joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040528c
xor eax, eax
push ebp
push 0x4c7e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c7d50
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c7d08
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c7cb0
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c7e18
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7e54
lea eax, [ebp - 4]
call fcn.00404ddc
ret
Function at 0x4c8ae8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c8ccc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c8c88
mov eax, dword [ebp - 4]
call fcn.004ca450
cmp ebx, eax
jge 0x4c8c88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004bd2b4
mov edx, dword [0x4c0030]
call fcn.00404148
mov esi, eax
mov eax, esi
call fcn.004c16c0
test al, al
je 0x4c8c7e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4c8c72
xor eax, eax
push ebp
push 0x4c8c6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c90a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.004205d8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405428
mov eax, dword [ebp - 8]
call fcn.004052f4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c8e64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8cb6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c8c6a
mov eax, dword [ebp - 4]
call fcn.004c9128
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040ac08
jmp 0x4c8cb6
mov eax, dword [ebp - 8]
call fcn.00404ddc
jmp 0x4c8cb6
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a014
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41b0f8]
call fcn.0040dbb4
call fcn.0040476c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8cd3
lea eax, [ebp - 0x54]
call fcn.00404ddc
ret
Function at 0x4cc8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4cc8cd
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4cc94c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004c3a60
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cc91a
mov cx, word [esp]
sub cx, si
jmp 0x4cc91c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cc903
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4cc942
mov cx, word [esp]
sub cx, si
jmp 0x4cc944
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cc92b
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4cc9a9
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004cc574
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4cc994
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4cc9a9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cc8aa
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d1694
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.004d1504
test al, al
je 0x4d16c1
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.004d15fc
test al, al
jne 0x4d16b7
call fcn.0040f3f4
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x4d16f2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.0040529c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
jne 0x4d16eb
call fcn.0040f3f4
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret

Function at 0x4d73d0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1e0], 0
je 0x4d73f4
mov eax, dword [ebx + 0x1e0]
call fcn.004bf660
test al, al
jne 0x4d740a
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.004bf984
jmp 0x4d7417
mov eax, esi
mov edx, dword [ebx + 0x1e0]
call fcn.00404e30
add esp, 0x130
pop esi
pop ebx
ret
Function at 0x4e0828
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
mov dword [esp + 8], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x78]
add eax, ebx
mov dword [esp + 0x10], eax
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x20]
add eax, ebx
mov edx, esi
shl edx, 2
add eax, edx
mov eax, dword [eax]
add eax, ebx
mov dword [esp + 4], eax
mov edx, ebp
mov eax, dword [esp + 4]
call fcn.004e0808
test al, al
je 0x4e08b2
mov eax, esi
add eax, eax
mov edx, dword [esp + 0x10]
add eax, dword [edx + 0x24]
add eax, ebx
mov ax, word [eax]
and ax, 0xffff
movzx eax, ax
shl eax, 2
mov edx, dword [esp + 0x10]
add eax, dword [edx + 0x1c]
add eax, ebx
mov edi, dword [eax]
add edi, ebx
inc esi
test edi, edi
jne 0x4e08c0
mov eax, dword [esp + 0x10]
cmp esi, dword [eax + 0x18]
jne 0x4e0864
mov dword [esp], edi
mov eax, dword [esp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51a1d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x64
call sub.kernel32.dll_Sleep_1
cmp byte [esi + 0x6c], 0
jne 0x51a217
cmp byte [esi + 0x6d], 0
jne 0x51a30f
cmp dword [esi + 0xc9], 1
jb 0x51a30f
fld dword [ebp - 0x28]
call fcn.00403204
push edx
push eax
fld dword [esi + 0xee]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a242
cmp eax, dword [esp]
pop edx
pop eax
jne 0x51a268
fld dword [ebp - 0x20]
call fcn.00403204
push edx
push eax
fld dword [esi + 0xf6]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a264
cmp eax, dword [esp]
pop edx
pop eax
je 0x51a292
mov eax, dword [esi + 0xee]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xf2]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0xf6]
mov dword [ebp - 0x20], eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x51a2b3
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, 0
jne 0x51a2ad
cmp eax, 0x1388
jbe 0x51a2b3
jmp 0x51a2af
jle 0x51a2b3
xor ebx, ebx
jmp 0x51a30f
lea edx, [esi + 0xee]
mov eax, edi
call fcn.0054321c
fstp dword [ebp - 4]
wait
fld dword [ebp + 8]
fadd dword [0x51a31c]
fcomp dword [ebp - 4]
fnstsw ax
sahf
jbe 0x51a2d9
mov bl, 1
jmp 0x51a30f
cmp byte [esi + 0xed], 1
je 0x51a200
mov ecx, 0x1f4
mov edx, 1
mov eax, esi
call fcn.0051ee98
test al, al
jne 0x51a200
push dword [edi + 8]
push dword [edi]
push esi
call fcn.00541800
jmp 0x51a200
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51a320
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp esi, dword [edi + 0x1b7]
je 0x51a354
mov edx, esi
mov eax, edi
call fcn.005209dc
test al, al
je 0x51a482
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, edi
call fcn.0052f5b8
test al, al
jne 0x51a482
cmp byte [edi + 0x6c], 0
jne 0x51a387
cmp byte [edi + 0x6d], 0
jne 0x51a482
cmp dword [edi + 0xc9], 1
jb 0x51a482
fld dword [ebp - 0x28]
call fcn.00403204
push edx
push eax
fld dword [edi + 0xee]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a3b2
cmp eax, dword [esp]
pop edx
pop eax
jne 0x51a3d8
fld dword [ebp - 0x20]
call fcn.00403204
push edx
push eax
fld dword [edi + 0xf6]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a3d4
cmp eax, dword [esp]
pop edx
pop eax
je 0x51a402
mov eax, dword [edi + 0xee]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0xf2]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xf6]
mov dword [ebp - 0x20], eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x51a423
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, 0
jne 0x51a41d
cmp eax, 0x2710
jbe 0x51a423
jmp 0x51a41f
jle 0x51a423
xor ebx, ebx
jmp 0x51a482
cmp byte [edi + 0xed], 1
je 0x51a361
lea edx, [edi + 0xee]
lea eax, [ebp - 0x1c]
call fcn.0054321c
fstp dword [ebp - 4]
wait
fld dword [ebp + 8]
fadd dword [0x51a490]
fcomp dword [ebp - 4]
fnstsw ax
sahf
jbe 0x51a457
mov bl, 1
jmp 0x51a482
mov ecx, 0x1f4
mov edx, 1
mov eax, edi
call fcn.0051ee98
test al, al
jne 0x51a361
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push esi
push edi
call fcn.00541968
jmp 0x51a361
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51a494
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov edi, eax
mov byte [ebp - 2], 0
cmp esi, dword [edi + 0x1b7]
je 0x51a4c1
mov edx, esi
mov eax, edi
call fcn.005209dc
test al, al
je 0x51a672
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x190
call sub.kernel32.dll_Sleep_1
cmp byte [ebp - 1], 0
jne 0x51a4fc
cmp byte [edi + 0x6c], 0
jne 0x51a4fc
cmp byte [edi + 0x6d], 0
jne 0x51a672
cmp dword [edi + 0xc9], 1
jb 0x51a672
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
cmp edx, dword [edi + 0x31d54]
jne 0x51a522
cmp eax, dword [edi + 0x31d50]
jae 0x51a53a
jmp 0x51a524
jge 0x51a53a
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x32
call sub.kernel32.dll_Sleep_1
jmp 0x51a4dc
fld dword [ebp - 0x28]
call fcn.00403204
push edx
push eax
fld dword [edi + 0xee]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a558
cmp eax, dword [esp]
pop edx
pop eax
jne 0x51a57e
fld dword [ebp - 0x20]
call fcn.00403204
push edx
push eax
fld dword [edi + 0xf6]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x51a57a
cmp eax, dword [esp]
pop edx
pop eax
je 0x51a5aa
mov eax, dword [edi + 0xee]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0xf2]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xf6]
mov dword [ebp - 0x20], eax
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x51a611
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, 0
jne 0x51a5c5
cmp eax, 0x1770
jbe 0x51a5d0
jmp 0x51a5c7
jle 0x51a5d0
mov byte [ebp - 2], 0
jmp 0x51a672
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, 0
jne 0x51a5eb
cmp eax, 0xbb8
jbe 0x51a611
jmp 0x51a5ed
jle 0x51a611
test bl, bl
jne 0x51a611
mov bl, 1
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push esi
push edi
call fcn.00541968
mov ecx, 0x1f4
mov edx, 1
mov eax, edi
call fcn.0051ee98
cmp byte [edi + 0xed], 1
je 0x51a4dc
lea edx, [edi + 0xee]
lea eax, [ebp - 0x1c]
call fcn.0054321c
fstp dword [ebp - 8]
wait
fld dword [ebp + 8]
fadd dword [0x51a680]
fcomp dword [ebp - 8]
fnstsw ax
sahf
jbe 0x51a647
mov byte [ebp - 2], 1
jmp 0x51a672
mov ecx, 0x1f4
mov edx, 1
mov eax, edi
call fcn.0051ee98
test al, al
jne 0x51a4dc
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push esi
push edi
call fcn.00541968
jmp 0x51a4dc
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5209dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, edx
mov ebx, eax
mov byte [esp], 0
mov eax, dword [ebx + 0xee]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xf2]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xf6]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x1b7]
mov edi, eax
cmp esi, eax
jne 0x520a1e
mov byte [esp], 1
jmp 0x520bc4
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp byte [ebx + 0x6c], 0
jne 0x520a3d
cmp byte [ebx + 0x6d], 0
jne 0x520bc4
cmp dword [ebx + 0xc9], 1
jb 0x520bc4
mov ebp, dword [ebx + 0x1b7]
cmp edi, ebp
je 0x520ab2
mov edi, ebp
cmp esi, ebp
jne 0x520a6b
mov ecx, 0x1f4
mov edx, 8
mov eax, ebx
call fcn.0051ef68
cmp esi, dword [ebx + 0x1b7]
jne 0x520aa3
cmp esi, dword [ebx + 0x1b7]
jne 0x520a94
push dword [ebx + 0xf6]
push dword [ebx + 0xee]
mov eax, dword [ebx + 0x1b7]
push eax
push ebx
call fcn.005418f0
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x520bc0
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
cmp edx, dword [ebx + 0x31d54]
jne 0x520acb
cmp eax, dword [ebx + 0x31d50]
jae 0x520ae8
jmp 0x520acd
jge 0x520ae8
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
push 0x32
call sub.kernel32.dll_Sleep_1
jmp 0x520a2d
cmp byte [ebx + 0xed], 1
je 0x520b17
cmp esi, dword [ebx + 0x1b7]
je 0x520bc0
push esi
push ebx
call fcn.00541878
mov ecx, 0xfa0
mov edx, 1
mov eax, ebx
call fcn.0051ee98
test al, al
fld dword [esp + 0x10]
call fcn.00403204
push edx
push eax
fld dword [ebx + 0xee]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x520b36
cmp eax, dword [esp]
pop edx
pop eax
jne 0x520b5d
fld dword [esp + 0x18]
call fcn.00403204
push edx
push eax
fld dword [ebx + 0xf6]
call fcn.00403204
cmp edx, dword [esp + 4]
jne 0x520b59
cmp eax, dword [esp]
pop edx
pop eax
je 0x520b8c
mov eax, dword [ebx + 0xee]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xf2]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xf6]
mov dword [esp + 0x18], eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x520bb1
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
cmp edx, 0
jne 0x520ba9
cmp eax, 0x7530
jbe 0x520bb1
jmp 0x520bab
jle 0x520bb1
mov byte [esp], 0
jmp 0x520bc4
push 0xc8
call sub.kernel32.dll_Sleep_1
jmp 0x520a2d
mov byte [esp], 1
mov al, byte [esp]
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52e234
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xfa8], 0
je 0x52e271
mov eax, dword [0x558400]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x268
push eax
push 0x543814
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [0x5580d0]
mov dword [edx], eax
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x537330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [ebx + 0x5c]
call fcn.004060d8
test eax, eax
jg 0x53741c
xor esi, esi
mov dword [ebx + 0x64], esi
push esi
lea eax, [ebx + 0x5c]
mov ecx, 1
mov edx, dword [0x515ae0]
call fcn.004062b4
add esp, 4
mov eax, dword [ebx + 0x64]
push eax
lea eax, [ebx + 0x60]
mov ecx, 1
mov edx, dword [0x515b04]
call fcn.004062b4
add esp, 4
mov edi, 0xb
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebx + 0x54], eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebx + 0x58], eax
xor esi, esi
mov eax, dword [ebx + 0x64]
inc eax
push eax
lea eax, [ebx + 0x5c]
mov ecx, 1
mov edx, dword [0x515ae0]
call fcn.004062b4
add esp, 4
mov eax, dword [ebx + 0x64]
inc eax
push eax
lea eax, [ebx + 0x60]
mov ecx, 1
mov edx, dword [0x515b04]
call fcn.004062b4
add esp, 4
mov edx, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x64]
mov eax, esi
shl eax, 9
mov ebp, eax
add ebp, dword [ebx + 0x54]
mov dword [edx + ecx*4], ebp
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x64]
add eax, dword [ebx + 0x58]
mov dword [edx + ecx*4], eax
inc dword [ebx + 0x64]
inc esi
cmp esi, 8
jne 0x5373b7
dec edi
jne 0x537381
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x31d78], 0
mov dword [ebx + 0x31d7c], 0
mov dword [ebx + 0x31d80], 0
mov dword [ebx + 0x31d84], 0
push 0
lea eax, [ebx + 0x11e]
mov ecx, 1
mov edx, dword [0x49cb94]
call fcn.004062b4
add esp, 4
lea eax, [ebx + 0x126]
call fcn.00404ddc
lea eax, [ebx + 0x12e]
call fcn.00404ddc
lea eax, [ebx + 0x132]
call fcn.00404ddc
xor eax, eax
mov dword [ebx + 0x31de4], eax
mov byte [ebx + 0x31d58], 0
mov byte [ebx + 0x31d68], 0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x537c34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x537da3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xc], 0
jne 0x537d6d
lea eax, [ebp - 0x14]
push eax
push edx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, dword [0x5586f4]
mov edx, dword [edx]
mov ecx, 0x100000
mov eax, esi
call fcn.005454c8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.004096d8
mov eax, dword [ebp - 4]
mov edx, dword [0x558538]
mov edx, dword [edx]
call fcn.004051e8
je 0x537d69
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [0x5585ec]
mov edx, dword [edx]
mov ecx, 0x100000
mov eax, esi
call fcn.005454c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x558414]
call fcn.00404e30
lea eax, [ebp - 8]
mov edx, dword [0x558538]
mov edx, dword [edx]
call fcn.00404e74
mov edx, dword [0x558414]
mov edx, dword [edx]
mov eax, dword [0x55d330]
call fcn.0053592c
mov eax, dword [0x558414]
cmp dword [eax], 0
je 0x537d69
lea ecx, [ebp - 0x10]
mov eax, dword [0x558414]
mov eax, dword [eax]
mov edx, 0x537db8
call fcn.00546b70
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
call fcn.004096d8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004051e8
je 0x537d69
lea edx, [ebp - 0x20]
mov eax, dword [0x558414]
mov eax, dword [eax]
call fcn.00546da4
mov ecx, dword [ebp - 0x20]
mov eax, dword [0x558490]
mov edx, 0x537dc4
call fcn.004050e8
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x5452a4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov byte [ebx + 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537daa
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404e00
lea eax, [ebp - 0x10]
mov edx, dword [0x49c99c]
call fcn.004063e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e00
ret
Function at 0x537dcc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0x558650]
xor eax, eax
push ebp
push 0x537f84
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x34c], 0
jne 0x537e05
mov dl, 1
mov eax, dword [0x41b984]
call fcn.00403f5c
mov dword [ebx + 0x34c], eax
cmp dword [ebx + 0x350], 0
jne 0x537e20
mov dl, 1
mov eax, dword [0x41b984]
call fcn.00403f5c
mov dword [ebx + 0x350], eax
cmp dword [ebx + 0x348], 0
jne 0x537e3b
mov dl, 1
mov eax, dword [0x41b984]
call fcn.00403f5c
mov dword [ebx + 0x348], eax
cmp dword [ebx + 0x354], 0
jne 0x537e56
mov dl, 1
mov eax, dword [0x41b984]
call fcn.00403f5c
mov dword [ebx + 0x354], eax
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x350]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x354]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xd8]
push 0
push 0x537a44
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jge 0x537f1e
mov eax, dword [0x558304]
cmp byte [eax], 0
je 0x537edf
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x40]
push eax
push 0xfffffffffffffffe
mov eax, dword [esi]
call fcn.00451d50
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x537f9c
call fcn.00444948
mov eax, dword [0x558304]
cmp byte [eax], 0
je 0x537f6e
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x40]
push eax
push 0xffffffffffffffff
mov eax, dword [esi]
call fcn.00451d50
push eax
call sub.user32.dll_SetWindowPos
jmp 0x537f6e
lea ecx, [ebp - 4]
xor edx, edx
mov eax, dword [ebx + 0x34c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
call fcn.00409cc8
mov edx, eax
mov eax, ebx
call fcn.00537c34
mov eax, ebx
call fcn.00537868
mov eax, dword [esi]
mov eax, dword [eax + 0x314]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov eax, dword [esi]
mov ebx, dword [eax + 0x314]
mov edx, dword [esi]
mov eax, dword [ebx + 0x124]
call dword [ebx + 0x120]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537f8b
lea eax, [ebp - 4]
call fcn.00404ddc
ret