joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410445
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
ret

Function at 0x41167a
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], vtable.CSHA1.0
jmp fcn.00410445

Function at 0x41170b
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x4117e9
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push edi
push 4
lea eax, [ebp - 4]
push eax
push 4
mov edi, 0xffff
push edi
push ebx
mov dword [ebp - 4], 1
call esi
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push edi
push ebx
mov dword [ebp - 4], 0x40000
call esi
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push edi
push ebx
mov dword [ebp - 4], 0x4000
call esi
lea eax, [ebp - 8]
push eax
push 0x8004667e
push ebx
mov dword [ebp - 8], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x4117e0
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push edi
push ebx
call esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 2
pop eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4117ca
cmp byte [eax], 0
je 0x4117ca
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
jmp 0x4117ce
and dword [ebp - 0x14], 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4117e5
or eax, 0xffffffff
jmp 0x4117e7
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4117ee
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x411810
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x411810
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
jmp 0x411812
xor eax, eax
ret 4

Function at 0x411815
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push edi
push 2
or edi, 0xffffffff
pop eax
mov dword [ebp - 4], 0x10
mov word [ebp - 0x14], ax
cmp dword [ebp + 8], edi
jne 0x41183e
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, edi
jmp 0x4118a8
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x240
lea eax, [ebp - 0x254]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 1
jge 0x411869
cmp esi, edi
jne 0x41189a
test esi, esi
jne 0x411876
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, edi
jmp 0x4118a7
cmp esi, edi
je 0x41189f
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [ebp + 0xc]
movzx eax, ax
push esi
lea ecx, [ebp - 0x254]
push ecx
push eax
push dword [ebp - 0x10]
call fcn.0040838a
xor eax, eax
inc eax
jmp 0x4118a7
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor eax, eax
pop esi
pop edi
leave
ret 0xc
Function at 0x4118ad
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x4118be
or eax, 0xffffffff
jmp 0x41191b
push esi
push dword [ebp + 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [ebp + 0x10]
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0x14]
push 2
mov dword [ebp - 0xc], eax
pop eax
mov word [ebp - 0x10], ax
movzx eax, word [ebp + 0x18]
push 0
push eax
push esi
push dword [ebp + 0xc]
call fcn.00411fde
add esp, 0x10
inc esi
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x464538
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
je 0x4118f0
pop esi
cmp eax, 0xffffffff
je 0x411915
xor eax, eax
jmp 0x41191b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
leave
ret 0x14

Function at 0x411947
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x50
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x4119ab
push ebx
push esi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x4119a9
mov eax, dword [ebx + 0xc]
cmp dword [eax], esi
je 0x4119a9
push edi
mov edi, dword [ebp + 8]
cmp esi, 0x28
jge 0x4119a8
mov eax, dword [esi + eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, edi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x41198f
mov eax, dword [ebx + 0xc]
add esi, 4
add edi, 0x10
cmp dword [esi + eax], 0
jne 0x41197d
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x411fde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
test edi, edi
jle 0x411ffe
mov dl, byte [eax + esi]
and dl, 0xaa
xor cl, dl
inc eax
cmp eax, edi
jl 0x411ff1
push edi
push esi
push 0x464539
mov byte [0x464538], cl
call fcn.0041e0c0
add esp, 0xc
xor edx, edx
test edi, edi
jle 0x412040
cmp dword [ebp + 0x14], 0
lea ecx, [edx + 0x464539]
movzx eax, byte [ecx]
mov al, byte [eax + 0x460cc0]
mov byte [ecx], al
je 0x412037
xor al, byte [ebp + 0x10]
xor al, 0xcc
mov byte [ecx], al
xor dword [ebp + 0x14], 1
inc edx
cmp edx, edi
jl 0x412019
pop edi
pop esi
pop ebp
ret
Function at 0x412493
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x4124b3
push ebx
push ebx
push ebx
push 2
call fcn.00413a8f
xor al, al
jmp 0x412570
push esi
call fcn.00412308
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 8]
call fcn.0041ffe1
push dword [ebp + 8]
call fcn.0041fee9
push ebx
push ebx
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], esi
call fcn.0041ffe1
add esp, 0x1c
cmp esi, ebx
jg 0x4124f1
push ebx
push ebx
push ebx
push 0xc
jmp 0x41251e
inc esi
push esi
call fcn.0041e884
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
mov byte [esi], bl
push esi
call fcn.0041fd2f
add esp, 0x14
cmp eax, 1
je 0x412529
push esi
call fcn.0041f05b
pop ecx
push ebx
push ebx
push ebx
push 2
mov ecx, edi
call fcn.00413a8f
xor al, al
jmp 0x41256f
mov edx, dword [ebp - 4]
mov byte [esi + edx], bl
mov ecx, esi
mov eax, esi
cmp byte [esi], bl
je 0x412552
mov dl, byte [ecx]
cmp dl, 0xd
jne 0x41254a
mov byte [eax], 0xa
inc eax
inc ecx
cmp byte [ecx], 0xa
jne 0x41254e
jmp 0x41254d
mov byte [eax], dl
inc eax
inc ecx
cmp byte [ecx], bl
jne 0x412537
push dword [ebp + 0xc]
mov byte [eax], bl
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 8]
push esi
call fcn.0041f05b
xor eax, eax
cmp byte [edi + 0x2c], bl
pop ecx
sete al
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x41623e
Capabilities:
Create thread
Set console window title

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call ebx
mov ebp, 0x4000
push ebp
push eax
call fcn.00421416
push 0x434c08
push eax
call fcn.00420eb1
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
call fcn.00420cfc
push 8
pop ecx
push 0
mov edi, eax
push 4
add edi, 0x20
lea esi, [esp + 0x18]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.00420cfc
add eax, 0x20
push eax
call fcn.00420bfe
add esp, 0x10
push 0xfffffffffffffff6
call ebx
push ebp
push eax
call fcn.00421416
push 0x436908
push eax
call fcn.00420eb1
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
call fcn.00420cfc
push 8
pop ecx
push 0
mov edi, eax
push 4
lea esi, [esp + 0x18]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.00420cfc
push eax
call fcn.00420bfe
add esp, 0x10
push 0xfffffffffffffff4
call ebx
push ebp
push eax
call fcn.00421416
push 0x434c08
push eax
call fcn.00420eb1
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
call fcn.00420cfc
mov edi, eax
add edi, 0x40
push 8
pop ecx
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 4
push esi
call fcn.00420cfc
add eax, 0x40
push eax
call fcn.00420bfe
push 1
call fcn.00416196
add esp, 0x14
push str.RakSAMP_v0.8.6_0.3.DL
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
push esi
push esi
push 0x4161c0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push 0x416218
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x416371
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433d78
call fcn.0041f03c
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x41657b
push edi
lea ecx, [ebp - 0x120]
call fcn.0040104b
mov dword [ebp - 4], ebx
cmp dword [0x485750], ebx
je 0x41656b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4e2b9c]
cmp dword [0x485750], eax
jae 0x41656b
mov eax, 0xffff
cmp word [ebp + 0x10], ax
je 0x4164df
movzx eax, word [ebp + 0x10]
imul eax, eax, 0x153
cmp dword [eax + 0x485788], ebx
je 0x41656b
mov cx, word [0x4e2fcf]
mov word [esi], cx
mov cx, word [eax + 0x4857fc]
mov word [esi + 2], cx
mov cx, word [eax + 0x4857fe]
mov word [esi + 4], cx
mov cx, word [eax + 0x485800]
mov word [esi + 6], cx
fld dword [eax + 0x485802]
fstp dword [esi + 8]
fld dword [eax + 0x485806]
fstp dword [esi + 0xc]
fld dword [eax + 0x48580a]
fstp dword [esi + 0x10]
fld dword [eax + 0x48580e]
fstp dword [esi + 0x14]
fld dword [eax + 0x485812]
fadd dword [0x4e2fd3]
fstp dword [esi + 0x18]
fld dword [eax + 0x485816]
fadd dword [0x4e2fd7]
fstp dword [esi + 0x1c]
fld dword [eax + 0x48581a]
fadd dword [0x4e2fdb]
fstp dword [esi + 0x20]
fld dword [eax + 0x48581e]
fstp dword [esi + 0x24]
fld dword [eax + 0x485822]
fstp dword [esi + 0x28]
fld dword [eax + 0x485826]
fstp dword [esi + 0x2c]
fld dword [eax + 0x48582a]
fstp dword [esi + 0x30]
cmp byte [0x4e2ff3], bl
jne 0x4164a4
mov cl, byte [eax + 0x48582e]
mov byte [esi + 0x34], cl
mov cl, byte [eax + 0x48582f]
mov byte [esi + 0x35], cl
mov cl, byte [0x4e3011]
cmp cl, bl
jne 0x4164b4
mov cl, byte [eax + 0x485830]
mov byte [esi + 0x36], cl
mov cl, byte [eax + 0x485831]
mov byte [esi + 0x37], cl
mov cl, byte [eax + 0x485832]
mov byte [esi + 0x38], cl
mov cx, word [eax + 0x485833]
mov word [esi + 0x39], cx
fld dword [eax + 0x485835]
fstp dword [esi + 0x3b]
jmp 0x41650d
movzx eax, word [esi]
imul eax, eax, 0x14
cmp dword [eax + 0x4d8910], ebx
je 0x41656b
cmp dword [ebp + 0xc], ebx
je 0x41650d
fld dword [eax + 0x4d8914]
fstp dword [esi + 0x18]
fld dword [eax + 0x4d8918]
fstp dword [esi + 0x1c]
fld dword [eax + 0x4d891c]
fstp dword [esi + 0x20]
fld dword [esi + 0x18]
push 1
fstp dword [0x4e3005]
push 8
fld dword [esi + 0x1c]
lea eax, [ebp + 8]
fstp dword [0x4e3009]
push eax
fld dword [esi + 0x20]
lea ecx, [ebp - 0x120]
fstp dword [0x4e300d]
mov byte [ebp + 8], 0xc8
call fcn.0040155c
push 0x3f
push esi
lea ecx, [ebp - 0x120]
call fcn.0040160f
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push ebx
push 7
push 1
lea edx, [ebp - 0x120]
push edx
call dword [eax + 0x18]
call edi
mov dword [0x485750], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401110
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x416589
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433c46
call fcn.0041f03c
sub esp, 0x12c
push esi
movzx esi, word [ebp + 8]
imul esi, esi, 0x14
push edi
xor edi, edi
cmp dword [esi + 0x4d8910], edi
je 0x416685
cmp dword [0x48575c], edi
je 0x416685
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x4e2b9c]
cmp dword [0x48575c], eax
jae 0x416684
lea ecx, [ebp - 0x138]
call fcn.0040104b
fld dword [esi + 0x4d8914]
mov dword [ebp - 4], edi
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
fstp dword [ebp - 0x18]
fld dword [esi + 0x4d8918]
fstp dword [ebp - 0x14]
fld dword [esi + 0x4d891c]
mov ax, word [ebp + 8]
fstp dword [ebp - 0x10]
fld dword [0x4e2ffc]
mov word [ebp - 0x24], ax
call fcn.00421566
mov byte [ebp - 0x20], al
fld dword [0x4e3000]
call fcn.00421566
push 1
mov byte [ebp - 0x1f], al
push 8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x138]
mov byte [ebp + 8], 0xd3
call fcn.0040155c
push 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040160f
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push 0
push 7
push 1
lea edx, [ebp - 0x138]
push edx
call dword [eax + 0x18]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
mov dword [0x48575c], eax
call fcn.00401110
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x416693
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433d24
call fcn.0041f03c
sub esp, 0x138
push esi
xor esi, esi
cmp dword [0x485760], esi
je 0x4167f2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x4e26fc]
cmp dword [0x485760], eax
jae 0x4167f1
push edi
lea ecx, [ebp - 0x144]
call fcn.0040104b
mov eax, 0xffff
mov dword [ebp - 4], esi
cmp word [ebp + 0x10], ax
je 0x41673d
movzx eax, word [ebp + 0x10]
imul eax, eax, 0x153
cmp dword [eax + 0x485788], esi
je 0x4167e1
fldz
push 7
lea esi, [eax + 0x485851]
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
fcom dword [ebp - 0x23]
fnstsw ax
test ah, 0x44
jp 0x416739
fcom dword [ebp - 0x1f]
fnstsw ax
test ah, 0x44
jp 0x416739
fcomp dword [ebp - 0x1b]
fnstsw ax
test ah, 0x44
jp 0x41679a
fld dword [0x43690c]
fstp dword [ebp - 0x23]
jmp 0x41679a
fstp st(0)
jmp 0x41679a
cmp dword [ebp + 0xc], esi
je 0x416758
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
or byte [eax + 0x48586e], 0xc0
jmp 0x416782
mov ecx, dword [ebp + 8]
cmp ecx, 1
jbe 0x416763
push 2
pop ecx
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
lea esi, [eax + 0x48586e]
mov dl, byte [esi]
and dl, 0x3f
shl cl, 6
or dl, cl
mov byte [esi], dl
push 7
mov byte [eax + 0x48586f], 0x55
lea esi, [eax + 0x485851]
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 1
push 8
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 0x10], 0xcb
call fcn.0040155c
push 0x1f
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x144]
call fcn.0040160f
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push 0
push 7
push 1
lea edx, [ebp - 0x144]
push edx
call dword [eax + 0x18]
call ebx
mov dword [0x485760], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00401110
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x416b2f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433d78
call fcn.0041f03c
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x416d1e
push edi
lea ecx, [ebp - 0x120]
call fcn.0040104b
mov dword [ebp - 4], ebx
cmp dword [0x485754], ebx
je 0x416d0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e25c4]
cmp dword [0x485754], eax
jae 0x416d0e
mov edi, 0xffff
mov eax, edi
cmp word [ebp + 0x10], ax
je 0x416c8d
movzx eax, word [ebp + 0x10]
imul eax, eax, 0x153
cmp dword [eax + 0x485788], ebx
je 0x416d0e
cmp dword [0x485748], ebx
jne 0x416d0e
cmp dword [0x48574c], ebx
jne 0x416d0e
mov cx, word [eax + 0x4857b6]
mov word [esi], cx
mov cx, word [eax + 0x4857b8]
mov word [esi + 2], cx
mov cx, word [eax + 0x4857ba]
mov word [esi + 4], cx
fld dword [eax + 0x4857bc]
fadd dword [0x4e2fd3]
fstp dword [esi + 6]
fld dword [eax + 0x4857c0]
fadd dword [0x4e2fd7]
fstp dword [esi + 0xa]
fld dword [eax + 0x4857c4]
fadd dword [0x4e2fdb]
fstp dword [esi + 0xe]
fld dword [eax + 0x4857c8]
fstp dword [esi + 0x12]
fld dword [eax + 0x4857cc]
fstp dword [esi + 0x16]
fld dword [eax + 0x4857d0]
fstp dword [esi + 0x1a]
fld dword [eax + 0x4857d4]
fstp dword [esi + 0x1e]
cmp byte [0x4e2ff3], bl
jne 0x416c4b
mov cl, byte [eax + 0x4857d8]
mov byte [esi + 0x22], cl
mov cl, byte [eax + 0x4857d9]
mov byte [esi + 0x23], cl
mov cl, byte [0x4e3011]
cmp cl, bl
jne 0x416c5b
mov cl, byte [eax + 0x4857da]
mov byte [esi + 0x24], cl
mov cl, byte [eax + 0x4857db]
mov byte [esi + 0x25], cl
fld dword [eax + 0x4857dc]
fstp dword [esi + 0x26]
fld dword [eax + 0x4857e0]
fstp dword [esi + 0x2a]
fld dword [eax + 0x4857e4]
fstp dword [esi + 0x2e]
mov eax, dword [eax + 0x4857f6]
mov dword [esi + 0x40], eax
jmp 0x416c99
mov al, byte [0x4e3011]
cmp al, bl
je 0x416c99
mov byte [esi + 0x24], al
fld dword [esi + 6]
push 1
fstp dword [0x4e3005]
push 8
fld dword [esi + 0xa]
lea eax, [ebp + 8]
fstp dword [0x4e3009]
push eax
fld dword [esi + 0xe]
lea ecx, [ebp - 0x120]
fstp dword [0x4e300d]
mov byte [ebp + 8], 0xcf
call fcn.0040155c
push 0x44
push esi
lea ecx, [ebp - 0x120]
call fcn.0040160f
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push ebx
push 7
push 1
lea edx, [ebp - 0x120]
push edx
call dword [eax + 0x18]
cmp dword [ebp + 0xc], ebx
je 0x416d03
cmp byte [esi + 0x22], bl
jne 0x416d03
push edi
push ebx
call fcn.00416a14
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x485754], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401110
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x417810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp dword [eax + 0x4857b0], esi
je 0x41785d
push 0x3f
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0041e4c0
mov ax, word [ebp + 0xc]
push ebx
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00416371
push ebx
push esi
push esi
call fcn.00416693
add esp, 0x24
cmp dword [0x4e25a0], esi
je 0x4178dc
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, 0x2710
cmp dword [0x4e25a0], eax
jae 0x4178dc
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
cmp dword [eax + 0x4857b0], esi
jne 0x4178d3
movzx eax, bx
imul eax, eax, 0x153
mov ecx, 0xffff
cmp word [eax + 0x4857fa], cx
je 0x4178f8
movzx eax, word [0x4e2fcf]
push esi
push eax
call fcn.004168f1
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
pop ecx
pop ecx
mov dword [eax + 0x4857b0], 1
mov dword [0x4e25a0], esi
call edi
mov dword [0x4e25a0], eax
jmp 0x4178f8
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
cmp dword [eax + 0x4857b0], esi
jne 0x4178f8
push ebx
call fcn.004177de
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417b42
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4e25a8]
cmp eax, dword [0x4e2f86]
jb 0x417b99
call fcn.004217d3
and eax, reloc.WS2_32.dll_ntohs
jns 0x417b6a
dec eax
or eax, 0xfffffff0
inc eax
add eax, 3
push eax
push 0x485768
call fcn.00416ff8
push 0
mov byte [0x4e2ba0], 1
call fcn.004179fb
push 1
push 1
call fcn.00418e9d
add esp, 0x14
call esi
mov dword [0x4e25a8], eax
pop esi
ret
Function at 0x417dfa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [0x4e3004], 0
push ebx
push esi
push edi
je 0x417f9d
cmp byte [0x4e26f6], 0
je 0x417f9d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e25a4]
cmp eax, dword [0x4e2f9e]
jb 0x417f9d
mov si, word [0x4e25ac]
mov eax, 0x3ec
cmp si, ax
jae 0x417ff8
cmp si, word [0x4d890c]
je 0x417fa4
movzx edi, si
imul edi, edi, 0x153
xor eax, eax
cmp dword [edi + 0x485788], eax
je 0x417fa4
cmp dword [edi + 0x48578c], eax
jne 0x417e82
cmp dword [edi + 0x485790], eax
je 0x417fa4
cmp dword [0x4e2f44], 4
mov ebx, 0x4e2fbb
jne 0x417eb7
push ebx
call fcn.00417b9b
movzx eax, ax
pop ecx
mov ecx, 0xffff
cmp ax, cx
je 0x417eb7
cmp ax, si
jne 0x417eb7
inc si
mov word [0x4e25ac], si
jmp 0x417fa4
fld dword [0x4e3005]
mov byte [ebp - 0x2c], 1
fstp dword [ebp - 0x29]
mov word [ebp - 0x2b], si
fld dword [0x4e3009]
fstp dword [ebp - 0x25]
fld dword [0x4e300d]
fstp dword [ebp - 0x21]
fld dword [edi + 0x4857bc]
fstp dword [ebp - 0x1d]
fld dword [edi + 0x4857c0]
fstp dword [ebp - 0x19]
fld dword [edi + 0x4857c4]
fstp dword [ebp - 0x15]
call fcn.004217d3
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fdiv qword [0x436e00]
fstp dword [ebp - 0x11]
call fcn.004217d3
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fdiv qword [0x436e00]
fstp dword [ebp - 0xd]
call fcn.004217d3
cdq
push 0xa
pop ecx
idiv ecx
mov al, byte [0x4e3011]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fdiv qword [0x436e00]
fstp dword [ebp - 9]
test al, al
jne 0x417f7e
mov eax, dword [0x4e2f44]
cmp eax, 4
je 0x417f5b
cmp eax, 5
jne 0x417f81
push ebx
call fcn.00417b9b
movzx eax, ax
pop ecx
mov ecx, 0xffff
cmp ax, cx
je 0x417f81
movzx eax, ax
imul eax, eax, 0x153
mov al, byte [eax + 0x4857da]
mov byte [ebp - 5], al
lea eax, [ebp - 0x2c]
push eax
call fcn.00416878
inc word [0x4e25ac]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e25a4], eax
mov si, word [0x4e25ac]
mov ecx, 0x3ec
mov eax, ecx
cmp si, ax
jae 0x417ff8
xor edx, edx
mov eax, ecx
cmp si, ax
jae 0x417fe3
cmp si, word [0x4d890c]
je 0x417fe3
movzx eax, si
imul eax, eax, 0x153
cmp dword [eax + 0x485788], edx
je 0x417fe3
cmp dword [eax + 0x48578c], edx
jne 0x417ff3
cmp dword [eax + 0x485790], edx
jne 0x417ff3
inc si
mov eax, ecx
mov word [0x4e25ac], si
cmp si, ax
jb 0x417fb2
cmp si, cx
jb 0x418000
xor eax, eax
mov word [0x4e25ac], ax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418005
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x4e2bd0], esi
je 0x418058
push esi
push esi
push 2
push dword [0x4e2bdc]
mov dword [0x4e2bd0], esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4e2bdc]
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x436e08
call dword [sym.imp.USER32.dll_UnregisterClassA]
push esi
push dword [0x4e2bd8]
mov dword [0x4e2bd4], esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push esi
push esi
push 0x41d02d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e2bd8], eax
pop esi
ret