joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590ba7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x68fddc]
jne 0x590bb1
repz ret
jmp fcn.0059a46f

Function at 0x590dce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x590dff
call fcn.00597cc2
mov dword [eax], esi
call fcn.00597caf
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00591db4
add esp, 0x14
push 0x16
pop eax
jmp 0x590e54
test dword [ebp + 0xc], 0xfffffff9
jne 0x590ddb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x590e2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00597cd5
pop ecx
call fcn.00597caf
mov eax, dword [eax]
jmp 0x590e54
test al, 0x10
jne 0x590e52
test al, 1
je 0x590e52
test byte [ebp + 0xc], 2
je 0x590e52
call fcn.00597cc2
mov dword [eax], 5
call fcn.00597caf
mov dword [eax], 0xd
jmp 0x590e23
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a53a4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0059a5e7
and dword [ebp - 4], 0
cmp dword [0x73bbd8], 0
mov ebx, eax
jne 0x5a5455
push 0x6575d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a5506
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6575cc
push edi
call esi
test eax, eax
je 0x5a5506
push eax
call fcn.0059a575
mov dword [esp], 0x6575bc
push edi
mov dword [0x73bbd8], eax
call esi
push eax
call fcn.0059a575
mov dword [esp], 0x6575a8
push edi
mov dword [0x73bbdc], eax
call esi
push eax
call fcn.0059a575
mov dword [esp], 0x65758c
push edi
mov dword [0x73bbe0], eax
call esi
push eax
call fcn.0059a575
pop ecx
mov dword [0x73bbe8], eax
test eax, eax
je 0x5a5455
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0059a575
pop ecx
mov dword [0x73bbe4], eax
mov eax, dword [0x73bbe4]
cmp eax, ebx
je 0x5a54ad
cmp dword [0x73bbe8], ebx
je 0x5a54ad
push eax
call fcn.0059a5f0
push dword [0x73bbe8]
mov esi, eax
call fcn.0059a5f0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a54ad
test edi, edi
je 0x5a54ad
call esi
test eax, eax
je 0x5a54a4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a54a4
test byte [ebp - 0xc], 1
jne 0x5a54ad
or dword [ebp + 0x10], 0x200000
jmp 0x5a54e6
mov eax, dword [0x73bbdc]
cmp eax, ebx
je 0x5a54e6
push eax
call fcn.0059a5f0
pop ecx
test eax, eax
je 0x5a54e6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a54e6
mov eax, dword [0x73bbe0]
cmp eax, ebx
je 0x5a54e6
push eax
call fcn.0059a5f0
pop ecx
test eax, eax
je 0x5a54e6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x73bbd8]
call fcn.0059a5f0
pop ecx
test eax, eax
je 0x5a5506
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a5508
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5af340
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5af3bb
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005ae122
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5af377
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5af38e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005ae122
add esp, 4
test eax, eax
jbe 0x5af3bb
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005ae122
add esp, 4
cmp esi, eax
jb 0x5af3a0
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x45bad0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
jne 0x45bb5a
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x45bb09
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x45bb12
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
cmp eax, dword [ebp - 8]
jae 0x45bb5a
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x15]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1f0
call fcn.005b76d0
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1e0
call fcn.005b76d0
push eax
push 0x18902
call fcn.00456eb0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x45bbda
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x45bb84
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x45bb8d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
add eax, 0x1f4
cmp eax, dword [ebp - 0xc]
jae 0x45bbda
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x15]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1f0
call fcn.005b76d0
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1e0
call fcn.005b76d0
push eax
push 0x18902
call fcn.00456eb0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x45bbfb
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x10], edx
jmp 0x45bc04
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
add eax, 0x4b0
cmp eax, dword [ebp - 0x10]
jae 0x45bc36
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
push edx
call fcn.0045aee0
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.004013e0
add esp, 4
mov dword [ebp + 8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45fcf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x5e991c
push str.data
push 0x5e996c
lea eax, [ebp - 0x88]
push eax
call fcn.005cc4f5
add esp, 0x10
push 0x5e9974
lea ecx, [ebp - 0x88]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45fd45
xor eax, eax
jmp 0x45fde2
push 0
mov edx, dword [ebp + 8]
imul edx, edx, 0x121
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.005cdc9c
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x121
mov edx, dword [ebp + 8]
imul edx, edx, 0x121
add edx, 0x68c788
push edx
call fcn.005cdb90
add esp, 0x10
cmp eax, 1
jae 0x45fd95
mov eax, dword [ebp - 4]
push eax
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x45fde2
push 0
push 0x4840
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cdc9c
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 4
lea eax, [ebp + 8]
push eax
call fcn.005cdb90
add esp, 0x10
cmp eax, 1
jae 0x45fdd1
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x45fde2
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret

Function at 0x45fdf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [0x690fcc], 0xffffffff
push str.chathis.dat
push str.data
push 0x5e9984
lea eax, [ebp - 0x88]
push eax
call fcn.005cc4f5
add esp, 0x10
push 0x5e998c
lea ecx, [ebp - 0x88]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45fe97
push 0x5e9990
lea edx, [ebp - 0x88]
push edx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45fe89
mov eax, dword [ebp - 4]
push eax
push 1
push 0x4844
push 0x68c788
call fcn.005cdb90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
mov dword [0x690fcc], 0x3f
xor eax, eax
jmp 0x45fed5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4844
push 0x68c788
call fcn.005cdfc1
add esp, 0x10
cmp eax, 1
jae 0x45fec4
mov eax, dword [ebp - 4]
push eax
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x45fed5
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x462cc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x68c610], 0
je 0x462d4c
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x462cf0
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x462cf9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
sub edx, dword [0x6b988c]
cmp edx, 0xa
jbe 0x462d3f
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x462d28
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x462d31
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [0x6b988c], edx
call fcn.00462bc0
push 0x68c4a8
call fcn.00478120
add esp, 4
cmp dword [0x68c780], 0
je 0x462dd2
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x462d76
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x462d7f
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
sub edx, dword [0x6b9890]
cmp edx, 0xa
jbe 0x462dc5
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x462dae
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x10], edx
jmp 0x462db7
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [0x6b9890], edx
call fcn.00462c40
push 0x68c618
call fcn.00478120
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4722d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
imul eax, eax, 3
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
jge 0x4722f8
mov ecx, dword [ebp + 0x10]
neg ecx
mov dword [ebp - 0x4c], ecx
jmp 0x4722fe
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov ecx, 0x4d42
mov word [ebp - 0x44], cx
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x48]
add edx, 0x36
mov dword [ebp - 0x42], edx
xor eax, eax
mov word [ebp - 0x3e], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
mov dword [ebp - 0x3a], 0x36
mov dword [ebp - 0x28], 0x28
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov ecx, 1
mov word [ebp - 0x1c], cx
mov edx, 0x18
mov word [ebp - 0x1a], dx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x4723a8
xor eax, eax
jmp 0x472447
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0xe
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x4723c6
jmp 0x47243b
cmp dword [ebp - 0x2c], 0xe
je 0x4723d0
jmp 0x47243b
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0x28
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x4723ee
jmp 0x47243b
cmp dword [ebp - 0x2c], 0x28
je 0x4723f8
jmp 0x47243b
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x42]
sub edx, dword [ebp - 0x3a]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x47241b
jmp 0x47243b
mov edx, dword [ebp - 0x42]
sub edx, dword [ebp - 0x3a]
cmp dword [ebp - 0x2c], edx
je 0x47242a
jmp 0x47243b
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
jmp 0x472447
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x476b10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x476b52
mov eax, 1
jmp 0x476d0f
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
cmp dword [eax*4 + 0x604838], 0
jne 0x476b82
mov eax, 1
jmp 0x476d0f
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx*4 + 0x604838]
mov dword [ebp - 0x220], edx
mov dword [ebp - 8], 0
jmp 0x476bab
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x220]
cmp dword [edx + ecx*4], 0
jne 0x476bbc
jmp 0x476bbe
jmp 0x476ba2
cmp dword [ebp - 8], 0
jle 0x476be8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax + edx*4 - 4]
mov dword [ebp - 0x224], ecx
jmp 0x476c01
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00476a70
add esp, 4
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jg 0x476c2a
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x21c], edx
jmp 0x476cb2
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0xc]
jge 0x476c71
mov ecx, dword [ebp + 8]
push ecx
push 0x5ea63c
lea edx, [ebp - 0x218]
push edx
call fcn.005cc4f5
add esp, 0xc
push 0x10
push 0x5ea660
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [0x9cef70]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x476d0f
mov edx, dword [ebp - 0x21c]
cmp edx, dword [ebp - 0xc]
jle 0x476cb2
mov eax, dword [ebp + 8]
push eax
push 0x5ea670
lea ecx, [ebp - 0x218]
push ecx
call fcn.005cc4f5
add esp, 0xc
push 0x10
push 0x5ea68c
lea edx, [ebp - 0x218]
push edx
mov eax, dword [0x9cef70]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x476d0f
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [ebp - 0xc]
jne 0x476d0a
mov edx, dword [ebp - 0x224]
cmp edx, dword [ebp - 4]
je 0x476d0a
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5ea6a0
lea eax, [ebp - 0x218]
push eax
call fcn.005cc4f5
add esp, 0x14
push 0x10
push 0x5ea708
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [0x9cef70]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x476d0f
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x479c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movsx eax, byte [0xfd576c]
test eax, eax
jne 0x479c86
jmp 0x479d2e
cmp dword [0x7d231c], 0
jne 0x479cce
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x479cb0
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x479cb9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0x7d2318], edx
mov eax, dword [0x7d2318]
mov dword [0x7d231c], eax
jmp 0x479d2e
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x479cef
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x479cf8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [0x7d2318], edx
mov eax, dword [0x7d2318]
sub eax, dword [0x7d231c]
cmp eax, 0xea60
jl 0x479d2e
mov ecx, dword [0x7d2318]
mov dword [0x7d231c], ecx
mov edx, dword [0xfd5768]
push edx
call fcn.00587d10
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x47acd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47ad05
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x47ad0e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0
fild qword [ebp - 0x14]
fstp qword [0x7d12b8]
cmp dword [ebp - 8], 0
je 0x47af29
call fcn.004936a0
test eax, eax
jne 0x47ad43
call fcn.00479c10
xor eax, eax
jmp 0x47af2e
cmp dword [ebp - 4], 0
jne 0x47ad7f
push 0
push 0
mov eax, dword [0x7d22cc]
push eax
push 0xff
push 0xf0
push 0x140
call fcn.005a19f0
add esp, 0x18
push 0x1e
push 0x13
call fcn.0046c870
add esp, 8
mov dword [ebp - 4], 1
jmp 0x47adb7
cmp dword [ebp - 4], 1
jne 0x47adb7
push 0
push 0
mov ecx, dword [0x7d22cc]
push ecx
push 0xff
push 0xf0
push 0x140
call fcn.005a19f0
add esp, 0x18
cmp dword [0x6ba8f8], 0
jne 0x47adb7
mov dword [ebp - 8], 0
call fcn.0059fd60
call fcn.0046c8c0
call fcn.0047c950
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47ade7
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x47adf0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
fld qword [0x7d12b8]
fadd qword [0x604ab8]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0
fild qword [ebp - 0x20]
fcompp
fnstsw ax
test ah, 0x41
jne 0x47ae42
cmp dword [0x604ac8], 0x14
jge 0x47ae42
fld qword [0x7d12b8]
fadd qword [0x604ac0]
fstp qword [0x7d12b8]
mov eax, dword [0x604ac8]
add eax, 1
mov dword [0x604ac8], eax
jmp 0x47ad24
call fcn.004637b0
test eax, eax
jne 0x47ae5a
mov ecx, dword [0x6b9edc]
add ecx, 1
mov dword [0x6b9edc], ecx
call fcn.0046d480
call fcn.005a0c00
cmp dword [0x6bbc48], 1
jne 0x47aea5
push 0x6b9ee0
push 0x100
push 0
push 0
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 0x90]
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 0x90]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x18]
call ecx
mov dword [0x6bbc48], 0
call fcn.00464ea0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47aecb
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x47aed4
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
fild qword [ebp - 0x2c]
fcomp qword [0x7d12b8]
fnstsw ax
test ah, 0x41
jp 0x47aefb
push 1
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x47aeaa
fld qword [0x7d12b8]
fadd qword [0x604ac0]
fstp qword [0x7d12b8]
mov dword [0x604ac8], 1
mov eax, dword [0x62f950]
add eax, 1
mov dword [0x62f950], eax
jmp 0x47ad24
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x47bc50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x121bbe0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
je 0x47bc6f
cmp dword [ebp - 8], 0xa
je 0x47bce9
jmp 0x47bd58
cmp dword [0x121bbbc], 0
je 0x47bce7
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47bc99
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x47bca2
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
cmp dword [0x1210820], 0
je 0x47bcde
mov eax, dword [ebp - 4]
sub eax, dword [0x1210824]
mov ecx, dword [0x121081c]
sub ecx, eax
mov dword [0x121081c], ecx
jns 0x47bcde
mov dword [0x121081c], 0
mov dword [0x1210820], 0
mov edx, dword [ebp - 4]
mov dword [0x1210824], edx
jmp 0x47bd58
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47bd0a
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x10], edx
jmp 0x47bd13
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [0x1210820], 0
je 0x47bd4f
mov eax, dword [ebp - 4]
sub eax, dword [0x1210824]
mov ecx, dword [0x121081c]
sub ecx, eax
mov dword [0x121081c], ecx
jns 0x47bd4f
mov dword [0x121081c], 0
mov dword [0x1210820], 0
mov edx, dword [ebp - 4]
mov dword [0x1210824], edx
mov esp, ebp
pop ebp
ret
Function at 0x47c640
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
and eax, 0x800
je 0x47c766
push 0
push 0
push 0x800
mov ecx, dword [0x7d2368]
push ecx
call sub.IMM32.DLL_ImmGetCompositionStringA
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x100
jl 0x47c699
mov dword [ebp - 0x114], 0xff
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x800
mov ecx, dword [0x7d2368]
push ecx
call sub.IMM32.DLL_ImmGetCompositionStringA
mov edx, dword [ebp - 0x114]
mov byte [ebp + edx - 0x110], 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x118]
mov al, byte [edx]
mov byte [ebp - 0x11d], al
add dword [ebp - 0x118], 1
cmp byte [ebp - 0x11d], 0
jne 0x47c6e1
mov ecx, dword [ebp - 0x118]
sub ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0x114], 0x100
jl 0x47c733
mov dword [ebp - 0x114], 0xff
mov dword [ebp - 4], 0
jmp 0x47c745
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x114]
jge 0x47c766
mov edx, dword [ebp - 4]
movzx eax, byte [ebp + edx - 0x110]
push eax
call fcn.00461760
add esp, 4
jmp 0x47c73c
mov ecx, dword [ebp + 8]
and ecx, 8
je 0x47c7c3
push 0
push 0
push 8
mov edx, dword [0x7d2368]
push edx
call sub.IMM32.DLL_ImmGetCompositionStringA
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x100
jl 0x47c79c
mov dword [ebp - 0x114], 0xff
mov eax, dword [ebp - 0x114]
push eax
push 0x7d2370
push 8
mov ecx, dword [0x7d2368]
push ecx
call sub.IMM32.DLL_ImmGetCompositionStringA
mov edx, dword [ebp - 0x114]
mov byte [edx + 0x7d2370], 0
mov eax, dword [ebp + 8]
and eax, 0x10
je 0x47c81f
push 0
push 0
push 0x10
mov ecx, dword [0x7d2368]
push ecx
call sub.IMM32.DLL_ImmGetCompositionStringA
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x100
jl 0x47c7f9
mov dword [ebp - 0x114], 0xff
mov edx, dword [ebp - 0x114]
push edx
push 0x7d2470
push 0x10
mov eax, dword [0x7d2368]
push eax
call sub.IMM32.DLL_ImmGetCompositionStringA
mov ecx, dword [ebp - 0x114]
mov byte [ecx + 0x7d2470], 0
mov edx, dword [ebp + 8]
and edx, 0x80
je 0x47c84d
push 0
push 0
push 0x80
mov eax, dword [0x7d2368]
push eax
call sub.IMM32.DLL_ImmGetCompositionStringA
mov dword [0x7d2570], eax
mov dword [0x6b9878], 0x14
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret