joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523204
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x523351
cmp byte [ebx], 0
je 0x523351
mov esi, edi
test edi, edi
je 0x523351
cmp word [ebx + 0x92], 0
jl 0x523351
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x92]
cmp eax, edx
jle 0x523351
cmp byte [ebx + 0x96], 0
jbe 0x523351
movzx eax, byte [ebx + 0x96]
mov edx, 0xa
call fcn.0047a1ec
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.0047a1ec
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 8]
cmp edi, eax
ja 0x5232b8
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 8], eax
inc byte [esi + 4]
movzx eax, byte [esi + 4]
cmp al, byte [ebx + 0x96]
jb 0x5232c8
mov byte [esi + 4], 0
movsx edx, word [ebx + 0x92]
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
je 0x523351
lea eax, [ebp - 0xc]
push eax
movzx edx, word [ebx + 0x94]
movzx eax, byte [esi + 4]
add edx, eax
lea ecx, [ebp - 8]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x18]
movsx edx, word [ebx + 0x97]
add dword [ebp - 8], edx
movsx edx, word [ebx + 0x99]
add dword [ebp - 0xc], edx
test eax, eax
je 0x523351
push eax
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub ebx, edx
sub ebx, dword [eax + 8]
sar ebx, 1
jns 0x523327
adc ebx, 0
add ebx, edx
add ebx, dword [ebp - 8]
dec ebx
mov edx, ebx
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub ebx, ecx
sub ebx, dword [eax + 4]
sar ebx, 1
jns 0x523341
adc ebx, 0
add ebx, ecx
add ebx, dword [ebp - 0xc]
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0047ad58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52335c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x52347c
cmp byte [ebx], 0
je 0x52347c
mov esi, edi
test edi, edi
je 0x52347c
cmp word [ebx + 0x92], 0
jl 0x52347c
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x92]
cmp eax, edx
jle 0x52347c
cmp byte [ebx + 0x96], 0
jbe 0x52347c
movzx eax, byte [ebx + 0x96]
mov edx, 0xa
call fcn.0047a1ec
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.0047a1ec
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 8]
cmp edi, eax
ja 0x52340a
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 8], eax
inc byte [esi + 4]
movzx eax, byte [esi + 4]
cmp al, byte [ebx + 0x96]
jb 0x52341a
mov byte [esi + 4], 0
movsx edx, word [ebx + 0x92]
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
je 0x52347c
lea eax, [ebp - 0x10]
push eax
movzx edx, word [ebx + 0x94]
movzx eax, byte [esi + 4]
add edx, eax
lea ecx, [ebp - 0xc]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x18]
movsx edx, word [ebx + 0x97]
add dword [ebp - 0xc], edx
movsx edx, word [ebx + 0x99]
add dword [ebp - 0x10], edx
test eax, eax
je 0x52347c
push eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 4]
call fcn.0047ad58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x536584
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.00542de8
mov eax, dword [ebx + 0x22c]
cmp eax, 0xb
je 0x536743
cmp eax, 9
je 0x536743
cmp eax, 0xd
je 0x536743
cmp eax, 5
je 0x536743
mov byte [ebx + 0x490], 0
mov eax, dword [ebx + 0x500]
cmp dword [eax + 8], 2
jl 0x5365d7
mov byte [ebx + 0x490], 1
mov edx, dword [ebx + 0x454]
sub edx, dword [ebx + 0x44c]
mov eax, ebx
mov si, 0xfff8
call fcn.00404844
mov edx, dword [ebx + 0x454]
sub edx, dword [ebx + 0x44c]
mov eax, ebx
mov si, 0xfff7
call fcn.00404844
mov edi, dword [ebx + 0x454]
cmp dword [ebx + 0x22c], 0
je 0x5366bc
mov edx, dword [ebx + 0x44c]
mov eax, dword [ebx + 0x454]
cmp edx, eax
jg 0x536630
cmp eax, dword [ebx + 0x450]
jle 0x536636
mov dword [ebx + 0x454], edx
cmp byte [ebx + 0x490], 0
je 0x536662
mov eax, dword [ebx + 0x478]
add eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x53674c]
call fcn.00403670
mov esi, eax
jmp 0x536668
mov esi, dword [ebx + 0x478]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x47c]
cmp esi, eax
jae 0x5366a7
mov eax, dword [ebx + 0x454]
cmp eax, dword [ebx + 0x450]
jge 0x536698
inc dword [ebx + 0x454]
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x47c], eax
jmp 0x5366a7
xor eax, eax
mov dword [ebx + 0x22c], eax
mov byte [ebx + 0x196], 0
xor eax, eax
mov dword [ebx + 0x498], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x49c], eax
jmp 0x536712
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x4a8]
cmp eax, 0xc8
jbe 0x536712
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x49c]
cmp eax, 0x1f4
jbe 0x536707
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x49c], eax
inc dword [ebx + 0x498]
mov eax, dword [ebx + 0x498]
cmp eax, dword [ebx + 0x4a0]
jl 0x536707
xor eax, eax
mov dword [ebx + 0x498], eax
mov eax, ebx
mov si, 0xfffe
call fcn.00404844
cmp edi, dword [ebx + 0x454]
jne 0x53672d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x28c]
cmp eax, dword [ebx + 0x288]
jbe 0x536743
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x28c], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404844
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x536b0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.00542de8
mov eax, dword [ebx + 0x22c]
cmp eax, 0xb
je 0x536d38
cmp eax, 9
je 0x536d38
cmp eax, 0xd
je 0x536d38
cmp eax, 5
je 0x536d38
mov byte [ebx + 0x490], 0
mov eax, dword [ebx + 0x500]
cmp dword [eax + 8], 2
jl 0x536b5f
mov byte [ebx + 0x490], 1
mov edx, dword [ebx + 0x454]
sub edx, dword [ebx + 0x44c]
mov eax, ebx
mov si, 0xfff8
call fcn.00404844
mov edx, dword [ebx + 0x454]
sub edx, dword [ebx + 0x44c]
mov eax, ebx
mov si, 0xfff7
call fcn.00404844
mov edi, dword [ebx + 0x454]
cmp dword [ebx + 0x22c], 0
je 0x536cb1
mov edx, dword [ebx + 0x44c]
mov eax, dword [ebx + 0x454]
cmp edx, eax
jg 0x536bb8
cmp eax, dword [ebx + 0x450]
jle 0x536bbe
mov dword [ebx + 0x454], edx
cmp byte [ebx + 0x490], 0
je 0x536bea
mov eax, dword [ebx + 0x478]
add eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x536d40]
call fcn.00403670
mov esi, eax
jmp 0x536bf0
mov esi, dword [ebx + 0x478]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x47c]
cmp esi, eax
jae 0x536c9c
mov eax, dword [ebx + 0x454]
cmp eax, dword [ebx + 0x450]
jge 0x536c24
inc dword [ebx + 0x454]
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x47c], eax
jmp 0x536c33
xor eax, eax
mov dword [ebx + 0x22c], eax
mov byte [ebx + 0x196], 0
cmp dword [ebx + 0x22c], 0x16
jne 0x536c9c
mov eax, dword [ebx + 0x454]
sub eax, dword [ebx + 0x44c]
cmp eax, 4
jne 0x536c9c
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x168]
push eax
mov eax, dword [ebx + 0x16c]
push eax
mov eax, dword [ebx + 0x170]
push eax
push 0xb
mov eax, dword [0x566ba4]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x10]
mov edx, ebx
call fcn.00532300
test eax, eax
je 0x536c9c
mov edx, dword [0x566c6c]
mov edx, dword [edx]
mov dword [eax + 0x18], edx
mov dword [eax + 0x80], 0x1e
mov dword [eax + 0xd8], 0x110
xor eax, eax
mov dword [ebx + 0x498], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x49c], eax
jmp 0x536d07
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x4a8]
cmp eax, 0xc8
jbe 0x536d07
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x49c]
cmp eax, 0x1f4
jbe 0x536cfc
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x49c], eax
inc dword [ebx + 0x498]
mov eax, dword [ebx + 0x498]
cmp eax, dword [ebx + 0x4a0]
jl 0x536cfc
xor eax, eax
mov dword [ebx + 0x498], eax
mov eax, ebx
mov si, 0xfffe
call fcn.00404844
cmp edi, dword [ebx + 0x454]
jne 0x536d22
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x28c]
cmp eax, dword [ebx + 0x288]
jbe 0x536d38
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x28c], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404844
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x53d664
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x40], 0
je 0x53d685
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2c]
cmp eax, dword [ebx + 0x38]
jbe 0x53d685
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c], eax
inc dword [ebx + 0x30]
pop ebx
ret
Function at 0x53f998
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov cx, word [eax + 8]
mov word [edx + 8], cx
mov ecx, dword [eax + 0xa]
mov dword [edx + 0xa], ecx
mov ecx, dword [eax + 0xe]
mov dword [edx + 0xe], ecx
mov cx, word [eax + 0x12]
mov word [edx + 0x12], cx
mov ecx, dword [eax + 0xa]
mov dword [edx + 0x14], ecx
mov ecx, dword [eax + 0xe]
mov dword [edx + 0x18], ecx
mov cx, word [eax + 0x12]
mov word [edx + 0x1c], cx
mov ecx, dword [eax + 0xa]
mov dword [edx + 0x1e], ecx
mov ecx, dword [eax + 0xe]
mov dword [edx + 0x22], ecx
mov cx, word [eax + 0x12]
mov word [edx + 0x26], cx
movzx ecx, word [eax + 0xa]
mov word [edx + 0x1e], cx
movzx ecx, word [eax + 0xc]
shr ecx, 1
mov ebx, ecx
mov word [edx + 0x20], bx
movzx esi, word [eax + 0xc]
add si, word [eax + 0xe]
sub si, bx
mov word [edx + 0x22], si
mov ecx, dword [edx + 0x1e]
mov dword [edx + 0x28], ecx
mov ecx, dword [edx + 0x22]
mov dword [edx + 0x2c], ecx
mov cx, word [edx + 0x26]
mov word [edx + 0x30], cx
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x3c], ecx
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x40], ecx
mov cx, word [eax + 0x1c]
mov word [edx + 0x44], cx
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x46], ecx
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x4a], ecx
mov cx, word [eax + 0x1c]
mov word [edx + 0x4e], cx
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x50], ecx
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x54], ecx
mov cx, word [eax + 0x1c]
mov word [edx + 0x58], cx
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x64], ecx
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x68], ecx
mov cx, word [eax + 0x1c]
mov word [edx + 0x6c], cx
movzx ecx, word [eax + 0x16]
shr ecx, 1
inc ecx
mov ebx, ecx
mov word [edx + 0x66], bx
movzx esi, word [eax + 0x16]
add si, word [eax + 0x18]
sub si, bx
mov word [edx + 0x68], si
mov ecx, dword [eax]
mov dword [edx + 0x6e], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 0x72], ecx
mov cx, word [eax + 8]
mov word [edx + 0x76], cx
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x78], ecx
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x7c], ecx
mov cx, word [eax + 0x30]
mov word [edx + 0x80], cx
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x82], ecx
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x86], ecx
mov cx, word [eax + 0x44]
mov word [edx + 0x8a], cx
mov ecx, dword [eax]
mov dword [edx + 0x5a], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 0x5e], ecx
mov cx, word [eax + 8]
mov word [edx + 0x62], cx
mov ecx, dword [0x567570]
lea esi, [ecx + 0x8c]
lea edi, [edx + 0x8c]
mov ecx, 0x2d
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [eax + 0x14]
mov word [edx + 0x32], cx
mov cx, 1
mov word [edx + 0x34], cx
movzx ebx, word [eax + 0x18]
add bx, word [eax + 0x16]
sub bx, cx
mov word [edx + 0x36], bx
mov word [edx + 0x38], 0xc8
pop edi
pop esi
pop ebx
ret
Function at 0x542de8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x542ea8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.0048a4c0
xor eax, eax
push ebp
push 0x542e93
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x2a0]
cmp esi, dword [edi + 8]
jge 0x542e77
mov eax, edi
mov edx, esi
call fcn.0041c194
mov ebx, eax
cmp dword [ebx + 0xc], 0x28
jl 0x542e5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
mov edx, esi
call fcn.0041c088
mov edx, 0x10
mov eax, ebx
call fcn.00403120
inc esi
jmp 0x542e1e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 8]
cmp eax, 0x14
jbe 0x542e74
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 8], eax
inc dword [ebx + 0xc]
inc esi
jmp 0x542e1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542e9a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.0048a4cc
ret
Function at 0x5447c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x544992
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
call fcn.00525290
test al, al
je 0x54497c
movzx eax, byte [ebx + 0x18]
sub al, 8
jae 0x54497c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x28c]
cmp eax, dword [ebx + 0x288]
jbe 0x544832
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x28c], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404844
mov eax, ebx
call fcn.00544328
cmp dword [ebx + 0x1f8], 0
je 0x544879
mov edx, dword [ebp - 4]
add edx, dword [ebx + 0x12c]
add edx, dword [ebx + 0x124]
mov esi, dword [ebp + 0x10]
add esi, dword [ebx + 0x13c]
add esi, dword [ebx + 0x128]
push edx
push esi
movzx edx, byte [ebp + 0xc]
push edx
push eax
mov ecx, dword [ebx + 0x1f8]
mov eax, ebx
mov edx, edi
call fcn.00543d34
jmp 0x5448ca
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x454]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebx + 0x44c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebx + 0x450]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x5449ac
call fcn.0040d554
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x40b214]
call fcn.00410118
call fcn.00404ebc
cmp byte [ebx + 0x194], 0
je 0x54496c
cmp dword [ebx + 0x1cc], 0
jle 0x54496c
xor eax, eax
mov edx, dword [ebx + 0x1b4]
dec edx
lea ecx, [ebp - 0x54]
mov ah, 0x20
call fcn.004040b8
mov eax, dword [ebx + 0x1b0]
cmp eax, 0xff
ja 0x544908
bt dword [ebp - 0x54], eax
jae 0x54496c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x1cc]
dec eax
xor edx, edx
call fcn.0054cc78
mov eax, dword [ebx + 0x1b0]
add dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0
je 0x544943
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x54496c
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x10]
add ecx, dword [ebx + 0x128]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
add edx, dword [ebx + 0x124]
mov eax, edi
call fcn.0047ad58
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
call fcn.00544260
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544999
lea eax, [ebp - 0x1c]
call fcn.00405544
ret
Function at 0x546268
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x5673b0]
cmp eax, dword [edx]
jne 0x546296
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x19c]
cmp eax, 0xbb8
seta al
jmp 0x5462af
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x19c]
cmp eax, 0x7d0
seta al
test al, al
je 0x5462c1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
xor ecx, ecx
mov dword [edx + 0x1bc], ecx
pop ebp
ret
Function at 0x54670c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, eax
xor ebx, ebx
mov byte [edi + 0x108], 0
mov esi, 0x64
mov eax, dword [0x567764]
cmp byte [eax + 0xc], 0
je 0x5467b5
mov eax, dword [0x5673b0]
cmp edi, dword [eax]
jne 0x54676d
movzx eax, byte [edi + 0xbe]
imul esi
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x5467f8]
call fcn.0040367c
push eax
mov eax, esi
pop edx
sub eax, edx
mov edx, 5
call fcn.0047a1ec
mov esi, eax
cmp byte [edi + 0x1a], 0
jne 0x5467b5
movzx ebp, word [edi + 0x2c8]
test bp, bp
je 0x5467b5
movsx eax, bp
cdq
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.004067d8
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fdiv dword [0x5467fc]
call fcn.00403670
push eax
mov eax, esi
pop edx
sub eax, edx
mov edx, 1
call fcn.0047a1ec
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x2c0]
cmp esi, eax
ja 0x5467ef
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x2c0], eax
inc dword [edi + 0x2c4]
cmp dword [edi + 0x2c4], 1
jle 0x5467e6
xor eax, eax
mov dword [edi + 0x2c4], eax
mov bl, 1
mov byte [edi + 0x108], 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x546800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x4fc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.0048a4c0
xor edx, edx
push ebp
push 0x546906
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5468ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, esi
call fcn.0041c194
mov ebx, eax
cmp dword [ebx + 8], 0
jle 0x5468ba
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x14]
movzx edx, word [ebx + 6]
cmp eax, edx
jbe 0x546878
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x14], eax
inc dword [ebx + 0x10]
movzx eax, word [ebx + 2]
movzx edx, ax
movzx ecx, byte [ebx + 4]
add edx, ecx
dec edx
cmp edx, dword [ebx + 0x10]
jge 0x5468a3
movzx eax, ax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x14], eax
dec dword [ebx + 8]
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 0xc]
je 0x5468e0
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x4fc], 1
jmp 0x5468e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, esi
call fcn.0041c088
mov edx, 0x24
mov eax, ebx
call fcn.00403120
mov eax, dword [ebp - 4]
mov byte [eax + 0x4fc], 1
dec esi
cmp esi, 0xffffffff
jne 0x546845
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54690d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.0048a4cc
ret
Function at 0x549d6c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x5673b0]
cmp eax, dword [edx]
jne 0x549d9a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x19c]
cmp eax, 0xbb8
seta al
jmp 0x549db3
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x19c]
cmp eax, 0x7d0
seta al
test al, al
je 0x549dc5
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
xor ecx, ecx
mov dword [edx + 0x1bc], ecx
pop ebp
ret
Function at 0x553cc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x553d2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x553ce9
mov eax, esi
mov si, 0xfff6
call fcn.00404844
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, 0x3e8
jbe 0x553d0b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 8], eax
inc dword [ebx + 8]
lea eax, [ebp - 4]
call fcn.00405544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553d33
lea eax, [ebp - 4]
call fcn.00405544
ret

Function at 0x556dec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x556df4
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x556f51
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x17c], dl
mov dl, 2
mov eax, ebx
call fcn.00556ab8
lea eax, [ebp - 4]
lea edx, [ebx + 0x5e]
call fcn.004057b8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 8]
call fcn.004497e4
lea eax, [ebp - 8]
lea edx, [ebx + 0x7d]
call fcn.004057b8
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.004497e4
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x8e]
call fcn.004057b8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x14]
call fcn.004497e4
mov edx, 0x556f68
mov eax, dword [ebx + 0x18]
call fcn.004497e4
lea eax, [ebp - 0x10]
lea edx, [ebx + 0xc1]
call fcn.004057b8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x20]
call fcn.004497e4
lea eax, [ebp - 0x14]
lea edx, [ebx + 0xd6]
call fcn.004057b8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x24]
call fcn.004497e4
lea eax, [ebp - 0x18]
lea edx, [ebx + 0xb2]
call fcn.004057b8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x30]
call fcn.004497e4
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0xe3]
call fcn.004057b8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x38]
call fcn.004497e4
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x10c]
call fcn.004057b8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x28]
call fcn.004497e4
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x121]
call fcn.004057b8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x2c]
call fcn.004497e4
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x139]
call fcn.004057b8
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0x34]
call fcn.004497e4
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x12e]
call fcn.004057b8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x1c]
call fcn.004497e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556f58
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00405568
ret

Function at 0x55ac00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xfffffefc
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 1]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403ca8
lea eax, [esp + 1]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x55ac37
movzx eax, byte [esp]
test byte [esp + eax + 1], 0x80
je 0x55ac37
mov bl, 1
mov eax, ebx
add esp, 0x104
pop ebx
ret