joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100048b0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10006188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x38]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x38]
mov byte [esp + 0x28], 1
mov esi, dword [ecx - 8]
cmp esi, ebx
jle 0x10004942
push 0x5c
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::ReverseFind
dec esi
cmp eax, esi
jne 0x10004942
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x38]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
call sub.MFC42.DLL_CString::Left
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
push ecx
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x3c]
cmp esi, ebx
jne 0x1000494f
mov esi, 0x80000002
push 0x100
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push edx
push 0x20019
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x100049d3
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
mov edi, esi
push eax
push esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x100049c6
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], 1
mov dword [ecx], edx
cmp esi, ebx
je 0x100049d3
push esi
call ebp
xor edi, edi
mov dword [esp + 0x18], edi
push 0xffffffffffffffff
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
cmp edi, ebx
je 0x100049f2
push edi
call ebp
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x10004a10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x100061b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x24], edi
xor esi, esi
mov dword [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x20], 1
mov ebp, dword [ecx - 8]
test ebp, ebp
jle 0x10004aa5
push 0x5c
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::ReverseFind
dec ebp
cmp eax, ebp
jne 0x10004aa5
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x34]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::Left
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
push ecx
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x38]
test ebp, ebp
jne 0x10004ab2
mov ebp, 0x80000002
push 0x100
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x38]
mov dword [esp + 0x38], 0
push edx
push 0x20019
push 0
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10004b1f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push eax
push edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test edi, edi
je 0x10004b1f
push edi
call ebp
xor edi, edi
mov dword [esp + 0x10], edi
push 0xffffffffffffffff
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
test edi, edi
je 0x10004b3f
push edi
call ebp
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xbe2ecb
Capabilities:
Encode data using base64

Disassembly:
add eax, 0x736
jmp 0x109ed29
mov dword [ebp - 0x18], ebx
clc
cmp edx, edi
mov byte [ebp - 1], bl
sub esi, edi
mov dword [ebp - 0x48], esi
shl esi, 0x93
sub esi, edx
mov esi, dword [eax]
mov dword [ecx], ebx
rol ecx, cl
bts ecx, esi
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
not cl
mov ecx, dword [eax + 4]
rcr ax, cl
or al, 0x87
cmovbe ax, di
add ecx, esi
rol ax, 0xad
cbw
shrd ax, bp, 0xb0
mov eax, 0x300
cmp ax, di
shl eax, cl
cmp di, sp
cmp ch, 0xa6
mov dword [ebp - 0x3c], esi
cmc
cmp sp, sp
clc
mov dword [ebp - 0x14], ebx
stc
clc
jmp 0xa1b1d9
mov dword [ebp - 0x10], edi
jmp 0xa0ee87
push esi
push edi
or esi, ebp
test cx, si
bts esi, ebx
mov edi, 1
mov esi, edi
stc
shl esi, cl
not cx
mov ecx, dword [eax + 4]
cmp esp, 0x4908faba
cmp bp, cx
xor ebx, ebx
cmp ax, sp
test ebp, ecx
mov dword [ebp - 0x20], edx
sub esi, edi
mov dword [ebp - 0x44], esi
bsr esi, esp
bsf esi, eax
mov esi, edi
cmp edi, esp
shl esi, cl
bts cx, cx
rcl ecx, cl
mov ch, 0x39
mov ecx, dword [ebp + 0xc]
cmp di, 0xe786
jmp 0xa17c96
shrd eax, edx, cl
mov ecx, dword [esp + 8]
mov dword [esp], 0x6e92a8a8
mov dword [esp + 4], 0x4391a8a3
mov dword [edi], eax
movzx eax, cl
mov edx, ecx
call fcn.01115e31
push ebp
mov ebp, esp
btr edx, ebp
shr cl, 0x22
bts edx, esi
lea esp, [esp - 0x48]
or dl, 0x94
sbb cx, si
mov ecx, dword [eax + 8]
sbb edx, 0xe335c0bd
bswap dx
btc edx, 0xa7
mov edx, dword [eax + 0xc]
clc
stc
push ebx
jmp 0xb62d61

Function at 0x13c7ab7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
or ecx, ecx
sub esp, 4
movsx esi, ax
cmovp si, ax
movzx esi, cx
mov dword [ebp - 4], 0
cld
sub edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
xor ch, 0x1a
mov edx, dword [edx + 0x14]
test eax, ebp
and esi, 0xfeb249a1
bswap si
Function at 0x26861315
Capabilities:
Read .ini file

Disassembly:
lea ecx, [eax + 0x414]
push ecx
push dword [esp + 0x10]
add eax, 0x20a
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
ret 0xc

Function at 0x26861339
Capabilities:
Read .ini file

Disassembly:
lea ecx, [eax + 0x414]
push ecx
push dword [esp + 0x10]
add eax, 0x20a
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
inc eax
ret 0x10

Function at 0x26861362
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.2686145c
test eax, eax
je 0x268613de
mov ecx, dword [0x2692af68]
test ecx, ecx
je 0x268613b9
lea eax, [esi + 0x838]
cmp dword [eax], 0
jne 0x26861398
xor eax, eax
jmp 0x268613a9
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov edx, dword [ecx]
push edi
lea edi, [ebp - 0x20c]
push edi
push 1
push eax
call dword [edx]
pop edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
add esi, 0x20a
push dword [ebp + 0xc]
push 0x268f1584
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
inc eax
pop esi
leave
ret 0xc

Function at 0x26861a1d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.2686145c
test eax, eax
je 0x26861a96
mov ecx, dword [0x2692af68]
test ecx, ecx
je 0x26861a74
lea eax, [esi + 0x838]
cmp dword [eax], 0
jne 0x26861a53
xor eax, eax
jmp 0x26861a64
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov edx, dword [ecx]
push edi
lea edi, [ebp - 0x20c]
push edi
push 1
push eax
call dword [edx]
pop edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
add esi, 0x20a
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
inc eax
pop esi
leave
ret 0xc
Function at 0x26861bb0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x268efe74
call fcn.268eb4dc
sub esp, 0x444
mov eax, dword [ebp + 8]
push ebx
push edi
mov ebx, ecx
xor edi, edi
push ebx
mov word [eax], di
call fcn.26861b78
test eax, eax
jne 0x26861bf7
mov eax, dword [ebx + 0x834]
cmp eax, edi
je 0x26861bf0
push 0x13ee3
mov ebx, 0x268f3f58
call fcn.268e6bb2
pop ecx
xor eax, eax
jmp 0x26861daf
push esi
mov eax, ebx
call fcn.26861dbf
lea esi, [ebx + 0x83c]
mov eax, esi
call fcn.268e3045
test eax, eax
je 0x26861c31
mov eax, dword [ebx + 0x834]
cmp eax, edi
je 0x26861c2a
push 0x13ee3
mov ebx, 0x268f3f58
call fcn.268e6bb2
pop ecx
xor eax, eax
jmp 0x26861dae
mov eax, esi
call fcn.268e3147
push eax
xor eax, eax
call fcn.268d1b68
test eax, eax
pop ecx
je 0x26861c10
lea eax, [ebp - 0x38]
call fcn.268db90f
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
push 1
push 0x105
lea eax, [ebp - 0x450]
push eax
push edi
mov eax, esi
call fcn.268e3147
push eax
mov eax, 0x268f166c
lea edi, [ebp - 0x38]
call fcn.268db96c
jmp 0x26861d8c
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.268e34fd
lea esi, [ebp - 0x10]
call fcn.268d1427
push str.INSTALL
mov eax, esi
push eax
call fcn.268e33a7
call fcn.268d1427
push str.WDUPDATE.NET
mov eax, esi
push eax
call fcn.268e33a7
mov ecx, dword [0x2692af68]
xor edx, edx
cmp ecx, edx
je 0x26861cf0
lea eax, [ebx + 0x838]
cmp dword [eax], edx
je 0x26861ce0
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov edx, eax
mov esi, dword [ecx]
lea eax, [ebp - 0x10]
call fcn.268e3147
push eax
push 1
push edx
call dword [esi]
lea eax, [ebp - 0x10]
call fcn.268e3147
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push 0x268f157c
push str.UTILISABLE
lea edi, [ebx + 0x20a]
push edi
call esi
cmp word [ebp - 0x14], 0x30
je 0x26861d78
lea eax, [ebp - 0x10]
call fcn.268e3147
push eax
push 0x104
lea eax, [ebp - 0x244]
push eax
push 0x268f1584
push 0x268f1800
push edi
call esi
cmp word [ebp - 0x244], 0
je 0x26861d78
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x26861d65
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x268f163c
call fcn.268dfac3
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push 0xffffffffffffffff
push eax
mov eax, dword [ebp + 0xc]
call fcn.268dfac3
pop ecx
pop ecx
push 0x105
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x450]
call fcn.268dba14
test eax, eax
jne 0x26861c80
mov byte [ebp - 4], al
lea eax, [ebp - 0x10]
call fcn.268e3036
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.268db949
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x26863959
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
not eax
jbe 0x2686397e
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x26927060]
inc ecx
dec edx
jne 0x26863961
pop edi
pop esi
not eax
ret
Function at 0x26863f0e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x11c
push ebx
mov ebx, ecx
push esi
xor ecx, ecx
mov esi, eax
mov word [ebx], cx
mov eax, dword [esi + 0x10]
sub eax, ecx
push edi
je 0x26864081
dec eax
je 0x26864044
dec eax
je 0x26863f41
xor eax, eax
jmp 0x2686409e
mov eax, dword [esi + 4]
sub eax, 3
je 0x2686403a
dec eax
je 0x26864030
dec eax
je 0x26863fc5
dec eax
jne 0x26863f3a
push 0x47
pop ecx
xor eax, eax
lea edi, [ebp - 0xa8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [ebp + 0x72], 3
jne 0x26863f9d
cmp dword [esi + 8], 2
push 0xffffffffffffffff
push dword [ebp + 0x7c]
jb 0x26863f96
mov eax, str.2012S
jmp 0x26864013
mov eax, 0x26910b2c
jmp 0x26864013
mov esi, dword [esi + 8]
cmp esi, 2
jb 0x26863fac
mov eax, 0x26910b28
jmp 0x2686400e
cmp esi, 1
jb 0x26863fb8
mov eax, 0x26910b24
jmp 0x2686400e
push dword [ebp + 0x7c]
push str.VISTA
jmp 0x26864089
mov esi, dword [esi + 8]
sub esi, ecx
je 0x26863fd2
dec esi
je 0x26864026
dec esi
je 0x26863fdf
push dword [ebp + 0x7c]
push str.NT_5
jmp 0x26864089
push 0x47
pop ecx
xor eax, eax
lea edi, [ebp - 0xa8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [ebp + 0x72], 1
jne 0x2686401c
mov eax, 0x26910b50
push 0xffffffffffffffff
push dword [ebp + 0x7c]
call fcn.268dfa74
pop ecx
pop ecx
jmp 0x2686409b
push dword [ebp + 0x7c]
push str.2003S
jmp 0x26864089
push dword [ebp + 0x7c]
push 0x26910b50
jmp 0x26864089
push dword [ebp + 0x7c]
push str.NT_4
jmp 0x26864089
push dword [ebp + 0x7c]
push str.NT_3.5
jmp 0x26864089
cmp dword [esi + 4], 4
jne 0x26863f3a
mov esi, dword [esi + 8]
cmp esi, ecx
je 0x26864077
cmp esi, 0xa
je 0x2686406d
cmp esi, 0x5a
jne 0x26863f3a
push dword [ebp + 0x7c]
push 0x26910b80
jmp 0x26864089
push dword [ebp + 0x7c]
push 0x26910b88
jmp 0x26864089
push dword [ebp + 0x7c]
push 0x26910b90
jmp 0x26864089
push dword [ebp + 0x7c]
push 0x26910b98
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
test eax, eax
je 0x26863f3a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x2686413d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
and word [ebx], 0
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [esi + 0x14]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
test eax, eax
je 0x26864273
cmp dword [esi + 0x10], 2
jne 0x26864270
cmp dword [esi + 4], 5
jb 0x26864270
cmp dword [esi + 8], 1
jb 0x26864270
push edi
push 0x47
pop ecx
xor eax, eax
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x268641e4
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
jbe 0x268641ca
push 0x26910acc
push ebx
call esi
pop ecx
pop ecx
test byte [ebp - 3], 2
je 0x268641d7
push str.Home_Edition
jmp 0x268641dc
push 0x26910aa8
push ebx
call esi
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
call fcn.26863e9e
test eax, eax
je 0x2686421f
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
jbe 0x2686420c
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x26910acc
mov edi, ebx
call fcn.268dfac3
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x26910aa0
mov edi, ebx
call fcn.268dfac3
pop ecx
pop ecx
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x2686423d
cmp dword [esi + 4], 6
jne 0x2686426f
cmp dword [esi + 8], 1
jne 0x2686426f
cmp byte [ebp - 2], 1
je 0x2686426f
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
jbe 0x2686425c
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x26910acc
mov edi, ebx
call fcn.268dfac3
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x26910a98
mov edi, ebx
call fcn.268dfac3
pop ecx
pop ecx
pop edi
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x26864664
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
push esi
mov esi, dword [eax + ecx*4 - 4]
test esi, esi
jne 0x26864677
xor eax, eax
pop esi
ret
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x2686469e
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
mov ch, al
mov cl, byte [esi + 4]
mov dword [edi + 8], 1
mov dword [edi + 4], ecx
jmp 0x268646ac
movzx eax, word [esi + 8]
mov dword [edi + 4], eax
movzx eax, word [esi + 0xa]
mov dword [edi + 8], eax
cmp dword [esi + 0xc], 0
jbe 0x268646c4
cmp dword [esi + 0x10], 0
jne 0x268646c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
pop esi
ret
Function at 0x26867ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebx]
jbe 0x26867d3b
movzx eax, word [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push 0x496
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x26867d24
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push edi
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
call esi
test eax, eax
jne 0x26867d10
push ebx
call fcn.26867ccc
pop edi
pop esi
leave
ret 8

Function at 0x268685aa
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xd4
push ebx
push esi
push edi
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x26868692
add eax, 3
and eax, 0xfffffffc
call fcn.268eb500
mov ebx, esp
xor eax, eax
test ebx, ebx
je 0x268686b3
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
push ebx
mov ecx, edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
push dword [ebp + 0x5c]
push dword [ebp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x26868692
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x64]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x26868692
push dword [ebp + 0x74]
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 0x32
pop ecx
ja 0x26868692
mov eax, dword [ebp + 0x64]
movzx ecx, word [eax + 2]
push dword [ebp + 0x74]
movzx eax, word [eax]
mov esi, dword [sym.imp.MSVCRT.dll_swprintf]
push ecx
push eax
lea eax, [ebp - 0x6c]
push str.StringFileInfo_04X_04X_s
push eax
call esi
add esp, 0x14
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x26868696
push dword [ebp + 0x74]
lea eax, [ebp - 0x6c]
push str.StringFileInfo040904E4_s
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x26868696
xor eax, eax
jmp 0x268686b3
mov esi, dword [ebp + 0x7c]
mov edi, dword [ebp + 0x78]
push esi
push dword [ebp + 0x64]
push edi
call dword [sym.imp.MSVCRT.dll_wcsncpy]
and word [edi + esi*2 - 2], 0
xor eax, eax
add esp, 0xc
inc eax
lea esp, [ebp - 0x78]
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret
Function at 0x268686be
Capabilities:
Get file version info

Disassembly:
mov eax, 0x268eca53
call fcn.268eb4dc
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x2686872d
add eax, 3
and eax, 0xfffffffc
call fcn.268eb500
mov ebx, esp
xor eax, eax
test ebx, ebx
je 0x2686876f
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
push ebx
mov ecx, edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x2686872d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x26911198
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x26868731
xor eax, eax
jmp 0x2686876f
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x18], 0
and dword [ebp - 4], 0
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push dword [ebp + 0xc]
call fcn.268e3c68
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
call fcn.268e3036
xor eax, eax
inc eax
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2686e035
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push edi
push 0x8000
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wopen]
mov edi, eax
cmp edi, 0xffffffff
pop ecx
pop ecx
jne 0x2686e05d
xor eax, eax
jmp 0x2686e18a
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__lseek]
push 2
push 0
push edi
call ebx
add esp, 0xc
cmp eax, 0x146
je 0x2686e07c
xor eax, eax
jmp 0x2686e189
push esi
push 0
push 0xa
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x2686e105
mov esi, dword [sym.imp.MSVCRT.dll__read]
push 2
lea eax, [ebp - 8]
push eax
push edi
call esi
add esp, 0xc
cmp eax, 0xffffffff
je 0x2686e105
push 2
lea eax, [ebp - 4]
push eax
push edi
call esi
add esp, 0xc
cmp eax, 0xffffffff
je 0x2686e105
cmp word [ebp - 8], 0x1f
push 0x10
pop eax
jle 0x2686e0c1
mov dword [ebp - 8], eax
cmp word [ebp - 4], 0x1f
jle 0x2686e0cb
mov dword [ebp - 4], eax
push 0
push 0x46
push edi
call ebx
add esp, 0xc
cmp eax, 0xffffffff
je 0x2686e105
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x314]
push eax
push edi
call esi
add esp, 0xc
cmp eax, 0xffffffff
je 0x2686e105
push ebx
lea eax, [ebp - 0x418]
push eax
push edi
call esi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x2686e111
push edi
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
xor eax, eax
jmp 0x2686e188
push edi
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10c]
rep stosd dword es:[edi], eax
push 0x20
stosw word es:[edi], ax
xor ecx, ecx
xor eax, eax
pop edx
mov esi, dword [ebp + eax - 0x21c]
mov dword [ebp + ecx - 0x10c], esi
mov esi, dword [ebp + eax - 0x320]
mov dword [ebp + ecx - 0x210], esi
sub eax, 8
add ecx, 8
dec edx
jne 0x2686e13e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
movsx eax, word [ebp - 4]
push 0x20
push 0x20
push eax
movsx eax, word [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CreateCursor]
pop esi
pop ebx
pop edi
leave
ret