joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a4e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a616
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45a5d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040523c
mov eax, dword [ebp - 0x14]
call fcn.00405304
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x50]
lea eax, [edx + eax + 1]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 8]
call fcn.00403cd8
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x18]
call fcn.004052a8
push dword [ebp - 0x18]
push 0x45a62c
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0xc]
call fcn.0040523c
push dword [ebp - 0x11c]
mov eax, dword [ebp - 4]
add eax, 0x7c
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 4]
add eax, 0x78
call fcn.00405044
mov eax, dword [ebp - 4]
call fcn.004599f4
test al, al
jne 0x45a5b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a5f0
push 1
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a5f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a61d
lea eax, [ebp - 0x11c]
call fcn.00405044
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405068
ret
Function at 0x4632cc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46333a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xfd
lea eax, [ebp - 8]
mov edx, 0xfe
call fcn.00405690
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00405690
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463341
lea eax, [ebp - 8]
call fcn.00405044
ret
Function at 0x463730
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
mov eax, dword [ebp - 8]
call fcn.004054f4
xor eax, eax
push ebp
push 0x463931
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4638fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0044e5f8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x148], 0x128
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x14]
call fcn.0044e618
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x463818
lea eax, [ebp - 0x1a4]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004052b4
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x1a0]
call fcn.0040983c
mov eax, dword [ebp - 0x1a0]
mov edx, 0x463948
call fcn.00405450
jne 0x463807
mov eax, dword [ebp - 0x140]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x1c], eax
jmp 0x46381e
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x14]
call fcn.0044e638
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4637b6
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x1c], 0
jne 0x46383a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463906
lea eax, [ebp - 0x19c]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x18]
push eax
push 0xb
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x20], eax
cmp dword [ebp - 4], 0
jne 0x463891
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_ImpersonateLoggedOnUser
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x46388a
lea eax, [ebp - 0x1a8]
call fcn.004632cc
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0xc]
call fcn.00405098
call sub.advapi32.dll_RevertToSelf
jmp 0x4638e9
cmp dword [ebp - 0x20], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4638e9
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
mov eax, dword [ebp - 4]
call fcn.00405504
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
sbb eax, eax
inc eax
test al, al
jne 0x4638e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463906
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463906
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463938
lea eax, [ebp - 0x1a8]
mov edx, 3
call fcn.00405068
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405068
ret
Function at 0x4639e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
mov eax, dword [ebp - 8]
call fcn.004054f4
xor eax, eax
push ebp
push 0x463b1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004050dc
lea eax, [ebp - 0x10]
mov ecx, 0x463b30
mov edx, dword [ebp - 0x14]
call fcn.00405350
mov eax, dword [ebp - 4]
call fcn.0040a4d4
test al, al
jne 0x463a4d
mov byte [ebp - 9], 0
jmp 0x463af2
call fcn.004373d4
cmp al, 6
jb 0x463acc
call fcn.004358c4
test al, al
je 0x463acc
call fcn.004373d4
cmp al, 6
jbe 0x463a9a
push 0x463b3c
push dword [ebp - 0x14]
push 0x463b48
push dword [ebp - 8]
push 0x463b3c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004053c4
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00463388
jmp 0x463af2
push 0x463b3c
push dword [ebp - 0x14]
push 0x463b48
push dword [ebp - 8]
push 0x463b3c
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004053c4
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00463730
jmp 0x463af2
push 1
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
lea eax, [ebp - 0x10]
call fcn.0040555c
push eax
push 0x463b4c
mov eax, dword [0x4d6b84]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463b21
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00405068
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405068
ret

Function at 0x4643d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], al
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x4d6d4c]
cmp eax, 0x64
jbe 0x464462
call sub.kernel32.dll_GetTickCount_1
mov dword [0x4d6d4c], eax
test byte [ebp - 1], 1
jbe 0x464423
xor eax, eax
push ebp
push 0x464419
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.00464304
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x464423
test byte [ebp - 1], 2
jbe 0x464462
xor eax, eax
push ebp
push 0x464458
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0xf170
push 0x112
mov eax, dword [0x4d6b84]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x464462
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4644e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
xor eax, eax
push ebp
push 0x4645e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4645bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a824
push dword [ebp - 0xc]
push 0x4645f8
push 0x464604
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 8]
call fcn.0040a4d4
test al, al
jne 0x46458a
push 0x10
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x464620
call fcn.00405350
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x44df70]
call fcn.0044dff4
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4645c6
push 1
push dword [ebp - 8]
push 0x46463c
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0x18]
call fcn.00405504
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4645c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4645e8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405068
ret

Function at 0x464b30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
je 0x464c24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.00427eb8
xor eax, eax
push ebp
push 0x464c1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 9
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00465388
cmp dword [ebp - 0xc], 9
jbe 0x464ba2
mov eax, dword [ebp - 0xc]
sub eax, 9
push eax
mov eax, dword [ebp - 8]
lea ecx, [eax + 9]
mov eax, dword [ebp - 8]
lea edx, [eax + 9]
mov eax, dword [ebp - 4]
call fcn.00465388
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jmp 0x464bec
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x464bde
mov dword [ebp - 0x10], 0xffffffff
jmp 0x464c01
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x464c01
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x464c01
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
jne 0x464baa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464c24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.00427ec0
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x464c2c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
je 0x464d3a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.00427eb8
xor eax, eax
push ebp
push 0x464d33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.00406354
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov ax, word [ebp - 6]
call fcn.00449d38
push 9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00465388
cmp dword [ebp + 8], 0
jbe 0x464cb4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 9]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00465388
add dword [ebp + 8], 9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x464d02
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x464cf4
mov dword [ebp - 0x10], 0xffffffff
jmp 0x464d17
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x464d17
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x464d17
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
jne 0x464cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464d3a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.00427ec0
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x466b84
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x466b8a
ret

Function at 0x469058
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4690a9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x469090
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x469080
jmp 0x4690a9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x469091
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46eb48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
jne 0x46ebb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x46ebbc
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46ebb8
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x46ebd0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret
Function at 0x46f090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
test dl, dl
je 0x46f0a5
add esp, 0xfffffff0
call fcn.0040454c
mov word [ebp - 8], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov word [eax + 0x3c], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x3e], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x2000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040981c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x46f10c
mov ecx, 0x46f22c
mov dl, 1
mov eax, dword [0x408bc8]
call fcn.0040de04
call fcn.004049b4
cmp dword [ebp - 0x9c], 2
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x30], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x46f14a
mov eax, 8
call fcn.00402b20
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, 8
call fcn.00402b20
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
jmp 0x46f1ee
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x46f24c
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46f183
mov ecx, 0x46f268
mov dl, 1
mov eax, dword [0x408bc8]
call fcn.0040de04
call fcn.004049b4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x46f290
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
push 0x20019
push 0
push 0x46f2a0
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46f1ee
mov ecx, 0x46f2bc
mov dl, 1
mov eax, dword [0x408bc8]
call fcn.0040de04
call fcn.004049b4
mov eax, dword [ebp - 4]
call fcn.0046ede0
mov dx, word [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046ebe0
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x46f21a
call fcn.004045a4
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x472854
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x54]
mov edx, dword [ebp - 4]
imul word [edx + 0x70]
mov word [ebp - 6], ax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd8]
mov eax, dword [eax + 0x54]
mov eax, dword [eax + 0x20]
or eax, 0xcc0020
push eax
movzx eax, word [ebp - 6]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xb5]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb1]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x70]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb9]
push eax
movzx eax, word [ebp - 6]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.0046cb34
call fcn.0046876c
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
inc word [eax + 0x54]
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x54]
mov edx, dword [ebp - 4]
cmp ax, word [edx + 0x6e]
jbe 0x4729f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x54]
cmp byte [eax + 0x10], 0
je 0x472967
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x50]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xd5]
cmp eax, edx
ja 0x472967
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x47291a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd8]
mov eax, dword [eax + 0x54]
cmp byte [eax + 4], 0
jne 0x47291a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd8]
mov eax, dword [eax + 0x54]
cmp byte [eax + 5], 0
je 0x47291a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov eax, dword [ebp - 4]
mov word [eax + 0x54], 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x5a]
xor al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x5a], al
push 0x4d6e70
call sub.kernel32.dll_QueryPerformanceCounter_1
push 0x4d6e58
call sub.kernel32.dll_QueryPerformanceFrequency
mov eax, dword [0x4d6e70]
mov edx, dword [0x4d6e74]
sub eax, dword [0x4d6e60]
sbb edx, dword [0x4d6e64]
mov dword [0x4d6e68], eax
mov dword [0x4d6e6c], edx
fild qword [0x4d6e68]
fild qword [0x4d6e58]
fdivp st(1)
fdivr dword [0x4729f8]
fstp qword [0x4d6e78]
wait
mov eax, dword [0x4d6e70]
mov dword [0x4d6e60], eax
mov eax, dword [0x4d6e74]
mov dword [0x4d6e64], eax
mov esp, ebp
pop ebp
ret
Function at 0x472bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x472c0d
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x472bea
mov esp, ebp
pop ebp
ret
Function at 0x476ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477295
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x477253
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x476f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47725d
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x476e90]
call fcn.00406528
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
call fcn.0040856c
cmp dword [ebp + 8], 0
jbe 0x476f60
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + 0xc]
add eax, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040856c
xor eax, eax
push ebp
push 0x476ff7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.00427eb8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xd4], edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
shr eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x476fdb
mov eax, dword [ebp - 0x30]
dec eax
test eax, eax
jl 0x476fdb
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
movsx eax, word [eax + edx*2]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd4]
call fcn.00424224
mov edx, dword [ebp - 4]
mov dword [edx + 0xd4], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x34]
jne 0x476fab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476ffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.00427ec0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47729c
lea eax, [ebp - 0x24]
mov edx, dword [0x476eb0]
call fcn.00406654
lea eax, [ebp - 0x20]
mov edx, dword [0x476e90]
call fcn.00406654
lea eax, [ebp - 0x18]
mov edx, dword [0x476e70]
call fcn.00406654
ret