joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x672e98
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x224], eax
je 0x4f98d7
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, eax
sub ecx, dword [esi + 0x224]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, 0x258
jbe 0x4f99b1
call edi
mov dword [esi + 0x224], eax
mov dword [ebp - 0x1c], 1
lea ebx, [esi + 0x218]
lea edi, [esi + 0x21c]
push ebx
push edi
push 0
push 0
push esi
call fcn.004ea600
add esp, 0x14
test eax, eax
jne 0x4f99b1
mov eax, dword [ebx]
test eax, eax
je 0x4f99b1
cmp dword [esi + 0x20c], eax
jne 0x4f9942
mov edx, dword [esi + 0x220]
cmp edx, dword [esi + 0x214]
jne 0x4f9942
mov ecx, dword [edi]
cmp ecx, dword [esi + 0x210]
jne 0x4f9942
cmp dword [esi + 0x224], 0
jne 0x4f99b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x224], eax
jmp 0x4f99b1
mov dword [esi + 0x20c], eax
mov edx, dword [edi]
mov dword [esi + 0x210], edx
mov eax, dword [edi + 4]
mov dword [esi + 0x214], eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x224], eax
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
lea edx, [esi + 0x208]
push edx
push esi
call fcn.004f18b0
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fdff0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x673020
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0x80
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0x10]
cmp eax, esi
jne 0x4fe06a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6aae14
call fcn.005e42c4
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
push 0x80
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x4fe113
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + ecx]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x20], esi
je 0x4fe113
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push esi
lea edx, [ebp - 0x28]
push edx
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4fe103
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4fe113
mov edx, dword [ebp - 0x28]
push edx
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x4fe113
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + eax]
push ecx
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x4fe0a1
mov edx, dword [ebp + 0x10]
push edx
push edi
call fcn.004fd150
add esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.004fe160
test esi, esi
je 0x4fe12f
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x4fe13f
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fe960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x6085b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6aae14]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 1
call fcn.005e1c04
add esp, 4
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
cmp dword [0x74bcc4], ebx
jne 0x4fe9c6
push 0x74bcc0
push str.MD5Log
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x74bcc4], 1
call fcn.004d5820
cmp dword [0x74bcc0], ebx
je 0x4feabd
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x70], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4fea16
sub eax, edi
push eax
push esi
call fcn.004016b0
lea ecx, [esp + 0x44]
call fcn.004fe6b0
mov edi, eax
cmp esi, ebx
je 0x4fea7d
cmp byte [esi], bl
je 0x4fea7d
call ebp
sub eax, dword [esp + 0x18]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
test eax, eax
jge 0x4fea51
fadd qword [0x60ecc0]
fdiv qword [0x60ecb8]
sub esp, 8
fstp qword [esp]
push esi
push str._MD5__File:_s___.2f_Secs_
push ebx
call fcn.004f0f30
mov edx, dword [esp + 0x28]
add esp, 0x14
push edx
call fcn.005e0d9a
mov eax, edi
jmp 0x4feb1c
call ebp
sub eax, dword [esp + 0x18]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
test eax, eax
jge 0x4fea95
fadd qword [0x60ecc0]
fdiv qword [0x60ecb8]
sub esp, 8
fstp qword [esp]
push str._MD5__Handle___.2f_Secs_
push ebx
call fcn.004f0f30
mov edx, dword [esp + 0x24]
add esp, 0x10
push edx
call fcn.005e0d9a
mov eax, edi
jmp 0x4feb1c
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x70], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4feaf5
sub eax, edi
push eax
push esi
call fcn.004016b0
lea ecx, [esp + 0x44]
call fcn.004fe6b0
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call fcn.005e0d9a
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
Function at 0x4febf0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x424
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x430]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
mov ebp, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x440]
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
mov edi, eax
test eax, eax
je 0x4fec4e
push eax
lea edx, [esp + 0x22c]
push edx
call ebx
lea edi, [esp + 0x228]
push 0x64850c
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x1c], 0x208
call ebx
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push edi
push ebp
call fcn.004feb40
cmp al, 1
jne 0x4fec92
lea eax, [esp + 0x20]
push esi
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x4fed62
test esi, esi
je 0x4fecc2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20106
push 0
push 0x648504
push 0
push edi
push ebp
call fcn.004fae50
test eax, eax
je 0x4fecc9
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x4fed64
cmp byte [esi], 0x25
mov edi, 1
jne 0x4fece5
lea eax, [esi + 1]
push 0x25
push eax
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4fed02
cmp byte [esi], 0x22
jne 0x4fed07
cmp byte [esi + 1], 0x25
jne 0x4fed07
lea ecx, [esi + 2]
push 0x25
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4fed07
mov edi, 2
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fed10
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
push esi
push edi
push 0
push ebx
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
test esi, esi
je 0x4fed57
test eax, eax
je 0x4fed4c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x4fed64
test eax, eax
je 0x4fed62
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x424
ret 0x10
Function at 0x4fed90
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
lea eax, [esp + 0xc]
push eax
push str.NoModify2500
push 0x60d9ec
xor ebp, ebp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebp
call fcn.004d5820
cmp dword [esp + 0xc], ebp
jne 0x4fef85
push edi
call fcn.004d5980
mov edi, eax
cmp edi, 7
jb 0x4fef84
push esi
push 0x103
lea ecx, [esp + 0x21]
push ebp
push ecx
mov byte [esp + 0x28], 0
call fcn.005dfd60
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp dword [esp + 0x128], 1
setne al
add eax, 0x80000001
mov esi, eax
cmp edi, 0xb
jb 0x4feeb4
push str.2500
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.004e9430
cmp eax, 1
jne 0x4fee3c
mov ebp, eax
call fcn.004d96c0
test eax, eax
je 0x4fef83
call fcn.004d96c0
test eax, eax
jne 0x4fee6b
lea edx, [esp + 0xc]
push edx
push 0xf003f
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4fee82
lea ecx, [esp + 0xc]
push ecx
push 0xf013f
push 0
lea edx, [esp + 0x28]
push edx
push esi
call fcn.004fadc0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x4fef83
mov eax, dword [esp + 0xc]
push str.2500
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4feeaa
lea ebp, [esi + 1]
mov ecx, dword [esp + 0xc]
push ecx
jmp 0x4fef7d
lea edx, [esp + 0x10]
push edx
push str.2500
lea eax, [esp + 0x24]
push eax
push esi
call fcn.004d5820
test al, al
jne 0x4feedf
push 0
push str.2500
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.004f48a0
call fcn.004d96c0
test eax, eax
je 0x4fef83
call fcn.004d96c0
test eax, eax
jne 0x4fef0e
lea edx, [esp + 0xc]
push edx
push 0xf003f
push eax
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4fef25
lea ecx, [esp + 0xc]
push ecx
push 0xf013f
push 0
lea edx, [esp + 0x28]
push edx
push esi
call fcn.004fadc0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x4fef83
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push esi
push str.2500
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4fef78
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.2500
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov ecx, dword [esp + 0x118]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x118
ret
Function at 0x502540
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call fcn.004e0670
add esp, 4
test eax, eax
jne 0x5025c4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x502594
push edi
call fcn.004e0fb0
add esp, 4
cmp eax, 0xffffffff
je 0x50257e
test al, 7
je 0x50257e
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call fcn.004e0670
add esp, 4
test eax, eax
jne 0x50259c
call esi
mov esi, eax
cmp esi, 2
jne 0x5025a4
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, 1
pop edi
ret
cmp dword [esp + 0x10], 0
je 0x5025b8
push 1
push 0
push edi
call fcn.00502270
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor eax, eax
pop edi
ret
mov eax, 1
pop edi
ret

Function at 0x5025d0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x5025ee
cmp byte [ebx], 0
je 0x5025ee
push 0
push ebx
call fcn.00502540
add esp, 8
cmp eax, 1
jne 0x5025f5
mov eax, 1
pop ebx
ret
push 0
push 0
push 0
push 0
push 0
push ebx
call fcn.004e8950
add esp, 0x18
test eax, eax
je 0x50263a
push 0
push 0x2000000
push 3
push 0
push 3
push connect
push ebx
call fcn.004e0400
add esp, 0x1c
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x5025ee
lea eax, [esp + 8]
push eax
call fcn.004dca10
push ebp
push esi
push edi
push ebx
call fcn.004e5420
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
jle 0x502682
lea esi, [eax + eax*4]
add esi, esi
xor edi, edi
test esi, esi
jle 0x502682
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push ebx
call fcn.004e0670
add esp, 4
cmp eax, 1
je 0x50269a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x502692
push 0x64
call ebp
inc edi
cmp edi, esi
jl 0x502660
push 1
push ebx
call fcn.00502540
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x502700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov dword [esp + 0x10], 0
mov byte [esp + 0x1c], 0
call fcn.005dfd60
call fcn.004d96c0
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x1c]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and esi, 0x100
push ecx
add esi, 0x20019
call fcn.005dfb23
add esp, 0x14
lea edx, [esp + 8]
push edx
push esi
push 0
lea eax, [esp + 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
pop esi
test eax, eax
jne 0x5027a7
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push 0x64b2a8
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, dword [esp]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x114
ret
Function at 0x5033a0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xa0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
mov esi, dword [esp + 0xa8]
lea eax, [esp + 4]
push eax
push 0x64a0b4
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call fcn.004d5820
test al, al
jne 0x5033fa
mov ecx, dword [esp + 4]
push ecx
push 0x64a0b4
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [esp + 4], 1
jne 0x503419
mov al, 1
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xa0
ret
push edi
push esi
call fcn.004db9e0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 4
call edi
cmp eax, esi
jne 0x503448
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xa0
ret
push ebx
push ebp
push 0x90
lea edx, [esp + 0x20]
push 0
push edx
call fcn.005dfd60
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x28]
cmp eax, 2
jne 0x5034ae
cmp dword [esp + 0x1c], 4
ja 0x5034c5
push esi
call fcn.004db9e0
add esp, 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esp + 0xac]
pop ebp
pop ebx
cmp eax, esi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0xa0
ret
cmp eax, 1
jne 0x503481
mov eax, dword [esp + 0x1c]
cmp eax, 4
ja 0x5034c5
jne 0x503481
cmp dword [esp + 0x20], 0
jbe 0x503481
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebx
push 0
push esi
mov edi, eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebx, eax
push edi
push ebx
call ebp
test eax, eax
je 0x503509
push esi
call fcn.004db9e0
add esp, 4
push 0
push edi
push ebx
call ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
sete al
test al, al
jne 0x50348a
call fcn.004f9a60
mov edi, eax
cmp edi, 1
je 0x50348a
call fcn.004d99e0
test eax, eax
je 0x50352b
cmp edi, 1
jbe 0x50348a
push 0x647834
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x50354e
push 0x647818
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50354e
push 0xffffffffffffffff
call eax
push 0
call fcn.00503120
test eax, eax
jne 0x50348a
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push eax
lea ecx, [esp + 0x18]
push ecx
push eax
push 0x2000
call edi
push 3
push 0
push 0
push 0x2001
call edi
push esi
call fcn.004db9e0
mov edx, dword [esp + 0x18]
add esp, 4
push 3
push edx
push 0
push 0x2001
call edi
jmp 0x50348a
Function at 0x5036a0
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x1008
call fcn.005e00d0
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x643dac
mov dword [esp + 0x10], eax
xor edi, edi
xor ebp, ebp
call fcn.004f4be0
mov esi, eax
test esi, esi
jne 0x5036d7
pop edi
pop esi
pop ebp
add esp, 0x1008
ret 8
push ebx
push 0x643d6c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x503700
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1008
ret 8
push 0
push 0x643ce8
call fcn.004e21c0
add esp, 8
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x20]
push ecx
call ebx
mov esi, dword [esp + 0x14]
shr esi, 2
test esi, esi
jle 0x503759
mov ebx, dword [esp + 0x1020]
mov eax, dword [esp + edi*4 + 0x18]
cmp eax, 2
jbe 0x503754
cmp eax, dword [esp + 0x10]
je 0x503754
mov edx, dword [esp + 0x101c]
push 0
push ebx
push edx
push eax
call fcn.004fa650
or ebp, eax
inc edi
cmp edi, esi
jl 0x503732
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x1008
ret 8
Function at 0x504030
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
test byte [0x74bcf0], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jne 0x504052
or dword [0x74bcf0], 1
call esi
mov dword [0x74bcec], eax
xor edi, edi
cmp dword [0x690698], 1
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edi
je 0x504083
call esi
sub eax, dword [0x74bcec]
cmp eax, 0x6d60
ja 0x504083
mov eax, dword [0x690698]
pop edi
pop esi
add esp, 0x10
ret
call esi
mov dword [0x74bcec], eax
push edi
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004fbc00
add esp, 0xc
cmp eax, 0x7a
jne 0x504216
mov ecx, dword [esp + 8]
push ebx
push ecx
call fcn.005e20e4
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x504207
push 1
lea edx, [esp + 0x10]
push edx
push ebx
call fcn.004fbc00
add esp, 0xc
test eax, eax
jne 0x5041fe
push 4
call fcn.005e20e4
mov esi, eax
add esp, 4
cmp esi, edi
je 0x5041fe
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004fbce0
add esp, 8
cmp eax, 0x6f
jne 0x5041e0
push ebp
push esi
call fcn.005e0865
mov ecx, dword [esp + 0x18]
push ecx
call fcn.005e20e4
mov ebp, eax
add esp, 8
mov dword [esp + 0x18], ebp
cmp ebp, edi
jne 0x504134
push ebx
call fcn.005e0865
add esp, 4
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x690698], eax
pop esi
add esp, 0x10
ret
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.004fbce0
add esp, 8
test eax, eax
jne 0x5041c1
mov edi, dword [ebx]
xor esi, esi
test edi, edi
jbe 0x504193
lea edx, [ebx + 0x224]
mov eax, ebp
xor ecx, ecx
test ecx, ecx
jne 0x504173
mov ebp, dword [eax + 0x19c]
cmp ebp, dword [edx - 0x20]
jne 0x504169
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x504158
test ecx, ecx
je 0x504184
mov eax, dword [edx]
cmp eax, 3
je 0x5041b6
cmp eax, 4
je 0x5041b6
cmp eax, 5
je 0x5041b6
mov ebp, dword [esp + 0x18]
inc esi
add edx, 0x35c
cmp esi, edi
jb 0x504154
mov esi, dword [esp + 0x1c]
push ebx
call fcn.005e0865
push ebp
call fcn.005e0865
add esp, 8
pop ebp
pop ebx
pop edi
mov dword [0x690698], esi
mov eax, esi
pop esi
add esp, 0x10
ret
mov ebp, dword [esp + 0x18]
mov esi, 1
jmp 0x504197
push ebx
call fcn.005e0865
push ebp
call fcn.005e0865
add esp, 8
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x690698], eax
pop esi
add esp, 0x10
ret
push ebx
call fcn.005e0865
push esi
call fcn.005e0865
add esp, 8
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x690698], eax
pop esi
add esp, 0x10
ret
push ebx
call fcn.005e0865
add esp, 4
pop ebx
or eax, 0xffffffff
pop edi
mov dword [0x690698], eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop edi
mov dword [0x690698], eax
pop esi
add esp, 0x10
ret
Function at 0x5042c0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x24c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x248], eax
push ebp
mov ebp, dword [esp + 0x254]
push esi
mov esi, dword [esp + 0x25c]
push edi
mov edi, dword [esp + 0x264]
push 0x103
lea eax, [esp + 0x155]
push 0
push eax
mov dword [esp + 0x18], 0
mov byte [esp + 0x15c], 0
call fcn.005dfd60
add esp, 0xc
test ebp, ebp
je 0x5044ba
test esi, esi
je 0x5044ba
cmp byte [ebp], 0
je 0x5044ba
cmp byte [esi], 0
je 0x5044ba
push ebx
push ebp
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x154]
push edx
call fcn.004e24e0
add esp, 4
push esi
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x158]
push edx
mov esi, 1
call fcn.004e0820
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x50449d
lea ebx, [ebx]
test esi, esi
je 0x504496
test byte [esp + 0x14], 0x10
jne 0x504481
test edi, edi
je 0x5043d2
xor esi, esi
cmp dword [edi], esi
je 0x5043d2
mov eax, edi
nop
mov edx, dword [eax]
lea ecx, [esp + 0x40]
push ecx
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x504481
inc esi
cmp dword [edi + esi*4], 0
lea eax, [edi + esi*4]
jne 0x5043b0
lea eax, [esp + 0x40]
push 0x2e
push eax
call fcn.004dad90
add esp, 8
cmp eax, 3
jne 0x504481
push ebp
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x154]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [esp + 0x14], 7
je 0x504436
push 0x80
lea edx, [esp + 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x154]
push 0
push eax
call fcn.00502540
add esp, 8
test eax, eax
jne 0x504479
cmp dword [esp + 0x26c], 1
jne 0x504481
push eax
lea ecx, [esp + 0x158]
push ecx
call fcn.005010e0
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.004d5ad0
add esp, 8
mov esi, eax
jmp 0x504390
mov dword [esp + 0x10], 1
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.004d5ad0
add esp, 8
mov esi, eax
jmp 0x504390
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x24c
ret
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x24c
ret