joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5614
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2fc], 0
jne 0x4a5741
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4a5741
mov eax, dword [ebp - 4]
cmp word [eax + 0x6a], 0
jne 0x4a5741
call fcn.00407b30
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3fc]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4fc]
jle 0x4a5741
call fcn.00407b30
mov edx, dword [ebp - 4]
mov dword [edx + 0x3fc], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2bd], 0
je 0x4a5694
mov eax, dword [ebp - 4]
mov bx, 0xffea
call fcn.004030dc
jmp 0x4a5741
call fcn.00407b30
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3f8]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x514]
jle 0x4a56b5
mov eax, dword [ebp - 4]
call fcn.004c94b4
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x378], 0
je 0x4a570f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x558]
jg 0x4a5709
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x28]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x558]
jle 0x4a5713
mov byte [ebp - 5], 1
jmp 0x4a5713
mov byte [ebp - 5], 1
cmp byte [ebp - 5], 0
je 0x4a5727
mov eax, dword [ebp - 4]
mov bx, 0xffe8
call fcn.004030dc
jmp 0x4a5741
mov eax, dword [ebp - 4]
mov bx, 0xffeb
call fcn.004030dc
test al, al
je 0x4a5741
mov eax, dword [ebp - 4]
call fcn.004c936c
jmp 0x4a5749
mov eax, dword [ebp - 4]
call fcn.004c936c
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a8190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
jle 0x4a8225
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
call fcn.00411704
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x3d], 0
je 0x4a821d
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x34]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x38]
jbe 0x4a821d
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0xc]
mov bx, 0xffff
call fcn.004030dc
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x28], 0
je 0x4a8218
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc]
call fcn.00411558
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
call fcn.004115a4
jmp 0x4a819f
inc dword [ebp - 8]
jmp 0x4a819f
inc dword [ebp - 8]
jmp 0x4a819f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4a8289
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
call fcn.00411704
push dword [eax + 0x24]
call sub.kernel32.dll_GetTickCount
pop edx
sub eax, edx
cmp eax, 0x493e0
jbe 0x4a8281
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
call fcn.00411704
call fcn.00402f00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
call fcn.004115a4
jmp 0x4a8289
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4a823e
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8e54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x550]
cmp eax, 0xbb8
jbe 0x4a8ed2
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x550], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.004b5db0
cmp eax, 2
jl 0x4a8eae
mov eax, dword [ebp - 4]
mov byte [eax + 0x555], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x378]
mov eax, dword [ebp - 4]
mov bx, 0xfff4
call fcn.004030dc
test al, al
jne 0x4a8ed2
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x378], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x555], 0
je 0x4a8f2a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, 8
call fcn.00402b78
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004c3f64
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x24]
jne 0x4a8f1c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x28]
je 0x4a8f2a
mov eax, dword [ebp - 4]
mov byte [eax + 0x555], 0
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9720
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4a97a1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x554], 0
jne 0x4a97a1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2fc], 0
jne 0x4a97a1
mov eax, dword [ebp - 4]
cmp word [eax + 0x6a], 0
jne 0x4a97a1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x400]
cmp eax, 0x1f40
ja 0x4a978b
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x400]
cmp eax, 0x3e8
jbe 0x4a97a1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x378], 0
jne 0x4a97a1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x400], eax
mov eax, dword [ebp - 4]
call fcn.004c94b4
mov eax, dword [ebp - 4]
call fcn.004a9020
pop ecx
pop ebp
ret
Function at 0x4aed70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4aee94
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 8]
call fcn.00411704
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4aee87
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4aee08
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
call fcn.00411704
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x304], 0
jne 0x4aedf1
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x2fc], 0
jne 0x4aedf1
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x2cc], 0
jne 0x4aedff
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
call fcn.004115a4
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4aedbc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
cmp dword [eax + 8], 0
jle 0x4aee39
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x10]
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 0x10]
cmp eax, dword [edx + 0x28]
ja 0x4aee39
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x10]
sub eax, dword [edx + 0x24]
cmp eax, 0x2bf20
jbe 0x4aee87
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
call fcn.00402f00
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp dword [edx + eax*4], 0
je 0x4aee63
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax*4]
call fcn.004a7c8c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4aee49
mov edx, 0x2c
mov eax, dword [ebp - 0x10]
call fcn.004027b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 8]
call fcn.004115a4
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x4aed8f
mov esp, ebp
pop ebp
ret
Function at 0x4b1b8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x15], 0
xor eax, eax
push ebp
push 0x4b1cb0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407b30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x68]
mov edx, dword [edx + 8]
dec edx
sub edx, eax
jl 0x4b1c98
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 8]
call fcn.00411704
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x2fc], 0
jne 0x4b1c6b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
sub edx, dword [eax + 0x368]
mov eax, dword [ebp - 0x14]
cmp edx, dword [eax + 0x36c]
jle 0x4b1c6b
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x14]
sub eax, dword [edx + 0x364]
mov edx, dword [ebp - 0x14]
cmp eax, dword [edx + 0x360]
jbe 0x4b1c3c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x364], eax
mov eax, dword [ebp - 0x14]
call fcn.004b966c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
sub edx, dword [eax + 0x368]
mov eax, dword [ebp - 0x14]
cmp edx, dword [eax + 0x36c]
jle 0x4b1c6b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x368], edx
mov eax, dword [ebp - 0x14]
mov bx, 0xfffb
call fcn.004030dc
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0xc]
mov edx, dword [0x4ea4a8]
cmp eax, dword [edx]
jbe 0x4b1c8c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x4c], edx
mov byte [ebp - 0x15], 1
jmp 0x4b1c98
inc dword [ebp - 8]
dec dword [ebp - 0x1c]
jne 0x4b1bd9
cmp byte [ebp - 0x15], 0
jne 0x4b1ca6
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x4c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1cc4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1cf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x15], 0
xor eax, eax
push ebp
push 0x4b1e14
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407b30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6c]
mov edx, dword [edx + 8]
dec edx
sub edx, eax
jl 0x4b1dfc
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 8]
call fcn.00411704
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x2fc], 0
jne 0x4b1dcf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub edx, dword [eax + 0x368]
mov eax, dword [ebp - 0x14]
cmp edx, dword [eax + 0x36c]
jle 0x4b1dcf
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x14]
sub eax, dword [edx + 0x364]
mov edx, dword [ebp - 0x14]
cmp eax, dword [edx + 0x360]
jbe 0x4b1da0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x364], eax
mov eax, dword [ebp - 0x14]
call fcn.004b966c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub edx, dword [eax + 0x368]
mov eax, dword [ebp - 0x14]
cmp edx, dword [eax + 0x36c]
jle 0x4b1dcf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x368], edx
mov eax, dword [ebp - 0x14]
mov bx, 0xfffb
call fcn.004030dc
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x10]
mov edx, dword [0x4ea4a8]
cmp eax, dword [edx]
jbe 0x4b1df0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x50], edx
mov byte [ebp - 0x15], 1
jmp 0x4b1dfc
inc dword [ebp - 8]
dec dword [ebp - 0x1c]
jne 0x4b1d3d
cmp byte [ebp - 0x15], 0
jne 0x4b1e0a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1e28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3d44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4036
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x39], 0
mov byte [ebp - 0xd], 0
call fcn.00407b30
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jbe 0x4b3dae
mov eax, dword [0x4ebb68]
mov dword [0x4ebb6c], eax
jmp 0x4b3fa5
lea eax, [ebp - 0x24]
call fcn.00403c4c
xor eax, eax
push ebp
push 0x4b3e1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4ea034]
mov eax, dword [eax]
call fcn.00450080
mov edx, dword [0x4ea2fc]
mov edx, dword [edx]
mov eax, 0x4b4050
call fcn.004041b8
test eax, eax
jle 0x4b3e00
lea eax, [ebp - 0x24]
mov edx, dword [0x4ea2fc]
mov edx, dword [edx]
call fcn.00403ce4
mov eax, dword [0x4ea2fc]
call fcn.00403c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3e21
mov eax, dword [0x4ea034]
mov eax, dword [eax]
call fcn.00450088
ret
cmp byte [ebp - 0x39], 0
jne 0x4b3fd7
call fcn.0040a548
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x5c]
call fcn.0040b190
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
mov edx, 0x4b4068
call fcn.00403f18
mov eax, dword [ebp - 0x58]
call fcn.004e4274
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x14]
mov edx, dword [0x4ea444]
cmp eax, dword [edx]
jbe 0x4b3ff9
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x14]
mov edx, dword [0x4ea444]
mov dword [edx], eax
mov eax, dword [0x4ea698]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b403d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00403c70
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00403c70
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00403c70
ret
Function at 0x4bca00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x530]
cmp eax, 0x2710
jbe 0x4bca52
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x530], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x52f], 1
mov ecx, 1
mov edx, 0x4bca70
mov eax, dword [ebp - 4]
call fcn.004bb124
mov byte [ebp - 5], 1
jmp 0x4bca61
xor ecx, ecx
mov edx, 0x4bca94
mov eax, dword [ebp - 4]
call fcn.004bb124
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c9190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
test dl, dl
je 0x4c91a2
add esp, 0xfffffff0
call fcn.00403240
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b780c
mov eax, dword [ebp - 4]
mov dword [eax + 0x538], 0xffffffff
mov eax, 4
call fcn.00402b78
imul eax, eax, 0x1f4
add eax, 0x3e8
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f0], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x23a], 0x32
mov eax, 0xbb8
call fcn.00402b78
push eax
call fcn.00407b30
pop edx
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f8], eax
mov eax, 0xbb8
call fcn.00402b78
push eax
call fcn.00407b30
pop edx
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x400], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x540], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x548], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4c9276
call fcn.00403298
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4caf08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb0f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x60c]
cmp eax, 0x258
jae 0x4caf5b
mov eax, dword [ebp - 4]
inc dword [eax + 0x61c]
mov eax, dword [ebp - 4]
inc dword [eax + 0x620]
jmp 0x4caf7b
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x61c], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x620], 0
jle 0x4caf7b
mov eax, dword [ebp - 4]
dec dword [eax + 0x620]
call sub.kernel32.dll_GetTickCount
mov edx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x60c], edx
cmp dword [eax + 0x61c], 4
jl 0x4caf99
jmp 0x4cb046
cmp dword [eax + 0x620], 6
jg 0x4caf94
mov byte [eax + 0x316], 0
mov eax, dword [eax + 0x5c]
test eax, 0x4000000
jne 0x4caf94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.004b2c38
and eax, 0xff
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004c3f64
test al, al
je 0x4cb02b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x316], 0
jne 0x4cb018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
cmp eax, dword [ebp - 8]
jne 0x4cb01c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp eax, dword [ebp - 0xc]
jne 0x4cb01c
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 4]
sub dword [eax + 0x370], 0xa
jmp 0x4cb0da
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x61c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x620], edx
jmp 0x4cb0da
mov eax, dword [ebp - 4]
inc dword [eax + 0x624]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x624], 8
jle 0x4cb065
mov eax, dword [ebp - 4]
mov byte [eax + 0x5d4], 1
mov eax, dword [0x4ea04c]
cmp byte [eax], 0
je 0x4cb0da
mov edx, 0x4cb108
lea eax, [ebp - 0x40]
call fcn.00402a18
mov eax, dword [ebp - 4]
lea edx, [eax + 0x15]
lea eax, [ebp - 0x40]
mov cl, 0x1b
call fcn.004029e8
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x60]
call fcn.00402a18
mov edx, 0x4cb118
lea eax, [ebp - 0x60]
mov cl, 0x1c
call fcn.004029e8
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x24]
call fcn.00403e70
lea eax, [ebp - 0x24]
push eax
call fcn.0040a548
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x64]
call fcn.0040b190
mov edx, dword [ebp - 0x64]
pop eax
call fcn.00403ed4
mov eax, dword [ebp - 0x24]
call fcn.004e4274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0ff
lea eax, [ebp - 0x64]
call fcn.00403c4c
lea eax, [ebp - 0x24]
call fcn.00403c4c
ret
Function at 0x4ddb04
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jge 0x4ddb4c
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00407b24
movzx eax, ax
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x414]
mov edx, 0x2ad
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp 0x4ddc87
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004c368c
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x31c]
jne 0x4ddc50
mov eax, dword [ebp - 4]
cmp dword [eax + 0x31c], 0
je 0x4ddc50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
cmp byte [eax + 0x418], 0
jne 0x4ddc50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x414]
cmp eax, dword [ebp - 8]
jl 0x4ddc50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x414]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x414], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00407b24
movzx eax, ax
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x414]
mov edx, 0x2ac
mov eax, dword [ebp - 4]
call fcn.004cad6c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x31c], 0
je 0x4ddc3e
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x414]
mov edx, 0x2ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.004cad6c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x31c]
mov dword [edx + 0x318], eax
mov byte [ebp - 9], 1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x318], eax
cmp byte [ebp - 9], 0
jne 0x4ddc87
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00407b24
movzx eax, ax
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x414]
mov edx, 0x2ad
mov eax, dword [ebp - 4]
call fcn.004cad6c
mov esp, ebp
pop ebp
ret
Function at 0x4e2488
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404080
xor eax, eax
push ebp
push 0x4e25a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004093b0
test al, al
je 0x4e258e
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409278
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4e258e
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.00409334
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x4e24f5
add eax, 3
sar eax, 2
shl eax, 2
call fcn.004027a0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x4e2510
add eax, 3
sar eax, 2
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00402b58
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.00409334
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004092dc
mov eax, dword [ebp - 0x14]
call fcn.00409340
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, 3
test eax, eax
jns 0x4e2556
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x4e2588
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x20], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x24]
jne 0x4e2569
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e25ab
lea eax, [ebp - 4]
call fcn.00403c4c
ret