joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5273a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
cmp dword [ebx + 0x410], 0
je 0x527514
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x527514
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
mov esi, dword [ebx + 0x410]
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004e0d6c
mov byte [ebx + 0x2c], al
mov eax, ebx
call fcn.005272d0
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.006a9ba0
lea esi, [ebx + 0x140]
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
inc eax
call fcn.004034e0
add eax, dword [esi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x4a4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x527509
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x4a4]
call fcn.00420a68
mov esi, dword [eax]
test esi, esi
je 0x5274fd
cmp byte [esi + 0x378], 0
jne 0x5274fd
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5274fd
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x23c]
cmp eax, ecx
jg 0x5274fd
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x5274fd
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [esi + 0x24]
movzx edx, word [esi + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
push esi
push 0
push 0x190
mov cx, 0xdc
mov edx, ebx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x18]
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 8
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, ebx
call fcn.006a4724
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x527464
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528058
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, eax
mov byte [ebp - 1], 0
cmp dword [ebx + 0x410], 0
je 0x5281a8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x5281a8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.006a9ba0
mov eax, dword [ebx + 0x158]
sub eax, dword [ebx + 0x154]
inc eax
call fcn.004034e0
add eax, dword [ebx + 0x154]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x4a4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52819d
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x4a4]
call fcn.00420a68
mov esi, dword [eax]
test esi, esi
je 0x528191
cmp byte [esi + 0x378], 0
jne 0x528191
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x528191
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x23c]
cmp eax, ecx
jg 0x528191
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x528191
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, esi
call fcn.006a9d70
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x528191
lea edx, [ebp - 0x10]
mov ecx, ebx
mov eax, esi
call fcn.006a9f54
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 0x16c]
push eax
mov eax, dword [esi + 0x174]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x18]
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x5280f4
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528d1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x410], 0
je 0x528ec9
mov esi, dword [ebx + 0x410]
mov eax, dword [esi + 0x36c]
cmp eax, dword [ebx + 0x36c]
jne 0x528ec9
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x528ec9
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x528ec9
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004e49e0
test al, al
je 0x528ec9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x528ec5
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
push 1
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x154]
sub ecx, eax
mov edx, eax
mov eax, ebx
call fcn.006ad27c
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x528ea2
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x36c]
call fcn.006b70f4
test al, al
je 0x528e98
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x36c]
call fcn.006b7460
mov edi, eax
test edi, edi
je 0x528e98
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x528e98
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.006a9bc4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x528e98
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.006a9f54
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [edi + 0x16c]
push eax
mov eax, dword [edi + 0x174]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x528e01
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.006a9ba0
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 3], 1
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58395c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x583978
cmp dword [esi + 4], 0
je 0x5839a5
test byte [ebx + 0x55], 1
jne 0x583997
mov eax, ebx
call fcn.00468564
test eax, eax
jne 0x583997
mov edx, esi
mov eax, ebx
call fcn.0046e77c
jmp 0x583a99
mov edx, esi
mov eax, ebx
call fcn.00469d28
jmp 0x583a99
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x583a92
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046c5f8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.00465838
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0058395c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046c5f8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583a99
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58bfa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x58bffa
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0058bf90
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00589880
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00589398
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58c001
lea eax, [ebp - 4]
call fcn.004054d0
ret
Function at 0x597787
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5977df
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x5977d5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x5977e3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x60e52c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x704194
test edx, edx
jne 0x60e53f
xor eax, eax
jmp 0x60e654
mov dword [esp], 1
cmp byte [esp], 0
je 0x60e55c
push ecx
push edx
push eax
call fcn.0060e658
add esp, 0xc
jmp 0x60e654
push ecx
push edx
push eax
call fcn.0060e918
add esp, 0xc
jmp 0x60e654
pop edx
pop esi
pop ebx
ret
Function at 0x6101c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x6101ff
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x610280
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0060deec
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x61024d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x61024f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x610236
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x610275
mov cx, word [ebp - 4]
sub cx, si
jmp 0x610277
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x61025e
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x6102e2
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.0060fe90
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x6102cd
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x6102e2
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x6101d3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x612c18
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x612c21
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5010], ecx
mov dword [ebp - 0x501c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405960
xor eax, eax
push ebp
push 0x612da0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004054d0
cmp dword [ebp - 4], 0
je 0x612d74
mov eax, dword [ebp - 4]
test eax, eax
je 0x612c7a
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405970
lea edx, [ebp - 0x500c]
mov ecx, dword [ebp - 8]
call fcn.00403258
xor eax, eax
push ebp
push 0x612d3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x500c]
mov edx, dword [ebp - 8]
call fcn.0060df50
movzx eax, byte [ebp - 8]
mov edx, dword [ebp - 0xc]
mov byte [edx], al
lea edx, [ebp - 0x500c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.00403258
lea eax, [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x501c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, 8
call fcn.0040ad64
mov eax, dword [ebp - 0x501c]
mov dword [ebp - 0x5018], eax
mov byte [ebp - 0x5014], 0xb
lea edx, [ebp - 0x5018]
xor ecx, ecx
mov eax, 0x612db8
call fcn.0040bf74
mov eax, dword [ebp - 0x5010]
call fcn.00405970
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x500c], 0
mov eax, dword [ebp - 0xc]
call fcn.0040300c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x612d4e
push 0x2800
lea edx, [ebp - 0x280c]
lea eax, [ebp - 0x500c]
mov ecx, dword [ebp - 8]
call fcn.00612afc
mov edx, ebx
lea eax, [ebp - 0x280c]
call fcn.0040b6e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612da7
lea eax, [ebp - 0x501c]
call fcn.004054d0
lea eax, [ebp - 0x5010]
call fcn.004054d0
lea eax, [ebp - 4]
call fcn.004054d0
ret
Function at 0x619e04
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405960
xor eax, eax
push ebp
push 0x619fb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x619f91
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.00403b3c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405970
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x619f91
mov eax, dword [ebp - 0x14]
call fcn.00402fd8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x619f8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x619f74
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x619fc4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x619f74
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x619fd0
call fcn.0040bf74
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.0040577c
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.00403a2c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619f91
mov eax, dword [ebp - 0xc]
call fcn.0040300c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619fb9
lea eax, [ebp - 0x118]
call fcn.004054d0
lea eax, [ebp - 4]
call fcn.004054d0
ret
Function at 0x61d718
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x1f8], edx
mov dword [ebp - 0x1fc], edx
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61d985
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x61d95a
call fcn.0040dbc0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x12]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xe]
call fcn.0040db78
call fcn.0040dbec
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1a]
push eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x14]
call fcn.0040d898
mov eax, dword [0x7070f8]
mov eax, dword [eax + 0x168]
call fcn.0040b214
test al, al
jne 0x61d7d9
mov eax, dword [0x7070f8]
mov eax, dword [eax + 0x168]
call fcn.0040b430
mov eax, dword [0x7070f8]
push dword [eax + 0x168]
lea edx, [ebp - 0x1ec]
movzx eax, word [ebp - 0xe]
call fcn.0040ab6c
push dword [ebp - 0x1ec]
push 0x61d99c
lea edx, [ebp - 0x1f0]
movzx eax, word [ebp - 0x10]
call fcn.0048d724
push dword [ebp - 0x1f0]
push 0x61d99c
lea edx, [ebp - 0x1f4]
movzx eax, word [ebp - 0x12]
call fcn.0048d724
push dword [ebp - 0x1f4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405874
mov eax, dword [ebp - 4]
call fcn.0040b214
test al, al
jne 0x61d856
push 0
mov eax, dword [ebp - 4]
call fcn.00405970
push eax
call sub.kernel32.dll_CreateDirectoryA
push dword [ebp - 4]
push 0x61d9a8
lea edx, [ebp - 0x1f8]
xor eax, eax
call fcn.0040ab6c
push dword [ebp - 0x1f8]
push 0x61d99c
lea edx, [ebp - 0x1fc]
movzx eax, word [ebp - 0x14]
call fcn.0048d724
push dword [ebp - 0x1fc]
push 0x61d9b4
movzx eax, word [ebp - 0x16]
mov ecx, 0xa
xor edx, edx
div ecx
add eax, eax
lea eax, [eax + eax*4]
lea edx, [ebp - 0x200]
call fcn.0048d724
push dword [ebp - 0x200]
push 0x61d9c0
lea eax, [ebp - 8]
mov edx, 8
call fcn.00405874
mov eax, dword [ebp - 8]
call fcn.0040b1f0
test al, al
jne 0x61d8e3
lea eax, [ebp - 0x1e8]
call fcn.00403660
call fcn.0040314c
jmp 0x61d8f3
lea eax, [ebp - 0x1e8]
call fcn.0040366c
call fcn.0040314c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x61d94a
inc ebx
xor esi, esi
lea ecx, [ebp - 0x208]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
mov edx, 0x61d9d0
call fcn.004057f8
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x1e8]
call fcn.00405c90
call fcn.00403e2c
call fcn.0040314c
inc esi
dec ebx
jne 0x61d905
lea eax, [ebp - 0x1e8]
call fcn.00403998
call fcn.0040314c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d98c
lea eax, [ebp - 0x208]
mov edx, 8
call fcn.004054f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f4
ret
Function at 0x623428
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x708160]
push eax
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x623537
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x707bc4]
mov eax, dword [eax]
call fcn.00632d68
mov eax, dword [0x707168]
mov eax, dword [eax]
call fcn.005152a8
mov eax, dword [0x7072c4]
mov eax, dword [eax]
call fcn.0050df80
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0xb087e0]
cmp eax, 0x2710
jbe 0x62351e
call sub.kernel32.dll_GetTickCount_1
mov dword [0xb087e0], eax
mov eax, dword [0x707c90]
mov eax, dword [eax]
call fcn.0051a150
mov eax, dword [0x707de8]
mov eax, dword [eax]
call fcn.00512190
mov eax, dword [0x7078e8]
mov eax, dword [eax]
call fcn.004d8144
xor eax, eax
push ebp
push 0x623517
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7078e8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x6234fd
mov eax, dword [0x7078e8]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
jae 0x6234f7
mov eax, dword [0x7078e8]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x6234d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62351e
mov eax, dword [0x7078e8]
mov eax, dword [eax]
call fcn.004d8154
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62353e
mov eax, dword [0x708160]
push eax
call sub.kernel32.dll_LeaveCriticalSection
ret
Function at 0x625ea4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x410], 0
je 0x626000
mov edx, 0x1391
mov eax, esi
call fcn.00628f68
test al, al
jne 0x625ffe
mov ecx, 7
mov edx, dword [esi + 0x410]
mov eax, esi
call fcn.00629820
test al, al
je 0x626000
mov eax, dword [esi + 0x410]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.006abc14
test al, al
je 0x626000
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x625ffa
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
push 1
mov ecx, dword [esi + 0x158]
mov eax, dword [esi + 0x154]
sub ecx, eax
mov edx, eax
mov eax, esi
call fcn.006ad27c
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x410]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x410]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x625fb1
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x410]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov ecx, 7
mov dx, 0xea
mov eax, esi
call fcn.006a4724
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x626000
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret