joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff734
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4ff87c
cmp byte [ebx], 0
je 0x4ff87c
mov dword [ebp - 8], esi
test esi, esi
je 0x4ff87c
cmp word [ebx + 0x95], 0
jl 0x4ff87c
mov eax, dword [0x545230]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x95]
cmp eax, edx
jle 0x4ff87c
cmp byte [ebx + 0x99], 0
jbe 0x4ff87c
xor eax, eax
mov al, byte [ebx + 0x99]
mov edx, 0xa
call fcn.00470308
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.00470308
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 8]
sub eax, dword [edx + 8]
cmp esi, eax
ja 0x4ff7f3
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
inc byte [eax + 4]
mov eax, dword [ebp - 8]
mov al, byte [eax + 4]
cmp al, byte [ebx + 0x99]
jb 0x4ff808
mov eax, dword [ebp - 8]
mov byte [eax + 4], 0
movsx edx, word [ebx + 0x95]
mov eax, dword [0x545230]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x4ff87c
lea edx, [ebp - 0x10]
push edx
movzx edx, word [ebx + 0x97]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + 4]
add edx, ecx
lea ecx, [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
test eax, eax
je 0x4ff87c
push eax
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub ebx, edx
sub ebx, dword [eax + 8]
sar ebx, 1
jns 0x4ff852
adc ebx, 0
add ebx, edx
add ebx, dword [ebp - 0xc]
dec ebx
mov edx, ebx
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
sub ebx, ecx
sub ebx, dword [eax + 4]
sar ebx, 1
jns 0x4ff86c
adc ebx, 0
add ebx, ecx
add ebx, dword [ebp - 0x10]
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00537208
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ff888
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4ff9a2
cmp byte [ebx], 0
je 0x4ff9a2
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4ff9a2
cmp word [ebx + 0x95], 0
jl 0x4ff9a2
mov eax, dword [0x545230]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x95]
cmp eax, edx
jle 0x4ff9a2
cmp byte [ebx + 0x99], 0
jbe 0x4ff9a2
xor eax, eax
mov al, byte [ebx + 0x99]
mov edx, 0xa
call fcn.00470308
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.00470308
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 8]
cmp esi, eax
ja 0x4ff940
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
inc byte [eax + 4]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 4]
cmp al, byte [ebx + 0x99]
jb 0x4ff955
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0
movsx edx, word [ebx + 0x95]
mov eax, dword [0x545230]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x4ff9a2
lea edx, [ebp - 0x14]
push edx
movzx edx, word [ebx + 0x97]
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + 4]
add edx, ecx
lea ecx, [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x18]
test eax, eax
je 0x4ff9a2
push eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
dec edx
mov eax, dword [ebp - 4]
call fcn.00537208
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x504290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x40], 0
je 0x5042c7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2c]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x38]
cdq
cmp edx, dword [esp + 4]
jne 0x5042b8
cmp eax, dword [esp]
pop edx
pop eax
jae 0x5042c7
jmp 0x5042bc
pop edx
pop eax
jge 0x5042c7
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c], eax
inc dword [ebx + 0x30]
pop ebx
ret
Function at 0x506d20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.005154e4
mov eax, dword [ebx + 0x204]
cmp eax, 0xb
je 0x506edf
cmp eax, 9
je 0x506edf
cmp eax, 0xd
je 0x506edf
cmp eax, 5
je 0x506edf
mov byte [ebx + 0x2f0], 0
mov eax, dword [ebx + 0x360]
cmp dword [eax + 8], 2
jl 0x506d73
mov byte [ebx + 0x2f0], 1
mov edx, dword [ebx + 0x2b4]
sub edx, dword [ebx + 0x2ac]
mov eax, ebx
mov si, 0xfff8
call fcn.00404458
mov edx, dword [ebx + 0x2b4]
sub edx, dword [ebx + 0x2ac]
mov eax, ebx
mov si, 0xfff7
call fcn.00404458
mov edi, dword [ebx + 0x2b4]
cmp dword [ebx + 0x204], 0
je 0x506e58
mov edx, dword [ebx + 0x2ac]
mov eax, dword [ebx + 0x2b4]
cmp edx, eax
jg 0x506dcc
cmp eax, dword [ebx + 0x2b0]
jle 0x506dd2
mov dword [ebx + 0x2b4], edx
cmp byte [ebx + 0x2f0], 0
je 0x506dfe
mov eax, dword [ebx + 0x2d8]
add eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x506ee8]
call fcn.00403330
mov esi, eax
jmp 0x506e04
mov esi, dword [ebx + 0x2d8]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2dc]
cmp esi, eax
jae 0x506e43
mov eax, dword [ebx + 0x2b4]
cmp eax, dword [ebx + 0x2b0]
jge 0x506e34
inc dword [ebx + 0x2b4]
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2dc], eax
jmp 0x506e43
xor eax, eax
mov dword [ebx + 0x204], eax
mov byte [ebx + 0x172], 0
xor eax, eax
mov dword [ebx + 0x2f8], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2fc], eax
jmp 0x506eae
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x308]
cmp eax, 0xc8
jbe 0x506eae
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2fc]
cmp eax, 0x1f4
jbe 0x506ea3
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2fc], eax
inc dword [ebx + 0x2f8]
mov eax, dword [ebx + 0x2f8]
cmp eax, dword [ebx + 0x300]
jl 0x506ea3
xor eax, eax
mov dword [ebx + 0x2f8], eax
mov eax, ebx
mov si, 0xfffe
call fcn.00404458
cmp edi, dword [ebx + 0x2b4]
jne 0x506ec9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x264]
cmp eax, dword [ebx + 0x260]
jbe 0x506edf
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x264], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404458
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x507328
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.005154e4
mov eax, dword [ebx + 0x204]
cmp eax, 0xb
je 0x507554
cmp eax, 9
je 0x507554
cmp eax, 0xd
je 0x507554
cmp eax, 5
je 0x507554
mov byte [ebx + 0x2f0], 0
mov eax, dword [ebx + 0x360]
cmp dword [eax + 8], 2
jl 0x50737b
mov byte [ebx + 0x2f0], 1
mov edx, dword [ebx + 0x2b4]
sub edx, dword [ebx + 0x2ac]
mov eax, ebx
mov si, 0xfff8
call fcn.00404458
mov edx, dword [ebx + 0x2b4]
sub edx, dword [ebx + 0x2ac]
mov eax, ebx
mov si, 0xfff7
call fcn.00404458
mov edi, dword [ebx + 0x2b4]
cmp dword [ebx + 0x204], 0
je 0x5074cd
mov edx, dword [ebx + 0x2ac]
mov eax, dword [ebx + 0x2b4]
cmp edx, eax
jg 0x5073d4
cmp eax, dword [ebx + 0x2b0]
jle 0x5073da
mov dword [ebx + 0x2b4], edx
cmp byte [ebx + 0x2f0], 0
je 0x507406
mov eax, dword [ebx + 0x2d8]
add eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x50755c]
call fcn.00403330
mov esi, eax
jmp 0x50740c
mov esi, dword [ebx + 0x2d8]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2dc]
cmp esi, eax
jae 0x5074b8
mov eax, dword [ebx + 0x2b4]
cmp eax, dword [ebx + 0x2b0]
jge 0x507440
inc dword [ebx + 0x2b4]
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2dc], eax
jmp 0x50744f
xor eax, eax
mov dword [ebx + 0x204], eax
mov byte [ebx + 0x172], 0
cmp dword [ebx + 0x204], 0x16
jne 0x5074b8
mov eax, dword [ebx + 0x2b4]
sub eax, dword [ebx + 0x2ac]
cmp eax, 4
jne 0x5074b8
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 0x144]
push eax
mov eax, dword [ebx + 0x148]
push eax
mov eax, dword [ebx + 0x14c]
push eax
push 0xb
mov eax, dword [0x544574]
mov eax, dword [eax]
mov ecx, dword [ebx + 8]
mov edx, ebx
call fcn.0052415c
test eax, eax
je 0x5074b8
mov edx, dword [0x544fe4]
mov edx, dword [edx]
mov dword [eax + 0x18], edx
mov dword [eax + 0x80], 0x1e
mov dword [eax + 0xd8], 0x110
xor eax, eax
mov dword [ebx + 0x2f8], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2fc], eax
jmp 0x507523
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x308]
cmp eax, 0xc8
jbe 0x507523
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2fc]
cmp eax, 0x1f4
jbe 0x507518
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2fc], eax
inc dword [ebx + 0x2f8]
mov eax, dword [ebx + 0x2f8]
cmp eax, dword [ebx + 0x300]
jl 0x507518
xor eax, eax
mov dword [ebx + 0x2f8], eax
mov eax, ebx
mov si, 0xfffe
call fcn.00404458
cmp edi, dword [ebx + 0x2b4]
jne 0x50753e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x264]
cmp eax, dword [ebx + 0x260]
jbe 0x507554
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x264], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404458
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x510880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, 1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0xa8]
cmp eax, dword [esi + 0x80]
jbe 0x5108e4
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0xa8], eax
inc dword [esi + 0x94]
mov eax, dword [esi + 0x90]
add eax, dword [esi + 0x98]
dec eax
cmp eax, dword [esi + 0x94]
jge 0x5108e4
mov dword [esi + 0x94], eax
cmp dword [esi + 0xd8], 0
jle 0x5108e2
dec dword [esi + 0xd8]
mov eax, dword [esi + 0x90]
mov dword [esi + 0x94], eax
jmp 0x5108e4
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5154e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x5155b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x278]
call fcn.005380b0
xor eax, eax
push ebp
push 0x51559c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x278]
cmp ebx, dword [esi + 8]
jge 0x515580
mov eax, esi
mov edx, ebx
call fcn.0041bce4
mov dword [edi], eax
mov eax, dword [edi]
cmp dword [eax + 0xc], 0x28
jl 0x51555f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x278]
mov edx, ebx
call fcn.0041bbc0
mov edx, 0x10
mov eax, dword [edi]
call fcn.00402e08
inc ebx
jmp 0x51551f
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + 8]
cmp eax, 0x14
jbe 0x51557d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
mov dword [edx + 8], eax
mov eax, dword [edi]
inc dword [eax + 0xc]
inc ebx
jmp 0x51551f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5155a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x278]
call fcn.005380bc
ret

Function at 0x516ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor edi, edi
call fcn.0052eb18
test al, al
je 0x516c13
mov al, byte [ebx + 0x10]
sub al, 8
jae 0x516c13
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x264]
cmp eax, dword [ebx + 0x260]
jbe 0x516b34
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x264], eax
mov eax, ebx
mov si, 0xfff3
call fcn.00404458
mov eax, ebx
call fcn.00516618
mov edx, dword [ebx + 0x1d0]
test edx, edx
je 0x516b76
mov ecx, dword [ebp - 8]
add ecx, dword [ebx + 0x108]
add ecx, dword [ebx + 0x100]
push ecx
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebx + 0x118]
add ecx, dword [ebx + 0x104]
push ecx
mov cl, byte [ebp + 0xc]
push ecx
push eax
mov ecx, edx
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.005163ec
cmp byte [ebx + 0x170], 0
je 0x516c13
cmp dword [ebx + 0x1a4], 0
jle 0x516c13
xor eax, eax
mov edx, dword [ebx + 0x18c]
dec edx
lea ecx, [ebp - 0x38]
mov ah, 0x20
call fcn.00403d20
mov eax, dword [ebx + 0x188]
cmp eax, 0xff
ja 0x516bb4
bt dword [ebp - 0x38], eax
jae 0x516c13
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x1a4]
dec eax
xor edx, edx
call fcn.0050f110
mov eax, dword [ebx + 0x188]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x516bee
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0x18]
mov edi, eax
test edi, edi
je 0x516c13
push edi
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x14]
add ecx, dword [ebx + 0x104]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
add edx, dword [ebx + 0x100]
mov eax, dword [ebp - 4]
call fcn.00537208
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5184bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x544738]
cmp eax, dword [edx]
jne 0x5184ea
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x178]
cmp eax, 0xbb8
seta al
jmp 0x518503
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x178]
cmp eax, 0x7d0
seta al
test al, al
je 0x518515
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
xor ecx, ecx
mov dword [edx + 0x194], ecx
pop ebp
ret
Function at 0x51895c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, eax
xor ebx, ebx
mov byte [edi + 0xec], 0
mov esi, 0x64
mov eax, dword [0x544aa4]
cmp byte [eax + 0xf], 0
je 0x518a06
mov eax, dword [0x544738]
cmp edi, dword [eax]
jne 0x5189be
xor eax, eax
mov al, byte [edi + 0xa2]
imul esi
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x518a4c]
call fcn.0040333c
push eax
mov eax, esi
pop edx
sub eax, edx
mov edx, 5
call fcn.00470308
mov esi, eax
cmp byte [edi + 0x12], 0
jne 0x518a06
mov bp, word [edi + 0x2a0]
test bp, bp
je 0x518a06
movsx eax, bp
cdq
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.0040623c
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fdiv dword [0x518a50]
call fcn.00403330
push eax
mov eax, esi
pop edx
sub eax, edx
mov edx, 1
call fcn.00470308
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x298]
cmp esi, eax
ja 0x518a40
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x298], eax
inc dword [edi + 0x29c]
cmp dword [edi + 0x29c], 1
jle 0x518a37
xor eax, eax
mov dword [edi + 0x29c], eax
mov bl, 1
mov byte [edi + 0xec], 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x518a54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 8]
mov eax, dword [ebp - 4]
mov byte [eax + 0x35c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.005380b0
xor edx, edx
push ebp
push 0x518b7d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x518b61
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
mov edx, ebx
call fcn.0041bce4
mov dword [esi], eax
mov eax, dword [esi]
cmp dword [eax + 8], 0
jle 0x518b31
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
sub eax, dword [edx + 0x14]
mov edx, dword [esi]
movzx edx, word [edx + 6]
cmp eax, edx
jbe 0x518adb
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
inc dword [eax + 0x10]
mov eax, dword [esi]
mov ax, word [eax + 2]
movzx edx, ax
mov ecx, dword [esi]
movzx ecx, byte [ecx + 4]
add edx, ecx
dec edx
mov ecx, dword [esi]
cmp edx, dword [ecx + 0x10]
jge 0x518b14
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x10], eax
mov eax, dword [esi]
mov dword [eax + 0xc], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
dec dword [eax + 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
cmp eax, dword [edx + 0xc]
je 0x518b57
mov edx, dword [esi]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x35c], 1
jmp 0x518b57
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
mov edx, ebx
call fcn.0041bbc0
mov edx, 0x24
mov eax, dword [esi]
call fcn.00402e08
mov eax, dword [ebp - 4]
mov byte [eax + 0x35c], 1
dec ebx
cmp ebx, 0xffffffff
jne 0x518a9e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518b84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.005380bc
ret
Function at 0x51c174
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x544738]
cmp eax, dword [edx]
jne 0x51c1a2
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x178]
cmp eax, 0xbb8
seta al
jmp 0x51c1bb
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x178]
cmp eax, 0x7d0
seta al
test al, al
je 0x51c1cd
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
xor ecx, ecx
mov dword [edx + 0x194], ecx
pop ebp
ret
Function at 0x527e74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xfffffefc
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 1]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403964
lea eax, [esp + 1]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x527eac
xor eax, eax
mov al, byte [esp]
test byte [esp + eax + 1], 0x80
je 0x527eac
mov bl, 1
mov eax, ebx
add esp, 0x104
pop ebx
ret

Function at 0x52a758
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x52a760
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x52a8bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x17c], dl
mov dl, 2
mov eax, ebx
call fcn.0052a428
lea eax, [ebp - 4]
lea edx, [ebx + 0x5e]
call fcn.004052f4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 8]
call fcn.0043e0b8
lea eax, [ebp - 8]
lea edx, [ebx + 0x7d]
call fcn.004052f4
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.0043e0b8
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x8e]
call fcn.004052f4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x14]
call fcn.0043e0b8
mov edx, 0x52a8d4
mov eax, dword [ebx + 0x18]
call fcn.0043e0b8
lea eax, [ebp - 0x10]
lea edx, [ebx + 0xc1]
call fcn.004052f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x20]
call fcn.0043e0b8
lea eax, [ebp - 0x14]
lea edx, [ebx + 0xd6]
call fcn.004052f4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x24]
call fcn.0043e0b8
lea eax, [ebp - 0x18]
lea edx, [ebx + 0xb2]
call fcn.004052f4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x30]
call fcn.0043e0b8
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0xe3]
call fcn.004052f4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x38]
call fcn.0043e0b8
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x10c]
call fcn.004052f4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x28]
call fcn.0043e0b8
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x121]
call fcn.004052f4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x2c]
call fcn.0043e0b8
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x139]
call fcn.004052f4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0x34]
call fcn.0043e0b8
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x12e]
call fcn.004052f4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x1c]
call fcn.0043e0b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a8c4
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.004050a4
ret
Function at 0x5367e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x536918
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x24]
mov eax, dword [esi + 8]
cmp eax, dword [ebp - 0xc]
jle 0x53690a
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0041bce4
mov ebx, eax
cmp ebx, dword [ebp - 8]
je 0x5368e9
test ebx, ebx
jl 0x5368e9
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x18]
jge 0x5368e9
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
cmp dword [edx + eax*8 + 8], 0
jne 0x536871
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.0041bbc0
jmp 0x536815
mov edi, ebx
add edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp dword [eax + edi*8 + 8], 0
je 0x5368e9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
sub eax, dword [edx + edi*8 + 0xc]
cmp eax, 0x1d4c0
jbe 0x5368e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.0041bbc0
xor eax, eax
push ebp
push 0x5368d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
lea eax, [eax + edi*8 + 8]
call fcn.00411554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536815
inc dword [ebp - 0xc]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x10]
cmp eax, 0xa
jbe 0x536815
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
cmp byte [ebp - 0x11], 0
jne 0x536918
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x536948
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x536a75
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x24]
mov eax, dword [esi + 8]
cmp eax, dword [ebp - 0xc]
jle 0x536a67
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0041bce4
mov ebx, eax
test ebx, ebx
jl 0x536a46
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x18]
jge 0x536a46
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
cmp dword [edx + eax*8 + 8], 0
jne 0x5369ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.0041bbc0
jmp 0x53697b
mov edi, ebx
add edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp dword [eax + edi*8 + 8], 0
je 0x536a46
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
sub eax, dword [edx + edi*8 + 0xc]
cmp eax, 0x1d4c0
jbe 0x536a46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.0041bbc0
xor eax, eax
push ebp
push 0x536a2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
lea eax, [eax + edi*8 + 8]
call fcn.00411554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53697b
inc dword [ebp - 0xc]
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, 0xa
jbe 0x53697b
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
cmp byte [ebp - 0xd], 0
jne 0x536a75
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret