joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, 1
mov dword [edi + 0x1384], 0xffffffff
mov dword [edi + 4], eax
lea esi, [edi + 8]
nop
mov ecx, eax
shr ecx, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [esi], eax
lea esi, [esi + 4]
cmp edx, 0x270
jl 0x41c8b0
mov dword [edi], 0x270
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x41c9b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov edi, edi
mov ecx, dword [edi + 4]
shl ebx, cl
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x41c9d9
mov ecx, esi
call fcn.0041cb00
jmp 0x41c9e7
cmp eax, 0x4e0
jb 0x41c9e7
mov ecx, esi
call fcn.0041ca40
mov eax, dword [esi]
inc eax
mov edx, dword [esi + eax*4]
mov dword [esi], eax
mov eax, dword [esi + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [edi + 8]
ja 0x41c9c5
mov eax, dword [ebp - 4]
add eax, dword [edi + 4]
or ebx, ecx
mov dword [ebp - 4], eax
cmp eax, 0x20
jb 0x41c9c0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ca40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 0x9c4]
mov ecx, 0xe3
mov edx, dword [edi + 4]
xor edx, dword [edi]
lea edi, [edi + 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
shr edx, 1
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x41ca50
lea esi, [ebx + 0xd50]
mov edi, 0x18c
nop
mov ecx, dword [esi]
xor ecx, dword [esi + 4]
lea esi, [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
shr ecx, 1
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x41ca90
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
shr ecx, 1
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x41cb00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
lea esp, [esp]
mov edx, dword [eax - 4]
xor edx, dword [eax]
lea eax, [eax + 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
shr edx, 1
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x41cb10
pop esi
ret
Function at 0x41e120
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 4
ja 0x41e164
mov cl, 0x61
js 0x41e165
mov ebp, 0xd4bc1fe9
scasb al, byte es:[edi]
out dx, al
cmp al, 0xd8
popal
fst qword [eax - 0x77bb6950]
test dword [esi], esp
test eax, 0xd6d1315e
test ah, dh
sub byte [edi], ch
mov al, byte [0xd643ab69]
mov ecx, 0xf45a12e
sub ebp, 0x334f4cd4
sti
inc edi
jp 0x41e197
xor al, al
cmp dword [ebp + 8], 0
jne 0x41e174
rol byte [ebx + 0x7500087d], 8
inc dword [esi + 0x3b4]
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x4219e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 3
ja 0x421a39
inc edx
or esi, dword [edi + 0xa]
aaa
scasb al, byte es:[edi]
inc edx
into
mov esi, 0xf99486e3
iretd
call fcn.0041cbb0
cmp dword [eax + 0x144], 0
jne 0x421a5c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret 0x20
mov edi, dword [ebp + 0x14]
cmp edi, 0x100
jae 0x421a8f
call fcn.0041cbb0
mov eax, dword [eax + 0x144]
push 0
push edi
push dword [ebp - 8]
push esi
push ebx
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret 0x20
xor ecx, ecx
mov eax, 0xa
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044738c
add esp, 4
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 0x38]
push 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
push 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
push 1
push 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x14], 0x10
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push eax
push 0x421800
push 0
push 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x421b29
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 0xa
jl 0x421ab1
push 0xffffffffffffffff
push 1
push ebx
push 0xa
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor edi, edi
call fcn.0041cbb0
cmp dword [eax + 0x14c], edi
je 0x421b7d
xor esi, esi
lea ecx, [ecx]
mov dword [ebp - 8], 0
call fcn.0041cbb0
mov eax, dword [eax + 0x14c]
lea ecx, [ebp - 8]
push ecx
push dword [ebx + esi*4]
call eax
test eax, eax
je 0x421b72
add edi, dword [ebp - 8]
inc esi
cmp esi, 0xa
jl 0x421b50
mov ecx, dword [ebp + 0x14]
jmp 0x421b82
mov ecx, dword [ebp + 0x14]
mov edi, ecx
xor eax, eax
cmp edi, ecx
sete al
push ebx
mov dword [ebp - 0x34], eax
call fcn.004486af
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x34]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00447bb9
mov esp, ebp
pop ebp
ret 0x20
Function at 0x424bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4635a3
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx

Function at 0x426d40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463db8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 1
ja 0x426d8d
dec edx
sub ah, bl
mov dword [ebx + esi*8], edx
inc ebp
xor al, 0xa6
ror byte [ebp - 0x4dd2827d], 0x12
push ss
sar dword [ebx + 0x6a535b], 1
push 0
push 0x46cfb4
mov ecx, 0x47aca1
mov dword [ebp - 0x2c], 0
call fcn.0040dbb0
cmp byte [0x47ac98], 0
je 0x426e50
push 0
push 0x46cfb4
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0040dbb0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call int.00421ec0
add esp, 4
cmp dword [ebp - 0x30], 0x10
jb 0x426dfd
push dword [ebp - 0x44]
call fcn.00447bb4
add esp, 4
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0040da80
call int.004271a0
add esp, 0x18
mov ecx, 0x47aca1
call fcn.00426b70
test al, al
sete bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0x10
jb 0x426edf
push dword [ebp - 0x28]
jmp 0x426ed7
mov ecx, 0x47aca1
call int.004443b0
mov ecx, 0x47aca1
call fcn.00426b70
test al, al
sete bl
test bl, bl
jne 0x426edf
sub esp, 0x18
mov ecx, esp
push 0x46d5d0
call fcn.0040dcb0
lea ecx, [ebp - 0x44]
call fcn.00444220
mov edi, eax
add esp, 0x18
cmp edi, 0x47aca1
je 0x426ece
cmp dword [0x47acb5], 0x10
jb 0x426ea8
push dword [0x47aca1]
call fcn.00447bb4
add esp, 4
push edi
mov ecx, 0x47aca1
mov dword [0x47acb5], 0xf
mov dword [0x47acb1], 0
mov byte [0x47aca1], 0
call fcn.004038b0
cmp dword [ebp - 0x30], 0x10
jb 0x426edf
push dword [ebp - 0x44]
call fcn.00447bb4
add esp, 4
call fcn.004030c0
cmp esi, 0x47aca1
je 0x426efc
push 0xffffffffffffffff
push 0
push 0x47aca1
mov ecx, esi
call fcn.0040da80
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
Function at 0x42df30
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 7
ja 0x42df8f
mov ebp, 0xa9995c0f
invalid
push 0
push esi
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push 0x476ff0
push 0x476f28
push 0
mov dword [0x47ac9d], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x42dfc9
pop esi
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
ret

Function at 0x42dfe0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x47ad14]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 2
ja 0x42e015
sub eax, 0x8323825d
dec ebp
pop ds
inc edi
push 0xffffffffffffffdc
loopne 0x42dffc
scasb al, byte es:[edi]
jp 0x42e034
inc ebp
sbb byte [ebx - 0x25], cl
sbb al, 0x37
push eax
pop ss
xor al, 0xc7
push ebx
sub eax, 0x57ec6a11
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x80
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
add byte [edx + 4], ch
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x431830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477238], 0
je 0x431853
mov eax, dword [0x477238]
jmp 0x4318d7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
add byte [eax], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x4318a7
stosb byte es:[edi], al
xor edx, dword [edx + 0x19be37f4]
arpl bp, ax
pop ds
jp 0x43186f
inc ebp
mov byte [0x2ac866f8], al
mov word [eax + 0x30ce6c0a], gs
xchg edx, eax
hlt
mov dword [ebp - 0x10], 0x431879
mov dword [ebp - 0x14], 0x4318a7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477238
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret

Function at 0x433240
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477758], 0
je 0x433260
mov eax, dword [0x477758]
jmp 0x4332d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 9
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x4332a6
sub ebp, dword [0xa3a7e0fe]
jnp 0x4332f8
cmp byte [eax], ch
push cs
retf
mov dword [ebp - 0x10], 0x433286
mov dword [ebp - 0x14], 0x4332a6
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477758
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477758]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
dec eax
inc edi
add byte [ebx], dh
lds ecx, [ecx + 0x3d83fc45]
push esp
ja 0x43334c
add byte [eax], al
je 0x433310
mov eax, dword [0x477754]
jmp 0x433383
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x433353
retf 0xf17a
add byte [eax], al
add byte [eax], al
or eax, dword [eax]
add edi, 0x45
lock xor eax, dword ss:[ebx]
mov dword [ebp - 0x10], 0x433336
mov dword [ebp - 0x14], 0x433353
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477754
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477754]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
Function at 0x434130
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477698], 0
je 0x434150
mov eax, dword [0x477698]
jmp 0x4341cd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x43419d
sub byte [ecx], al
sbb dword [edx], eax
fiadd word [edx]
mov esi, 0x24045203
add eax, 0x6fc05f3
xlatb
pop es
stosb byte es:[edi], al
or byte [ecx], dl
or esp, esp
or dword [edi + 0x5d0b8a0a], esi
or al, 0x30
or eax, 0
or al, byte [eax]
rol bh, cl
inc ebp
invalid
mov dword [ebp - 0x10], 0x434176
mov dword [ebp - 0x14], 0x43419d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477698
mov ecx, dword [ebp - 0x10]
call fcn.0042f980
add esp, 4
mov eax, dword [0x477698]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret

Function at 0x435810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477618], 0
je 0x435830
mov eax, dword [0x477618]
jmp 0x4358a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x435879
stosd dword es:[edi], eax
sub eax, 0xcb6de3a0
xor byte [ebp + 0x16ba31f1], al
cmp dword [eax - 0x24], 0x40
movsb byte es:[edi], byte [esi]
or byte [eax + edx*8 + 0x34], ch
cwde
cld
pushal
les ebp, [eax]
invalid
mov dword [ebp - 0x10], 0x435856
mov dword [ebp - 0x14], 0x435879
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477618
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477618]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
Function at 0x437900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477558], 0
je 0x437920
mov eax, dword [0x477558]
jmp 0x437999
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x437969
mov dh, cl
cmp dh, byte [edx + ebx*4 + 1]
dec esi
xchg ebx, eax
fdivr st(5)
pop esi
pushfd
mov bh, 0x19
pop edi
test al, 0xe9
or eax, 0x5106c47a
jae 0x4379be
movsb byte es:[edi], byte [esi]
call fcn.0043e990
add byte [eax], al
pop ss
add byte [ebx - 0x39], al
inc ebp
invalid
mov dword [ebp - 0x10], 0x437946
mov dword [ebp - 0x14], 0x437969
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477558
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477558]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
inc ebp
cld
cmp dword [0x477554], 0
je 0x4379d3
mov eax, dword [0x477554]
jmp 0x437a55
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x437a25
pop esp
xchg ebp, eax
mov al, 0xbc
mov esp, 0x1b2412e9
dec esi
pop esi
dec ebx
jg 0x43799e
mov dl, 0xc5
mov ebx, 0x472a16fa
cmp edi, edx
adc byte [esi], ah
cmp al, 0x52
push 0xc0aa947e
salc
in al, dx
add bl, byte [eax]
add byte cs:[eax], al
add byte [eax], al
push ss
add byte [0xf9f045c7], dl
jns 0x437a6e
mov dword [ebp - 0x10], 0x4379f9
mov dword [ebp - 0x14], 0x437a25
mov eax, dword [ebp - 0x14]
add bh, al
inc ebp
in al, dx
and eax, 0x8b00437a
inc ebp
in al, dx
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477554
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477554]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
int3
Function at 0x437f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x477538], 0
je 0x437f20
mov eax, dword [0x477538]
jmp 0x437f9c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x437f6c
sub esi, dword [ebx]
sbb eax, 0xb5c7bff8
wait
or dword [eax + 0x46], 0xd0f31628
xchg ecx, eax
xor eax, 0xc9e4ff1a
scasb al, byte es:[edi]
xchg ebx, eax
js 0x437fbc
inc edx
daa
or al, 0xf1
salc
mov ebx, 0
adc byte [eax], al
in al, 0xc7
inc ebp
invalid
mov dword [ebp - 0x10], 0x437f46
mov dword [ebp - 0x14], 0x437f6c
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477538
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477538]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
lds ecx, [ecx + 0x3d83fc45]
xor al, 0x75
inc edi
add byte [eax], al
je 0x437fd0
mov eax, dword [0x477534]
jmp 0x43804a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x10], 0
lock add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x43801a
les ebp, [ecx - 0x4b]
push ecx
leave
push edi
les edi, [edi]
mov eax, 0xa4369940
movsb byte es:[edi], byte [esi]
sub eax, 0xa69f1e9a
and dword [edi + edx + 0x3880d92], ebx
jle 0x43800a
pop ss
xchg edx, eax
or eax, 0xf97e0388
je 0x438002
add byte [eax], al
add byte [eax], al
adc dword [eax], eax
jp 0x437fe2
mov dword [ebp - 0x10], 0x437ff6
mov dword [ebp - 0x14], 0x43801a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x477534
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x477534]
inc ebp
invalid
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
Function at 0x438ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4774d4], 0
je 0x439010
mov eax, dword [0x4774d4]
jmp 0x43907e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x43904e
cmp dword [esi], esi
paddb mm1, mm7
xchg edx, eax
xchg edi, eax
jl 0x439096
aam 0xb6
cwde
jp 0x4390a0
and byte ds:[edx], al
add byte [eax], al
add byte [eax], al
or dword [eax], eax
loope 0x439016
mov dword [ebp - 0x10], 0x439036
mov dword [ebp - 0x14], 0x43904e
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x4774d4
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x4774d4]
inc ebp
invalid
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4774d0], 0
je 0x4390b0
mov eax, dword [0x4774d0]
jmp 0x43911f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x4390ef
out dx, eax
lahf
cmp al, bl
push edi
pop ss
mov bh, 0x4d
test dword [edx], esp
mov edi, 0x3396f95c
shr byte [ebp + 0xa], 1
add byte [eax], al
add byte [eax], al
or byte [eax], al
pushfd
mov dword [ebp - 0x10], 0x4390d6
mov dword [ebp - 0x14], 0x4390ef
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x4774d0
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x4774d0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret

Function at 0x439750
Capabilities:
Check for time delay via gettickcount

Disassembly:
in eax, 0x5d
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x474860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4774a8], 0
je 0x439770
mov eax, dword [0x4774a8]
jmp 0x4397e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jno 0x4397b1
jb 0x439740
invalid
mov dword [ebp - 0x10], 0x439796
mov dword [ebp - 0x14], 0x4397b1
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, 0x4774a8
mov ecx, dword [ebp - 0x10]
call fcn.00430170
add esp, 4
mov eax, dword [0x4774a8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447bb9
mov esp, ebp
pop ebp
ret