joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bf7ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5bf901
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
xor edx, edx
push ebp
push 0x5bf8b6
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2c]
mov edx, dword [setsockopt]
cmp eax, dword [edx + 0x1a04]
jbe 0x5bf81b
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push ebp
call fcn.005bf6f4
pop ecx
mov eax, dword [0x6c10e4]
mov eax, dword [eax]
call fcn.0050bb84
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x30]
cmp eax, 0x2710
jbe 0x5bf84e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
call fcn.005bcd80
mov edx, eax
mov eax, dword [0x6c0d50]
mov eax, dword [eax]
call fcn.005af810
cmp byte [0x6b7254], 0
jne 0x5bf8ac
mov byte [0x6b7254], 1
xor edx, edx
push ebp
push 0x5bf88e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6c13c4]
cmp dword [eax], 0
je 0x5bf884
mov eax, dword [0x6c13c4]
mov eax, dword [eax]
mov dl, 1
call fcn.004e2440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bf8ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bf8eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bf908
lea eax, [ebp - 8]
call fcn.00405394
ret
Function at 0x5c2820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405814
xor eax, eax
push ebp
push 0x5c29de
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5c29c0
inc edi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x10]
call fcn.0041fbfc
mov ebx, eax
test ebx, ebx
je 0x5c29b6
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055f8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00409e48
test eax, eax
jne 0x5c29b6
test esi, esi
je 0x5c29b6
movzx eax, byte [ebx + 0xf]
mov byte [esi + 0x22a], al
movzx eax, byte [ebx + 0x10]
mov byte [esi + 0x22b], al
movzx eax, word [ebx + 0x11]
mov word [esi + 0x228], ax
movzx eax, word [ebx + 0x13]
mov word [esi + 0x34], ax
movzx eax, byte [ebx + 0x15]
mov byte [esi + 0x264], al
movzx eax, byte [ebx + 0x17]
mov byte [esi + 0x263], al
movzx eax, byte [ebx + 0x18]
mov byte [esi + 0x265], al
mov eax, dword [ebx + 0x1a]
mov dword [esi + 0x104], eax
movzx eax, word [ebx + 0x20]
mov word [esi + 0x4a], ax
movzx eax, word [ebx + 0x20]
mov word [esi + 0x4e], ax
mov word [esi + 0x4c], 0
movzx eax, word [ebx + 0x1e]
mov word [esi + 0x50], ax
movzx eax, word [ebx + 0x22]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x36], edx
movzx eax, word [ebx + 0x24]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x3a], edx
movzx eax, word [ebx + 0x26]
movzx edx, word [ebx + 0x28]
shl edx, 0x10
or eax, edx
mov dword [esi + 0x3e], eax
movzx eax, word [ebx + 0x2a]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x42], edx
movzx eax, word [ebx + 0x2c]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x46], edx
movzx eax, byte [ebx + 0x2e]
mov byte [esi + 0x260], al
movzx eax, byte [ebx + 0x30]
mov byte [esi + 0x22c], al
mov eax, dword [ebx + 0x32]
mov dword [esi + 0xb48], eax
movzx eax, word [ebx + 0x36]
mov dword [esi + 0xb4c], eax
movzx eax, word [ebx + 0x38]
mov dword [esi + 0xb54], eax
movzx eax, word [ebx + 0x3a]
mov dword [esi + 0xb60], eax
mov eax, dword [ebx + 0x41]
mov dword [esi + 0xbac], eax
movzx eax, byte [ebx + 0x3c]
test al, al
jbe 0x5c29ae
mov byte [esi + 0x292], al
mov eax, dword [ebx + 0x3d]
mov dword [ebp - 0xc], eax
jmp 0x5c29c0
inc dword [ebp - 0x10]
dec edi
jne 0x5c286b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c29e5
lea eax, [ebp - 0x14]
call fcn.00405394
lea eax, [ebp - 4]
call fcn.00405394
ret
Function at 0x5c2cec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
mov eax, dword [ebp + 0x1ea4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c2dd7
mov eax, dword [ebp + 0x1ea4]
cmp dword [eax + 8], 0
jle 0x5c2dd7
mov edx, edi
call fcn.0041fbfc
mov ebx, eax
test ebx, ebx
je 0x5c2dcd
cmp dword [ebx], 0
je 0x5c2dcd
mov eax, dword [ebx]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c2d71
mov edx, esi
mov eax, dword [ebx]
call fcn.0041fbfc
test eax, eax
je 0x5c2d6b
cmp byte [eax + 0x2ec], 0
jne 0x5c2d62
cmp byte [eax + 0x2e4], 0
jne 0x5c2d62
cmp byte [eax + 0x2b4], 0
jne 0x5c2d6b
mov edx, esi
mov eax, dword [ebx]
call fcn.0041faa0
dec esi
cmp esi, 0xffffffff
jne 0x5c2d3a
mov eax, dword [ebx]
cmp dword [eax + 8], 0
jle 0x5c2d95
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
ja 0x5c2d95
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, 0x2bf20
jbe 0x5c2dcd
mov eax, dword [ebx]
call fcn.00404430
xor esi, esi
cmp dword [ebx + esi*4 + 0xc], 0
je 0x5c2dae
mov eax, dword [ebx + esi*4 + 0xc]
mov edx, dword [eax]
call dword [edx + 4]
inc esi
cmp esi, 8
jl 0x5c2d9e
mov edx, 0x2c
mov eax, ebx
call fcn.00402fb0
mov eax, dword [ebp + 0x1ea4]
mov edx, edi
call fcn.0041faa0
dec edi
cmp edi, 0xffffffff
jne 0x5c2d05
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d7148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x5d7394
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5d71c0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x5d71c0
push 1
push 0x5d73ac
push dword [ebp - 4]
push 0x5d73c0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0x14]
mov cl, 1
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
mov eax, dword [esi + 0x10d4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x5d71e4
push 1
xor ecx, ecx
mov edx, 0x5d7408
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
cmp byte [esi + 0x10d8], 0
jne 0x5d7202
push 1
xor ecx, ecx
mov edx, 0x5d7428
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
mov eax, dword [esi + 0x2e0]
cmp byte [eax + 0x4e], 0
je 0x5d7223
push 1
xor ecx, ecx
mov edx, 0x5d7448
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x10d0]
cmp eax, 0x2710
jae 0x5d724a
push 1
xor ecx, ecx
mov edx, 0x5d7464
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x10d0], eax
mov byte [ebp - 0xd], 0
mov eax, dword [esi + 0x10d4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jl 0x5d7356
inc edi
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x10d4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
test ebx, ebx
je 0x5d734c
mov byte [ebp - 0xd], 1
cmp byte [ebx + 0x2e4], 0
jne 0x5d72ae
cmp byte [ebx + 0x2ec], 0
jne 0x5d72ae
cmp byte [ebx + 0xbbe], 0
jne 0x5d72eb
push 1
push 0x5d7480
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi + 0x10d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1c]
push 0x5d748c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, esi
call fcn.0060cf8c
jmp 0x5d736c
cmp byte [ebx + 0x10c9], 0
je 0x5d72ff
mov edx, ebx
mov eax, esi
call fcn.006050dc
jmp 0x5d734c
push 1
mov edx, 0x5d74a4
lea eax, [ebp - 0x34]
call fcn.004039c4
lea edx, [ebx + 0x15]
lea eax, [ebp - 0x34]
mov cl, 0x10
call fcn.00403994
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x58]
call fcn.004039c4
mov edx, 0x5d74a8
lea eax, [ebp - 0x58]
mov cl, 0x22
call fcn.00403994
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x20]
call fcn.004055f8
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, esi
call fcn.0060cf8c
inc dword [ebp - 0xc]
dec edi
jne 0x5d7277
cmp byte [ebp - 0xd], 0
jne 0x5d736c
push 1
xor ecx, ecx
mov edx, 0x5d74c4
mov eax, esi
call fcn.0060cf8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d739b
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004053b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b8
ret
Function at 0x5d78b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x5d7a7e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5d7921
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x5d7921
push 1
push 0x5d7a94
push dword [ebp - 4]
push 0x5d7aa8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0xc]
mov cl, 1
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
cmp byte [ebx + 0x10b4], 0
jne 0x5d793f
push 1
xor ecx, ecx
mov edx, 0x5d7ae8
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x4d], 0
je 0x5d7960
push 1
xor ecx, ecx
mov edx, 0x5d7b00
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
cmp dword [ebx + 0x10c4], 0
jne 0x5d7999
cmp byte [ebx + 0x2d], 0
jne 0x5d7984
push 1
xor ecx, ecx
mov edx, 0x5d7b1c
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
push 1
xor ecx, ecx
mov edx, 0x5d7b34
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
mov eax, dword [ebx + 0x10c4]
cmp byte [eax + 0x2e4], 0
jne 0x5d79ba
cmp byte [eax + 0x2ec], 0
jne 0x5d79ba
cmp byte [eax + 0xbbe], 0
jne 0x5d79e7
cmp byte [ebx + 0x2d], 0
jne 0x5d79d5
push 1
xor ecx, ecx
mov edx, 0x5d7b4c
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
push 1
xor ecx, ecx
mov edx, 0x5d7b70
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x10cc]
cmp eax, 0x2710
jae 0x5d7a0b
push 1
xor ecx, ecx
mov edx, 0x5d7b94
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d7a63
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x10cc], eax
mov esi, dword [ebx + 0x10c4]
cmp byte [esi + 0x10c8], 0
je 0x5d7a30
mov edx, esi
mov eax, ebx
call fcn.006050dc
jmp 0x5d7a63
push 1
lea edx, [esi + 0x15]
lea eax, [ebp - 0x30]
call fcn.004039c4
mov edx, 0x5d7ba8
lea eax, [ebp - 0x30]
mov cl, 0x1e
call fcn.00403994
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
call fcn.004055f8
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d7a85
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004053b8
ret
Function at 0x5d8440
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5d8681
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x238], 0
je 0x5d864e
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x4b], 0
jne 0x5d863c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x234]
mov ecx, 0x3e8
xor edx, edx
div ecx
imul edx, eax, 0x3e8
add dword [ebx + 0x234], edx
movzx edx, word [ebx + 0xec]
cmp eax, edx
jae 0x5d84b1
sub word [ebx + 0xec], ax
jmp 0x5d84ba
mov word [ebx + 0xec], 0
movzx esi, word [ebx + 0xec]
test si, si
jne 0x5d860f
cmp ebx, dword [ebx + 0x268]
jne 0x5d85fd
mov eax, dword [ebx + 0x26c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jle 0x5d85dd
mov dword [ebp - 4], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x26c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
cmp byte [esi + 0xf0], 0
je 0x5d85a8
cmp byte [esi + 0x2e4], 0
jne 0x5d852b
cmp byte [esi + 0x2ec], 0
jne 0x5d852b
cmp byte [esi + 0xbbe], 0
jne 0x5d8558
push 1
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5d8698
call fcn.0040bb24
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d85d3
mov eax, dword [esi + 0x2e0]
cmp byte [eax + 0x4b], 0
je 0x5d8591
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5d86bc
call fcn.0040bb24
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d85d3
lea eax, [ebp - 0x18]
lea edx, [esi + 0x15]
call fcn.004055f8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00605034
jmp 0x5d85d3
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x15]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 4
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5d86e4
call fcn.0040bb24
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
inc dword [ebp - 4]
dec edi
jne 0x5d84f3
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x234], eax
mov eax, dword [setsockopt]
movzx eax, word [eax + 0x5f10]
mov word [ebx + 0xec], ax
jmp 0x5d865e
push 1
xor ecx, ecx
mov edx, 0x5d8704
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d865e
push 1
lea eax, [ebp - 0x20]
push eax
movzx eax, si
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5d8724
call fcn.0040bb24
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d865e
push 1
xor ecx, ecx
mov edx, 0x5d874c
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d865e
push 1
xor ecx, ecx
mov edx, 0x5d876c
mov eax, ebx
call fcn.0060cf8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8688
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004053b8
lea eax, [ebp - 8]
call fcn.00405394
ret
Function at 0x5d8864
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x5d8a06
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x333], 0
jne 0x5d88b5
cmp byte [ebx + 0x261], 6
jb 0x5d89db
cmp dword [ebp - 8], 0
jne 0x5d88e8
push 1
push 0x5d8a1c
push dword [ebp - 4]
push 0x5d8a30
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405728
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d89eb
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x39c]
cmp eax, 0x2710
ja 0x5d8907
cmp byte [ebx + 0x261], 3
jb 0x5d899b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x39c], eax
mov eax, dword [0x6c0ec4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.005c130c
mov esi, eax
test esi, esi
je 0x5d897b
push 1
push dword [ebp - 8]
push 0x5d8a44
mov eax, dword [esi + 0x2e0]
push dword [eax + 8]
push 0x5d8a58
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x24]
call fcn.0040a790
push dword [ebp - 0x14]
push 0x5d8a64
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x28]
call fcn.0040a790
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00405728
mov edx, dword [ebp - 0x10]
mov cl, 2
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d89eb
push 1
lea eax, [ebp - 0x1c]
mov ecx, 0x5d8a70
mov edx, dword [ebp - 8]
call fcn.004056ac
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d89eb
push 1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x39c]
mov ecx, 0x3e8
xor edx, edx
div ecx
sub eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040a960
lea eax, [ebp - 0x20]
mov edx, 0x5d8a9c
call fcn.00405660
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, ebx
call fcn.0060cf8c
jmp 0x5d89eb
push 1
xor ecx, ecx
mov edx, 0x5d8ac0
mov eax, ebx
call fcn.0060cf8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8a0d
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004053b8
ret
Function at 0x5e37a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
lea eax, [ebp - 0x20]
mov edx, dword [0x4e40b4]
call fcn.0040603c
xor eax, eax
push ebp
push 0x5e38fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xcb8], 0
jne 0x5e37eb
cmp byte [ebx + 0xcba], 0
jne 0x5e37eb
cmp byte [ebx + 0xcb9], 0
je 0x5e3815
cmp byte [ebx + 0xcba], 0
je 0x5e3809
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dx, 0x13d6
mov eax, ebx
call fcn.005e44bc
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
jmp 0x5e38da
xor eax, eax
push ebp
push 0x5e38bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x1081], 0
jne 0x5e3847
mov eax, ebx
call fcn.005e8bbc
mov byte [ebx + 0x1081], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1084], eax
jmp 0x5e38b1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x1084]
cmp eax, 0x9c40
jbe 0x5e38a3
mov byte [ebx + 0xcb8], 1
jmp 0x5e38a3
movzx esi, word [ebp - 0x20]
cmp si, 0x7f
jne 0x5e388d
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.0061969c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005e88a8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1084], eax
jmp 0x5e38a3
cmp si, 0x27
jne 0x5e38a3
mov byte [ebx + 0x1088], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x15b0], eax
lea edx, [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test al, al
jne 0x5e3862
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e38da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e3905
lea eax, [ebp - 0x24]
call fcn.00405394
lea eax, [ebp - 0x20]
mov edx, dword [0x4e40b4]
call fcn.0040610c
ret
Function at 0x61cea4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61cfdd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61cf44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a98]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x61cf3a
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a98]
mov edx, edi
call fcn.0041fbfc
mov ebx, eax
test ebx, ebx
je 0x61cf36
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x8e]
imul edx, dword [ebx + 0x8a], 0x3c
imul edx, edx, 0x3e8
cmp eax, edx
jbe 0x61cf36
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x8e], eax
mov eax, dword [ebx + 0x82]
mov dword [ebx + 0x86], eax
inc edi
dec esi
jne 0x61ceed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61cfc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cfe4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004053b8
ret
Function at 0x635174
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x635263
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x63527c
push dword [ebp + 8]
push 0x63528c
lea eax, [ebp - 8]
lea edx, [ebx + 0x15]
call fcn.004055f8
push dword [ebp - 8]
push 0x6352a0
lea eax, [ebp - 0xc]
lea edx, [ebx + 4]
call fcn.004055f8
push dword [ebp - 0xc]
push 0x6352b0
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x24]
call fcn.0040a790
push dword [ebp - 0x10]
push 0x6352c0
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x28]
call fcn.0040a790
push dword [ebp - 0x14]
push 0x6352cc
push dword [esi + 0xc]
push 0x6352dc
push dword [esi + 0x18]
push 0x6352ec
push dword [esi + 0x24]
push 0x6352fc
push dword [esi + 0x30]
push 0x63530c
push dword [esi + 0x3c]
lea eax, [ebp - 4]
mov edx, 0x14
call fcn.00405728
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x63531c
call fcn.004056ac
mov eax, dword [ebp - 0x18]
call fcn.00641540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63526a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004053b8
lea eax, [ebp + 8]
call fcn.00405394
ret
Function at 0x671810
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x1f8], edx
mov dword [ebp - 0x1fc], edx
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x671a7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x671a52
call fcn.0040d5e0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x12]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xe]
call fcn.0040d598
call fcn.0040d60c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1a]
push eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x14]
call fcn.0040d2b8
mov eax, dword [setsockopt]
mov eax, dword [eax + 0x15c]
call fcn.0040adc4
test al, al
jne 0x6718d1
mov eax, dword [setsockopt]
mov eax, dword [eax + 0x15c]
call fcn.0040afe0
mov eax, dword [setsockopt]
push dword [eax + 0x15c]
lea edx, [ebp - 0x1ec]
movzx eax, word [ebp - 0xe]
call fcn.0040a790
push dword [ebp - 0x1ec]
push 0x671a94
lea edx, [ebp - 0x1f0]
movzx eax, word [ebp - 0x10]
call fcn.004e39b0
push dword [ebp - 0x1f0]
push 0x671a94
lea edx, [ebp - 0x1f4]
movzx eax, word [ebp - 0x12]
call fcn.004e39b0
push dword [ebp - 0x1f4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405728
mov eax, dword [ebp - 4]
call fcn.0040adc4
test al, al
jne 0x67194e
push 0
mov eax, dword [ebp - 4]
call fcn.00405824
push eax
call sub.kernel32.dll_CreateDirectoryA
push dword [ebp - 4]
push 0x671aa0
lea edx, [ebp - 0x1f8]
xor eax, eax
call fcn.0040a790
push dword [ebp - 0x1f8]
push 0x671a94
lea edx, [ebp - 0x1fc]
movzx eax, word [ebp - 0x14]
call fcn.004e39b0
push dword [ebp - 0x1fc]
push 0x671aac
movzx eax, word [ebp - 0x16]
mov ecx, 0xa
xor edx, edx
div ecx
add eax, eax
lea eax, [eax + eax*4]
lea edx, [ebp - 0x200]
call fcn.004e39b0
push dword [ebp - 0x200]
push 0x671ab8
lea eax, [ebp - 8]
mov edx, 8
call fcn.00405728
mov eax, dword [ebp - 8]
call fcn.0040ada0
test al, al
jne 0x6719db
lea eax, [ebp - 0x1e8]
call fcn.00403604
call fcn.004030f0
jmp 0x6719eb
lea eax, [ebp - 0x1e8]
call fcn.00403610
call fcn.004030f0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x671a42
inc ebx
xor esi, esi
lea ecx, [ebp - 0x208]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
mov edx, 0x671ac8
call fcn.004056ac
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x1e8]
call fcn.00405b44
call fcn.00403dd0
call fcn.004030f0
inc esi
dec ebx
jne 0x6719fd
lea eax, [ebp - 0x1e8]
call fcn.0040393c
call fcn.004030f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x671a84
lea eax, [ebp - 0x208]
mov edx, 8
call fcn.004053b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b8
ret