joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438e2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
mov edi, dword [ebp + 0xc]
push str._path_
push edi
call esi
test eax, eax
jne 0x438e6e
push 0x104
push dword [ebp + 8]
push dword [0x45ffcc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
push dword [ebp + 8]
call fcn.00430531
jmp 0x438f91
push str._temp_
push edi
call esi
test eax, eax
jne 0x438e8c
push 0x104
push dword [ebp + 8]
call fcn.0042fff3
jmp 0x438f91
push str._cd_
push edi
call esi
test eax, eax
jne 0x438ec5
mov esi, dword [ebp + 8]
push 0x41
pop ebx
and byte [esi + 3], al
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0x5c
push esi
mov byte [esi], bl
call fcn.00438f9b
test eax, eax
pop ecx
jne 0x438f91
inc ebx
cmp ebx, 0x5b
jl 0x438ea9
jmp 0x438f94
push str._wind_
push edi
call esi
test eax, eax
je 0x438f83
push str._windir_
push edi
call esi
test eax, eax
je 0x438f83
push str._winsysdir_
push edi
call esi
test eax, eax
jne 0x438f04
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x438f91
push str._programfilesdir_
push edi
call esi
test eax, eax
mov ebx, str._commonfilesdir_
je 0x438f29
push ebx
push edi
call esi
test eax, eax
je 0x438f29
push str._desktopdir_
push edi
call esi
test eax, eax
jne 0x438f91
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 4], eax
je 0x438f91
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x438f78
push str._programfilesdir_
push edi
call esi
test eax, eax
jne 0x438f5f
push 0x26
pop eax
jmp 0x438f6c
push ebx
push edi
call esi
neg eax
sbb eax, eax
and al, 0xe5
add eax, 0x2b
push dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
call dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x438f91
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43bee7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
movzx ecx, word [ebp + 0x10]
imul ecx, ecx, 0xfa
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ecx
add ecx, eax
cmp si, 0x10e1
mov dword [ebp - 8], eax
mov dword [ebp + 0x10], ecx
jne 0x43bf71
cmp di, 0x4d2
jne 0x43bf71
cmp dword [ebp + 0xc], 0
je 0x43bf55
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call fcn.0040e007
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
sar esi, 1
add esi, dword [ebp - 0x24]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, dword [ebp - 0x20]
jmp 0x43bf71
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
cdq
sub eax, edx
push 1
mov esi, eax
sar esi, 1
call edi
cdq
sub eax, edx
mov edi, eax
sar edi, 1
push 0
push 9
push dword [ebp + 8]
call fcn.00405a34
push 0
push 0xb
push dword [ebp + 8]
call fcn.00405a34
lea ecx, [ebp - 4]
mov dword [ebp + 0xc], eax
push ecx
push 0
push 0x22
push eax
call fcn.00403693
cmp dword [ebp - 4], 1
jne 0x43bfdb
push 4
push dword [ebp + 0xc]
call fcn.00403526
push 1
push eax
call fcn.0044095d
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43bfdb
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ClientToScreen]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
movzx esi, si
movzx edi, di
mov dword [ebp + 0x14], esi
sub esi, dword [ebp - 0x14]
mov dword [ebp + 8], edi
sub edi, dword [ebp - 0x10]
call ebx
cmp eax, dword [ebp + 0x10]
jae 0x43c040
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x64
mov dword [ebp + 0xc], ecx
jmp 0x43c00c
mov ecx, dword [ebp + 0xc]
imul eax, eax, 0x64
sub eax, ecx
xor edx, edx
div dword [ebp - 0xc]
push 0x64
pop ecx
mov dword [ebp + 0x18], eax
imul eax, edi
cdq
idiv ecx
add eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x18]
imul eax, esi
cdq
idiv ecx
add eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
call ebx
cmp eax, dword [ebp + 0x10]
jb 0x43c009
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c43b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x114]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00430694
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x114]
push 0x45c338
push eax
call esi
test eax, eax
je 0x43c486
lea eax, [ebp - 0x114]
push 0x45c334
push eax
call esi
test eax, eax
mov dword [ebp - 4], edi
jne 0x43c48d
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040f9fd
mov ebx, eax
cmp ebx, edi
je 0x43c4be
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43c4c2
xor eax, eax
jmp 0x43c509
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call fcn.0043c84c
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x7ffe
push ebx
push esi
call fcn.00430cfe
push edi
push esi
call fcn.00430cfe
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c55a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
xor edi, edi
push edi
push 0xb
push dword [ebp + 8]
call fcn.00405a34
push 4
pop ebx
push ebx
push eax
call fcn.00403526
push 1
pop esi
push esi
push eax
call fcn.0044095d
mov dword [ebp - 4], eax
push 0x18
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.00442900
add esp, 0xc
lea eax, [ebp - 0x194]
mov dword [ebp - 0x28], esi
push str.SMTP:
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x194]
push 0x30
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x194]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.00442900
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x2c]
cmp ebx, edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
je 0x43c61d
push 0x18
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.00442900
lea eax, [ebp - 0x74]
add esp, 0xc
or dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push 0x43c50e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp + 8], eax
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
call ebx
test eax, eax
je 0x43c6a1
push esi
push edi
push edi
lea eax, [ebp - 0x90]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x43c692
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x43c661
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
jmp 0x43c65b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x43c6aa
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push esi
lea eax, [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00438c7c
mov esi, eax
cmp esi, 0xffffffff
jne 0x43c6dd
lea eax, [ebp - 0x224]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x43c734
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00438e2e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x10]
push 0
add eax, esi
push 0
add eax, edi
push eax
call fcn.00438c7c
cmp eax, 0xffffffff
je 0x43c720
mov ecx, dword [ebp + 0x10]
add eax, ecx
and byte [eax + edi], 0
mov eax, dword [ebp + 0x10]
add eax, esi
add eax, edi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00438bdb
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00430531
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x43c76d
lea eax, [ebp - 0x11c]
push eax
call fcn.00430b0c
test eax, eax
jne 0x43c76d
leave
ret
lea eax, [ebp - 0x224]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x43fd00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, ebx
and ebx, 0x7fffffff
shr edi, 0x1f
cmp ebx, 0x2bf20
jbe 0x43fd2f
or eax, 0xffffffff
jmp 0x43fd7f
call esi
sub eax, dword [ebp - 4]
cmp eax, ebx
jae 0x43fd7d
xor eax, eax
push 1
cmp edi, eax
je 0x43fd6d
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x43fd2f
cmp dword [ebp - 0x1c], 0x12
je 0x43fd75
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x43fd2f
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43fd2f
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4408df
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x440900
lea eax, [ebp + 8]
push eax
push 0
push 0x22
push dword [edi + 4]
call fcn.00403693
cmp dword [ebp + 8], 1
jne 0x440904
xor eax, eax
jmp 0x440958
push esi
push dword [edi + 0x40]
call fcn.004300c3
mov esi, eax
test esi, esi
je 0x440947
cmp dword [esi], 0
je 0x44093d
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44093d
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x44093d
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x40]
call fcn.004300f9
jmp 0x44090d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
pop esi
pop edi
pop ebp
ret 4
Function at 0x450127
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 1
xor ebx, ebx
mov esi, ecx
pop edi
mov dword [ebp - 4], ebx
call fcn.00450223
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x450189
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x450189
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.ProxyEnable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x450189
cmp dword [ebp - 0xc], ebx
je 0x450189
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.0044fe0e
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [esi + 4], eax
je 0x4501ac
cmp dword [ebp + 0xc], 4
jne 0x4501c6
cmp dword [ebp - 0x10], ebx
jne 0x4501c6
cmp word [esi + 0x14], 3
mov ecx, esi
jne 0x4501c1
call fcn.004503e2
jmp 0x4501c6
call fcn.0045060e
cmp dword [esi + 4], ebx
pop edi
pop esi
setne byte [ebp + 0xf]
cmp dword [ebp - 4], ebx
pop ebx
je 0x4501de
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0xf]
leave
ret 0x14

Function at 0x450223
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x258]
push eax
mov edi, SysReAllocStringLen
push str..htm
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], 0x104
call esi
test eax, eax
jne 0x450323
lea eax, [ebp - 0x258]
push str._shellopencommand
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x258]
push eax
push edi
call esi
test eax, eax
jne 0x450323
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
lea eax, [ebp - 0x154]
push str.netscape.exe
push eax
call fcn.00444e50
pop ecx
test eax, eax
pop ecx
je 0x450323
lea ecx, [ebp - 0x154]
sub eax, ecx
add eax, 0xd
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x50]
call fcn.0045032a
lea eax, [ebp - 0x35c]
lea ecx, [ebp - 0x50]
push eax
call fcn.00451688
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov edx, ecx
mov dword [ebp - 0x50], 0x455688
shr edx, 0x10
mov word [eax + 0x16], cx
lea ecx, [ebp - 0x50]
mov word [eax + 0x14], dx
call fcn.00450387
xor eax, eax
jmp 0x450326
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x4503e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.00443730
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4505b0
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x4505b0
cmp dword [ebp - 0x14], 1
jne 0x4505b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x450573
cmp byte [ebp - 0x148], al
je 0x450573
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x450565
lea eax, [ebp - 0x96c]
push 0x45b31c
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x45a8f0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x45af54
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x4504c9
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.0044ffac
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4505be
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450ecd
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
and dword [edi], 0
cmp dword [ebp + 0xc], 0
jbe 0x451094
jmp 0x450eed
mov edi, dword [ebp + 0x10]
cmp dword [esi + 0x5c], 0x2710
jbe 0x450f08
cmp dword [esi + 0x54], 0
je 0x450f08
mov ecx, esi
call fcn.004510a1
lea ebx, [eax + eax*4]
jmp 0x450f0d
mov ebx, 0x1f4
test ebx, ebx
jne 0x450f14
push 1
pop ebx
cmp byte [esi + 0x90], 0
je 0x450f29
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x450f36
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [edi]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
cmp ecx, ebx
jb 0x450f4c
mov ecx, ebx
lea edx, [ebp - 4]
push edx
push ecx
mov ecx, dword [ebp + 8]
add eax, ecx
push eax
push dword [esi + 4]
call fcn.0044fee3
add esp, 0x10
test eax, eax
jne 0x450f79
mov eax, dword [esi]
push 0x7530
mov ecx, esi
call dword [eax]
test al, al
je 0x45109d
cmp byte [esi + 0x90], 0
je 0x450f94
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x450fa2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x451094
add dword [edi], ecx
add dword [esi + 0x4c], ecx
add dword [esi + 0x54], ecx
add dword [esi + 0x60], ecx
sub eax, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
or eax, edx
mov dword [ebp - 8], edx
jne 0x450fd3
and dword [ebp - 8], 0
mov dword [ebp - 0xc], 5
push 0
push 0x3e8
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004450e0
mov edi, dword [esi + 0x8c]
mov ebx, dword [esi + 0x88]
cmp edx, edi
jl 0x451028
jg 0x450ffb
cmp eax, ebx
jb 0x451028
push edi
push ebx
push edx
push eax
call fcn.00451980
add dword [esi + 0x5c], eax
add dword [esi + 0x68], eax
push edi
push ebx
push 0
push eax
call fcn.004450e0
push 0xffffffffffffffff
push 0xfffffc18
push edx
push eax
call fcn.00451980
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
push 0
push 0xf4240
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004450e0
push edi
push ebx
push edx
push eax
call fcn.00451980
add dword [esi + 0x58], eax
mov edi, dword [esi + 0x58]
add dword [esi + 0x64], eax
mov ecx, 0x3e8
cmp edi, ecx
jbe 0x45106b
mov eax, edi
xor edx, edx
mov ebx, ecx
div ebx
xor edx, edx
add dword [esi + 0x5c], eax
mov eax, edi
mov edi, ecx
div edi
mov dword [esi + 0x58], edx
mov edi, dword [esi + 0x64]
cmp edi, ecx
jbe 0x451086
mov eax, edi
xor edx, edx
mov ebx, ecx
div ebx
xor edx, edx
add dword [esi + 0x68], eax
mov eax, edi
div ecx
mov dword [esi + 0x64], edx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp dword [ecx], eax
jb 0x450eea
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc
xor al, al
jmp 0x451096
Function at 0x4510a1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x6c]
cmp eax, 0x7530
jbe 0x4510d9
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], ecx
mov ecx, dword [esi + 0x64]
xor eax, eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x64], eax
call edi
mov dword [esi + 0x6c], eax
mov edi, dword [esi + 0x5c]
test edi, edi
jne 0x4510e5
mov eax, dword [esi + 0x54]
jmp 0x45112e
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x45112c
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0x54]
cmp ebx, eax
jbe 0x45110a
shr ebx, 1
shr edi, 1
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], edi
mov eax, dword [esi + 0x54]
mov edi, dword [esi + 0x5c]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x4510ee
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x451688
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x4516da
push eax
call fcn.00442e85
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4516da
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x45a4d4
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4516de
xor al, al
jmp 0x45173f
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x45173d
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00442e85
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x45173d
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x45172b
mov al, 1
pop ebx
leave
ret 4