joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b936
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x5463d0
call fcn.0054565c
sub esp, 0x418
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x60
ja 0x43bb5d
lodsb al, byte [esi]
dec edi
invalid
push 0x553f98
lea ecx, [ebp - 0x18]
call fcn.00401a3b
push 0x571258
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004024e8
mov byte [ebp - 4], 3
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push str.SOFTWARE_s
push eax
call fcn.0040326a
mov esi, dword [ebp - 0x14]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43bbb5
push dword [ebp - 0x1c]
call edi
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.0041b930
add esp, 0xc
mov dword [ebp - 0x24], 0x400
mov dword [ebp - 0x20], ebx
call fcn.0049d913
cmp eax, ebx
lea eax, [ebp - 0x10]
push eax
jne 0x43bbf1
push 0x2021f
jmp 0x43bbf6
push 0x2011f
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bc80
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.AppInstanceUid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43bc48
cmp byte [ebp + 0x10], al
jne 0x43bc48
mov edi, 0x553fdc
push edi
call fcn.0041b53d
pop ecx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.00402590
jmp 0x43bc80
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 1
mov ebx, dword [eax - 0xc]
jle 0x43bc60
push ebx
lea ecx, [ebp + 0xc]
call fcn.0040266b
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + ebx]
push ecx
push eax
push 1
push 0
push str.AppInstanceUid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43bc80
push dword [ebp - 0x10]
call edi
lea ecx, [esi - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x43cd65
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x546485
call fcn.0054565c
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x15
ja 0x43cf8b
hlt
mov edi, dword [ebp + 8]
mov esi, 0x571258
push esi
mov ecx, edi
call fcn.004024e8
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
call fcn.004024e8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x553f68
push edi
call fcn.0040326a
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call fcn.0043d0b4
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401ad5
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ebx, 0x553f20
push ebx
lea ecx, [ebp - 0x24]
call fcn.00401a3b
mov esi, eax
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00401a3b
lea ecx, [ebp - 0x10]
push ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00401d27
pop ecx
push esi
mov edx, eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00401d27
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004013c0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
jle 0x43d065
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.0040266b
mov eax, dword [ebp - 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00401ba2
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
jle 0x43d085
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040266b
mov esi, dword [ebp - 0x10]
push ecx
push esi
mov ecx, edi
call fcn.00401ba2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004013c0
lea ecx, [esi - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x43d1c1
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5464b9
call fcn.0054565c
sub esp, 0x38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5e
ja 0x43d3df
jne 0x43d164
invalid
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, dword [eax]
cmp esi, eax
je 0x43d481
lea edi, [esi + 8]
lea ecx, [ebp - 0x2c]
lea eax, [edi + 0x18]
push eax
call fcn.004018ce
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x44]
call fcn.004018ce
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
jne 0x43d42a
mov edi, 0x553f64
push edi
call fcn.0041b53d
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00402a1d
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.004018ce
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.004018ce
mov ecx, dword [ebp + 0xc]
push 1
mov byte [ebp - 4], 1
call fcn.0044608b
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004023ba
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004023ba
mov esi, dword [esi]
cmp esi, dword [ebx]
jne 0x43d3ee
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x43d760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x15
ja 0x43d973
xchg esi, eax
push ss
sahf
xchg edi, eax
jmp 0x43d7df
bound edx, qword [ecx]
fsubr qword [ecx - 0x57]
and al, 0x32
cli
jns 0x43d852
jge 0x43d7f3
enter 0x7056, 0x44
bswap edx
jns 0x43d82c
inc edx
cmp byte [ecx - 0x76], dl
push es
or cl, dl
jnp 0x43d81b
cmp al, byte [edi]
mov bl, 0x27
dec ebp
mov dword [ecx - 0x7a], eax
pop edi
or esp, ebx
sahf
xchg ebp, eax
sub ch, byte [edi + 0x46]
mov ebp, 0x327ad592
inc eax
loopne 0x43d864
add byte [eax], ah
mov eax, dword [0xe3dd492e]
cmp ebp, eax
idiv ecx
adc edx, dword [ebx + 0x15]
mov edx, 0xc99cc6bf
in al, 0x9e
sbb byte [edx], 0x3a
add ebx, dword [ebx - 0x4f]
inc eax
leave
mov esp, 0xc1982fad
xchg byte [ebx + ecx*2], ch
call 0x22db99d1
iretd
cmpsd dword [esi], dword es:[edi]
lds ecx, [eax + 0x5a]
shl dword [esi - 0x2a], 0x98
xchg ecx, eax
lcall 0x6de1, 0xbdaf90
mov al, 0xe6
cmp byte [eax - 0x359a8c1e], bl
pop ecx
and eax, 0x7f707f47
movsb byte es:[edi], byte [esi]
insd dword es:[edi], dx
xlatb
sti
pop eax
adc al, 0xdb
inc esi
mov dl, 0x95
out 0xac, eax
sbb eax, edi
dec ebx
sar eax, 1
mov byte [0x1d51d2a3], bh
invalid
mov esi, dword [ebp + 0xc]
cmp byte [esi], 0
jne 0x43d9bb
and dword [ebp + 0xc], 0
call fcn.004ae8cf
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004ae2c6
mov ecx, dword [ebp + 8]
call fcn.0049e7fb
test al, al
jne 0x43d99f
mov byte [esi], 1
cmp byte [esi], 0
jne 0x43d9bb
push dword [ebp + 8]
call fcn.0043d9c1
mov ecx, dword [ebp + 8]
call fcn.0049e7fb
test al, al
jne 0x43d9bb
mov byte [esi], 1
pop esi
pop ecx
pop ebp
ret 8
Function at 0x43e0c4
Capabilities:
Accept command line arguments

Disassembly:
cdq
mov eax, 0x54652f
call fcn.0054565c
mov eax, 0x2040
call fcn.004318e0
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xa
ja 0x43e2eb
or cl, byte [edi]
xchg edi, edi
add dword [eax], eax
add byte [0xdc8b3129], bl
sbb al, 0x65
sub dword [ecx], esi
mov ebx, esp
mov edi, 0xa9911bc4
and ebx, esi
out 0x16, al
fiadd dword [0xebb96fd2]
xlatb
jg 0x43e173
push ebp
xor al, 0xd7
pop ebx
clc
pop ebx
jno 0x43e0aa
cmp esp, dword [ebp + 0x453f7593]
test dh, 0x1c
jnp 0x43e13f
clc
outsb dx, byte [esi]
or ch, byte [edi]
or byte [ecx], dl
jmp 0x43e18e
mov cl, 0x7f
mov dword [0x2a753e80], eax
call 0xd854aa94
jg 0x43e0e5
cmp byte [esi], 0x75
sub ch, al
dec ecx
leave
adc al, bl
fidiv dword [esi]
scasd eax, dword es:[edi]
mov ecx, dword [edi + 0x6e]
jg 0x43e140
bound eax, qword [eax + eax - 0x2e]
mov ebp, 0xb1cc7e86
inc edx
shr cl, 0xf7
invalid
outsb dx, byte [esi]
mov dh, 0xf5
jmp 0x44f46ca3
div dword ds:[ebx]
stc
and esp, dword [edx - 0x20]
invalid
call int.0049ce4d
test eax, eax
setne al
mov byte [ebx + 0x121], al
call int.0049d0de
test eax, eax
setne al
mov byte [ebx + 0x122], al
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x204c], ax
lea eax, [ebp - 0x204a]
push eax
call fcn.0041b930
add esp, 0xc
lea edx, [ebx + 0x124]
lea ecx, [ebp - 0x204c]
call fcn.004942ed
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
lea ecx, [ebp - 0x30]
call fcn.004018f6
lea edi, [ebx + 0x84]
push eax
mov ecx, edi
call fcn.00401940
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004023ba
call esi
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004018f6
lea eax, [ebp - 0x48]
push eax
call fcn.0043e425
push eax
lea ecx, [ebx + 0x9c]
call fcn.00401940
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004023ba
lea esi, [ebx + 0x7c]
mov edx, esi
mov ecx, edi
call fcn.004428f2
mov ecx, esi
call fcn.00447978
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.004018ce
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push 0x553f48
call fcn.004018f6
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0044739a
mov ecx, dword [ebp - 0xc]
add esp, 0x30
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e425
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x54657f
call fcn.0054565c
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x64], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x47
ja 0x43e64e
and byte [esi - 0x50], bh
fisub word fs:[ecx - 7]
invalid
cmp dword [ebp + 0x20], 8
lea esi, [ebp + 0xc]
cmovae esi, dword [ebp + 0xc]
call fcn.004ae8cf
lea ecx, [ebp - 0x10]
push ecx
push esi
call dword [eax + 0x190]
mov edi, eax
test edi, edi
je 0x43e825
cmp dword [ebp - 0x10], 0
jle 0x43e825
push dword [edi]
lea ecx, [ebp - 0x28]
call fcn.004018f6
lea eax, [ebp - 0x28]
mov esi, 0x553f20
push eax
mov edx, esi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.00403331
pop ecx
push esi
mov edx, eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004033aa
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.004023ba
xor eax, eax
push 0xffffffffffffffff
mov word [ebp - 0x40], ax
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
call fcn.00402200
mov byte [ebp - 4], 5
push dword [ebp - 0x18]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
lea ecx, [ebp + 0xc]
call fcn.004022ba
push dword [ebp - 0x48]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x58]
push 0
push ecx
lea ecx, [ebp + 0xc]
mov ebx, eax
call fcn.004022ba
mov esi, eax
cmp esi, ebx
jge 0x43e730
test esi, esi
js 0x43e730
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402200
mov ebx, esi
test ebx, ebx
js 0x43e7fb
mov eax, dword [ebp - 0x30]
push 0xffffffffffffffff
add eax, ebx
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp + 0xc]
call fcn.00401999
mov esi, eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.00401999
push esi
mov edx, eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 7
call fcn.004033e1
pop ecx
push eax
lea ecx, [ebp + 0xc]
call fcn.00401940
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0xac]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.004023ba
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x553f44
call fcn.004018f6
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
mov byte [ebp - 4], 8
call fcn.004018ce
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.0040342b
add esp, 0x30
lea ecx, [ebp + 0xc]
push eax
call fcn.00401940
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004023ba
jmp 0x43e7fd
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004023ba
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0040191b
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
Function at 0x43e850
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5465b9
call fcn.0054565c
sub esp, 0x4c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x27
ja 0x43ea75
imul esp, dword [ebp - 0x48164eca], 0xffffff9d
ljmp 0xf8a5
push ebx
xor eax, eax
push 0x553ec0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], ax
call fcn.00402a1d
mov ecx, dword [ebp + 8]
mov esi, str.homepage
mov edx, esi
mov byte [ebp - 4], 1
call int.0049e2dc
test al, al
je 0x43eb39
mov ecx, dword [ebp + 8]
push esi
call fcn.0046dc01
mov ecx, eax
call fcn.0046e2a4
test al, al
je 0x43eb39
lea eax, [ebp - 0x3c]
push eax
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.0046dc01
pop ecx
mov ecx, eax
call fcn.0046ea4b
mov byte [ebp - 4], 2
call fcn.004ae8cf
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.004ae617
push eax
lea ecx, [ebp - 0x24]
call fcn.00401940
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004023ba
sub esp, 0x18
lea eax, [ebp - 0x24]
mov ecx, esp
push eax
call fcn.004018ce
lea ecx, [ebp - 0x54]
call fcn.0049cbbc
add esp, 0x18
lea ecx, [ebp - 0x24]
push eax
call fcn.00401940
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004023ba
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0040187f
cmp dword [ebp + 0x1c], 0
je 0x43eb90
lea eax, [ebp + 0xc]
push eax
mov edx, 0x553f24
lea ecx, [ebp - 0x3c]
call fcn.00403331
mov byte [ebp - 4], 3
mov edx, eax
lea ecx, [ebp - 0x54]
mov dword [esp], 0x553f20
call fcn.004033aa
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00402977
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.004023ba
cmp dword [ebp - 0x14], 0
je 0x43ec01
lea eax, [ebp - 0x24]
push eax
mov edx, 0x553f44
lea ecx, [ebp - 0x54]
call fcn.00403331
pop ecx
push 0xffffffffffffffff
push ebx
lea esi, [edi + 0x84]
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00402977
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.004023ba
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004018ce
lea eax, [ebp - 0x54]
push eax
call fcn.0043e425
push eax
lea ecx, [edi + 0x9c]
call fcn.00401940
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004023ba
lea edx, [edi + 0x7c]
mov ecx, esi
call fcn.004428f2
push ebx
push 1
lea ecx, [ebp - 0x24]
call fcn.004023ba
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
Function at 0x43f093
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x576548]
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x56
ja 0x43f2ae
push esp
add byte [ebx - 0x78f0a908], al
inc dword [ecx]
add byte [eax], al
sbb byte [ecx - 0x42e9d255], al
xchg esp, eax
fsub dword [edx]
mov ah, 0x9f
sub dl, byte [ecx]
ja 0x43f0a4
out 0x6b, al
invalid
cmp byte [0x5789b0], 0
jne 0x43f2fa
mov eax, dword [ebp + 8]
push ebx
mov ebx, 0x553ec0
push ebx
mov byte [0x5789b0], 1
mov dword [edi], eax
mov dword [edi + 0xc], 0x5767a0
mov dword [edi + 8], esi
call fcn.0041b53d
pop ecx
push eax
push ebx
lea ecx, [edi + 0x24]
call fcn.00402590
xor eax, eax
push eax
push eax
push edi
push 0x43ee56
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x442095
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x546aa5
call fcn.0054565c
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5a
ja 0x4422c0
dec edi
or byte [0x4ee29cfc], 0x42
ljmp 0x64da
push ebx
xor eax, eax
push 0x553ec0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x38], ax
call fcn.00402a1d
mov byte [ebp - 4], 1
call fcn.004ae8cf
cmp dword [eax + 0x190], ebx
jne 0x44230b
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.0040191b
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.004023ba
push ebx
jmp 0x4423a6
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
call fcn.004ae8cf
lea ecx, [ebp - 0x14]
push ecx
push esi
call dword [eax + 0x190]
mov ebx, eax
test ebx, ebx
je 0x44238d
mov ecx, dword [ebp - 0x14]
xor esi, esi
inc esi
cmp ecx, esi
jle 0x442386
xor edi, edi
cmp dword [ebx + esi*4], edi
je 0x44237e
push 0x553f44
call fcn.0041b53d
pop ecx
push eax
push 0x553f44
lea ecx, [ebp - 0x38]
call fcn.00403e80
mov eax, dword [ebx + esi*4]
mov dword [ebp - 0x18], eax
cmp word [eax], di
jne 0x442365
mov ecx, edi
jmp 0x442371
push eax
call fcn.0041b53d
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00403e80
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, ecx
jl 0x442338
mov edi, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.0040191b
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
Function at 0x4428f2
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x546afc
call fcn.0054565c
sub esp, 0x48
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x64
ja 0x442b14
dec eax
dec edx
inc ebx
lea eax, [ecx + 0x54ef3e2]
cmp esi, dword [ebx + 0x6e]
push es
push esi
invalid
call fcn.004ae8cf
cmp dword [eax + 0x190], 0
je 0x442c6f
mov ecx, edi
call fcn.00401f1e
cmp dword [esi + 0x14], 8
jb 0x442b35
mov esi, dword [esi]
call fcn.004ae8cf
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [eax + 0x190]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x442c6f
mov edx, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x442c68
cmp dword [ebx + ecx*4], 0
je 0x442c5c
push 0x553ec0
lea ecx, [ebp - 0x50]
call fcn.004018f6
and dword [ebp - 4], 0
push 0x553ec0
lea ecx, [ebp - 0x38]
call fcn.004018f6
mov dword [ebp - 4], 1
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push ebx
lea ecx, [ebp - 0x50]
call fcn.00441c6e
xor al, al
mov byte [ebp - 0x11], al
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x442c09
cmp dword [ebp - 0x3c], 8
push dword [ebp - 0x40]
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
lea ebx, [esi + 8]
push eax
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.0040235d
test eax, eax
jne 0x442bfc
lea eax, [ebp - 0x50]
mov byte [ebp - 0x11], 1
cmp ebx, eax
je 0x442be8
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00402200
lea ecx, [ebx + 0x18]
lea eax, [ebp - 0x38]
cmp ecx, eax
je 0x442bfc
push 0xffffffffffffffff
push 0
push eax
call fcn.00402200
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x442baf
mov al, byte [ebp - 0x11]
test al, al
jne 0x442c37
mov esi, dword [edi]
lea eax, [ebp - 0x50]
push eax
push dword [esi + 4]
push esi
call fcn.00404d35
mov edx, eax
mov eax, dword [edi + 4]
mov ecx, 0x4924923
sub ecx, eax
cmp ecx, 1
jb 0x442c7e
lea ecx, [eax + 1]
mov dword [edi + 4], ecx
mov dword [esi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.004023ba
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, edx
jl 0x442b63
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push str.list_T__too_long
call fcn.00417f0e
int3
Function at 0x444de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x50
ja 0x444ff1
dec esp
int 0x7e
inc edx
pop ds
cli
inc ecx
push esi
or edi, esi
sbb eax, 0xbca6e647
jmp 0xef175dc7
mov eax, esi
pop esi
ret
Function at 0x444ff5
Capabilities:
Check for time delay via gettickcount

Disassembly:
pop esp
add ecx, edx
sbb dword [eax + eax - 0x54], ecx
aas
add eax, 0xf2f281f9
movsb byte es:[edi], byte [esi]
push 0xf4c943c0
imul edx, dword [ebx + 0x62b93e25], 0xffffffca
pop esp
jns 0x444fe7
push ss
test dword [0x6775e53e], edx
push ds
push es
adc ecx, ebp
imul ebp, esp, 0xa6488052
push ebp
and dword [edx + edx + 0x4da295d6], esp
enter 0x6a13, 0x6d
salc
xchg ebp, eax
mov byte [0x6a13c84d], al
insd dword es:[edi], dx
cmp edi, dword [ebx - 0x75]
invalid
mov eax, 0x546d74
call fcn.0054565c
sub esp, 0x8c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x42
rcl byte fs:[eax + eax - 0x7d]
clc
inc edx
ja 0x44521d
sub eax, 0x66ea8173
jnp 0x444fb4
mov esp, dword [eax + 0x36]
movsd dword es:[edi], dword [esi]
mov al, 0xf8
lcall 0xb3f2, 0xd8a42132
mov ah, 0x8f
pop ecx
sbb eax, 0x8343fd8
jecxz 0x44503c
mov fs, word [ebp - 0x32]
je 0x445011
add eax, dword [eax]
cli
sub eax, 0x3d24cc61
sar dword [esp + ebp*2], 0xe8
jge 0x44505c
and al, byte [esi + 0x44a9fa9e]
stosd dword es:[edi], eax
jecxz 0x445023
mov edi, 0xde1bea54
sbb ebx, esi
add dword [ecx], eax
mov esp, 0x18ca9489
nop
insd dword es:[edi], dx
mov ecx, 0xc8bc2823
cmp eax, 0xa5b6c8b
dec eax
popal
out 0xda, al
and edx, edx
popal
inc ebp
xchg ebx, eax
stosd dword es:[edi], eax
invalid
push ebx
lea ecx, [ebp - 0x58]
call fcn.0046efbb
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0x10], esi
cmp esi, eax
je 0x445312
call fcn.004ae8cf
lea edx, [esi + 0x10]
lea ecx, [ebp - 0x80]
call fcn.004ae369
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00401f8b
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.0040187f
call fcn.004ae8cf
lea edx, [esi + 0x28]
lea ecx, [ebp - 0x98]
call fcn.004ae369
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
call fcn.00401f8b
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.0040187f
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x68]
call fcn.0046f462
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x68]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.0046dc01
pop ecx
mov ecx, eax
call int.0046ece4
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.0046ef20
lea ecx, [ebp - 0x44]
call fcn.0040187f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040187f
lea ecx, [ebp - 0x10]
call fcn.00402cb1
mov esi, dword [ebp - 0x10]
cmp esi, dword [edi]
jne 0x44523c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
call int.0046f8c7
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
call fcn.0046ef20
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4