joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49260c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x492640
add eax, 3
sar eax, 2
test eax, eax
jle 0x49279e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x49267d
je 0x4926e3
sub eax, 0x2b
je 0x4926cf
sub eax, 4
je 0x4926d9
dec eax
sub eax, 0xa
jb 0x4926b9
jmp 0x4926eb
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x49268f
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4926a3
jmp 0x4926eb
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4926eb
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4926eb
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4926eb
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x4926eb
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x4926eb
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x49265a
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x49274f
cmp byte [ebp - 0x21], 0xff
jne 0x49274f
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x49278f
cmp byte [ebp - 0x22], 0xff
je 0x49278f
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x492655
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x494e94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
jne 0x494ec3
mov ecx, 0x494f50
mov dl, 1
mov eax, dword [0x4942fc]
call fcn.0040d4c8
call fcn.0040457c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x494f41
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x40]
xor al, byte [edx]
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
dec ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
inc eax
call fcn.00402d40
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x44]
dec edx
mov byte [edx], al
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x494ee0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x494f68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
jne 0x494f97
mov ecx, 0x49502c
mov dl, 1
mov eax, dword [0x4942fc]
call fcn.0040d4c8
call fcn.0040457c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x49501b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x40]
xor al, byte [edx]
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
dec ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
inc eax
call fcn.00402d40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x44]
dec eax
mov dl, byte [ebp - 0x19]
mov byte [eax], dl
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x20]
jne 0x494fb4
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x495798
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49583a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x494620]
mov eax, 0x14
call fcn.00405c98
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call dword [eax + 0x34]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409044
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 4
call fcn.00404c40
mov eax, dword [ebp - 4]
call dword [eax + 0x30]
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [0x5d95ac]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x10], al
mov eax, dword [ebp - 0xc]
mov dword [0x5d95ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495841
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404c10
ret

Function at 0x495848
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4958de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x494648]
mov eax, 0x10
call fcn.00405c98
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call dword [eax + 0x34]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409044
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00404c40
mov eax, dword [ebp - 4]
call dword [eax + 0x30]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [0x5d95b0]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dword [0x5d95b0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4958e5
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404c10
ret

Function at 0x495960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x49599a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
dec eax
mov al, byte [eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
dec edx
xor byte [edx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x495980
mov esp, ebp
pop ebp
ret
Function at 0x497d28
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416c6c]
call fcn.00405754
xor eax, eax
push ebp
push 0x497e6c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5710ec], 0
jne 0x497d7b
mov ecx, dword [0x5735dc]
mov dl, 1
mov eax, dword [0x4082f4]
call fcn.0040d584
call fcn.0040457c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035b8
mov eax, ebx
call fcn.00405474
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x497e7c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004068a8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405484
test eax, eax
jle 0x497e13
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x497e0c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404e74
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404e5c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004091fc
test eax, eax
jne 0x497e0c
mov ebx, 0x15
jmp 0x497e18
mov ebx, 0x10
jmp 0x497e18
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5710ec]
call fcn.00497ba0
mov eax, dword [ebp - 8]
call fcn.00497ba0
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004068c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e73
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404c10
lea eax, [ebp - 0x10]
mov edx, dword [0x416c6c]
call fcn.00405824
ret
Function at 0x4a9448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040509c
xor eax, eax
push ebp
push 0x4a94e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404eac
test eax, eax
jle 0x4a94c2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
call fcn.00404eac
mov edx, eax
imul edx, dword [ebp - 0xc]
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, byte [eax + ecx - 1]
xor edx, eax
lea eax, [ebp - 0x14]
call fcn.00404dd4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00404eb4
mov eax, dword [ebp - 8]
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4a9485
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a94e7
lea eax, [ebp - 0x14]
call fcn.00404bec
lea eax, [ebp - 4]
call fcn.00404bec
ret
Function at 0x4d9148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x9c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x74]
jbe 0x4d91e9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 4]
inc dword [eax + 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x8c]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x88]
jge 0x4d91e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x8c]
dec eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc8], 0
jle 0x4d91e5
mov eax, dword [ebp - 4]
dec dword [eax + 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
jmp 0x4d91e9
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4df240
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x21c], 0
je 0x4df369
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x210]
jbe 0x4df28f
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
inc dword [eax + 0x218]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x20c]
jle 0x4df2ad
mov eax, dword [ebp - 4]
mov byte [eax + 0x21c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x218]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
call fcn.0047fdb8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x224], 0
jne 0x4df31d
cmp dword [ebp - 0x10], 0
je 0x4df369
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0xd0]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xcc]
mov eax, dword [ebp - 8]
call fcn.00481744
jmp 0x4df369
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x573628]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x22c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x228]
call fcn.004bb8c4
cmp dword [ebp - 0x10], 0
je 0x4df369
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x1c]
sub ecx, 0x10
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x18]
sub edx, 0x18
mov eax, dword [ebp - 8]
call fcn.00481744
mov esp, ebp
pop ebp
ret 4
Function at 0x4e0c9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x57382c]
cmp eax, dword [edx]
jne 0x4e0ccc
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0xbb8
seta byte [ebp - 1]
jmp 0x4e0ce6
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0x7d0
seta byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4e0cfa
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
mov dword [eax + 0x14c], edx
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x4e3fbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x57382c]
cmp eax, dword [edx]
jne 0x4e4017
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x15c], 0x3c
jne 0x4e3ffb
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0x1f4
seta byte [ebp - 1]
jmp 0x4e405c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0xbb8
seta byte [ebp - 1]
jmp 0x4e405c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x15c], 0x3c
jne 0x4e4042
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0x1f4
seta byte [ebp - 1]
jmp 0x4e405c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x134]
cmp eax, 0x7d0
seta byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4e4070
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
mov dword [eax + 0x14c], edx
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x4e5678
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e5760
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
dec eax
je 0x4e56a0
dec eax
je 0x4e56fc
jmp 0x4e5756
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [0x573ed0]
mov eax, dword [eax]
call fcn.0045ceb4
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e56db
cmp eax, 0x14
jbe 0x4e56ad
jmp 0x4e56dd
jle 0x4e56ad
mov eax, 0x39
call fcn.004e5790
mov eax, 0x7a
call fcn.004e5790
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jne 0x4e56a5
jmp 0x4e5756
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [0x573ed0]
mov eax, dword [eax]
call fcn.0045ceb4
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e5737
cmp eax, 0x14
jbe 0x4e5709
jmp 0x4e5739
jle 0x4e5709
mov eax, 0x7c
call fcn.004e5790
mov eax, 0x2910
call fcn.004e5790
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jne 0x4e5701
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e5774
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7ef0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov byte [ebp - 1], al
mov byte [ebp - 2], 0
lea eax, [ebp - 0x102]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004035b8
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x4e7f35
xor eax, eax
mov al, byte [ebp - 1]
test byte [ebp + eax - 0x102], 0x80
je 0x4e7f35
mov byte [ebp - 2], 1
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x511be0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0xab0]
cmp eax, 0x1f4
jbe 0x511c2a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0xab0], eax
mov eax, dword [ebp - 4]
inc dword [eax + 0xaac]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xaac], 1
jle 0x511c2a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xaac], edx
pop ecx
pop ebp
ret

Function at 0x513658
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x5136b3
mov eax, dword [0x573da8]
mov eax, dword [eax]
mov edx, 0x17c
call fcn.0047e974
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x51374b
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00471c08
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00471474
jmp 0x51374b
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0xc]
mov edx, dword [0x573f70]
mov dword [edx], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573750]
sub eax, dword [edx]
cmp eax, 0x2bc
jbe 0x5136e9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573750]
mov dword [edx], eax
mov eax, dword [0x573588]
inc dword [eax]
mov eax, dword [0x573588]
mov eax, dword [eax]
mov edx, dword [0x573f70]
cmp eax, dword [edx]
jle 0x513703
mov eax, dword [0x573588]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x573588]
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [0x573da8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.0047e974
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x51374b
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00471c08
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00471474
mov esp, ebp
pop ebp
ret 0xc
Function at 0x516a98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x574390]
sub eax, dword [edx]
cmp eax, 0x64
jbe 0x516ae0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x574390]
mov dword [edx], eax
mov eax, dword [0x57355c]
inc dword [eax]
mov eax, dword [0x57355c]
cmp dword [eax], 2
jle 0x516ae0
mov eax, dword [0x57355c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x57355c]
cmp dword [eax], 2
je 0x516b42
mov edx, dword [0x573b2c]
mov edx, dword [edx]
mov eax, dword [0x57355c]
add edx, dword [eax]
mov eax, dword [0x574294]
mov eax, dword [eax]
call fcn.0047e974
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x516b42
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x44]
sub edx, 0xb
mov eax, dword [ebp - 8]
call fcn.00487510
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x40]
sub edx, 0xa
mov eax, dword [ebp - 8]
call fcn.004874c8
mov edx, eax
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.00481744
mov esp, ebp
pop ebp
ret

Function at 0x516f24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x573b64]
cmp byte [eax], 0
je 0x517002
mov eax, dword [0x573f30]
cmp dword [eax], 0
jle 0x516f5f
mov eax, dword [0x573f30]
cmp dword [eax], 9
jge 0x516f5f
mov eax, dword [0x57436c]
mov dword [eax], 0x32
jmp 0x516f6a
mov eax, dword [0x57436c]
mov dword [eax], 0x190
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573cbc]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x57436c]
mov eax, dword [eax]
cdq
cmp edx, dword [esp + 4]
jne 0x516f92
cmp eax, dword [esp]
pop edx
pop eax
jae 0x517002
jmp 0x516f96
pop edx
pop eax
jge 0x517002
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573cbc]
mov dword [edx], eax
mov eax, dword [0x573a84]
inc dword [eax]
mov eax, 0x517010
call fcn.004e55cc
mov eax, dword [0x573a84]
cmp dword [eax], 7
jle 0x516fce
mov eax, dword [0x573a84]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x573f30]
inc dword [eax]
mov eax, dword [0x573f30]
cmp dword [eax], 9
jne 0x517002
mov eax, dword [0x573a84]
mov eax, dword [eax]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x573754]
mov eax, dword [edx + eax*4 + 0x3c]
mov edx, dword [0x573764]
cmp eax, dword [edx]
jne 0x517002
mov eax, dword [0x573b64]
mov byte [eax], 0
pop ecx
pop ecx
pop ebp
ret

Function at 0x5183b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573b7c]
sub eax, dword [edx]
cmp eax, 0xc8
jbe 0x5183f6
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573b7c]
mov dword [edx], eax
mov eax, dword [0x573888]
inc dword [eax]
mov eax, dword [0x573888]
cmp dword [eax], 5
jle 0x5183f6
mov eax, dword [0x573888]
xor edx, edx
mov dword [eax], edx
pop ecx
pop ebp
ret