joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d434
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405488
push esp
push esi
mov eax, dword [0x52bf8c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x48d47b
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x48d47b
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040d270
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x48db24
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41c030]
call fcn.00405f80
xor eax, eax
push ebp
push 0x48dc68
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x526194], 0
jne 0x48db77
mov ecx, dword [0x52ba04]
mov dl, 1
mov eax, dword [0x40b4b4]
call fcn.00410330
call fcn.00404e18
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ba0
mov eax, ebx
call fcn.00405d54
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48dc78
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00407244
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405d64
test eax, eax
jle 0x48dc0f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48dc08
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405720
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405708
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040c398
test eax, eax
jne 0x48dc08
mov ebx, 0x15
jmp 0x48dc14
mov ebx, 0x10
jmp 0x48dc14
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x526194]
call fcn.0048da7c
mov eax, dword [ebp - 8]
call fcn.0048da7c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040725c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dc6f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004054ac
lea eax, [ebp - 0x10]
mov edx, dword [0x41c030]
call fcn.00406050
ret
Function at 0x4920b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x492230
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403ba0
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x526844], eax
mov eax, dword [ebp - 0xc]
mov dword [0x526848], eax
mov eax, dword [ebp - 0x24]
mov dword [0x52684c], eax
mov eax, dword [0x52c2b0]
cmp dword [eax], 2
sete byte [0x526424]
push 0x49223c
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0049250c
cmp byte [0x526424], 0
jne 0x49213c
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0049253c
test al, al
je 0x49213c
mov eax, dword [ebp - 0x4c]
mov dword [0x550898], eax
jmp 0x492143
xor eax, eax
mov dword [0x550898], eax
call fcn.00491f48
and eax, 0x7f
cmp eax, 0xc
ja case.0x492154.0
jmp dword [eax*4 + 0x49215b]
mov byte [0x526410], 1
jmp case.0x492154.0
mov byte [0x526414], 1
jmp case.0x492154.0
mov byte [0x526418], 1
jmp case.0x492154.0
mov byte [0x52641c], 1
jmp case.0x492154.0
mov byte [0x526420], 1
jmp case.0x492154.0
mov byte [0x526428], 1
mov byte [0x52642c], 1
jmp case.0x492154.0
mov byte [0x526428], 1
mov byte [0x526430], 1
jmp case.0x492154.0
mov byte [0x526428], 1
mov byte [0x526430], 1
mov byte [0x526434], 1
jmp case.0x492154.0
mov byte [0x526438], 1
jmp case.0x492154.0
mov byte [0x52643c], 1
jmp case.0x492154.0
mov byte [0x526440], 1
jmp case.0x492154.0
mov byte [0x526444], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492237
lea eax, [ebp - 4]
call fcn.00405488
ret

Function at 0x49253c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4925e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405958
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4925cd
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405ae4
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405958
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4925cd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4925f4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4925cd
cmp dword [ebp - 8], 0x34
jne 0x4925cd
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4925ea
lea eax, [ebp - 0x10]
call fcn.00405488
ret
Function at 0x4b54cc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b564e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b58c0
mov eax, ebx
call fcn.0042af10
dec al
je 0x4b5510
dec al
je 0x4b5516
jmp 0x4b551c
mov byte [ebp - 0x77], 2
jmp 0x4b5520
mov byte [ebp - 0x77], 1
jmp 0x4b5520
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042ae9c
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4b556d
cmp edi, 0x20000000
jne 0x4b5579
mov dword [ebp - 0x88], 0x40000000
jmp 0x4b5583
mov eax, edi
call fcn.0042a734
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.0042aed8
test al, 1
je 0x4b5595
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042aed8
test al, 2
je 0x4b55a7
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042aed8
test al, 4
je 0x4b55b9
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042aed8
test al, 8
je 0x4b55cb
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.0042ae28
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040d12c
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.0042af40
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042ac2c
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x4b5628
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b58ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5655
lea eax, [ebp - 0x94]
call fcn.00405488
ret
Function at 0x4b65f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0x52a27c
xor eax, eax
push ebp
push 0x4b677a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x551180], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b675d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b6788
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4b664f
cmp dword [ebx], 0x20
jae 0x4b664f
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4b667b
push 0x4b6798
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4b6746
cmp dword [ebx], 0x20
jae 0x4b6746
xor eax, eax
mov dword [ebx], eax
jmp 0x4b6746
mov byte [0x551180], 2
lea eax, [ebp - 8]
mov edx, 0x4b67b0
call fcn.00405520
lea eax, [ebp - 8]
call fcn.004059a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405958
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4b6746
mov eax, ebx
call fcn.00402e98
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b673f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405958
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4b6729
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4b67c0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4b6729
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov byte [0x551180], al
cmp byte [0x551180], 0
jne 0x4b6729
mov byte [0x551180], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6746
mov eax, dword [ebp - 0x10]
call fcn.00402ec8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6764
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4cc668
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4cc670
push ebx
push esi
push edi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4cc852
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
call fcn.00403440
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0x41
jb 0x4cc822
cmp byte [ebp - 1], 0x5a
ja 0x4cc822
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403a00
mov edx, 0x4cc860
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.004039d0
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004056fc
mov eax, dword [ebp - 0xc]
call fcn.00405958
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4cc822
lea eax, [ebp - 0x1c]
call fcn.004f4b08
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov edx, 0x4cc86c
call fcn.0040cdd8
mov eax, dword [ebp - 8]
call fcn.0040cc08
test al, al
jne 0x4cc6f2
push 0x4cc87c
push 0x4cc884
mov ecx, dword [0x52d668]
mov dl, 1
mov eax, dword [0x41d3ec]
call fcn.00421a60
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cc764
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0042185c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc76b
mov eax, dword [ebp - 0x10]
call fcn.00404638
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc859
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004054ac
lea eax, [ebp - 0x1c]
call fcn.00405488
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004054ac
ret
Function at 0x4cc8a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x14]
xor eax, eax
push ebp
push 0x4cca64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edx
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jg 0x4cca41
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 6
lea edx, [ebp - 0x18]
mov eax, dword [0x52c0f4]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0040d788
cmp ebx, 0x20
ja case.0x4cc91f.0
mov bl, byte [ebx + 0x4cc926]
jmp dword [ebx*4 + 0x4cc947]
lea eax, [ebp - 0x10]
mov edx, dword [0x52c19c]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52c258]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52bb40]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52bfa0]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52c29c]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52bc60]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52c228]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
mov edx, dword [0x52c084]
mov edx, dword [edx]
call fcn.00405520
jmp 0x4cca06
lea eax, [ebp - 0x10]
call fcn.00405488
cmp dword [ebp - 0x10], 0
je 0x4cca24
push dword [ebp - 0xc]
push 0x4cca7c
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405818
push 0x4cca88
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00491a64
mov ecx, dword [ebp - 0x1c]
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.004cca90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cca6b
lea eax, [ebp - 0x1c]
call fcn.00405488
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054ac
ret
Function at 0x4ced90
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x242], 0
jne 0x4cede5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 1
je 0x4cede5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 2
jne 0x4cedd5
mov eax, dword [ebp - 4]
call fcn.004ce698
test al, al
jne 0x4cede5
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0x64
jge 0x4cef57
mov eax, dword [ebp - 4]
call fcn.00452af4
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x4cef50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00452af4
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cef3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4cef14
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044bd1c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0044bcd8
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ceef6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00450af8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x241], 0
je 0x4cee9a
mov eax, dword [ebp - 4]
call fcn.004cebb4
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044bd1c
push eax
mov eax, dword [ebp - 4]
call fcn.0044bcd8
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x20c]
mov esi, dword [eax*4 + 0x52a608]
push esi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ceefd
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf338
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
call fcn.004cf304
cmp dword [0x551650], 0
jne 0x4cf354
cmp dword [0x55164c], 0
je 0x4cf364
fld qword [ebp + 8]
fcomp dword [0x4cf404]
fnstsw ax
sahf
jbe 0x4cf38e
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4cf372
call fcn.004cf304
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x4cf36d
jmp 0x4cf3fa
fld qword [ebp + 8]
fcomp dword [0x4cf408]
fnstsw ax
sahf
jbe 0x4cf3fa
fld qword [ebp + 8]
fdiv dword [0x4cf40c]
fstp qword [ebp + 8]
wait
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
jmp 0x4cf3ef
call fcn.004cf304
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fild qword [0x55164c]
fdivp st(1)
fstp xword [ebp - 0x10]
wait
fld xword [ebp - 0x10]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x4cf3c0
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4cf524
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x52a61c
mov esi, eax
cmp ecx, 1
jb 0x4cf62d
test edx, edx
jne 0x4cf541
xor esi, esi
jmp 0x4cf62d
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4cf609
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x4cf54d
test ecx, ecx
je 0x4cf628
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x4cf60d
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4d988c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d9a5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [esi + 0x58]
mov eax, ebx
call fcn.00405488
mov byte [ebx + 4], 0
mov dword [ebx + 8], 1
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x18]
call fcn.00405488
lea eax, [ebx + 0x1c]
call fcn.00405488
cmp dword [esi + 0x34], 0
je 0x4d9a32
mov eax, ebx
mov edx, dword [esi + 0x40]
call fcn.004054dc
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov byte [ebx + 4], al
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 8]
push eax
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 8]
cmp dword [ebx + 0x10], 0
jle 0x4d9975
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
cdq
idiv dword [ebx + 0x10]
mov edi, eax
mov dword [ebx + 0x14], edi
test edi, edi
jle 0x4d9975
push 0
push 0x80
push 3
push 0
push 1
push 0
mov eax, dword [esi + 0x40]
call fcn.00405958
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
je 0x4d9975
push 0
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4d9975
mov eax, ecx
shl eax, 3
cdq
idiv dword [ebx + 0x14]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
dec eax
test eax, eax
jl 0x4d9a32
inc eax
mov dword [ebp - 0xc], eax
xor edi, edi
push edi
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00405690
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040c1e0
mov eax, dword [ebp - 8]
mov edx, 0x4d9a74
call fcn.004058a4
jne 0x4d99d4
lea ecx, [ebp - 0x14]
mov edx, edi
mov eax, esi
call fcn.004d9a9c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x18]
call fcn.00405720
jmp 0x4d9a28
mov eax, dword [ebp - 8]
mov edx, 0x4d9a84
call fcn.004058a4
jne 0x4d99fc
lea ecx, [ebp - 0x18]
mov edx, edi
mov eax, esi
call fcn.004d9a9c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x1c]
call fcn.00405720
jmp 0x4d9a28
mov eax, dword [ebp - 8]
mov edx, 0x4d9a94
call fcn.004058a4
jne 0x4d9a28
cmp dword [ebx + 0x1c], 0
jne 0x4d9a28
lea ecx, [ebp - 0x1c]
mov edx, edi
mov eax, esi
call fcn.004d9a9c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x1c]
call fcn.00405720
inc edi
dec dword [ebp - 0xc]
jne 0x4d998d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9a64
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405bf8
lea eax, [ebp - 0x10]
call fcn.00405488
lea eax, [ebp - 8]
call fcn.00405488
ret
Function at 0x4e8c18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4e8c3f
mov ecx, edi
mov dl, 1
mov eax, dword [0x4e79f4]
call fcn.004e7a58
mov dword [edi + 0x294], eax
jmp 0x4e8d48
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4e8c80
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4e8c75
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004e81c8
jmp 0x4e8cb6
xor edx, edx
mov eax, edi
call fcn.004e81c8
jmp 0x4e8cb6
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4e8cad
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004e81c8
jmp 0x4e8cb6
mov dl, 0x64
mov eax, edi
call fcn.004e81c8
cmp byte [edi + 0x22b], 0
je 0x4e8cc8
cmp byte [edi + 0x22a], 0
je 0x4e8cda
cmp byte [edi + 0x22b], 0
jne 0x4e8ce5
cmp byte [edi + 0x22a], 0x64
jne 0x4e8ce5
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4e8d15
mov eax, dword [0x52bf8c]
mov eax, dword [eax]
call fcn.0046c1c8
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4e8d15
cmp byte [edi + 0x224], 0
jne 0x4e8d15
cmp byte [edi + 0x2a0], 0
je 0x4e8ce5
test bl, bl
jne 0x4e8d2f
cmp byte [edi + 0x224], 0
jne 0x4e8d2f
cmp byte [edi + 0x2a0], 0
je 0x4e8c41
cmp byte [edi + 0x2a0], 0
jne 0x4e8d41
cmp byte [edi + 0x224], 0
jne 0x4e8d48
mov eax, edi
call fcn.004e903c
pop edi
pop esi
pop ebx
ret