joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a6c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
mov eax, esi
call fcn.00404a78
mov eax, 1
mov edx, dword [esi]
dec eax
test edx, edx
je 0x45a6eb
cmp eax, dword [edx - 4]
jb 0x45a6f0
call fcn.00403914
inc eax
cmp byte [edx + eax - 1], 0x22
jne 0x45a719
mov edx, dword [esi]
mov ecx, 2
mov eax, 0x45a758
call fcn.00426c90
mov ebx, eax
test ebx, ebx
jle 0x45a712
inc ebx
jmp 0x45a71e
mov ebx, 0x7fffffff
jmp 0x45a71e
mov ebx, 1
mov edx, dword [esi]
mov ecx, ebx
mov eax, 0x45a764
call fcn.00426c90
mov ebx, eax
test ebx, ebx
jle 0x45a745
push esi
lea edx, [ebx + 1]
mov eax, dword [esi]
mov ecx, 0x7fffffff
call fcn.00404d78
pop esi
pop ebx
ret
mov eax, esi
call fcn.00404880
pop esi
pop ebx
ret

Function at 0x45a7cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403380
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x500
mov dword [ebp - 0x34], ebx
mov eax, 0x45a844
mov dword [ebp - 0x30], eax
mov eax, esi
call fcn.00404d10
mov dword [ebp - 0x2c], eax
mov eax, edi
call fcn.00404d10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
call fcn.00404d10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x45a83a
call fcn.0040d644
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x7fdaa0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x7fdaa6
pop ebp
sub ebp, 6
sub ebp, 0x3fdaa0
jmp 0x7fdb04
jmp 0x7fdb0d
mov eax, 0x3fdaa0
add eax, ebp
add eax, 0x93
mov ecx, 0x595
mov edx, 0x3017ac
xor byte [eax], dl
inc eax
dec ecx
jne 0x7fdb24
jmp 0x7fdb37
daa
popal
daa
and eax, 0xacacac90
sub eax, 0xacac546d
lodsb al, byte [esi]
scasd eax, dword es:[edi]
popal
adc al, 0xaa
lodsb al, byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
push ss
test byte [esp + ebp*4 - 0x50b1a454], ch
daa
sub eax, 0xacacaca0
scasd eax, dword es:[edi]
imul edi, esp, 0x648c4fc
mov al, byte [0x8316c4ac]
lahf
lodsb al, byte [esi]
lodsd eax, dword [esi]
or byte [eax - 0x3896b83c], 0x8c
inc esp
test eax, 0x45acacac
test byte [esp + ebp*4 - 0xe070654], ch
daa
sub dword [esp + ebp*4 + 0x3927acac], esp
mov al, byte [0x27acacac]
and dword [esp + ebp*4 + 0x456dacac], edi
scasb al, byte es:[edi]
popfd
scasb al, byte es:[edi]
das
outsb dx, byte [esi]
test al, 0xe5
mov dword [0x53535829], eax
push ebx
int1
outsb dx, byte [esi]
mov al, byte [0x882027ac]
test al, 0xac
lodsb al, byte [esi]
lodsb al, byte [esi]
les ecx, [eax + 6]
mov al, byte [0x8316c4ac]
lahf
lodsb al, byte [esi]
lodsd eax, dword [esi]
or byte [eax - 0x5356bb03], 0xac
lodsb al, byte [esi]
inc ebp
out 0xae, eax
lodsb al, byte [esi]
lodsb al, byte [esi]
stc
daa
inc eax
push ebx
fldenv [eax + 0x44a4d953]
shr byte [esp + ebp*4 - 0x5beed854], cl
lodsb al, byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
sub eax, 0x3803e55d
adc dword [0x3803e55d], ebp
adc dword [edi - 0x6ca1d29b], ebx
sahf
invalid
Function at 0x4056a0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x218]
push edi
test esi, esi
je 0x4056b9
mov dword [esi], 0
mov edi, dword [esp + 0x218]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x405799
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.0049f8ef
add esp, 0xc
test eax, eax
je 0x40578c
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x40578c
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x40578c
lea eax, [esp + 8]
push str.Native
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x40578c
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x40578c
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x405782
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.0049f76e
add esp, 8
test eax, eax
jne 0x4057a0
test esi, esi
je 0x40578c
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 8], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x20c
ret 8

Function at 0x4057c0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
cmp dword [0x4eb10c], 0
je 0x4057cf
mov eax, 1
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4e9eac]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
test eax, eax
jne 0x40583e
nop
mov eax, dword [0x4e59b0]
cmp eax, 0xffffffff
je 0x40580f
test eax, eax
je 0x405851
call esi
mov ecx, dword [0x4e59b0]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x405851
mov edx, 1
mov dword [0x4e5998], 0
mov ecx, 0x8000012f
call fcn.004015c0
push dword [0x4e9eac]
mov dword [0x4e5998], 1
call edi
test eax, eax
je 0x4057f0
pop edi
pop esi
mov dword [0x4eb10c], 1
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4060f3
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x406171
cmp word [esi + 8], 2
jne 0x406153
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x406153
mov edi, dword [esi + 0xc]
jmp 0x40614d
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.0040608c
mov dword [ebp], eax
test eax, eax
je 0x40616c
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x40612d
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.004a023e
add esp, 0x10
xor eax, eax
jmp 0x406198
push 8
pop eax
jmp 0x406198
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x406196
sub eax, 1
je 0x40618f
sub eax, 1
jne 0x406196
lea eax, [ecx + 2]
jmp 0x406198
mov eax, 0x2afa
jmp 0x406198
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x4067ad
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
cmp dword [0x4eba8c], 0
mov ax, cx
mov word [esp + 2], ax
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 8], 0x4062f9
mov dword [esp + 0xc], str.getnameinfo
mov dword [esp + 0x10], 0x4065d9
mov dword [esp + 0x14], str.freeaddrinfo
mov dword [esp + 0x18], fcn.004062be
je 0x4067fc
movzx eax, ax
jmp 0x406903
push 0x104
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4068f4
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x138]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.004a593b
push str.ws2_32
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.004a9d46
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x44]
add esp, 0x18
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test esi, esi
je 0x406874
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4068b8
push esi
call ebp
lea eax, [esp + 0x138]
mov esi, 0x10c
push eax
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004a593b
push str.wship6
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.004a9d46
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4068f0
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x4068ed
xor edi, edi
mov ebx, edi
push dword [esp + ebx*8 + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x18], eax
test eax, eax
je 0x4068ed
inc ebx
cmp ebx, 3
jl 0x4068bc
test esi, esi
je 0x4068f0
mov eax, dword [esp + edi + 0x18]
mov dword [edi + 0x4e58b4], eax
add edi, 8
cmp edi, 0x18
jl 0x4068d9
jmp 0x4068f0
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
movzx eax, word [esp + 2]
mov dword [0x4eba8c], 1
mov eax, dword [eax*8 + 0x4e58b4]
add esp, 0x230
ret
Function at 0x4094f9
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [0x4eb098]
push esi
xor esi, esi
mov edx, dword [0x4eb090]
jmp 0x409511
cmp byte [edx + esi], 0
je 0x409575
inc esi
cmp esi, eax
jb 0x40950a
mov ecx, dword [0x4eb094]
cmp eax, ecx
jne 0x40954c
test ecx, ecx
je 0x409527
add ecx, ecx
jmp 0x40952c
mov ecx, 0x800
push ecx
mov ecx, 0x4eb090
call fcn.0040a0c8
test eax, eax
jne 0x409583
mov eax, dword [0x4eb098]
mov ecx, dword [0x4eb094]
mov edx, dword [0x4eb090]
push 0
sub ecx, eax
add eax, edx
push ecx
push eax
push dword [0x4eb088]
call dword [sym.imp.WSOCK32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x409583
mov eax, dword [0x4eb098]
add eax, ecx
mov dword [0x4eb098], eax
jmp 0x409502
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40957f
mov dword [eax], esi
xor eax, eax
jmp 0x40958d
mov ecx, str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.004099a8
pop esi
pop ecx
ret 4

Function at 0x409592
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
lea eax, [esp]
push ebp
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call fcn.004a00d4
add esp, 0xc
lea eax, [esp + 0xc]
xor ebp, ebp
push ebp
push eax
call fcn.0049d620
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4d3144
lea esi, [eax + 1]
push esi
call fcn.004058bc
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push ebp
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x409623
push 1
push 0x4d1e48
lea ecx, [edi + 0x28]
call fcn.00409c7b
test eax, eax
jne 0x409623
push ebp
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x409623
mov dword [edi + 0x30], ebp
xor eax, eax
mov dword [edi + 0x34], ebp
jmp 0x40962d
mov ecx, str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.004099a8
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x4099e7
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov ebp, edx
cmp esi, 0xffffffff
jne 0x409a0d
mov esi, ebp
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x409a04
sub esi, ecx
cmp esi, 2
jbe 0x409a96
lea eax, [ebx + 2]
xor edx, edx
mov dword [esp + 0x18], eax
lea eax, [esi - 3]
push 3
pop ecx
div ecx
mov ebx, dword [esp + 0x18]
lea edx, [eax + 1]
mov edi, edx
shl edi, 2
movzx ecx, byte [ebp]
sub esi, 3
movzx eax, byte [ebp + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 2]
shl ecx, 8
add ebp, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 2], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], al
lea ebx, [ebx + 4]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 3], al
sub edx, 1
jne 0x409a33
mov ebx, dword [esp + 0x10]
test esi, esi
je 0x409af0
movzx ecx, byte [ebp]
shl ecx, 0x10
cmp esi, 1
jbe 0x409aaf
movzx eax, byte [ebp + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebx + 1], al
cmp esi, 1
jbe 0x409ae2
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x409ae4
mov al, 0x3d
mov byte [edi + ebx + 2], al
mov byte [edi + ebx + 3], 0x3d
add edi, 4
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40eeb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x30
push ebx
xor al, al
mov bl, cl
cmp dword [0x4ea0ec], 0
mov ecx, 1
push ebp
movzx eax, al
mov bh, dl
cmovne eax, ecx
mov byte [esp + 0x13], bh
cmp dword [0x4ea0e8], 0
push esi
push edi
mov dword [esp + 0x1c], eax
je 0x40eeed
or eax, 2
mov dword [esp + 0x1c], eax
cmp bl, al
je 0x40f0f2
test al, al
jne 0x40ef2e
test bh, bh
jne 0x40ef2e
push 0x4ea204
push 0
push 0
push 0x40f160
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4eb9c4], eax
test eax, eax
je 0x40efe6
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx edi, bh
xor esi, esi
xor edi, 1
movzx ebp, bl
nop dword [eax]
push edi
push ebp
push 0x417
push dword [0x4ea204]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40ef65
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x40ef40
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor bh, bh
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov dh, bl
mov dl, bh
test bl, bl
je 0x40eff3
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x34]
push eax
call ebp
test eax, eax
je 0x40efd1
cmp dword [esp + 0x2c], 0
je 0x40f00d
mov bh, 1
call fcn.0040f550
test al, al
jne 0x40f00d
cmp byte [esp + 0x1b], al
jne 0x40f0bd
xor bl, bl
lea eax, [esp + 0x20]
push eax
push dword [0x4eb9c4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x40f01a
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x40f00d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40ef77
call fcn.0040f570
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x1b], 0
mov bh, dl
mov bl, dh
je 0x40efb6
call fcn.0040f550
test al, al
je 0x40f0b9
jmp 0x40efd1
cmp byte [esp + 0x1b], 0
jne 0x40f0b9
jmp 0x40f035
push dword [0x4eb9c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4eb9c4], 0
call fcn.0040f570
mov al, byte [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
and al, 1
cmp dword [0x4ea0ec], 0
je 0x40f060
test al, al
jne 0x40f07a
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4eb9bc], eax
jmp 0x40f07a
test al, al
je 0x40f07a
push dword [0x4eb9bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4eb9bc], 0
mov eax, dword [esp + 0x1c]
and al, 2
cmp dword [0x4ea0e8], 0
je 0x40f09f
test al, al
jne 0x40f0b9
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4eb9c0], eax
jmp 0x40f0b9
test al, al
je 0x40f0b9
push dword [0x4eb9c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4eb9c0], 0
test bh, bh
je 0x40f0f2
sub esp, 8
mov dword [0x4e5998], 0
xorps xmm0, xmm0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
movsd qword [esp], xmm0
push 0
push 0
call fcn.00487690
add esp, 0x10
mov dword [0x4e5998], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4106a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1010
call fcn.004b8900
cmp byte [0x4ebaa4], 0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
jne 0x4108d8
cmp dword [0x4ea240], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4106d3
call ebx
mov dword [0x4ea240], eax
inc dword [0x4ebaa0]
call ebx
mov edi, dword [0x4ebaa0]
mov ecx, eax
sub ecx, dword [0x4ea240]
mov edx, dword [0x4e5f04]
mov dword [0x4ea23c], eax
cmp edi, dword [0x4e5f08]
jbe 0x4107c2
cmp ecx, edx
jae 0x4107c2
push ecx
push edi
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_A_MaxHotkeysPerInterval_in_the_help_file_
lea eax, [esp + 0x2c]
mov esi, 1
push 0x800
push eax
call fcn.00482070
mov dx, word [0x4ea238]
xor eax, eax
add esp, 0x14
xor ecx, ecx
cmp ax, dx
jae 0x41076a
nop word [eax + eax]
mov eax, dword [0x4ea228]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x410762
nop
mov byte [eax + 0x1f], 0
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x410750
mov dx, word [0x4ea238]
inc ecx
movzx eax, dx
cmp ecx, eax
jl 0x410740
sub esp, 8
mov byte [0x4ebaa4], 1
xorps xmm0, xmm0
mov dword [0x4e5998], 0
mov edx, 4
lea ecx, [esp + 0x28]
movsd qword [esp], xmm0
push 0
push 0
call fcn.00487690
add esp, 0x10
cmp eax, 7
jne 0x4107ae
push 0
push 4
mov ecx, 0x4eb110
call fcn.0041be90
mov eax, dword [0x4ea23c]
mov dword [0x4e5998], esi
mov byte [0x4ebaa4], 0
jmp 0x4107c8
xor esi, esi
cmp ecx, edx
jbe 0x4107df
mov dword [0x4ebaa0], 0
mov dword [0x4ea240], eax
test esi, esi
jne 0x4108d8
movzx eax, byte [ebp + 0xf]
mov esi, dword [esp + 0x1024]
mov byte [0x4eb7ba], al
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xffffffff
inc byte [esi + 0x1a]
mov ecx, dword [0x4eb07c]
mov eax, dword [ebp + 0x1c]
mov edi, dword [0x4eb754]
mov dword [esp + 0x10], eax
cmp ecx, dword [0x4eb080]
jne 0x410828
call fcn.00405d4d
mov ecx, dword [0x4eb07c]
cmp ecx, dword [0x4eb078]
jb 0x41083d
mov eax, dword [0x4eb750]
mov dword [ecx], eax
mov ecx, dword [0x4eb07c]
add ecx, 0xc
lea eax, [esp + 0x10]
mov dword [0x4eb07c], ecx
mov dword [ecx], 0
mov dword [ecx + 4], edi
mov dword [ecx + 8], 0
mov ecx, dword [esi]
mov edx, ecx
push ecx
push 0
push 1
push eax
push 0
call fcn.004760f0
mov ecx, dword [0x4eb07c]
add esp, 0x14
sub ecx, 0xc
mov dword [0x4eb07c], ecx
cmp ecx, dword [0x4eb078]
jb 0x410893
mov ecx, dword [ecx]
mov dword [0x4eb08c], ecx
mov dword [0x4eb750], ecx
dec byte [esi + 0x1a]
test eax, eax
jne 0x4108aa
mov byte [esi + 0x1f], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret 4
cmp byte [esi + 0x1f], 0
je 0x4108d8
mov byte [esi + 0x1f], 0
call ebx
sub eax, dword [esi + 0x10]
cmp eax, 0x3e8
ja 0x4108d8
movzx eax, word [ebp + 4]
push 0
push eax
push 0x312
push dword [0x4e9eac]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret 4
Function at 0x415e30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov bl, byte [ebp + 0xc]
mov bh, cl
or byte [ebp + 8], bl
mov al, bh
dec al
mov dword [esp + 8], edx
push esi
push edi
cmp al, 5
ja 0x415e55
cmp bh, 3
jne 0x415e5d
mov al, bh
add al, 0x66
cmp al, 5
ja 0x415e64
mov byte [esp + 0xf], 1
jmp 0x415e69
mov byte [esp + 0xf], 0
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
test esi, esi
jle 0x415f99
mov bl, byte [esp + 0xf]
nop dword [eax + eax]
cmp dword [0x4eba58], 0
jne 0x415ee3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e59a0]
sub eax, dword [0x4eb7f4]
cmp eax, dword [ecx + 0x5c]
jbe 0x415ee9
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x415ed8
mov edx, 1
mov dword [0x4e5998], 0
or ecx, 0xffffffff
call fcn.004015c0
mov dword [0x4e5998], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4eb7f4], eax
mov ecx, dword [0x4e59a0]
cmp byte [ebp + 0x18], 0
jne 0x415f3d
mov al, byte [ecx + 0x99]
test al, al
je 0x415f05
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x415f0a
mov esi, 0xffc3d44f
cmp dword [0x4eba58], 0
je 0x415f1a
mov al, byte [0x4eba4c]
jmp 0x415f21
xor cl, cl
call fcn.00418a00
mov cl, byte [ebp + 8]
mov dl, al
push esi
push 1
push 0
push edi
call fcn.00418300
mov ecx, dword [0x4e59a0]
add esp, 0x10
mov esi, dword [ebp + 0x10]
test bl, bl
je 0x415f67
test edi, edi
jne 0x415f67
push dword [ebp + 0x28]
movzx eax, byte [ecx + 0x97]
mov cl, bh
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
push eax
push 1
push dword [ebp + 0x24]
call fcn.00417190
add esp, 0x14
jmp 0x415f8a
movzx eax, byte [ecx + 0x99]
mov dl, bh
mov ecx, 0xffc3d44d
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push edi
push dword [esp + 0x1c]
call fcn.004163d0
add esp, 0x10
sub esi, 1
mov dword [ebp + 0x10], esi
jne 0x415e80
mov bl, byte [ebp + 0xc]
cmp byte [ebp + 0x18], 0
jne 0x415fd5
cmp dword [0x4eba58], 0
je 0x415faf
mov al, byte [0x4eba4c]
jmp 0x415fb6
xor cl, cl
call fcn.00418a00
not bl
and bl, al
and bl, 0xcc
je 0x415fd5
push 0xffc3d44d
push 0
push 1
push edi
mov dl, bl
xor cl, cl
call fcn.00418300
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415fe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x44
mov eax, dword [0x4eba58]
cmp eax, 2
push ebx
push esi
push edi
mov esi, edx
sete byte [esp + 0xf]
jne 0x41602f
movzx edx, cx
mov ecx, edx
and ecx, 0xffffff80
je 0x41600b
mov eax, 0x30
mov word [esp + 0x30], ax
test ecx, ecx
lea eax, [esp + 0x30]
lea edi, [esp + 0x32]
push 0xa
cmovne eax, edi
push eax
push edx
call fcn.004a0109
mov ebx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [0x4eba58]
jmp 0x416032
movzx ebx, cx
test esi, esi
jle 0x4160e1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x416099
call edi
mov ecx, dword [0x4e59a0]
sub eax, dword [0x4eb7f4]
cmp eax, dword [ecx + 0x5c]
jbe 0x416099
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call ebp
test eax, eax
je 0x416092
mov edx, 1
mov dword [0x4e5998], 0
or ecx, 0xffffffff
call fcn.004015c0
mov dword [0x4e5998], 1
call edi
mov dword [0x4eb7f4], eax
cmp byte [esp + 0x13], 0
je 0x4160ab
lea ecx, [esp + 0x34]
call fcn.004160f0
jmp 0x4160b6
mov dl, byte [esp + 0x58]
mov ecx, ebx
call fcn.004148d0
cmp dword [0x4eba58], 2
mov eax, dword [0x4e59a0]
jne 0x4160c9
mov ecx, dword [eax + 0x70]
jmp 0x4160cc
mov ecx, dword [eax + 0x6c]
call fcn.00417e80
sub esi, 1
je 0x4160e0
mov eax, dword [0x4eba58]
jmp 0x416047
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret