joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov eax, 2
mov word [ebp - 0x14], ax
push 0x5ead70
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47d630
xor eax, eax
jmp 0x47d7b7
mov eax, dword [ebp - 0x10]
push eax
call fcn.005cef1a
add esp, 4
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005cebc3
add esp, 8
test eax, eax
jge 0x47d666
mov eax, dword [ebp - 0x10]
push eax
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x47d7b7
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.005cd459
add esp, 4
push 0x5ead74
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47d6cc
mov edx, dword [ebp - 0x10]
push edx
call fcn.005cef1a
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cebc3
add esp, 8
test eax, eax
jge 0x47d6ba
jmp 0x47d6c0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.005cd459
add esp, 4
push 0x5ead78
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47d720
mov eax, dword [ebp - 0x10]
push eax
call fcn.005cef1a
add esp, 4
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005cebc3
add esp, 8
test eax, eax
jge 0x47d70e
jmp 0x47d714
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005cd459
add esp, 4
push 0x5ead7c
mov edx, dword [ebp + 8]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x47d73e
xor eax, eax
jmp 0x47d7b7
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 2
lea ecx, [ebp - 0x14]
push ecx
call fcn.005cdb90
add esp, 0x10
mov edx, dword [ebp - 0x1c]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.005cdb90
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
push 4
lea edx, [ebp - 8]
push edx
call fcn.005cdb90
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 4
lea ecx, [ebp - 0x18]
push ecx
call fcn.005cdb90
add esp, 0x10
mov edx, dword [ebp - 0x1c]
push edx
push 1
push 0x10000
push 0x7d3768
call fcn.005cdb90
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005cd459
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x47dcf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
cmp dword [ebp + 8], 0
jl 0x47dd09
mov eax, dword [ebp + 8]
cmp eax, dword [0x1267cb8]
jl 0x47dd10
xor eax, eax
jmp 0x47ddf6
mov esi, dword [ebp + 8]
shl esi, 5
add esi, dword [0x9cbbe8]
mov ecx, 8
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
shl ecx, 5
mov edx, dword [0x9cbbe8]
movsx eax, word [edx + ecx + 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx*4 + 0x7d2ee8], 0
jne 0x47dd4e
xor eax, eax
jmp 0x47ddf6
push 0
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*4 + 0x7d2ee8]
push ecx
call fcn.005cdc9c
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov eax, dword [edx*4 + 0x7d2ee8]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
push 0x7e3768
call fcn.005cdfc1
add esp, 0x10
cmp eax, 1
je 0x47dd8e
xor eax, eax
jmp 0x47ddf6
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x8d79a8
cmp dword [ebp + 0x18], 0
je 0x47ddc8
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x7e3768
call fcn.005b2280
add esp, 0x18
test eax, eax
jne 0x47ddc6
xor eax, eax
jmp 0x47ddf6
jmp 0x47ddf1
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x7e3768
call fcn.005b2280
add esp, 0x18
test eax, eax
jne 0x47ddf1
xor eax, eax
jmp 0x47ddf6
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47efb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x5eadd4
mov eax, dword [ebp + 0xc]
push eax
call fcn.005cd6b5
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x47efdb
xor eax, eax
jmp 0x47f0c1
push 0x5eadd8
mov eax, dword [ebp + 0x10]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47effc
xor eax, eax
jmp 0x47f0c1
mov ecx, dword [ebp - 8]
push ecx
push 1
push 1
lea edx, [ebp - 9]
push edx
call fcn.005cdfc1
add esp, 0x10
movzx eax, byte [ebp - 9]
cmp eax, 1
jne 0x47f0ac
mov ecx, dword [ebp - 8]
push ecx
call fcn.005ce950
add esp, 4
test eax, eax
jne 0x47f0aa
mov edx, dword [ebp - 8]
push edx
push 2
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.005cdfc1
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 1
push 2
lea edx, [ebp - 4]
push edx
call fcn.005cdfc1
add esp, 0x10
mov eax, dword [ebp - 0x18]
sub eax, 0x186a0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0047ded0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x47f077
jmp 0x47f01d
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x24
mov ecx, dword [0x9ccc64]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x14], edx
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x24
mov ecx, dword [0x9ccc64]
mov dx, word [ebp - 4]
mov word [ecx + eax + 6], dx
jmp 0x47f01d
jmp 0x47f0b0
xor eax, eax
jmp 0x47f0c1
mov eax, dword [ebp - 8]
push eax
call fcn.005cd459
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x489380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x9ce470]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48939f
cmp dword [ebp - 4], 1
je 0x489416
jmp 0x48944e
call fcn.0059b290
mov dword [0x7d22c4], 2
call fcn.005ae490
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4893d4
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x4893dd
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
fild qword [ebp - 0x10]
fstp qword [0x7d12b8]
mov dword [0x62f838], 1
mov eax, dword [0x9ce470]
add eax, 1
mov dword [0x9ce470], eax
call fcn.005711e0
call fcn.0044fe10
jmp 0x48944e
push ecx
fld dword [0x5e85e4]
fstp dword [esp]
push 8
push 0xe
call fcn.0059e640
add esp, 0xc
cmp eax, 1
jne 0x48944e
mov dword [0x7d22c4], 0
push 0
push 0
call fcn.0046c870
add esp, 8
mov eax, 1
jmp 0x489450
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4897a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4897c7
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x4897d0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
fld qword [0x7d12b8]
fadd qword [0x5ec058]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
fild qword [ebp - 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4897fc
mov eax, 1
jmp 0x4897fe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x493230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x9cf360], 0
je 0x49324d
mov dword [ebp - 4], 0xca0000
call fcn.00492280
jmp 0x493254
mov dword [ebp - 4], 0x90000000
cmp dword [0x9cf360], 0
je 0x49327a
mov eax, dword [0x607ee8]
push eax
mov ecx, dword [0x607ee4]
push ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x493292
push 0x1e0
push 0x280
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
cmp dword [0x9cef70], 0
jne 0x493339
cmp dword [0x9cf360], 0
je 0x4932fe
push 0
mov eax, dword [0x9cf2fc]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [0x9cf36c]
push eax
mov ecx, dword [0x9cf368]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x5eca28
push 0x5eca34
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x9cef70], eax
jmp 0x493337
push 0
mov eax, dword [0x9cf2fc]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x5eca40
push 0x5eca4c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x9cef70], eax
jmp 0x4933b8
mov ecx, dword [ebp - 4]
push ecx
push 0xfffffffffffffff0
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x9cf300]
push eax
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x9cf360], 0
je 0x493396
push 0x20
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x9cf36c]
push ecx
mov edx, dword [0x9cf368]
push edx
push 0xfffffffffffffffe
mov eax, dword [0x9cef70]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4933b8
push 0x20
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x9cef70]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x9cf300]
push ecx
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x9cef70]
push eax
push ecx
adc eax, sym.imp.USER32.dll_UpdateWindow
mov esp, ebp
pop ebp
ret
Function at 0x495020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0x5ecb0c
mov dword [ebp - 0x18], 1
push 0x5ecb10
mov ecx, dword [ebp + 8]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49505c
or eax, 0xffffffff
jmp 0x49516b
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
push ecx
call fcn.005cf0db
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax + 1]
push ecx
call fcn.005cf0db
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax + 2]
push ecx
call fcn.005cf0db
add esp, 8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.005cf0db
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
lea edx, [ebp + 0xc]
push edx
call fcn.005cdb90
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
push 1
push 4
lea ecx, [ebp + 0x10]
push ecx
call fcn.005cdb90
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.005cdb90
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
lea edx, [ebp + 0x18]
push edx
call fcn.005cdb90
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x495109
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x49515d
mov dword [ebp - 0x1c], 0
jmp 0x495121
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 0x14]
jge 0x49515b
mov dword [ebp - 0xc], 0
jmp 0x49513b
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x18]
jge 0x495159
mov edx, dword [ebp - 8]
push edx
push 1
push 2
lea eax, [ebp - 0x14]
push eax
call fcn.005cdb90
add esp, 0x10
jmp 0x495132
jmp 0x495118
jmp 0x495100
mov ecx, dword [ebp - 8]
push ecx
call fcn.005cd459
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x499800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x121bbbc], 0
jne 0x499814
jmp 0x499998
fld dword [0xc34efc]
fcomp qword [0x5e8680]
fnstsw ax
test ah, 0x44
jp 0x49983a
fld dword [0xc1852c]
fcomp qword [0x5e8680]
fnstsw ax
test ah, 0x44
jnp 0x49983f
jmp 0x499998
movsx eax, word [0x6bdfc8]
test eax, eax
jne 0x499855
movsx ecx, word [0xca994c]
test ecx, ecx
je 0x49985a
jmp 0x499998
push 0xca99f0
mov edx, dword [0xcb1fd0]
push edx
call fcn.005b7880
add esp, 8
movzx eax, al
test eax, eax
je 0x499895
push 0xca9a20
mov ecx, dword [0xcb1fc8]
push ecx
call fcn.005b7880
add esp, 8
movzx edx, al
test edx, edx
je 0x499895
jmp 0x499998
push 0xca99f0
mov eax, dword [0xcb1fd0]
push eax
call fcn.005b7860
add esp, 8
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp dword [ebp - 0x10]
push 0xca9a20
mov ecx, dword [0xcb1fc8]
push ecx
call fcn.005b7860
add esp, 8
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp dword [ebp - 8]
push ecx
fld dword [ebp - 8]
fstp dword [esp]
push ecx
fld dword [ebp - 0x10]
fstp dword [esp]
call fcn.0049cb30
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x499908
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x1c], edx
jmp 0x499911
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov edx, dword [0xca9a70]
add edx, 0x1f4
cmp edx, dword [ebp - 0x1c]
jae 0x499998
mov eax, dword [ebp - 0xc]
push eax
call fcn.00596350
add esp, 4
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0049a6d0
add esp, 8
mov byte [ebp - 4], al
mov byte [ebp - 3], 0
lea edx, [ebp - 4]
push edx
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
call fcn.0057f2f0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x499986
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x20], edx
jmp 0x49998f
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [0xca9a70], edx
mov esp, ebp
pop ebp
ret
Function at 0x4999a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jl 0x4999b2
cmp dword [ebp + 8], 7
jle 0x4999b7
jmp 0x499ad2
cmp dword [0x121bbbc], 0
jne 0x4999c5
jmp 0x499ad2
fld dword [0xc34efc]
fcomp qword [0x5e8680]
fnstsw ax
test ah, 0x44
jp 0x4999eb
fld dword [0xc1852c]
fcomp qword [0x5e8680]
fnstsw ax
test ah, 0x44
jnp 0x4999f0
jmp 0x499ad2
movsx eax, word [0x6bdfc8]
test eax, eax
jne 0x499a06
movsx ecx, word [0xca994c]
test ecx, ecx
je 0x499a0b
jmp 0x499ad2
mov edx, dword [0x121bbbc]
mov eax, dword [edx + 0x2b8]
cmp eax, dword [ebp + 8]
jne 0x499a21
jmp 0x499ad2
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x499a42
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x499a4b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0xca9a74]
add edx, 0x1f4
cmp edx, dword [ebp - 8]
jae 0x499ad2
mov eax, dword [ebp + 8]
push eax
call fcn.00596350
add esp, 4
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049a6d0
add esp, 8
mov byte [ebp - 4], al
mov byte [ebp - 3], 0
lea edx, [ebp - 4]
push edx
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
call fcn.0057f2f0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x499ac0
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x499ac9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [0xca9a74], edx
mov esp, ebp
pop ebp
ret
Function at 0x49dba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0049dd90
mov eax, dword [ebp + 8]
push eax
push str.binPUK2cutdat_d.cut
lea ecx, [ebp - 0x110]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 0x5ecb40
lea edx, [ebp - 0x110]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49dc3b
push 0x10
push 0x5ecb44
push 0x5ecb4c
mov eax, dword [0x9cef70]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x11
push 0x5ecb60
push 0x5ecb6c
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x49dc36
push 0
push 0
push 0x10
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x49dd80
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0xc
push 0xa21ee8
call fcn.005cdfc1
add esp, 0x10
movsx ecx, word [0xa21eee]
movsx edx, word [0xa21ef0]
add ecx, edx
movsx eax, word [0xa21ef2]
add ecx, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x49dc7e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jge 0x49dd74
mov eax, dword [ebp - 0xc]
push eax
push 1
push 4
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x14
add ecx, 0xa21ef4
push ecx
call fcn.005cdfc1
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
push 1
push 2
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0xa21ef8
push eax
call fcn.005cdfc1
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 2
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
add edx, 0xa21efa
push edx
call fcn.005cdfc1
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
push 1
push 2
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x14
add ecx, 0xa21efc
push ecx
call fcn.005cdfc1
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
push 1
push 2
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0xa21efe
push eax
call fcn.005cdfc1
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 2
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
add edx, 0xa21f00
push edx
call fcn.005cdfc1
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
push 1
push 2
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x14
add ecx, 0xa21f02
push ecx
call fcn.005cdfc1
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
push 1
push 2
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, 0xa21f04
push eax
call fcn.005cdfc1
add esp, 0x10
jmp 0x49dc75
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x49dde0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push str.binPUK2cutdat_d.aut
lea ecx, [ebp - 0x108]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 0x5ecb94
lea edx, [ebp - 0x108]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49de73
push 0x10
push 0x5ecb98
push 0x5ecba0
mov eax, dword [0x9cef70]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x11
push 0x5ecbb4
push 0x5ecbc0
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x49de71
push 0
push 0
push 0x10
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x49de97
mov eax, dword [ebp - 4]
push eax
push 0x749a3
push 1
push 0xc34f80
call fcn.005cdfc1
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x4a68d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
cmp dword [0x121098c], 0
jge 0x4a68ff
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a6a74
mov eax, dword [0x121098c]
movsx ecx, word [eax*4 + 0x608078]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x121098c]
movsx eax, word [edx*4 + 0x60807a]
mov dword [ebp - 4], eax
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.00458220
add esp, 0xc
mov dword [ebp - 0xc], eax
movsx eax, word [0x120e5d4]
test eax, eax
je 0x4a6979
movsx ecx, word [0x120e5d4]
cmp ecx, 1
jne 0x4a6a60
movzx edx, word [0x1210992]
and edx, 0x100
je 0x4a6a60
cmp dword [ebp - 0xc], 1
jne 0x4a6a60
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x4a6a60
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x4a6a60
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x4a6a60
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a69d9
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x14], edx
jmp 0x4a69e2
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edx, dword [0x6bdfcc]
add edx, 0x1f4
cmp edx, dword [ebp - 0x14]
jae 0x4a6a4a
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov eax, dword [0xfd5768]
push eax
call fcn.005855f0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a6a38
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4a6a41
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [0x6bdfcc], edx
push 0xf0
push 0x140
push 0x33
call fcn.005af300
add esp, 0xc
jmp 0x4a6a74
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4a6a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
cmp dword [0x121098c], 0
jge 0x4a6aaf
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a6c2b
mov eax, dword [0x121098c]
movsx ecx, word [eax*4 + 0x608078]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x121098c]
movsx eax, word [edx*4 + 0x60807a]
mov dword [ebp - 4], eax
push 0
push 0xc400
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.004583d0
add esp, 0x14
mov dword [ebp - 0xc], eax
movsx eax, word [0x120e5d4]
test eax, eax
je 0x4a6b30
movsx ecx, word [0x120e5d4]
cmp ecx, 1
jne 0x4a6c17
movzx edx, word [0x1210992]
and edx, 0x100
je 0x4a6c17
cmp dword [ebp - 0xc], 1
jne 0x4a6c17
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x4a6c17
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x4a6c17
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x4a6c17
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a6b90
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x14], edx
jmp 0x4a6b99
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edx, dword [0x6bdfcc]
add edx, 0x1f4
cmp edx, dword [ebp - 0x14]
jae 0x4a6c01
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov eax, dword [0xfd5768]
push eax
call fcn.00585770
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a6bef
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4a6bf8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [0x6bdfcc], edx
push 0xf0
push 0x140
push 0x33
call fcn.005af300
add esp, 0xc
jmp 0x4a6c2b
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
mov esp, ebp
pop ebp
ret