov dword [esi + 0x8ac0], eax
mov eax, esi
call fcn.100b0260
pop edi
pop ebx
pop ebp
ret 4

Function at 0x100c3070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, edi
mov esi, eax
call fcn.100bb9d0
test al, al
jne 0x100c3088
xor al, al
pop esi
pop ebp
ret 8
cmp byte [ebp + 0xc], 1
jne 0x100c309d
mov eax, esi
imul eax, eax, 0x54
cmp byte [eax + edi + 0x14a], 0
je 0x100c3081
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
imul esi, esi, 0x54
mov ecx, dword [ebp + 8]
sub eax, dword [esi + edi + 0x144]
add esi, edi
cmp ecx, 0x201
jne 0x100c30eb
cmp byte [esi + 0x148], 0
jne 0x100c30cd
mov byte [esi + 0x148], 1
cmp eax, 0x1388
jb 0x100c30e3
mov byte [esi + 0x148], 0
call ebx
mov dword [esi + 0x144], eax
pop ebx
xor al, al
pop esi
pop ebp
ret 8
cmp ecx, 0x202
jne 0x100c30cd
cmp byte [esi + 0x148], 1
jne 0x100c30cd
pop ebx
mov byte [esi + 0x148], 0
mov al, 1
pop esi
pop ebp
ret 8
Function at 0x100c54b0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
mov eax, 0x635fd0
call eax
fld1
mov esi, dword [sym.imp.OPENGL32.dll_glColor3f]
fst dword [esp]
sub esp, 8
fst dword [esp + 4]
fstp dword [esp]
call esi
fld dword [ebp + 0x10]
fmul qword [0x1013f600]
mov ecx, dword [0x108c77e4]
mov edx, dword [0x108c77e0]
mov eax, dword [0x108c77e8]
push str.Tahoma
fdiv qword [0x1013f760]
push 0
push ecx
mov ecx, dword [0x108c77f4]
push 0
push 0
push 1
push edx
mov edx, dword [0x108c77ec]
push eax
push ecx
push 0x2bc
push 0
push 0
push edx
push 0xe
mov byte [ebp - 1], 0
fstp dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateFontA]
fld dword [ebp + 0x10]
mov edi, eax
call fcn.1012e5b0
fld dword [ebp + 8]
mov ebx, eax
call fcn.1012e5b0
fld dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.1012e5b0
fld dword [ebp + 0xc]
push eax
push ebx
call fcn.1012e5b0
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x790b10
call ecx
add esp, 0x10
sub esp, 0xc
cmp al, 1
jne 0x100c55e1
fld dword [0x1013f840]
fstp dword [esp + 8]
fld dword [0x1013fd60]
fstp dword [esp + 4]
fld1
fstp dword [esp]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x118c4f94]
cmp eax, 0x12c
jbe 0x100c55f0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
test dx, ax
je 0x100c55f0
fld dword [0x1013fd5c]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1013fd58]
fstp dword [esp + 4]
fld dword [0x1013fd54]
fstp dword [esp]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x118c4f94], eax
mov byte [ebp - 1], 1
jmp 0x100c55f0
fld1
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
call esi
fldz
push ecx
fst dword [esp]
mov eax, 0x637c60
fld dword [0x1013f5bc]
push 1
push 1
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [0x1013fd50]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp - 8]
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7b4b
call eax
fld dword [ebp - 8]
fmul qword [0x1013f510]
mov ecx, dword [ebp + 0x14]
add esp, 0x30
push ecx
fadd dword [ebp + 0xc]
push 0
push ebx
push 0
fsub qword [0x10140508]
push 0xe6fcf7ff
call fcn.1012e5b0
mov edx, dword [ebp - 0xc]
push eax
push edx
push edi
mov cl, 3
call fcn.1008a600
fld1
add esp, 0x14
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call esi
mov eax, dword [ebp + 0x14]
push eax
call esi
mov ecx, 0x635f50
call ecx
push 0
mov edx, 0x635fd0
call edx
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100c6e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c668c]
cmp byte [0x118c6499], 0
mov edx, eax
je 0x100c6e8c
mov eax, 0x46
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100c6e8c
cmp dword [ebp + 8], 0x201
jne 0x100c6e4d
mov eax, 1
mov byte [0x118c6690], al
mov dword [0xe8cb3c], eax
pop esi
pop ebp
ret 4
mov byte [0x118c6690], 0
cmp edx, 0x1f4
jb 0x100c6e8c
call esi
mov dword [0x118c668c], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x67fb04c1
call fcn.10100800
mov byte [0x118c6499], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4

Function at 0x100c6ea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c6638]
xor ebx, ebx
mov edx, eax
cmp byte [0x118c6499], bl
je 0x100c6f1b
lea eax, [ebx + 0x45]
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100c6f1b
cmp dword [ebp + 8], 0x201
jne 0x100c6eee
mov eax, 1
pop esi
mov byte [0x118c663c], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x118c663c], bl
cmp edx, 0x1f4
jb 0x100c6f1b
call esi
mov dword [0x118c6638], eax
mov byte [0x118c6499], bl
mov dword [0xe8cb3c], ebx
mov byte [0x118c64c9], bl
mov dword [0xe8cb3c], ebx
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x100c6f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c6980]
cmp byte [0x118c678d], 0
mov edx, eax
je 0x100c6fbc
mov eax, 0x4f
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100c6fbc
cmp dword [ebp + 8], 0x201
jne 0x100c6f7d
mov eax, 1
mov byte [0x118c6984], al
mov dword [0xe8cb3c], eax
pop esi
pop ebp
ret 4
mov byte [0x118c6984], 0
cmp edx, 0x5dc
jb 0x100c6fbc
call esi
mov dword [0x118c6980], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x68fb04c1
call fcn.10100800
mov byte [0x118c678d], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4

Function at 0x100c6fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c69d4]
cmp byte [0x118c678d], 0
mov edx, eax
je 0x100c705c
mov eax, 0x50
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100c705c
cmp dword [ebp + 8], 0x201
jne 0x100c701d
mov eax, 1
mov byte [0x118c69d8], al
mov dword [0xe8cb3c], eax
pop esi
pop ebp
ret 4
mov byte [0x118c69d8], 0
cmp edx, 0x5dc
jb 0x100c705c
call esi
mov dword [0x118c69d4], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x69fb04c1
call fcn.10100800
mov byte [0x118c678d], 0
add esp, 4
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4
Function at 0x100c7070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c692c]
xor ebx, ebx
mov edx, eax
cmp byte [0x118c678d], bl
je 0x100c70eb
lea eax, [ebx + 0x4e]
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100c70eb
cmp dword [ebp + 8], 0x201
jne 0x100c70be
mov eax, 1
pop esi
mov byte [0x118c6930], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x118c6930], bl
cmp edx, 0x5dc
jb 0x100c70eb
call esi
mov dword [0x118c692c], eax
mov byte [0x118c678d], bl
mov dword [0xe8cb3c], ebx
mov byte [0x118c67bd], bl
mov dword [0xe8cb3c], ebx
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x100c79e0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x7ff
lea eax, [ebp - 0x804]
push 0
push eax
xor bl, bl
call sub.MSVCR100.dll_memset
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x1c]
push ecx
push edx
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
add esp, 0x1c
sub esp, 0x18
cmp byte [ebp + 0x14], bl
je 0x100c7a61
fldz
mov ecx, 0x790e40
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1013f6f0]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7b69
call ecx
jmp 0x100c7a92
fld dword [0x1013f6f0]
mov edx, 0x790e40
fst dword [esp + 0x14]
fldz
fstp dword [esp + 0x10]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7b69
call edx
mov eax, dword [ebp + 0x18]
fld dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
fadd qword [0x1013f6e8]
add esp, 0x1c
push eax
push 0
push 0
push 0
push ecx
call fcn.1012e5b0
fld dword [ebp + 8]
fadd qword [0x101404e0]
push eax
call fcn.1012e5b0
mov edx, dword [0xe8c58c]
push eax
push edx
mov cl, 1
call fcn.10025780
fld dword [ebp + 0xc]
add esp, 0x20
push 0xf
push 0xf
call fcn.1012e5b0
fld dword [ebp + 8]
push eax
call fcn.1012e5b0
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
cmp al, 1
jne 0x100c7b53
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100c7b53
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c8078]
cmp eax, 0x1f4
jbe 0x100c7b64
call esi
push 0
push 0
push 0x19
mov edx, 0x6d6c20
mov dword [0x118c8078], eax
call edx
add esp, 0xc
call esi
add eax, 0x1f4
pop esi
mov dword [0x116dca90], eax
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100cad70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118cee64]
cmp eax, 0x12c
jbe 0x100cadb1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov ecx, 8
push edx
mov dword [ebp - 0xc], 0x2cd308c1
mov dword [ebp - 8], eax
call fcn.10100800
add esp, 4
call esi
mov dword [0x118cee64], eax
pop esi
mov esp, ebp
pop ebp
ret