joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e680
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x538bb4]
cmp dword [eax + 0x30], 0
je 0x45e72a
cmp dword [ebx + 0x94], 0
jne 0x45e724
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e610
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e724
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e6ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e724
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ce8c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e6f9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f28c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f2c1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042a0
jmp 0x45f2ce
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404204
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460338
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460379
mov eax, esi
call fcn.004467f4
test al, al
je 0x460379
mov eax, dword [ebx + 0x84]
call fcn.004464f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460379
push 0
mov eax, dword [ebx + 0x84]
call fcn.004464f0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47d6ac
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x47d6d1
cmp dword [esp + 4], 5
jb 0x47d6d1
mov al, 1
jmp 0x47d6d3
xor eax, eax
add esp, 0x94
ret
Function at 0x48e648
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x48e672
cmp dword [ebx + 0x64], 0
jne 0x48e672
cmp dword [ebx + 0x6c], 0
jne 0x48e672
mov esi, edi
jmp 0x48e700
cmp esi, 0xffffffff
jne 0x48e67d
dec esi
jmp 0x48e700
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x48e700
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.0048dcac
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x48e6c8
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x48e6cd
mov word [edx], 0
dec eax
test eax, eax
jne 0x48e6ae
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x48e6f4
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x48e6f9
mov word [edx], 0
dec eax
test eax, eax
jne 0x48e6da
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x48e75e
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.0048e3d0
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48e749
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48e75e
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48e652
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x492eb4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x539d48
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x492ed6
shr eax, 1
xor eax, 0xedb88320
jmp 0x492ed8
shr eax, 1
dec edx
jne 0x492ec4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x492ebd
mov byte [0x53a148], 1
pop esi
pop ebx
ret

Function at 0x492ef4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x53a148], 0
jne 0x492f0b
call fcn.00492eb4
mov eax, edi
dec eax
test eax, eax
jl 0x492f34
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x539d48]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x492f15
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4954a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4954d9
dec al
je 0x495515
dec al
je 0x495559
dec al
je 0x4955c4
jmp 0x49564e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49564e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4954e9
jmp 0x49564e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49564e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x495525
jmp 0x49564e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49564e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x495587
xor ebp, ebp
jmp 0x495598
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4955a1
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x495569
jmp 0x49564e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49564e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49561c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00492f3c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4955d8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x498160
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4983c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4981c3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00497c28
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d2d4
cmp al, 1
jne 0x4981c3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00497f40
test al, al
je 0x49834f
cmp dword [ebp - 8], 0
jge 0x4981e1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00497c28
mov eax, dword [ebp - 0x210]
call fcn.00404470
cmp ebx, eax
jge 0x49822b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00497c28
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x537680]
and eax, 0xff
bt dword [edx], eax
jae 0x49822b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49823f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049813c
cmp ebx, dword [ebp - 8]
je 0x498341
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49826b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040355c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5365f4]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49832e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040355c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5365f4]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040355c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5365f4]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498335
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4983a2
cmp dword [ebp - 8], 0
jge 0x49835a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00497c28
mov eax, dword [ebp - 0x218]
call fcn.00404470
cmp eax, dword [ebp - 8]
jg 0x498394
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00497c28
mov eax, dword [ebp - 0x21c]
call fcn.00404470
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049813c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4983c7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004041d4
ret
Function at 0x49a2e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x49a320]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49a2fe
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49a30d
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49a31c
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x49ac5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x43bae8]
call fcn.004034ec
test al, al
je 0x49ac9e
mov eax, dword [0x537448]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x49ac9e
mov edx, dword [0x537448]
xor edx, edx
call fcn.00458ccc
push 0
mov eax, dword [0x537448]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4c0228
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.004c0f00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004c0148
pop ecx
call fcn.004f6540
test al, al
je 0x4c02d0
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x4c02d0
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.004464f0
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.004464f0
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x4c02b9
mov eax, dword [edi]
call fcn.004464f0
xor edx, edx
call fcn.004f657c
jmp 0x4c02d0
mov eax, dword [edi]
call fcn.004464f0
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.004f657c
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.004464f0
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.0043fc28
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x4c0369
cmp byte [ebx + 0x60], 0
je 0x4c0369
call fcn.004f6540
test al, al
je 0x4c0369
mov eax, dword [0x537448]
mov eax, dword [eax]
call fcn.0045f53c
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 5
jbe 0x4c0359
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x4c034b
mov ebx, eax
mov eax, dword [edi]
call fcn.004464f0
mov edx, ebx
call fcn.004f657c
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x4c0323
mov eax, dword [edi]
call fcn.004c1434
mov eax, dword [edi]
call fcn.004464f0
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4deaec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.004f6540
test al, al
je 0x4debf3
mov eax, dword [esi + 4]
mov edx, dword [0x4dcc80]
call fcn.004034ec
test al, al
je 0x4debf3
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x2f9], 0
je 0x4deb5c
cmp byte [esi + 0x540], 0
jne 0x4deb5c
push 0xffffffffffffffec
mov eax, esi
call fcn.004464f0
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.004464f0
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4deb92
cmp byte [ebx + 0x2f9], 0
jne 0x4deb92
cmp byte [esi + 0x540], 0
je 0x4deb92
push 0xffffffffffffffec
mov eax, esi
call fcn.004464f0
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.004464f0
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x2f9]
mov byte [esi + 0x540], al
mov al, byte [esi + 0x541]
cmp al, byte [ebx + 0x2fb]
je 0x4debf3
cmp byte [ebx + 0x2f9], 0
je 0x4debf3
cmp byte [ebx + 0x2fa], 0
je 0x4debd5
mov eax, esi
call fcn.004464f0
xor edx, edx
call fcn.004f657c
mov byte [esi + 0x541], 0
jmp 0x4debf3
mov eax, esi
call fcn.004464f0
mov dl, byte [ebx + 0x2fb]
call fcn.004f657c
mov al, byte [ebx + 0x2fb]
mov byte [esi + 0x541], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.004464f0
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0043fc28
call fcn.004f6540
test al, al
je 0x4decb3
test ebx, ebx
je 0x4decb3
cmp byte [ebx + 0x2fa], 0
je 0x4decb3
cmp byte [ebx + 0x2f9], 0
je 0x4decb3
mov eax, dword [0x537448]
mov eax, dword [eax]
call fcn.0045f53c
xor edi, edi
xor ebp, ebp
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4dec73
cmp eax, 5
jbe 0x4dec9b
jmp 0x4dec75
jle 0x4dec9b
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
add edi, 0xa
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jle 0x4dec8d
mov edi, eax
mov eax, esi
call fcn.004464f0
mov edx, edi
call fcn.004f657c
mov eax, dword [0x537448]
mov eax, dword [eax]
call fcn.0045f53c
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jl 0x4dec52
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e7e5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e7fac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4e7f84
cmp dword [eax + 0x3f8], 0
je 0x4e7f84
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2f0]
cmp eax, 0xc8
jbe 0x4e7f84
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2f0], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0043fd08
mov eax, dword [ebp - 0xc]
call fcn.00404470
dec eax
jne 0x4e7f04
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0043fd08
mov eax, dword [ebp - 0x10]
call fcn.00404670
push eax
mov eax, ebx
call fcn.004e8aac
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4e7f37
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0043fd08
mov eax, dword [ebp - 0x14]
call fcn.00404670
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4e7f84
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043fd08
mov edx, esi
mov eax, ebx
call fcn.004e8ab8
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043fd08
mov eax, dword [ebp - 4]
call fcn.00404470
mov edx, eax
mov eax, ebx
call fcn.004e813c
mov eax, dword [ebp - 8]
call fcn.00404470
push eax
mov eax, dword [ebp - 4]
call fcn.00404470
pop edx
sub edx, eax
mov eax, ebx
call fcn.004e8158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7fb3
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004041d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041d4
ret
Function at 0x4e7fbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x4e80d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4e80c3
cmp dword [eax + 0x3f8], 0
je 0x4e80c3
cmp byte [ebx + 0x2f8], 0
je 0x4e8044
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2f0]
cmp eax, 0x1f4
jb 0x4e801d
lea eax, [ebx + 0x2f4]
call fcn.004041b0
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2f0], eax
lea eax, [ebx + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.00404478
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2f4]
call fcn.00404248
mov eax, dword [ebp - 4]
call fcn.00404470
test eax, eax
jle 0x4e80b3
mov eax, dword [ebp - 4]
call fcn.00404470
dec eax
jne 0x4e808a
mov eax, dword [ebp - 4]
call fcn.00404670
push eax
mov eax, ebx
call fcn.004e8aac
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
jmp 0x4e80b6
mov eax, dword [ebp - 4]
call fcn.00404670
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.004464f0
push eax
call sub.user32.dll_SendMessageA
jmp 0x4e80b6
or eax, 0xffffffff
test eax, eax
jl 0x4e80c3
mov edx, eax
mov eax, ebx
call fcn.004e8ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e80e0
lea eax, [ebp - 4]
call fcn.004041b0
ret
Function at 0x502bf4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x502c09
add esp, 0xfffffff0
call fcn.00403684
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x502ce4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004fddd0
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041ba30
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041ba30
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041ba30
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041ba30
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041ba58
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502ceb
lea eax, [ebp - 4]
call fcn.004041b0
ret