joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4891f4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00488994
xor eax, eax
push ebp
push 0x489372
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x48935c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x48923f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x489249
call fcn.00404ad0
jmp 0x489379
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041b178
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1018]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x489351
push 0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4892ff
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2733
je 0x4892ec
lea eax, [ebp - 0x18]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043ac
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004891ac
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x489384]
cmp dl, byte [eax + 0x28]
je 0x489358
call fcn.0040d6c0
jmp 0x489358
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041b198
jmp 0x489358
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x489320
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041b198
jmp 0x489249
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041b178
cmp edx, dword [esp + 4]
jne 0x489340
cmp eax, dword [esp]
pop edx
pop eax
jne 0x489249
push ebp
call fcn.004891ac
pop ecx
jmp 0x489358
push ebp
call fcn.004891ac
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489379
mov eax, dword [ebp - 4]
call fcn.004889ac
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489388
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4894b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00488994
xor eax, eax
push ebp
push 0x489495
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4893da
call fcn.00404ad0
jmp 0x48949c
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48947f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x48947f
lea eax, [ebp - 0x14]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043ac
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], 0
je 0x48947f
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040cd5c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, 0x4894cc
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
mov ecx, dword [0x568a34]
mov dl, 1
mov eax, dword [0x487bfc]
call fcn.0040d7d8
call fcn.00404a24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48949c
mov eax, dword [ebp - 4]
call fcn.004889ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4894b9
lea eax, [ebp - 0x30]
call fcn.00404ff8
ret
Function at 0x489544
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00488994
xor eax, eax
push ebp
push 0x48967a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4895ac
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4895ac
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x489664
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4895bf
call fcn.00404ad0
jmp 0x489681
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x489664
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x489664
lea eax, [ebp - 0x14]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043ac
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], 0
je 0x489664
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040cd5c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, 0x4896b0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
mov ecx, dword [0x568a34]
mov dl, 1
mov eax, dword [0x487bfc]
call fcn.0040d7d8
call fcn.00404a24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489681
mov eax, dword [ebp - 4]
call fcn.004889ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48969e
lea eax, [ebp - 0x30]
call fcn.00404ff8
ret
Function at 0x48a26c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.00404ff8
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.00403930
mov dword [ebp - 0x18], 1
xor eax, eax
push ebp
push 0x48a380
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.00405488
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48a369
xor eax, eax
push ebp
push 0x48a362
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x48a30c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x1c], eax
jmp 0x48a332
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405488
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x48a34b
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x11c]
mov ecx, pe_nt_image_headers32
call fcn.00405268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a369
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a387
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret

Function at 0x48a9b4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov al, byte [ebp - 2]
and al, 0x20
mov dl, byte [ebp - 2]
and dl, 0x1e
and edx, 0xff
shr edx, 1
or al, dl
mov dl, byte [ebp - 2]
and dl, 1
shl edx, 4
or al, dl
mov byte [ebp - 4], al
xor eax, eax
mov al, byte [ebp - 4]
xor edx, edx
mov dl, byte [ebp - 1]
shl edx, 3
lea edx, [edx*8 + 0x567094]
mov al, byte [edx + eax]
and al, 0xf
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret
Function at 0x48aa04
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x48aa1c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48aa15
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403930
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x567294]
and al, 7
and eax, 0xff
mov ecx, 7
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x567294]
shr edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
and eax, edx
je 0x48aa8e
mov eax, dword [ebp - 0xc]
and eax, 7
mov ecx, 7
sub ecx, eax
mov al, 1
shl al, cl
mov edx, dword [ebp - 0xc]
shr edx, 3
mov ecx, dword [ebp - 8]
or byte [ecx + edx], al
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x38
jne 0x48aa3b
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x48ad3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x48ad55
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x48ad4e
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x48ad67
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48ad60
mov eax, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 5
lea ecx, [ebp - 0x12]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0048a87c
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x20]
xor byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jne 0x48ad87
xor eax, eax
mov al, byte [ebp - 0x12]
shr eax, 2
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x12]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x11]
shr edx, 4
or al, dl
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x10]
shr edx, 6
or al, dl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x10]
and al, 0x3f
mov byte [ebp - 0x17], al
xor eax, eax
mov al, byte [ebp - 0xf]
shr eax, 2
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xf]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0xe]
shr edx, 4
or al, dl
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0xe]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0xd]
shr edx, 6
or al, dl
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xd]
and al, 0x3f
mov byte [ebp - 0x13], al
xor eax, eax
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov dl, byte [ebp + edx - 0x1a]
call fcn.0048a9b4
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x1a], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jne 0x48ae1f
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, eax
mov al, byte [ebp + eax - 0x1a]
shl eax, 4
mov edx, dword [ebp - 0x20]
add edx, edx
or al, byte [ebp + edx - 0x19]
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x48ae43
lea eax, [ebp - 0x12]
mov edx, 5
call fcn.0048a918
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov al, byte [ebp + eax - 0x12]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x48ae7a
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48bc70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x48bc8f
mov eax, dword [0x568904]
mov eax, dword [eax]
call fcn.004636a8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x48bc83
pop ecx
pop ecx
pop ebp
ret

Function at 0x48bee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405478
xor eax, eax
push ebp
push 0x48bffd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00409bd8
test al, al
je 0x48bfe7
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409a8c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x48bfe7
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.00409b3c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x48bf4d
add eax, 3
sar eax, 2
shl eax, 2
call fcn.00402eb0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x48bf68
add eax, 3
sar eax, 2
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00403930
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.00409b3c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00409ae4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x48bfaf
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x48bfe1
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x20], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x24]
jne 0x48bfc2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c004
lea eax, [ebp - 4]
call fcn.00404ff8
ret
Function at 0x4947d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [0x5f1b38]
movzx eax, byte [eax + 0x30]
imul edx, eax, 0xe
mov eax, 0x172
call fcn.00466154
mov dword [ebp - 0x10], eax
mov eax, dword [0x5f1b38]
movsx eax, byte [eax + 0x5c]
imul edx, eax, 0x3c
add edx, dword [ebp - 0x10]
mov eax, 0x320
call fcn.00466154
mov dword [ebp - 0x10], eax
cmp byte [0x5f37f9], 0
je 0x494831
mov eax, 0x578
sub eax, dword [ebp - 0x10]
add eax, 0x5dc
mov dword [ebp - 0xc], eax
jmp 0x49483c
mov eax, 0x578
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x494847
xor eax, eax
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x398]
cmp eax, dword [ebp - 0xc]
jbe 0x49486e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x398], eax
mov byte [ebp - 5], 1
jmp 0x494872
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x494fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x494fa8
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x495101
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5f3568], 0
jbe 0x4950d4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5f356c]
cmp eax, 0x36ee80
jbe 0x494ff5
mov eax, dword [ebp - 8]
mov dword [0x5f3568], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5f356c], eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5f356c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
sub eax, dword [0x5f3568]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xbb8
cmp eax, dword [ebp - 0xc]
jge 0x49505c
inc dword [0x5f3570]
cmp dword [0x5f3570], 5
jle 0x495070
lea eax, [ebp - 0x14]
mov edx, 0x495114
call fcn.00405090
mov eax, dword [0x568bc8]
mov eax, dword [eax]
mov cx, word [0x495118]
mov edx, 0x495124
call fcn.004b6bdc
mov eax, dword [0x5f189c]
call fcn.0045f8fc
jmp 0x495070
lea eax, [ebp - 0x14]
mov edx, 0x49517c
call fcn.00405090
xor eax, eax
mov dword [0x5f3570], eax
cmp byte [0x5f3803], 0
je 0x4950e6
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.004096c0
push dword [ebp - 0x1c]
push 0x49518c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004096c0
push dword [ebp - 0x20]
push 0x495198
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
call fcn.004096c0
push dword [ebp - 0x24]
push 0x4951a4
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.0040538c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x5f18a0]
call fcn.004a9998
jmp 0x4950e6
mov eax, dword [ebp - 8]
mov dword [0x5f3568], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5f356c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495108
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.0040501c
ret
Function at 0x4ca1cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x3c], 0xa
jae 0x4ca1ef
mov dword [ebp - 8], 0xffffffff
jmp 0x4ca23a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x168]
xor edx, edx
push edx
push eax
mov eax, dword [0x5684c0]
mov eax, dword [eax]
cdq
cmp edx, dword [esp + 4]
jne 0x4ca218
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4ca233
jmp 0x4ca21c
pop edx
pop eax
jg 0x4ca233
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x568598]
sub eax, dword [edx]
mov edx, dword [0x5688c0]
cmp eax, dword [edx]
jae 0x4ca23a
mov dword [ebp - 8], 0xfffffffe
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4cadb8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xc]
sub al, 8
jae 0x4caf21
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x204]
cmp eax, 0xea60
jbe 0x4cae05
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x204], eax
mov eax, dword [ebp - 4]
mov si, 0xfff3
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.004cad34
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 4]
cmp dword [eax + 0x140], 0
je 0x4cae64
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa0]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x98]
push eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xac]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x9c]
push eax
mov al, byte [ebp + 8]
push eax
mov al, byte [ebp - 0x1d]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x140]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cac04
mov eax, dword [ebp - 4]
cmp byte [eax + 0xec], 0
je 0x4caf21
mov eax, dword [ebp - 4]
cmp dword [eax + 0x11c], 0
jle 0x4caf21
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x108]
dec edx
lea ecx, [ebp - 0x44]
mov ah, 0x20
call fcn.00403c2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x104]
cmp eax, 0xff
ja 0x4caeae
bt dword [ebp - 0x44], eax
jae 0x4caf21
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11c]
dec eax
xor edx, edx
call fcn.004cf220
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x104]
add dword [ebp - 0x10], eax
cmp dword [ebp - 0x24], 0
je 0x4caeef
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
call fcn.0047bdf0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4caf21
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x9c]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x98]
mov eax, dword [ebp - 8]
call fcn.00486830
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4cc098
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x5685c0]
cmp eax, dword [edx]
jne 0x4cc0c8
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0xf4]
cmp eax, 0xbb8
seta byte [ebp - 1]
jmp 0x4cc0e2
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0xf4]
cmp eax, 0x7d0
seta byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4cc0f6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
mov dword [eax + 0x10c], edx
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x4ce0f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x5685c0]
cmp eax, dword [edx]
jne 0x4ce128
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0xf4]
cmp eax, 0xbb8
seta byte [ebp - 1]
jmp 0x4ce142
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0xf4]
cmp eax, 0x7d0
seta byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4ce156
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
mov dword [eax + 0x10c], edx
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x4d07d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x98]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x78]
jbe 0x4d0879
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x98], eax
mov eax, dword [ebp - 4]
inc dword [eax + 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x88]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x84]
jge 0x4d0879
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x88]
dec eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc8], 0
jle 0x4d0875
mov eax, dword [ebp - 4]
dec dword [eax + 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
jmp 0x4d0879
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d3d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov byte [ebp - 1], al
mov byte [ebp - 2], 0
lea eax, [ebp - 0x102]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403930
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x4d3d55
xor eax, eax
mov al, byte [ebp - 1]
test byte [ebp + eax - 0x102], 0x80
je 0x4d3d55
mov byte [ebp - 2], 1
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret