joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484489
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x54812d
call fcn.0054565c
sub esp, 0x58
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x57
ja 0x4846a7
jmp dword [edi]
sub esp, 0x18
mov ecx, esp
push str.TargetFilePath
xor bl, bl
call fcn.004018f6
mov esi, dword [ebp + 8]
push 8
mov ecx, dword [esi]
pop edi
lea eax, [ebp - 0x60]
add ecx, edi
push eax
call fcn.004459ac
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push str.ResourceID
call fcn.004018f6
mov ecx, dword [esi]
lea eax, [ebp - 0x48]
add ecx, edi
push eax
call fcn.004459ac
sub esp, 0x18
xor eax, eax
inc eax
mov ecx, esp
push str.ResourceType
mov byte [ebp - 4], al
call fcn.004018f6
mov ecx, dword [esi]
lea eax, [ebp - 0x30]
add ecx, edi
push eax
call fcn.004459ac
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], 0
je 0x4847cc
cmp dword [ebp - 0x38], 0
je 0x4847cc
cmp dword [ebp - 0x20], 0
je 0x4847cc
cmp dword [ebp - 0x4c], edi
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
xor ecx, ecx
push ecx
push ecx
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x4847cc
cmp edi, 0xffffffff
je 0x4847cc
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
push ecx
call fcn.0041bf02
pop ecx
lea ecx, [ebp - 0x14]
push ecx
xor esi, esi
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp + 8]
lea edx, [ebp - 0x30]
cmovae edx, dword [ebp - 0x30]
push ecx
mov ecx, eax
mov dword [ebp + 8], esi
mov dword [ebp - 0x14], esi
call fcn.0049bf66
pop ecx
pop ecx
cmp dword [ebp + 8], esi
je 0x4847c0
push esi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], esi
push 1
pop esi
xor esi, esi
inc esi
xor esi, esi
inc esi
Function at 0x484ddc
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
movsb byte es:[edi], byte [esi]
push eax
call fcn.0041bf02
pop ecx
push eax
mov edx, edi
mov ecx, esi
call int.0040bf3d
mov ebx, eax
neg ebx
pop ecx
sbb bl, bl
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x2c]
inc bl
call fcn.004023ba
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.004023ba
push esi
push 1
lea ecx, [ebp - 0x5c]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret 8
mov eax, 0x5481b1
call fcn.0054565c
mov cl, 0x81
push esp
add al, ch
jbe 0x484dec
or al, 0
sub esp, 0x70
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xb
ja 0x484ffa
outsb dx, byte [esi]
jecxz 0x484db3
pop edx
or al, 0x43
sub dword [esi + 0x71a9f737], eax
jne 0x484d8b
jle 0x484ddd
push 0xffffffffffffffe4
test byte [ebx - 0x71], ch
push cs
or byte [edx - 0x46], 0x6b
or dword [ebx], edx
jns 0x484e42
invalid
cmp bh, byte [edi - 0x10]
dec ebx
in al, 0x11
iretd
sub esp, 0x18
mov ecx, esp
push 0x5597c0
xor bl, bl
call fcn.004018f6
mov esi, dword [ebp + 8]
push 8
mov ecx, dword [esi]
pop edi
lea eax, [ebp - 0x30]
add ecx, edi
push eax
call fcn.004459ac
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push str.ZipTargetFile
call fcn.004018f6
mov ecx, dword [esi]
lea eax, [ebp - 0x78]
add ecx, edi
push eax
call fcn.004459ac
sub esp, 0x18
mov ecx, esp
push str.DestFilePath
mov byte [ebp - 4], 1
call fcn.004018f6
mov ecx, dword [esi]
lea eax, [ebp - 0x48]
add ecx, edi
push eax
call fcn.004459ac
sub esp, 0x18
mov ecx, esp
push str.ZipCmdParams
mov byte [ebp - 4], 2
call fcn.004018f6
mov ecx, dword [esi]
lea eax, [ebp - 0x60]
add ecx, edi
push eax
call fcn.004459ac
sub esp, 0x18
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.004018ce
call fcn.0049b848
add esp, 0x18
lea edi, [ebp - 0x60]
push 8
pop ecx
cmp dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x48]
cmovae edi, dword [ebp - 0x60]
cmp dword [ebp - 0x34], ecx
cmovae eax, dword [ebp - 0x48]
cmp dword [ebp - 0x64], ecx
mov dword [ebp + 8], eax
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
cmp dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [0x5789c4]
test al, 1
jne 0x4850f5
or eax, 1
mov dword [0x5789c4], eax
mov byte [ebp - 4], 4
call fcn.004afcf1
push 0x54c24e
call fcn.0041b67b
pop ecx
mov byte [ebp - 4], 3
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push str.x_s_s_o_s__s
push 0x5789c8
call fcn.004af734
add esp, 0x18
cmp eax, 0xffffffff
je 0x485161
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.TRUE
call fcn.004018f6
sub esp, 0x18
mov ecx, esp
push str.DeleteAfterExtraction
mov byte [ebp - 4], 5
call fcn.004018f6
mov ecx, dword [esi]
add ecx, 8
mov byte [ebp - 4], 3
call fcn.00442f42
test al, al
je 0x48515f
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
xor esi, esi
push esi
Function at 0x48c84d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 2
ja 0x48c87a
mov eax, dword [ebp + 8]
add eax, 8
pop ebp
ret 4

Function at 0x48c884
Capabilities:
Parse pe header

Disassembly:
pop ds
enter 0xffffffffffff8000, 0xffffffffffffffb6
pop edi
xor al, 0x36
loopne 0x48c8a7
cmpsd dword [esi], dword es:[edi]
mov esi, 0x7401c1de
mov cl, 0xaa
pop edi
push eax
adc dword [edi + 0x49], 0xe3e9310a
xor dword [edi], 0x8b5d67d5
inc ebp
or byte [ebx - 0x3da2f740], al
add al, 0
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4c
dec esp
ja 0x48ca95
stosd dword es:[edi], eax
mov eax, dword [0xe89df3d2]
fisubr word [edx - 0x54]
movsb byte es:[edi], byte [esi]
xor dword [esp + edx*8], ebx
lodsd eax, dword [esi]
aam 0x3f
mov byte [esi - 0x3b], bh
add dword [0xe5d58092], esi
jl 0x48c88f
lds eax, [ecx]
xor eax, 0xe5d58092
mov cl, bl
pop es
add eax, 0x684eeee4
pop ebp
loopne 0x48c85a
inc eax
mov dh, 0x71
pop ebx
test dword [ebx], 0x54f8e770
ret 0x6466
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48cabd
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x48cabd
mov ecx, dword [ecx + eax + 0x98]
test ecx, ecx
je 0x48cabd
add eax, ecx
jmp 0x48cabf
xor eax, eax
pop ebp
ret 4

Function at 0x48d888
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x6b
ja 0x48daa0
xor al, byte [edx + 0x6f253a3d]
pop esp
inc si
pop ebx
fcom dword [ecx + 0x5e0b88dc]
jnp 0x48d88a
invalid
mov ecx, esi
call fcn.0048d637
call fcn.004ae8cf
xor edi, edi
cmp dword [eax + 0x278], edi
je 0x48db8d
call fcn.004ae8cf
cmp dword [eax + 0x2a8], edi
je 0x48db8d
call fcn.004ae8cf
cmp dword [eax + 0x2b0], edi
je 0x48db8d
call fcn.004ae8cf
cmp dword [eax + 0x2b8], edi
je 0x48db8d
call fcn.004ae8cf
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [eax + 0x278]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.0048d1dd
test al, al
je 0x48db8d
call fcn.004ae8cf
push edi
push edi
push edi
push 2
push edi
push dword [esi + 4]
call dword [eax + 0x2b8]
mov dword [esi + 8], eax
test eax, eax
je 0x48db86
call fcn.004ae8cf
push edi
push edi
push edi
push 4
push dword [esi + 8]
call dword [eax + 0x2b0]
mov dword [esi + 0xc], eax
test eax, eax
je 0x48db7d
mov dword [ebp - 0x1c], edi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
call fcn.004ae8cf
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push dword [esi + 0xc]
call dword [eax + 0x2a8]
test eax, eax
je 0x48db7d
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x10], ecx
mov al, 1
jmp 0x48db8f
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0048d637
xor al, al
pop edi
pop esi
leave
ret 4
Function at 0x48db95
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.omaha::TagExtractor.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x62
ja 0x48ddac
int1
ljmp 0x771e
mov ecx, esi
pop esi
jmp fcn.0048d637
Function at 0x4942ed
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5485c9
call fcn.0054565c
sub esp, 0x178
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x24
ja 0x494512
fdivrp st(6)
xor byte [ebx + ebp*4], ch
xchg ebx, ebx
pop ebp
leave
pop ecx
and byte [ecx + 0x64f182f], bl
cmp edi, dword [edx]
push esi
out 0xf7, eax
xor ebp, dword [ebx]
insd dword es:[edi], dx
lcall 0x4067, 0x52cf6ae8
popfd
inc eax
aad 0x87
push ecx
les esp, [edi + 0x16fc2732]
in al, dx
xchg esp, ecx
cld
lahf
invalid
mov ecx, edi
call fcn.004935b0
mov edi, 0x11c
push edi
mov bl, al
lea eax, [ebp - 0x184]
push 0
push eax
call fcn.0041b930
add esp, 0xc
mov dword [ebp - 0x184], edi
call fcn.004ae8cf
cmp dword [eax + 0x2d4], 0
je 0x494558
call fcn.004ae8cf
lea ecx, [ebp - 0x184]
push ecx
call dword [eax + 0x2d4]
push dword [ebp - 0x6a]
mov edx, dword [ebp - 0x180]
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x4c]
call fcn.00493cc8
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.00401847
lea ecx, [ebp - 0x4c]
call fcn.0040187f
mov edi, str.unknown
push edi
call fcn.0041b210
pop ecx
push eax
push 0
push edi
mov ecx, esi
call fcn.0040206d
test eax, eax
js 0x494631
sub esp, 0x18
xor edi, edi
mov ecx, esp
push str.nEMMLFSOFMsr
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.004018f6
push 0x450
push 0xc
push ecx
push 0x20
pop edx
lea ecx, [ebp - 0x34]
call fcn.004aeee4
mov dword [ebp - 4], edi
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
add esp, 0xc
mov ecx, esp
push eax
call fcn.004018f6
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x4c]
call fcn.0049b151
add esp, 0x1c
lea ecx, [ebp - 0x4c]
push edi
push 1
call fcn.004023ba
movzx eax, word [ebp - 0x18]
push dword [ebp - 0x6a]
movzx edx, word [ebp - 0x14]
push eax
lea ecx, [ebp - 0x64]
call fcn.00493cc8
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.00401847
lea ecx, [ebp - 0x64]
call fcn.0040187f
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x494642
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5485db
call fcn.0054565c
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x11], cl
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3f
ja 0x49486b
push edi
sti
out 0x85, eax
mov bh, 0x74
cmc
cmp byte [esi - 0x21], cl
pop esi
cmp dl, bl
aad 0xef
jae 0x49461e
push ebx
cmp al, 0x79
push es
add bl, dl
ficomp word [edx - 0x45]
into
loopne 0x49467d
mov ebx, 0x4af4e0ce
dec edx
inc esi
dec edx
test byte [edx - 0x79], dh
cdq
movsb byte es:[edi], byte [esi]
xor ah, byte [edi]
pop esp
mov al, 0x47
jl 0x494679
fdiv st(2)
push esp
or eax, 0x8ce6fb73
xchg esi, eax
test byte [ecx], 0x2b
out 0xc5, al
movsb byte es:[edi], byte [esi]
sub dword [edx + 0x25d5665e], 0x223cb7cf
jg 0x4946a1
add dl, al
mov dh, 0xc4
dec ebx
rcr byte [edi + 8], 1
cli
lea ecx, [0x3dccd295]
sbb bl, 0x84
fistp dword [eax + 0x907ef08]
push ss
loope 0x4946e6
pop esi
mov bh, 0x59
loope 0x494685
invalid
push ebp
xor al, 0x1e
shr bl, 0xa5
je 0x4946de
xchg esi, eax
nop
xor byte [esi + ecx*8 - 0x244654a2], dl
add edx, dword [edx - 0x68341544]
xlatb
xchg edx, eax
mov esp, 0xd797cbea
popal
push edi
push dx
jo 0x4946d4
fucomi st(7)
call 0x51cfb9c3
dec ebx
invalid
push 0x44
pop esi
push esi
lea eax, [ebp - 0x74]
push edi
push eax
mov ebx, edi
call fcn.0041b930
add esp, 0xc
lea eax, [ebp - 0x28]
push 0x10
push edi
push eax
call fcn.0041b930
add esp, 0xc
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x74], esi
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x48], 1
call fcn.004ae8cf
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [eax + 0x260]
test eax, eax
je 0x494905
cmp byte [ebp - 0x11], 1
mov edi, dword [ebp - 0x28]
jne 0x4948d9
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4948e7
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor edi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4948e9
Function at 0x494c19
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5c
ja 0x494e32
dec ebp
invalid
call fcn.004ae8cf
push 0
push 4
call dword [eax + 0x28]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
jne 0x494e4c
xor al, al
jmp 0x494ebc
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x1c
call fcn.004ae8cf
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [eax + 0x12c]
mov edi, dword [ebp + 8]
jmp 0x494eb0
mov esi, dword [ebx + 0x10]
jmp 0x494e92
mov eax, dword [esi]
cmp eax, dword [ebp - 0x14]
jne 0x494e8f
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0040c66f
add esi, 4
cmp esi, dword [ebx + 0x14]
jne 0x494e77
mov dword [ebp - 0x20], 0x1c
call fcn.004ae8cf
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 4]
call dword [eax + 0x130]
test eax, eax
jne 0x494e72
mov ecx, dword [edi]
cmp ecx, dword [edi + 4]
setne al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4958f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
and ebx, 8
push edi
mov edi, ecx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x12
ja 0x495b1a
cmpsb byte [esi], byte es:[edi]
push ecx
mov cs, word [edx + 0x29]
add eax, dword [eax]
wait
xchg byte [eax - 0x6c], al
inc eax
mov al, 0xb9
test byte [edx + 0x5f9e443b], ah
push ds
invalid
mov eax, 0x100410
test ebx, ebx
lea ecx, [eax - 0xf]
cmovne eax, ecx
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.004966ce
mov eax, dword [edi + 0x14]
cmp dword [edi + 0x10], eax
je 0x495c20
sub eax, dword [edi + 0x10]
xor ebx, ebx
sar eax, 2
mov dword [ebp - 8], ebx
test eax, eax
je 0x495be7
mov esi, dword [edi + 0x10]
call fcn.004ae8cf
push dword [esi + ebx*4]
push 0
push dword [ebp - 0xc]
call dword [eax + 0x50]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x495bc7
lea esi, [edi + 4]
lea eax, [ebp - 4]
mov ecx, dword [esi + 4]
cmp eax, ecx
jae 0x495ba8
cmp dword [esi], eax
ja 0x495ba8
mov ebx, eax
sub ebx, dword [esi]
sar ebx, 2
cmp ecx, dword [esi + 8]
jne 0x495b91
push ecx
mov ecx, esi
call fcn.0040b5b5
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x495b9f
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
mov dword [ecx], eax
add dword [esi + 4], 4
mov ebx, dword [ebp - 8]
jmp 0x495bd2
cmp ecx, dword [esi + 8]
jne 0x495bb8
push ecx
mov ecx, esi
call fcn.0040b5b5
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
test eax, eax
je 0x495bc1
mov dword [eax], edx
add dword [esi + 4], 4
jmp 0x495bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x495c19
mov eax, dword [edi + 0x14]
sub eax, dword [edi + 0x10]
inc ebx
sar eax, 2
mov dword [ebp - 8], ebx
cmp ebx, eax
jb 0x495b50
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x14]
sub ecx, dword [edi + 4]
sub eax, dword [edi + 0x10]
xor ecx, eax
test ecx, 0xfffffffc
je 0x495c33
inc dword [edi + 0x1c]
mov ecx, edi
call fcn.00495ed5
test al, al
je 0x495c2d
cmp dword [edi + 0x1c], 3
jge 0x495c29
mov ebx, dword [ebp + 8]
jmp 0x49590c
mov ecx, edi
call fcn.004966ce
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor al, al
jmp 0x495c35
and dword [edi + 0x1c], 0
jmp 0x495c20
mov al, 1
and dword [edi + 0x1c], 0
jmp 0x495c22
Function at 0x495c3b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x23
ja 0x495e50
sbb byte [ecx - 0x6a], dl
call 0xdf3a7a1f
or dword [ebx], esp
mov cl, 0x69
dec edx
clc
cmpsd dword [esi], dword es:[edi]
and esi, dword [ecx - 0x5807b597]
popal
adc edx, ecx
leave
and byte ss:[ebx - 0x2a], al
mov eax, 0x3ed1894e
lcall 0xd33e, 0x3bb50
pop esi
dec ebp
jle 0x495c5a
inc dword [edx + 0x58]
sbb bh, 0x61
in eax, dx
cmp eax, 0x66c7efe1
mov eax, edx
fcom dword [edx - 0x61]
cmp al, 0xcc
push ss
mov bh, 7
jo 0x495ce9
mov bl, 0x1b
pop ebx
pop esp
mov dword [esi], esp
aam 0x67
inc esi
nop
invalid
insd dword es:[edi], dx
sub dword [ebx + edx], ecx
sbb al, 0x19
test byte [ecx], cl
pop esp
sub eax, 0xd74e790a
rcl byte [0xc1a703e7]
mov edx, dword [esi + 0x2b]
clc
fidivr word [eax + 0x10d76c3b]
lodsd eax, dword [esi]
in eax, dx
push ss
dec esi
aas
invalid
mov ecx, esi
call fcn.00495ed5
test al, al
mov eax, dword [ebp + 0xc]
jne 0x495e6a
test eax, eax
je 0x495e65
mov byte [eax], 0
xor eax, eax
inc eax
jmp 0x495ecf
test eax, eax
je 0x495e71
mov byte [eax], 1
push 2
mov ecx, esi
mov byte [esi + 0x30], 0
call fcn.004958f8
test al, al
je 0x495e8a
push ecx
mov ecx, esi
call fcn.00494ec3
mov ecx, esi
call fcn.00495ed5
test al, al
jne 0x495e99
xor eax, eax
jmp 0x495ecf
push 8
mov ecx, esi
call fcn.004958f8
test al, al
je 0x495eae
push ecx
mov ecx, esi
call fcn.00494ba9
mov ecx, esi
call fcn.00495ed5
test al, al
je 0x495e95
push ecx
mov ecx, esi
call fcn.0049490f
xor edx, edx
test al, al
mov ecx, 0x80004005
cmovne ecx, edx
mov eax, ecx
pop esi
pop ecx
pop ebp
ret 0x10
Function at 0x4963f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
idiv edi
mov eax, 0x548623
call fcn.0054565c
sub esp, 0x234
push esi
push edi
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x2a
ja 0x496614
lcall 0xd3c4, 0x35b478db
wait
xlatb
sbb edx, dword [edi - 0x4b]
fisub dword [esi + eax*8 - 0x36]
mov dl, 0xd2
fadd st(4)
je 0x4963e5
ffree st(2)
xchg ebp, eax
inc esi
mov dword [0x9a6ef469], eax
jp 0x496451
and al, 0x36
stosb byte es:[edi], al
ret 0x95cf
add eax, 0x6d472943
scasb al, byte es:[edi]
inc esp
and al, 0x8c
outsb dx, byte [esi]
out 0xcf, eax
adc cl, byte [ecx - 0x588a6f2c]
loope 0x4964d5
fsubr qword [eax - 5]
dec edx
cmp al, 0xfb
imul eax, ecx, 0xffffffc0
in eax, dx
pop eax
cmc
outsd dx, dword [esi]
lea edx, ds:[esi]
or dword [edx - 0x79cea283], edi
test byte [edx - 0x2f], al
cli
jo 0x49646a
mov ebx, 0x8cf440ae
fsubr dword [esp + edi]
salc
aad 0xe5
inc eax
jle 0x49648e
hlt
sbb eax, 0x4adc627a
sbb eax, 0x3a7363f
shr ebx, cl
jl 0x49647e
movsb byte es:[edi], byte ds:[esi]
mov al, byte [0x3cedaed4]
fnstsw word [ebx]
mov edx, ecx
movups xmm1, xmmword [edi]
jge 0x49644b
int3
wait
arpl word [esi], di
inc ebp
fcmovbe st(0), st(0)
mov esi, 0xb69128ad
pop ebx
popfd
cmc
test byte [ebp + 0x28], al
mov esp, 0x8619403b
dec eax
adc eax, 0xd8558be2
push ds
lea ebp, [ebp + 0x75]
ror byte [ebx], cl
popal
invalid
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [esi + 4], eax
call fcn.004ae8cf
push 0
push 2
call dword [eax + 0x28]
mov edi, eax
mov dword [ebp - 0x240], 0x22c
call fcn.004ae8cf
lea ecx, [ebp - 0x240]
push ecx
push edi
call dword [eax + 0x2c]
jmp 0x496677
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x238], eax
je 0x496667
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp + 8]
call fcn.00401b7e
test eax, eax
je 0x49667e
call fcn.004ae8cf
lea ecx, [ebp - 0x240]
push ecx
push edi
call dword [eax + 0x30]
cmp eax, 1
je 0x496646
jmp 0x496692
mov eax, dword [ebp - 0x238]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0040c66f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
sub eax, dword [esi]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
mov ecx, dword [ebp + 8]
sbb esi, esi
add ecx, 0xfffffff0
and esi, 0x7fffbffb
call fcn.004013c0
Function at 0x49976b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4a
ja 0x499984
mov bl, 0x9c
mov ah, 0xa0
xor ch, byte [ecx + 0x45e69ccb]
and al, 0x81
lodsd eax, dword [esi]
retf
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004ae8cf
cmp dword [eax + 0x10c], ebx
je 0x499a20
call fcn.004ae8cf
cmp dword [eax + 0x114], ebx
je 0x499a20
call fcn.004ae8cf
cmp dword [eax + 0x11c], ebx
je 0x499a20
test edi, edi
jne 0x4999c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call fcn.004ae8cf
push str.IsWow64Process
lea esi, [eax + 0x10c]
call fcn.004ae8cf
push str.kernel32
call dword [eax + 0x114]
push eax
call dword [esi]
test eax, eax
je 0x499a1b
lea ecx, [ebp - 4]
push ecx
push edi
call eax
test eax, eax
xor eax, eax

Function at 0x499a27
Capabilities:
Check for time delay via gettickcount

Disassembly:
je 0x499a1b
mov eax, dword [ebp - 4]
test eax, eax
jne 0x499a17
test edi, edi
je 0x499a22
call fcn.004ae8cf
lea ecx, [ebp - 0x28]
push ecx
call dword [eax + 0x11c]
cmp word [ebp - 0x28], bx
je 0x499a1b
xor eax, eax
inc eax
jmp 0x499a22
mov eax, ebx
jmp 0x499a22
mov eax, dword [ebp - 4]
jmp 0x499a22
pop edi
pop esi
pop ebx
leave
ret
mov eax, 0x548853
call fcn.0054565c
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3a
ja 0x499c48
or ah, byte [eax - 0x63]
lcall 0x1132, 0x96fc9a35
cld
xchg esi, eax
xor dl, byte [ecx]
xchg ecx, eax
sub eax, 0xa6dcf4b5
jae 0x499ad4
push ecx
jl 0x4999f0
jge 0x499ac7
sbb bl, byte [esi + 0x6b]
in al, dx
jecxz 0x499aa3
pop esi
wait
jne 0x499a4f
mov dh, al
das
int3
imul esp, dword [ebx], 0x47
out 0x12, eax
fild word [edx - 0x58]
clc
mul al
popal
push eax
popfd
adc ecx, dword [edi - 0x508b2d48]
invalid
dec edx
jge 0x499a5e
sub al, 0xfc
cmp byte [0x6600773c], ch
push ds
push 0xffffffffffffff9b
wait
jl 0x499b41
push ds
cli
sub al, 0x3b
dec edi
mov ebp, 0xf93bd722
mov ah, 0x92
clc
cmp al, dl
out dx, eax
or al, cl
xor ecx, dword [ecx]
xor eax, 0x9031dc1a
int3
xchg byte [edx + edi - 0x7e3434d8], dh
out dx, al
call 0xd797ac86
lodsb al, byte [esi]
push edx
mov byte [0x1a62d4de], al
mov dh, 0xc5
pop ebp
stc
in eax, dx
jmp 0x3ad29d0c
jne 0x499b12
ret
xor esi, esi
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00499caf
lea ecx, [ebp - 0x1c]
cmp ecx, eax
je 0x499c79
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp dword [ebp - 0x28], 0
je 0x499c88
push dword [ebp - 0x28]
call fcn.00418a9a
pop ecx
sub edi, ebx
sar edi, 2
test edi, edi
je 0x499c93
mov esi, dword [ebx]
test ebx, ebx
je 0x499c9e
push ebx
call fcn.00418a9a
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret