joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b940
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x47b973
push esi
call fcn.0047ea40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x47b96c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x47b9f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47b9e2
mov eax, dword [esi + 8]
test eax, eax
je 0x47b997
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47b9de
cmp eax, 2
je 0x47b9e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47b98a
cmp eax, 3
je 0x47b9bd
cmp eax, 1
jne 0x47b98a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47b98a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47b98a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0047ba20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x47ba08
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0047ba20
add esp, 4
pop esi
ret

Function at 0x49a8f4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49a92c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004989ab
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00498983
jmp 0x49a938
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49bfe5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49c027
call fcn.004a1ba3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49c027
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49c01e
xor eax, eax
jmp 0x49c02f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049c035
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a20d3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a2101
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a211f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a2039
jmp 0x4a211f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a211f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a2039
test edi, edi
mov eax, edi
jne 0x4a2109
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
lea edx, [ebp - 0x14]
lea ecx, [ebp - 8]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push edx
push ecx
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ClearCommError
test eax, eax
je 0x402df8
cmp dword [ebp - 8], 0
jbe 0x402df8
push 2
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_PurgeComm
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x402e6a
cmp eax, esi
jae 0x402e08
mov edx, dword [ebp - 0x10]
jmp 0x402e0a
mov edx, esi
mov esi, edx
lea edi, [ebx + 0x48]
push edi
lea eax, [ebp - 4]
push eax
push esi
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x402e6a
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
jne 0x402e65
push 0xbb8
mov eax, dword [ebx + 0x58]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push 0
lea edx, [ebp - 4]
push edx
push edi
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
jne 0x402e6a
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e4
je 0x402e6a
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402e6a
xor edx, edx
mov dword [ebp - 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403328
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x74]
mov dword [ebp - 8], edx
call fcn.004a2ec0
mov dword [ebp - 4], eax
xor edi, edi
cmp byte [ebp + 0x14], 0
je 0x403357
push 1
call sub.KERNEL32.DLL_Sleep
mov eax, dword [ebx + 4]
push eax
call fcn.00402ebc
pop ecx
cmp esi, eax
jg 0x4033a3
mov edx, dword [ebx + 4]
push edx
call fcn.00402ebc
pop ecx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, edi
cmp esi, ecx
jg 0x403382
mov eax, esi
sub eax, edi
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, edi
push ecx
mov eax, dword [ebx + 4]
push eax
call fcn.00402dc0
add esp, 0xc
add edi, dword [ebp - 0xc]
cmp esi, edi
jne 0x4033a3
mov al, 1
jmp 0x4033cb
call fcn.004a2ec0
mov ecx, eax
mov eax, esi
shl eax, 4
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
cdq
idiv dword [ebp - 8]
add eax, dword [ebx + 8]
sub ecx, dword [ebp - 4]
cmp eax, ecx
jg 0x40334a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4033d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push 1
push eax
mov edx, dword [ebx + 4]
push edx
call fcn.00402d58
add esp, 0xc
call fcn.004a2ec0
mov esi, eax
jmp 0x403403
call fcn.004a2ec0
sub eax, esi
cmp eax, dword [ebx + 8]
jg 0x403411
mov eax, dword [ebx + 4]
push eax
call fcn.00402f08
pop ecx
test eax, eax
jg 0x4033f7
mov al, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x403418
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.00403310
pop ecx
mov eax, dword [ebp + 0x10]
inc eax
push eax
call fcn.0049a2dc
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [ebp - 4]
mov esi, edx
mov edx, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jge 0x403453
mov cl, byte [edx]
mov byte [esi], cl
inc eax
inc esi
inc edx
cmp eax, dword [ebp + 0x10]
jl 0x403447
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebx + 4]
push edx
call fcn.00402d58
add esp, 0xc
call fcn.004a2ec0
mov esi, eax
jmp 0x40347c
call fcn.004a2ec0
sub eax, esi
cmp eax, dword [ebx + 8]
jg 0x40348a
mov eax, dword [ebx + 4]
push eax
call fcn.00402f08
pop ecx
test eax, eax
jg 0x403470
mov edx, dword [ebp - 4]
push edx
call fcn.0049a104
cmp dword [ebp + 0x14], 0
pop ecx
jne 0x40349e
mov al, 1
jmp 0x403508
mov edx, dword [ebp + 0x14]
inc edx
push edx
call fcn.0049a2dc
pop ecx
mov dword [ebp - 8], eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp - 8]
push eax
push ebx
call fcn.00403328
add esp, 0x10
test al, al
jne 0x4034d1
mov edx, dword [ebp - 8]
push edx
call fcn.0049a114
pop ecx
xor eax, eax
jmp 0x403508
xor eax, eax
mov edx, dword [ebp - 8]
mov ecx, edx
mov edx, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x14]
jge 0x4034fc
mov bl, byte [edx]
cmp bl, byte [ecx]
je 0x4034f4
mov eax, dword [ebp - 8]
push eax
call fcn.0049a114
pop ecx
xor eax, eax
jmp 0x403508
inc eax
inc ecx
inc edx
cmp eax, dword [ebp + 0x14]
jl 0x4034e0
mov edx, dword [ebp - 8]
push edx
call fcn.0049a114
pop ecx
mov al, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4035d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx + 4]
push ecx
call fcn.00402d18
add esp, 0xc
call fcn.004a2ec0
mov esi, eax
jmp 0x403605
call fcn.004a2ec0
sub eax, esi
cmp eax, 0x64
jg 0x403613
mov eax, dword [ebx + 4]
push eax
call fcn.00402f08
pop ecx
test eax, eax
jg 0x4035f9
pop esi
pop ebx
pop ebp
ret
Function at 0x4036f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
jle 0x403754
cmp byte [ebp + 0x24], 0
je 0x40371a
push edi
call fcn.00403310
pop ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [edi + 4]
push ecx
call fcn.00402d58
add esp, 0xc
call fcn.004a2ec0
mov ebx, eax
jmp 0x403743
call fcn.004a2ec0
sub eax, ebx
cmp eax, dword [ebp + 0x1c]
jg 0x403751
mov eax, dword [edi + 4]
push eax
call fcn.00402f08
pop ecx
test eax, eax
jg 0x403737
mov ebx, dword [ebp + 0x10]
test esi, esi
jle 0x403865
xor ebx, ebx
call fcn.004a2ec0
mov dword [ebp - 8], eax
jmp 0x403854
push 1
call sub.KERNEL32.DLL_Sleep
mov dword [ebp - 0xc], esi
mov eax, dword [edi + 4]
push eax
call fcn.00402ebc
pop ecx
cmp eax, dword [ebp - 0xc]
jl 0x4037ba
mov edx, dword [edi + 4]
push edx
call fcn.00402ebc
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp esi, ecx
jg 0x4037a1
mov eax, esi
sub eax, ebx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x14]
add ecx, ebx
push ecx
mov eax, dword [edi + 4]
push eax
call fcn.00402dc0
add esp, 0xc
add ebx, dword [ebp - 4]
cmp ebx, 5
jle 0x403850
test esi, 0xff
je 0x403850
cmp esi, 0x100
jge 0x403850
mov edx, dword [ebp + 0x14]
cmp byte [edx + ebx - 4], 0x4f
jne 0x403850
mov ecx, dword [ebp + 0x14]
cmp byte [ecx + ebx - 3], 0x4b
jne 0x403850
mov eax, dword [ebp + 0x14]
cmp byte [eax + ebx - 6], 0xd
jne 0x4037ff
mov edx, dword [ebp + 0x14]
cmp byte [edx + ebx - 5], 0xa
je 0x403813
mov ecx, dword [ebp + 0x14]
cmp byte [ecx + ebx - 6], 0xa
jne 0x403850
mov eax, dword [ebp + 0x14]
cmp byte [eax + ebx - 5], 0xd
jne 0x403850
mov edx, dword [ebp + 0x14]
cmp byte [edx + ebx - 2], 0xd
jne 0x403827
mov ecx, dword [ebp + 0x14]
cmp byte [ecx + ebx - 1], 0xa
je 0x40383b
mov eax, dword [ebp + 0x14]
cmp byte [eax + ebx - 2], 0xa
jne 0x403850
mov edx, dword [ebp + 0x14]
cmp byte [edx + ebx - 1], 0xd
jne 0x403850
cmp ebx, 4
jle 0x403865
cmp dword [ebp + 0x10], 0
jle 0x403865
mov ecx, dword [ebp + 0x14]
mov byte [ecx + ebx - 4], 0
jmp 0x403865
cmp esi, ebx
jle 0x403865
call fcn.004a2ec0
sub eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x1c]
jl 0x40376b
mov eax, dword [edi + 4]
push eax
call fcn.00402ebc
pop ecx
test eax, eax
jle 0x4038ab
test ebx, ebx
jne 0x4038ab
mov edx, dword [edi + 4]
push edx
call fcn.00402ebc
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp esi, ecx
jg 0x403892
sub esi, ebx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 0x14]
add edx, ebx
push edx
mov ecx, dword [edi + 4]
push ecx
call fcn.00402dc0
add esp, 0xc
add ebx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40580c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x405815
mov eax, dword [ebp - 4]
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0x2000
push 0
lea eax, [ebp - 0x2008]
push eax
call fcn.0049af44
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x2008]
mov edx, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x20]
jge 0x40585d
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, dword [ebp + 0x20]
jl 0x405851
call fcn.004a2ec0
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x39], 0
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
mov edx, dword [ebp + 0xc]
cmp byte [edx + 0x39], 0
je 0x405892
cmp byte [ebp + 0x2c], 0
je 0x405892
or eax, 0xffffffff
jmp 0x405942
cmp ebx, dword [ebp + 0x24]
jge 0x4058b1
mov edx, dword [ebp + 0x24]
lea ecx, [ebp - 0x2008]
push edx
push ebx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00403618
add esp, 0x10
mov ebx, eax
xor edx, edx
xor eax, eax
test esi, esi
je 0x4058f0
jmp 0x4058e7
mov ecx, edx
inc edx
movzx edi, byte [ebp + eax - 0x2008]
movzx ecx, byte [esi + ecx]
not edi
and edi, 0xff
and ecx, 0xff
cmp ecx, edi
je 0x4058e6
cmp edx, 1
jle 0x4058e4
dec edx
sub eax, edx
xor edx, edx
inc eax
cmp ebx, eax
jle 0x4058f0
cmp edx, dword [ebp + 0x14]
jl 0x4058bb
cmp edx, dword [ebp + 0x14]
jne 0x40592c
mov ecx, ebx
sub ecx, eax
cmp ecx, dword [ebp + 0x1c]
jl 0x40592c
xor edx, edx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 8], ecx
lea esi, [ebp + eax - 0x2008]
jmp 0x40591e
mov edi, dword [ebp - 8]
mov cl, byte [esi]
and cl, 0xff
inc edx
mov byte [edi], cl
inc dword [ebp - 8]
inc esi
mov ecx, ebx
sub ecx, eax
cmp edx, ecx
jl 0x40590f
sub ebx, eax
mov eax, ebx
jmp 0x405942
call fcn.004a2ec0
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x28]
jle 0x40586f
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40594c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x405955
mov eax, dword [ebp - 4]
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
push 0x2000
push 0
lea eax, [ebp - 0x2008]
push eax
call fcn.0049af44
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x2008]
mov edx, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x20]
jge 0x40599d
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, dword [ebp + 0x20]
jl 0x405991
call fcn.004a2ec0
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x39], 0
Function at 0x407648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, 1
mov dl, byte [eax]
xor dl, 0xa5
mov byte [ecx], dl
inc ecx
mov dl, byte [eax]
inc eax
cmp esi, dword [ebp + 0x10]
jge 0x407687
xor ebx, ebx
inc esi
mov bl, dl
and edx, 0xff
imul ebx, edx
inc ebx
and bl, 0xff
xor bl, byte [eax]
mov byte [ecx], bl
inc ecx
mov dl, byte [eax]
inc eax
cmp esi, dword [ebp + 0x10]
jl 0x407668
pop esi
pop ebx
pop ebp
ret

Function at 0x40a858
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 8
push eax
add esp, 0xfffffec8
lea eax, [ebp - 0x24]
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov esi, str.Spreadtrum_Boot_Block_version_2.0
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push eax
call fcn.0049b078
pop ecx
mov dword [ebp - 0x28], eax
push 0x52b4dc
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403510
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004036e0
pop ecx
xor ebx, ebx
mov byte [ebp - 0x138], 0x7e
mov byte [ebp - 0x29], 0
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
call fcn.004a2ec0
mov dword [ebp - 0x30], eax
push 1
call sub.KERNEL32.DLL_Sleep
push 1
lea edx, [ebp - 0x138]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
lea eax, [ebp - 0x1138]
push 0x1000
push ebx
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov ebx, eax
cmp ebx, 0x2a
jl 0x40a9c9
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
cmp esi, dword [ebp - 0x28]
jge 0x40a944
xor eax, eax
mov edx, dword [ebp - 0x34]
mov edi, edx
lea edx, [ebp - 0x1138]
cmp ebx, eax
jle 0x40a92e
mov cl, byte [edi]
cmp cl, byte [edx]
je 0x40a92e
inc eax
inc edx
cmp ebx, eax
jg 0x40a922
cmp ebx, eax
je 0x40a93b
mov edx, ebx
sub edx, eax
cmp edx, 0x1e
jg 0x40a944
inc esi
inc dword [ebp - 0x34]
cmp esi, dword [ebp - 0x28]
jl 0x40a911
mov eax, esi
xor edx, edx
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x38], ecx
jmp 0x40a982
mov ecx, dword [ebp - 0x38]
mov edi, eax
inc eax
movzx edi, byte [ebp + edi - 0x24]
movzx ecx, byte [ecx]
and ecx, 0xff
and edi, 0xff
cmp ecx, edi
je 0x40a975
mov eax, esi
jmp 0x40a97e
mov ecx, eax
sub ecx, esi
cmp ecx, 0x14
jg 0x40a98b
inc edx
inc dword [ebp - 0x38]
cmp ebx, edx
jle 0x40a98b
cmp eax, dword [ebp - 0x28]
jl 0x40a953
mov ecx, eax
sub ecx, esi
cmp ecx, 0x14
jle 0x40a9c9
lea ecx, [edx + 0x1f]
sub ecx, eax
cmp ebx, ecx
jle 0x40a9c3
test ecx, ecx
jle 0x40a9c3
cmp byte [ebp + ecx - 0x1138], 0x32
jne 0x40a9b3
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
jmp 0x40a9c3
cmp byte [ebp + ecx - 0x1138], 0x33
jne 0x40a9c3
mov edx, dword [ebp + 0x14]
mov byte [edx], 2
mov byte [ebp - 0x29], 1
jmp 0x40a9dc
call fcn.004a2ec0
sub eax, dword [ebp - 0x30]
cmp eax, 0x5dc
jle 0x40a8c4
cmp byte [ebp - 0x29], 0
je 0x40a9e6
xor eax, eax
jmp 0x40a9eb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a9f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffec8
push ebx
push esi
push edi
mov eax, 0x52ccec
call fcn.0049b3b8
mov edx, dword [0x502699]
mov dword [ebp - 0x34], edx
push 0x1000
push 0
lea ecx, [ebp - 0x1138]
push ecx
call fcn.0049af44
mov word [ebp - 0x20], 8
xor eax, eax
add esp, 0xc
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
inc dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
call fcn.00485424
lea edx, [ebp - 4]
push edx
mov edx, 0x52b4e9
lea eax, [ebp - 8]
call fcn.004a6cf4
inc dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
pop eax
call fcn.004a6eac
cmp dword [ebp - 0xc], 0
je 0x40aa7c
mov edx, dword [ebp - 0xc]
jmp 0x40aa81
mov edx, 0x52b4f0
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403510
add esp, 0xc
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a6e54
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a6e54
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a6e54
mov ecx, dword [ebp + 8]
push ecx
call fcn.004036e0
pop ecx
xor esi, esi
xor ebx, ebx
call fcn.004a2ec0
mov dword [ebp - 0x38], eax
push 1
call sub.KERNEL32.DLL_Sleep
push 4
lea eax, [ebp - 0x34]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov edi, eax
push 1
call sub.KERNEL32.DLL_Sleep
push 0x1000
push esi
lea eax, [ebp - 0x1138]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov esi, eax
cmp esi, 0xc
jl 0x40ab74
xor edx, edx
lea eax, [ebp - 0x1138]
mov cl, byte [eax]
cmp cl, byte [ebp - 0x34]
jne 0x40ab3e
mov cl, byte [eax + 1]
cmp cl, byte [ebp - 0x33]
jne 0x40ab45
mov cl, byte [eax + 2]
cmp cl, byte [ebp - 0x32]
jne 0x40ab45
inc edx
inc eax
cmp edx, 1
jl 0x40ab27
dec edx
jne 0x40ab58
call fcn.004a2ec0
sub eax, edi
cmp eax, 0xc8
jg 0x40ab86
jmp 0x40aaf8
xor edx, edx
mov eax, esi
sub eax, edx
mov al, byte [ebp + eax - 0x1139]
cmp al, byte [ebp - 0x31]
jne 0x40ab6e
mov bl, 1
jmp 0x40ab74
inc edx
cmp edx, 1
jl 0x40ab5a
call fcn.004a2ec0
sub eax, edi
cmp eax, 0xc8
jle 0x40aaf8
test bl, bl
je 0x40ab98
xor eax, eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x40abba
call fcn.004a2ec0
sub eax, dword [ebp - 0x38]
cmp eax, 0x320
jle 0x40aad8
mov eax, 1
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40abc4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x40abcd
mov eax, dword [ebp - 4]
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, 0x52cd20
call fcn.0049b3b8
mov word [ebp - 0x14], 8
push str.19200_N_8_1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403510
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004036e0
pop ecx
mov byte [ebp - 0x33], 0
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x32]
mov byte [edx + 0x39], 0
mov byte [ebp - 0x32], 0x3c
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0x3e
mov byte [ebp - 0x2e], 0x69
push 3
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x28], eax
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
xor ebx, ebx
push 0x10000
push 0
lea eax, [ebp - 0x10034]
push eax
call fcn.0049af44
add esp, 0xc
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
mov edx, dword [ebp + 0xc]
cmp byte [edx + 0x39], 0
jne 0x40ad11
cmp ebx, 0xe000
jle 0x40ac8b
xor ebx, ebx
push 0x64
push ebx
lea eax, [ebp - 0x10034]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov ebx, eax
cmp ebx, 3
jl 0x40acd7
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x10034]
jmp 0x40acc3
mov edi, eax
inc eax
mov cl, byte [edx]
cmp cl, byte [ebp + edi - 0x2f]
je 0x40acc1
xor eax, eax
inc esi
inc edx
cmp ebx, esi
jle 0x40accc
cmp eax, 2
jl 0x40acb4
cmp eax, 2
jne 0x40acd7
mov byte [ebp - 0x33], 1
jmp 0x40ad11
call fcn.004a2ec0
sub eax, dword [ebp - 0x2c]
cmp eax, 0xa
jle 0x40acfe
push 3
lea edx, [ebp - 0x32]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
call fcn.004a2ec0
sub eax, dword [ebp - 0x28]
cmp eax, 0x3e8
jle 0x40ac68
cmp byte [ebp - 0x33], 0
je 0x40ad1b
xor ebx, ebx
jmp 0x40ad30
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
je 0x40ad2b
mov ebx, 0x64
jmp 0x40ad30
mov ebx, 0xc8
mov eax, ebx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40ad5a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret