joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5228b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov word [ebp - 2], dx
mov byte [ebp - 3], 0
lea edx, [ebp - 0x3c]
mov eax, dword [0x58d174]
call fcn.0050ca68
test al, al
je 0x5229bb
mov esi, dword [ebp - 0x30]
mov eax, dword [0x58d174]
call fcn.0050edd8
movzx edi, ax
mov eax, dword [0x58d174]
call fcn.0050fbe4
movzx eax, ax
mov dword [ebp - 8], eax
mov eax, dword [0x58d174]
call fcn.0050eb28
xor eax, eax
push ebp
push 0x5229b4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004b9988
mov ebx, eax
call fcn.004b9988
sub eax, ebx
cmp eax, 0x2bc
ja 0x52299c
mov eax, dword [0x58d174]
call fcn.0050bdb8
test al, al
jne 0x52299c
mov eax, dword [0x58d174]
call fcn.00511ce0
test al, al
jne 0x52299c
mov eax, dword [0x58d174]
call fcn.0050edd8
movzx eax, ax
cmp edi, eax
jne 0x522962
mov eax, dword [0x58d174]
call fcn.0050fbe4
movzx eax, ax
cmp eax, dword [ebp - 8]
je 0x522968
mov byte [ebp - 3], 1
jmp 0x52299c
lea edx, [ebp - 0x3c]
mov eax, dword [0x58d174]
call fcn.0050ca68
cmp esi, dword [ebp - 0x30]
jle 0x522980
mov byte [ebp - 3], 1
jmp 0x52299c
movzx edx, byte [ebp - 2]
xor ecx, ecx
mov eax, dword [0x58d174]
call fcn.00511884
push 0x32
call sub.kernel32.dll_Sleep_2
jmp 0x522915
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5229bb
mov eax, dword [0x58d174]
call fcn.0051163c
ret
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x522a2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffcc
mov edi, 0x58d174
xor ebx, ebx
mov ecx, esp
mov dx, 0x55
mov eax, dword [edi]
call fcn.0050d5c8
test al, al
je 0x522acf
mov eax, dword [edi]
call fcn.0050edd8
mov ebx, eax
call fcn.004b9988
mov esi, eax
jmp 0x522a92
or ecx, 0xffffffff
mov edx, dword [esp + 4]
mov eax, dword [edi]
call fcn.00511928
push 0x12c
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
ja 0x522aa2
mov eax, dword [edi]
call fcn.0050edd8
cmp bx, ax
jne 0x522aa2
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x522a60
mov eax, dword [edi]
call fcn.0050edd8
cmp bx, ax
setne al
mov ebx, eax
test bl, bl
je 0x522acf
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp byte [eax + 0x5cd], 0
je 0x522acf
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, ebx
add esp, 0x34
pop edi
pop esi
pop ebx
ret
Function at 0x522ad8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov byte [ebp - 4], 0
call fcn.004b9988
mov dword [ebp - 0xc], eax
jmp 0x522b90
xor eax, eax
push ebp
push 0x522b6d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 3], 0
je 0x522b38
lea ecx, [ebp - 8]
movzx edx, word [ebp - 2]
mov eax, dword [0x58d178]
call fcn.00517e24
test al, al
je 0x522b63
mov eax, dword [ebp - 8]
call fcn.004041e0
mov byte [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522ba4
lea ecx, [ebp - 8]
movzx edx, word [ebp - 2]
mov eax, dword [0x58d178]
call fcn.00517e24
test al, al
jne 0x522b5b
mov byte [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522ba4
mov eax, dword [ebp - 8]
call fcn.004041e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522b77
push 0xc8
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, dword [ebp - 0xc]
cmp eax, 0x7d0
ja 0x522ba4
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x522af9
movzx eax, byte [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528988
Capabilities:
Check for time delay via gettickcount
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffcc
mov esi, eax
movzx ebp, word [esi + 0xa4]
mov word [esi + 0xa4], 0
push 0x528bec
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov byte [eax + 0x62], 0
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov byte [eax + 0x68], 0
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov byte [eax + 0x69], 0
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, dword [esi + 0xa0]
mov edx, ebp
call fcn.0050b128
push 0x12c
call sub.kernel32.dll_Sleep_2
cmp byte [esi + 0xa8], 0
je 0x528a2c
mov byte [esi + 0xa8], 0
mov edx, esp
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 0xa
call fcn.0050b4a4
test al, al
je 0x528a62
movzx eax, word [esp + 8]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
movzx ecx, byte [esp + 8]
mov edx, ebp
call fcn.0050f51c
jmp 0x528a62
cmp byte [esi + 0xaa], 0
je 0x528a62
mov byte [esi + 0xaa], 0
mov eax, dword [0x586a98]
mov eax, dword [eax]
cmp dword [eax + 0x80], 0x65
jne 0x528a58
movzx edx, bp
mov eax, esi
call fcn.0052a7e4
jmp 0x528a62
movzx edx, bp
mov eax, esi
call fcn.0052a860
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 1
mov edx, ebp
call fcn.0050f5a0
push 0x12c
call sub.kernel32.dll_Sleep_2
push 0x528bf8
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 1
mov edx, ebp
call fcn.0050f754
call fcn.004b9988
mov ebx, eax
mov edi, 1
jmp 0x528b17
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586a98]
mov eax, dword [eax]
cmp byte [eax + 0x62], 0
jne 0x528b1d
mov eax, dword [0x586a98]
mov eax, dword [eax]
cmp byte [eax + 0x68], 0
jne 0x528b1d
call fcn.004b9988
sub eax, ebx
mov ecx, 0x5dc
xor edx, edx
div ecx
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x528af1
cmp eax, dword [esp]
pop edx
pop eax
jae 0x528b09
jmp 0x528af5
pop edx
pop eax
jge 0x528b09
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 1
mov edx, ebp
call fcn.0050f754
inc edi
call fcn.004b9988
sub eax, ebx
cmp eax, 0x3a98
ja 0x528b1d
cmp byte [esi + 0xd], 0
je 0x528aaa
push 0x528c04
call sub.kernel32.dll_OutputDebugStringA
push 0x1f4
call sub.kernel32.dll_Sleep_2
jmp 0x528be1
add esp, 0x34
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x528d4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x5865d0]
call fcn.004b9988
mov ebx, eax
jmp 0x528d8a
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [esi]
call fcn.0050bdb8
test al, al
je 0x528d96
call fcn.004b9988
sub eax, ebx
cmp eax, 0x2710
ja 0x528d96
mov eax, dword [esi]
call fcn.0050fbb4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
je 0x528d60
mov eax, dword [esi]
call fcn.0050bdb8
mov ebx, eax
xor bl, 1
test bl, bl
je 0x528db0
push 0xbb8
call sub.kernel32.dll_Sleep_2
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x52ea9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov word [ebp - 8], cx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
call fcn.0041e26c
mov edi, eax
xor eax, eax
push ebp
push 0x52eb4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [edi + 8]
dec esi
cmp esi, 0
jl 0x52eb31
mov edx, esi
mov eax, edi
call fcn.0041dea4
mov ebx, eax
call fcn.004b9988
sub eax, dword [ebx + 4]
cmp eax, 0x1388
jbe 0x52eb0c
mov edx, 0x18
mov eax, ebx
call fcn.00402f6c
mov edx, esi
mov eax, edi
call fcn.0041dd98
jmp 0x52eb2b
movzx eax, word [ebx]
cmp ax, word [ebp - 6]
jne 0x52eb2b
call fcn.004b9988
mov dword [ebx + 4], eax
movzx eax, word [ebp - 8]
mov word [ebx + 2], ax
mov byte [ebp - 9], 1
jmp 0x52eb31
dec esi
cmp esi, 0xffffffff
jne 0x52eadb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52eb54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
call fcn.0041e2d0
ret

Function at 0x52f51c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffcc
mov esi, edx
mov ebx, eax
mov edi, dword [0x5865d0]
cmp byte [ebx + 0x54], 0
je 0x52f644
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29d
call fcn.0050c900
test al, al
jne 0x52f55c
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29e
call fcn.0050c900
test al, al
je 0x52f644
test esi, esi
je 0x52f5e6
mov eax, esi
call fcn.005243c8
cmp ax, 0x151
jbe 0x52f5e6
mov eax, esi
call fcn.005243c8
cmp ax, 0x157
jae 0x52f5e6
cmp dword [esp + 4], 4
je 0x52f644
mov eax, dword [edi]
call fcn.0050b9cc
call fcn.004b9988
mov esi, eax
jmp 0x52f5de
push 0xc8
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0xbb8
ja 0x52f644
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29d
call fcn.0050c900
test al, al
jne 0x52f5d7
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29e
call fcn.0050c900
test al, al
je 0x52f5de
cmp dword [esp + 4], 4
je 0x52f644
cmp byte [ebx + 0xd], 0
je 0x52f599
jmp 0x52f644
cmp dword [esp + 4], 4
jne 0x52f644
mov eax, dword [edi]
call fcn.0050b9cc
call fcn.004b9988
mov esi, eax
jmp 0x52f63e
push 0xc8
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0xbb8
ja 0x52f644
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29d
call fcn.0050c900
test al, al
jne 0x52f637
mov ecx, esp
mov eax, dword [edi]
mov dx, 0x29e
call fcn.0050c900
test al, al
je 0x52f63e
cmp dword [esp + 4], 4
jne 0x52f644
cmp byte [ebx + 0xd], 0
je 0x52f5fd
add esp, 0x34
pop edi
pop esi
pop ebx
ret
Function at 0x53157c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov byte [ebp - 7], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.0041e26c
mov edi, eax
xor eax, eax
push ebp
push 0x53163f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [edi + 8]
dec ebx
cmp ebx, 0
jl 0x531623
mov edx, ebx
mov eax, edi
call fcn.0041dea4
mov esi, eax
movzx eax, word [esi]
cmp ax, word [ebp - 6]
jne 0x5315f9
call fcn.004b9988
sub eax, dword [esi + 4]
cmp eax, 0xbb8
setb byte [ebp - 7]
cmp byte [ebp - 7], 0
jne 0x531623
mov edx, 0x18
mov eax, esi
call fcn.00402f6c
mov edx, ebx
mov eax, edi
call fcn.0041dd98
jmp 0x531623
call fcn.004b9988
sub eax, dword [esi + 4]
cmp eax, 0xbb8
jbe 0x53161d
mov edx, 0x18
mov eax, esi
call fcn.00402f6c
mov edx, ebx
mov eax, edi
call fcn.0041dd98
dec ebx
cmp ebx, 0xffffffff
jne 0x5315b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531646
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.0041e2d0
ret

Function at 0x5317c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
call fcn.0041e26c
mov edi, eax
xor eax, eax
push ebp
push 0x5318af
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [edi + 8]
dec esi
cmp esi, 0
jl 0x531893
mov edx, esi
mov eax, edi
call fcn.0041dea4
mov ebx, eax
call fcn.004b9988
sub eax, dword [ebx + 4]
cmp eax, 0x1388
jbe 0x53182f
mov edx, 0x18
mov eax, ebx
call fcn.00402f6c
mov edx, esi
mov eax, edi
call fcn.0041dd98
jmp 0x531889
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005243a0
cmp ax, word [ebx]
jne 0x531889
call fcn.004b9988
sub eax, dword [ebx + 4]
cmp eax, 0xbb8
jbe 0x531883
lea ecx, [ebp - 0x10]
movzx edx, word [ebx + 2]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005181ec
test al, al
jne 0x53187b
mov edx, 0x18
mov eax, ebx
call fcn.00402f6c
mov edx, esi
mov eax, edi
call fcn.0041dd98
jmp 0x531893
mov eax, dword [ebp - 0x10]
call fcn.004041e0
mov byte [ebp - 9], 1
jmp 0x531893
dec esi
cmp esi, 0xffffffff
jne 0x5317fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5318b6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
call fcn.0041e2d0
ret
Function at 0x531d78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc4
mov esi, eax
mov byte [esp], 0
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511c88
mov edi, eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511cb0
mov ebp, eax
call fcn.004b9988
mov ebx, eax
lea ecx, [esp + 8]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov dx, 0x54
call fcn.0050d5c8
test al, al
je 0x531e25
mov eax, dword [0x5865d0]
mov eax, dword [eax]
or ecx, 0xffffffff
mov edx, dword [esp + 0xc]
call fcn.00511928
jmp 0x531e1a
push 0xc8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511c88
cmp edi, eax
jne 0x531dff
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511cb0
cmp ebp, eax
je 0x531e08
mov byte [esp], 1
jmp 0x531eda
call fcn.004b9988
sub eax, ebx
cmp eax, 0x3e8
ja 0x531eda
cmp byte [esi + 0xd], 0
je 0x531dd5
jmp 0x531eda
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511c74
cmp al, 2
jne 0x531eda
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050cf54
mov ecx, eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov dl, 9
call fcn.00511a74
jmp 0x531ed4
push 0xc8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511c88
cmp edi, eax
jne 0x531e87
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511cb0
cmp ebp, eax
je 0x531e8d
mov byte [esp], 1
jmp 0x531eda
call fcn.004b9988
sub eax, ebx
cmp eax, 0x320
jbe 0x531ec6
cmp dword [esp + 4], 0
jne 0x531ec6
mov dword [esp + 4], 1
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050cf54
mov ecx, eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov dl, 9
call fcn.00511a74
call fcn.004b9988
sub eax, ebx
cmp eax, 0x3e8
ja 0x531eda
cmp byte [esi + 0xd], 0
je 0x531e5d
movzx eax, byte [esp]
add esp, 0x3c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54ae18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, eax
movzx eax, word [esi]
cmp eax, 0x2d
jg 0x54ae3f
je 0x54ae60
sub eax, 0x21
je 0x54ae8f
dec eax
je 0x54aecc
dec eax
je 0x54ae60
jmp 0x54b060
sub eax, 0x31
je 0x54af6a
dec eax
je 0x54af40
add eax, 0xffffffc1
sub eax, 0xb
jb 0x54af94
jmp 0x54b060
cmp byte [ebx + 0x1da], 0
je 0x54ae7c
mov eax, ebx
call fcn.0046daa4
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
jmp 0x54b060
mov eax, ebx
call fcn.0046daac
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
jmp 0x54b060
mov eax, dword [ebx + 0x3e0]
cmp byte [eax + 0x1e4], 0
jne 0x54b060
mov eax, dword [ebx + 0x3e8]
cmp byte [eax + 0x1e4], 0
jne 0x54b060
mov eax, dword [0x58d1a8]
mov edx, dword [eax + 0x3e0]
mov eax, ebx
call fcn.005384b4
jmp 0x54b060
mov esi, dword [ebx + 0x3e0]
cmp byte [esi + 0x1e4], 0
jne 0x54aeee
mov eax, dword [ebx + 0x3e8]
cmp byte [eax + 0x1e4], 0
je 0x54b060
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x54af13
mov eax, dword [0x58d1a8]
mov edx, dword [eax + 0x3e0]
mov eax, dword [0x58d1a8]
call fcn.005384b4
jmp 0x54b060
mov eax, dword [ebx + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x54b060
mov eax, dword [0x58d1a8]
mov edx, dword [eax + 0x3e0]
mov eax, dword [0x58d1a8]
call fcn.005384b4
jmp 0x54b060
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54b060
mov eax, dword [0x58d1a8]
mov edx, dword [eax + 0x6c4]
mov eax, dword [0x58d1a8]
call fcn.00557f70
jmp 0x54b060
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54b060
mov eax, dword [0x58d1a8]
mov edx, dword [eax + 0x6c8]
mov eax, dword [0x58d1a8]
call fcn.00557f70
jmp 0x54b060
mov eax, dword [ebx + 0x6ac]
mov edx, dword [eax]
call dword [edx + 0xdc]
movzx edx, word [esi]
sub edx, 0x6f
cmp eax, edx
jne 0x54afba
xor edx, edx
mov eax, ebx
call fcn.00539968
jmp 0x54b060
mov eax, dword [ebx + 0x8a4]
mov edx, dword [eax]
call dword [edx + 0xdc]
inc eax
movzx edx, word [esi]
sub edx, 0x6f
cmp eax, edx
jne 0x54b02e
mov eax, dword [ebx + 0x8f8]
call fcn.004dbc38
mov edx, dword [0x5866d8]
mov edx, dword [edx]
mov byte [edx + 0xfd], al
mov eax, dword [ebx + 0x8fc]
call fcn.004dbc38
mov edx, dword [0x5866d8]
mov edx, dword [edx]
mov byte [edx + 0xfc], al
mov eax, dword [ebx + 0x8ac]
call fcn.004dbc38
mov edx, dword [0x5866d8]
mov edx, dword [edx]
mov byte [edx + 0xf5], al
mov eax, dword [0x5866d8]
mov eax, dword [eax]
mov byte [eax + 0xf4], 1
jmp 0x54b060
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54b060
cmp word [esi], 0x7b
jne 0x54b060
cmp byte [ebx + 0x1da], 0
je 0x54b052
mov eax, ebx
call fcn.0046daa4
jmp 0x54b060
mov eax, ebx
call fcn.0046daac
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
pop esi
pop ebx
pop ebp
ret 4
Function at 0x54db88
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x54db90
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x54dff5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00512754
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0x54e00c
call fcn.004054c0
mov eax, dword [ebp - 4]
call fcn.0040a510
test al, al
jne 0x54dc16
lea edx, [ebp - 0x24]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00512754
lea eax, [ebp - 0x24]
mov edx, 0x54e024
call fcn.00405474
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00405638
push eax
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
call fcn.00405638
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov dl, 1
mov eax, dword [0x41bb74]
call fcn.004041b0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x7ac]
mov eax, dword [eax + 0x278]
call fcn.0047ed1c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x7ac]
mov eax, dword [eax + 0x278]
call fcn.0047ecf0
xor eax, eax
push ebp
push 0x54dd5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x54dd30
inc esi
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, 0x54e040
mov eax, dword [ebp - 0xc]
call fcn.00409b44
test al, al
jne 0x54dd30
mov edx, dword [ebp - 0xc]
mov eax, 0x54e054
call fcn.00405784
mov ebx, eax
test ebx, ebx
jle 0x54dd26
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebx + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.004056a0
mov eax, dword [ebp - 0x2c]
or edx, 0xffffffff
call fcn.0040a188
mov edi, eax
cmp edi, 0xffffffff
je 0x54dd26
lea eax, [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004056a0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x7ac]
mov eax, dword [eax + 0x278]
call fcn.0047eb68
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047e5b8
lea edx, [ebp - 0x30]
mov eax, edi
call fcn.00409fe0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x18]
dec esi
jne 0x54dc81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54dd61
mov eax, dword [ebp - 0x1c]
call fcn.004041e0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x7ac]
mov eax, dword [eax + 0x278]
call fcn.0047ef00
ret
Function at 0x564f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5d0], 0
jne 0x564f9f
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050e8f4
cmp esi, eax
jle 0x564f9f
call fcn.004b9988
mov edi, eax
jmp 0x564f99
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050b184
test eax, eax
jle 0x564f9f
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050e8f4
cmp esi, eax
jle 0x564f9f
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov edx, 0x564fac
call fcn.00512050
push 0x1f4
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, edi
cmp eax, 0x1388
ja 0x564f9f
cmp byte [ebx + 0xd], 0
je 0x564f50
pop edi
pop esi
pop ebx
ret

Function at 0x564fb8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x34]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
call fcn.004b9988
mov edi, eax
movzx esi, word [ebp - 0x34]
jmp 0x56507e
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 4
mov edx, dword [ebp - 0x30]
call fcn.0050f2cc
push 0x3e8
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x68]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, 4
call fcn.0050c9b0
test al, al
je 0x565027
movzx eax, si
cmp eax, dword [ebp - 0x68]
je 0x565023
cmp dword [ebp - 0x4c], 5
jle 0x565027
mov bl, 1
jmp 0x56508e
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050b184
test eax, eax
jle 0x565070
call fcn.004b9988
sub eax, edi
cmp eax, 0x7d0
jbe 0x565070
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5d0], 0
jne 0x565070
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov edx, 0x5650a0
call fcn.00512050
push 0x1f4
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, edi
cmp eax, 0x1388
ja 0x56508e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
je 0x564fdf
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5655c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov word [ebp - 6], cx
mov edi, edx
mov dword [ebp - 4], eax
mov byte [ebp - 7], 0
lea ecx, [ebp - 0x40]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, edi
call fcn.0050d5c8
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
movzx ecx, word [ebp + 8]
mov edx, edi
call fcn.0050b5d4
call fcn.004b9988
mov esi, eax
xor ebx, ebx
jmp 0x5656e3
push 0x32
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0x1f40
ja 0x5656f0
lea ecx, [ebp - 0x40]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, edi
call fcn.0050d5c8
test al, al
je 0x565663
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc]
jle 0x565663
push 0xc8
call sub.kernel32.dll_Sleep_2
mov byte [ebp - 7], 1
jmp 0x5656f0
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
jbe 0x56568d
test ebx, ebx
jne 0x56568d
movzx eax, word [ebp - 6]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
movzx ecx, word [ebp + 8]
mov edx, edi
call fcn.0050b5d4
inc ebx
call fcn.004b9988
sub eax, esi
cmp eax, 0xfa0
jbe 0x5656b8
cmp ebx, 1
jne 0x5656b8
movzx eax, word [ebp - 6]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
movzx ecx, word [ebp + 8]
mov edx, edi
call fcn.0050b5d4
inc ebx
call fcn.004b9988
sub eax, esi
cmp eax, 0x1770
jbe 0x5656e3
cmp ebx, 2
jne 0x5656e3
movzx eax, word [ebp - 6]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
movzx ecx, word [ebp + 8]
mov edx, edi
call fcn.0050b5d4
inc ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x56561a
movzx eax, byte [ebp - 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4