joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42068c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4206e5
test eax, edx
je 0x4206e8
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4206a3
movzx eax, word [eax]
sub eax, ecx
jmp 0x4206ca
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4206cb
add ecx, 4
js 0x4206bb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4206c8
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4206ca
xor eax, eax
ret
test eax, eax
je 0x4206f4
test edx, edx
jne 0x420694
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x421b14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x421b41
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x421c14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040b05c
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x421c7e
test ah, 4
je 0x421c77
test bl, bl
jne 0x421c3c
mov al, 1
jmp 0x421ca5
test al, 0x10
je 0x421c44
xor eax, eax
jmp 0x421ca5
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x421c68
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x421ca5
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x421ca5
test al, 0x10
sete al
jmp 0x421ca5
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x421c9f
cmp ebx, 3
je 0x421c9f
cmp ebx, 0x7b
je 0x421c9f
mov eax, esi
call fcn.00421bd4
test al, al
jne 0x421ca3
xor eax, eax
jmp 0x421ca5
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x421cac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040b05c
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x421d53
test esi, 0x400
jne 0x421ce8
test esi, 0x10
setne bl
jmp 0x421d83
cmp byte [esp], 0
je 0x421d1c
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x421d83
push eax
call sub.KERNEL32.DLL_CloseHandle
test esi, 0x10
setne bl
jmp 0x421d83
test esi, 0x10
je 0x421d28
mov bl, 1
jmp 0x421d83
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x421d4f
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ebx, ebx
jmp 0x421d83
mov bl, 1
jmp 0x421d83
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x421d7d
cmp eax, 3
je 0x421d7d
cmp eax, 0xa1
je 0x421d7d
cmp eax, 0x7b
je 0x421d7d
cmp eax, 0x35
je 0x421d7d
cmp eax, 0x15
je 0x421d7d
cmp eax, 0x43
jne 0x421d81
xor ebx, ebx
jmp 0x421d83
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x425fa8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x425fe1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040a5a4
jmp 0x425fea
mov eax, ebx
mov edx, esi
call fcn.0040a7fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x425ff4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x426016
movzx eax, word [esp]
jmp 0x426018
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x427350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x427475
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00427158
mov esi, eax
mov eax, dword [0x5587c4]
cmp byte [eax], 0
je 0x42741d
mov eax, dword [0x558510]
call fcn.00407a50
call fcn.00407020
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x427320]
call fcn.0040c808
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x427490
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x427459
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x5584b0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x55c634]
call fcn.0040cbf8
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42747c
lea eax, [ebp - 4]
mov edx, dword [0x427320]
call fcn.0040c92c
ret
Function at 0x4285f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4286f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a844
lea eax, [ebp - 4]
call fcn.0040a9e4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b05c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4286de
mov eax, ebx
call fcn.00406eac
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4286d7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b05c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4286c1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x428708
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4286c1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4286de
mov eax, dword [ebp - 0x10]
call fcn.00406ec8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4286fb
lea eax, [ebp - 4]
call fcn.0040a41c
ret

Function at 0x429798
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a924
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f9c8
mov edi, eax
cmp edi, 0x104
jbe 0x429743
mov eax, edi
add eax, eax
call fcn.00406eac
mov esi, eax
jmp 0x429745
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f9c8
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42977e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x429768
mov eax, esp
cmp esi, eax
je 0x42978b
mov eax, esi
call fcn.00406ec8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4297c4
cmp bl, 0
je 0x4297c0
cmp bl, 0x41
jl 0x4297bb
cmp bl, 0x5a
jg 0x4297bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x42979f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x429704

Function at 0x42a0bc
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040b114
add esp, 0x800
pop ebx
ret
Function at 0x483ea4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x483eac
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4c23f4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c2442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c19e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c245b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c43dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x55f420
cmp dword [edi], 0
jne 0x4c4458
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x55f41c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x5557dc
mov ecx, 2
call fcn.00407070
mov edx, 0x4c43b4
lea eax, [esi + 5]
call fcn.004c43d4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c43d4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c442d
mov dword [0x55f41c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f60e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x4f614c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040b114
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00421634
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6153
lea eax, [ebp - 0x14]
call fcn.0040a41c
ret
Function at 0x4f6ec8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f6f5e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042856c
cmp eax, 2
jne 0x4f6f08
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x4f6f40
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040aebc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040abb8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040ad50
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6f65
lea eax, [ebp - 8]
call fcn.0040a464
lea eax, [ebp - 4]
call fcn.0040a440
ret

Function at 0x4f72fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040b05c
mov edx, eax
mov eax, ebx
call fcn.004f6d34
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.004f6e10
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x4f736e
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040b05c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4f8b00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f8bb2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b05c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x4f8b9c
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b1ec
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b05c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4f8b9c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4f8bc4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4f8b9c
cmp dword [ebp - 0xc], 0x34
jne 0x4f8b9c
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8bb9
lea eax, [ebp - 4]
call fcn.0040a41c
ret
Function at 0x4f90e4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4f9149
mov eax, dword [esp]
call fcn.004f9394
test al, al
je 0x4f9149
mov eax, dword [esp]
call fcn.004f91a4
mov esi, eax
call sub.KERNEL32.DLL_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4f912c
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4f9149
cmp ax, 0x5a
ja 0x4f9149
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4fa4b8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fa732
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004f8bc8
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x55617c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x556180], eax
mov eax, dword [ebp - 0x24]
mov dword [0x556184], eax
call fcn.0042856c
cmp eax, 2
sete byte [0x555955]
push 0x4fa740
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.004f8ad0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x555955], 0
jne 0x4fa547
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004f8b00
test al, al
je 0x4fa547
mov eax, dword [ebp - 0x4c]
mov dword [0x5e0a3c], eax
jmp 0x4fa54e
xor eax, eax
mov dword [0x5e0a3c], eax
call fcn.004f9a2c
and eax, 0x7f
cmp eax, 0x1c
ja case.0x4fa55f.0
jmp dword [eax*4 + 0x4fa566]
mov byte [0x555950], 1
jmp case.0x4fa55f.0
mov byte [0x555951], 1
jmp case.0x4fa55f.0
mov byte [0x555952], 1
jmp case.0x4fa55f.0
mov byte [0x555953], 1
jmp case.0x4fa55f.0
mov byte [0x555954], 1
jmp case.0x4fa55f.0
mov byte [0x555956], 1
mov byte [0x555957], 1
jmp case.0x4fa55f.0
mov byte [0x555956], 1
mov byte [0x555958], 1
jmp case.0x4fa55f.0
mov byte [0x555956], 1
mov byte [0x555958], 1
mov byte [0x555959], 1
jmp case.0x4fa55f.0
mov byte [0x55595a], 1
jmp case.0x4fa55f.0
mov byte [0x55595b], 1
jmp case.0x4fa55f.0
mov byte [0x55595c], 1
jmp case.0x4fa55f.0
mov byte [0x55595d], 1
jmp case.0x4fa55f.0
mov byte [0x55595e], 1
jmp case.0x4fa55f.0
mov byte [0x55595f], 1
jmp case.0x4fa55f.0
mov byte [0x555960], 1
jmp case.0x4fa55f.0
mov byte [0x555961], 1
jmp case.0x4fa55f.0
mov byte [0x555962], 1
jmp case.0x4fa55f.0
mov byte [0x555963], 1
jmp case.0x4fa55f.0
mov byte [0x555964], 1
jmp case.0x4fa55f.0
mov byte [0x555965], 1
jmp case.0x4fa55f.0
mov byte [0x555966], 1
jmp case.0x4fa55f.0
mov byte [0x555967], 1
jmp case.0x4fa55f.0
mov byte [0x555968], 1
jmp case.0x4fa55f.0
mov byte [0x555969], 1
jmp case.0x4fa55f.0
mov byte [0x55596a], 1
jmp case.0x4fa55f.0
mov byte [0x55596b], 1
jmp case.0x4fa55f.0
mov byte [0x55596c], 1
jmp case.0x4fa55f.0
mov byte [0x55596d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa739
lea eax, [ebp - 4]
call fcn.0040a41c
ret

Function at 0x5047bc
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x5047db
call sub.wsock32.dll_WSAGetLastError
call fcn.00500e6c
add esp, 0x190
ret
Function at 0x5047ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x504915
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov esi, 1
test edx, edx
je 0x50482a
inc esi
push 0x4bf
push edi
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_MsgWaitForMultipleObjects
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x504852
call sub.wsock32.dll_WSAGetLastError
call fcn.00500e6c
jmp 0x5048f3
cmp ebx, 0x102
jne 0x504874
lea edx, [ebp - 0x30]
mov eax, dword [0x55883c]
call fcn.0040f934
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00500ec4
jmp 0x5048f3
cmp ebx, esi
jne 0x5048f3
jmp 0x5048b5
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageW
cmp edi, 0xffffffff
je 0x5048b5
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x5048b5
lea edx, [ebp - 0x34]
mov eax, dword [0x55883c]
call fcn.0040f934
mov eax, dword [ebp - 0x34]
or edx, 0xffffffff
call fcn.00500ec4
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x50487a
cmp edi, 0xffffffff
je 0x5048f3
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x5048f3
lea edx, [ebp - 0x38]
mov eax, dword [0x55883c]
call fcn.0040f934
mov eax, dword [ebp - 0x38]
or edx, 0xffffffff
call fcn.00500ec4
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50491c
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.0040a47c
ret
Function at 0x505a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x24]
mov eax, esi
call fcn.00505b64
cmp dword [eax + 0xc], 0
jle 0x505b5b
mov eax, esi
call fcn.00505b64
push dword [eax + 0xc]
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
imul eax, eax, 0x3e8
pop edx
mov ecx, edx
cdq
idiv ecx
mov ebx, eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x505b54
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
push 0x4bf
push ebx
push 0
lea eax, [ebp - 4]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub eax, 1
jb 0x505b3d
je 0x505b1e
sub eax, 0x101
jne 0x505ae4
jmp 0x505b3d
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageW
call sub.KERNEL32.DLL_GetTickCount
sub eax, esi
cmp ebx, eax
jl 0x505b30
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x505b07
call sub.KERNEL32.DLL_GetTickCount
sub eax, esi
cmp ebx, eax
jl 0x505b3d
jmp 0x505ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505b5b
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetLastError
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x513b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x513be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040a41c
push 0
push 0
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.0050bb04
mov esi, eax
cmp esi, 1
jl 0x513bcb
mov ecx, esi
add ecx, ecx
mov dl, 1
mov eax, dword [0x50d868]
call fcn.004fef98
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x513bc4
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.0050bb04
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ff648
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513bcb
mov eax, dword [ebp - 4]
call fcn.0040858c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513be8
lea eax, [ebp - 8]
call fcn.0040a464
ret
Function at 0x51ed18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x51edb6
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jg 0x51ed4b
mov ecx, 0xc6
mov edx, 0x51edd4
mov eax, 0x51eec0
call fcn.0040a268
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404af0]
call fcn.0040c808
add esp, 4
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
push ebx
push 0x51eef0
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x4fbb9c]
call fcn.004fcd0c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51edbd
lea eax, [ebp - 8]
call fcn.0040a41c
lea eax, [ebp - 4]
mov edx, dword [0x404af0]
call fcn.0040c92c
ret