joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dca9c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], ecx
mov ebx, edx
mov byte [esp + 4], 0
movzx eax, byte [ebx + 0x2c]
push eax
push 2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x2e0]
call fcn.0067510c
mov dl, 1
mov eax, dword [0x41cf4c]
call fcn.00404400
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
push 1
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x2e0]
mov eax, ebx
call fcn.00663274
push 1
mov eax, dword [esp + 4]
call fcn.004d8754
mov edx, dword [esp + 4]
call fcn.004d8774
mov edx, eax
movzx esi, word [ebx + 0x112]
movzx eax, si
add edx, eax
mov ecx, dword [ebx + 0x112]
shr ecx, 0x10
sub cx, si
movsx ecx, cx
inc ecx
mov eax, ebx
call fcn.0066b858
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
jle 0x4dcbde
mov eax, dword [esp]
movzx edx, byte [eax + 6]
mov eax, 1
call fcn.0048b210
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld xword [0x4dcbf4]
fmulp st(1)
fild dword [esp + 0x14]
fmulp st(1)
call fcn.00403560
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
dec eax
test eax, eax
jl 0x4dcbde
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x10]
mov eax, edi
call fcn.0041fbf0
mov esi, eax
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x4dcbd4
push 0
mov eax, dword [esp + 0x18]
push eax
push 0
push 0
push 0
push 0xc8
mov cx, 0xa1
mov edx, ebx
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x18]
push 2
mov eax, dword [esp + 4]
movzx ecx, word [eax + 4]
mov edx, ebx
mov eax, esi
call fcn.00661488
mov byte [esp + 4], 1
inc dword [esp + 0x10]
dec dword [esp + 0x18]
jne 0x4dcb83
mov eax, edi
call fcn.00404430
movzx eax, byte [esp + 4]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e1e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [ebp + 0xc]
call fcn.00405814
xor eax, eax
push ebp
push 0x4e1ef9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4e068c]
mov eax, 0x34
call fcn.0040647c
mov ebx, eax
mov eax, ebx
call fcn.00405394
lea eax, [ebx + 4]
call fcn.00405394
lea eax, [ebx + 8]
mov edx, dword [ebp + 0xc]
call fcn.004053e8
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], edi
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c], eax
mov byte [ebx + 0x30], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x4e1ed2
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.0041fbf0
test eax, eax
jne 0x4e1ece
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.0041fd4c
mov ebx, esi
jmp 0x4e1ee3
inc esi
dec edi
jne 0x4e1eb0
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0041fa48
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1f00
lea eax, [ebp + 0xc]
call fcn.00405394
ret

Function at 0x4e2ba8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x4e2ca0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x4e2c9c
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
movzx eax, byte [esi + 0x2c]
mov byte [esp], al
lea ecx, [esi + 0x28]
lea edx, [esi + 0x24]
mov eax, dword [esi + 0x380]
call fcn.0066924c
mov ebp, dword [esi + 0x380]
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.0049fed8
mov byte [esi + 0x2c], al
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov word [esp + 2], 0
lea edx, [esp + 2]
mov ecx, dword [esi + 0x380]
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x20]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00667178
mov eax, dword [esi + 0x380]
xor edx, edx
mov dword [eax + 0x390], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
movzx edx, al
mov eax, esi
call fcn.00665740
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x4e2ca7
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e2ddc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x4e2ed4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x4e2ed0
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
movzx eax, byte [esi + 0x2c]
mov byte [esp], al
lea ecx, [esi + 0x28]
lea edx, [esi + 0x24]
mov eax, dword [esi + 0x380]
call fcn.0066924c
mov ebp, dword [esi + 0x380]
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.0049fed8
mov byte [esi + 0x2c], al
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov word [esp + 2], 0
lea edx, [esp + 2]
mov ecx, dword [esi + 0x380]
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x20]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00667178
mov eax, dword [esi + 0x380]
xor edx, edx
mov dword [eax + 0x390], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
movzx edx, al
mov eax, esi
call fcn.00665740
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x4e2edb
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e5750
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
mov byte [esp], 0
cmp dword [ebx + 0x380], 0
je 0x4e58c5
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x4e58c5
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.0049fed8
mov byte [ebx + 0x2c], al
mov eax, ebx
call fcn.004e5680
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.0066835c
lea esi, [ebx + 0x108]
mov eax, dword [esi + 0xa]
shr eax, 0x10
sub ax, word [esi + 0xa]
movsx eax, ax
inc eax
call fcn.00403484
movzx edx, word [esi + 0xa]
add eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x414]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x4e58ba
inc edi
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x414]
call fcn.0041fbf0
mov esi, dword [eax]
test esi, esi
je 0x4e58af
cmp byte [esi + 0x2ec], 0
jne 0x4e58af
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x4e58af
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jg 0x4e58af
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x4e58af
movzx eax, word [esp + 8]
push eax
movzx eax, word [esi + 0x24]
movzx edx, word [esi + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
push esi
push 0
push 0x190
mov cx, 0xdc
mov edx, ebx
mov eax, ebx
mov ebp, dword [eax]
call dword [ebp + 0x18]
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 8
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, ebx
call fcn.006633cc
inc dword [esp + 4]
dec edi
jne 0x4e5813
mov eax, ebx
call fcn.00667e24
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e63c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov ebx, eax
mov byte [esp], 0
cmp dword [ebx + 0x380], 0
je 0x4e652b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x4e652b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.0066835c
mov eax, dword [ebx + 0x112]
shr eax, 0x10
sub ax, word [ebx + 0x112]
movsx eax, ax
inc eax
call fcn.00403484
movzx edx, word [ebx + 0x112]
add eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x414]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x4e6520
inc edi
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x414]
call fcn.0041fbf0
mov esi, dword [eax]
test esi, esi
je 0x4e6515
cmp byte [esi + 0x2ec], 0
jne 0x4e6515
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x4e6515
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jg 0x4e6515
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x4e6515
mov ecx, dword [esp + 8]
mov edx, ebx
mov eax, esi
call fcn.0066853c
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x4e6515
lea edx, [esp + 0xc]
mov ecx, ebx
mov eax, esi
call fcn.00668730
movzx eax, word [esp + 0xc]
push eax
movzx eax, word [esi + 0x11e]
push eax
movzx eax, word [esi + 0x122]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x18]
inc dword [esp + 4]
dec edi
jne 0x4e646b
mov eax, ebx
call fcn.00667e24
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4e70b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov byte [esp + 1], cl
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0x380], 0
je 0x4e7273
mov esi, dword [edi + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [edi + 0x2e0]
jne 0x4e7273
mov eax, dword [edi + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [esp + 1]
cmp eax, edx
jg 0x4e7273
mov eax, dword [edi + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [esp + 1]
cmp eax, edx
jg 0x4e7273
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x24]
call fcn.004a3a1c
test al, al
je 0x4e7273
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x3fc]
cmp eax, dword [edi + 0xb60]
jle 0x4e7271
movzx eax, byte [esp]
mov byte [edi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x384], eax
push 1
mov ecx, dword [edi + 0x112]
shr ecx, 0x10
movzx eax, word [edi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, edi
call fcn.0066b858
mov dword [esp + 0x10], eax
movzx esi, byte [esp + 1]
test esi, esi
jle 0x4e724e
mov dword [esp + 4], 1
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x2e0]
call fcn.0067510c
test al, al
je 0x4e7243
push 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0x2e0]
call fcn.00675478
mov ebx, eax
test ebx, ebx
je 0x4e7243
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x4e7243
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, ebx
call fcn.00668380
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
jle 0x4e7243
lea edx, [esp + 0x14]
mov ecx, edi
mov eax, ebx
call fcn.00668730
movzx eax, word [esp + 0x14]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push edi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 4]
dec esi
jne 0x4e719f
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, edi
call fcn.0066835c
mov eax, edi
call fcn.00667e24
mov bl, 1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x53d40c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x53d428
cmp dword [esi + 4], 0
je 0x53d455
test byte [ebx + 0x55], 1
jne 0x53d447
mov eax, ebx
call fcn.00465dd4
test eax, eax
jne 0x53d447
mov edx, esi
mov eax, ebx
call fcn.0046bfec
jmp 0x53d549
mov edx, esi
mov eax, ebx
call fcn.00467598
jmp 0x53d549
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x53d542
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00469e68
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.004630a8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0053d40c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00469e68
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d549
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x540ad7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x540b2f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x540b25
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x540b33
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x5db40c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405814
xor eax, eax
push ebp
push 0x5db5ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x5db599
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.00403ae0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405824
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5db599
mov eax, dword [ebp - 0x14]
call fcn.00402f7c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5db592
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5db57c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5db5cc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5db57c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x5db5d8
call fcn.0040bb18
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00405630
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.004039d0
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5db599
mov eax, dword [ebp - 0xc]
call fcn.00402fb0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5db5c1
lea eax, [ebp - 0x118]
call fcn.00405394
lea eax, [ebp - 4]
call fcn.00405394
ret
Function at 0x5dec00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x1f8], edx
mov dword [ebp - 0x1fc], edx
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5dee6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x5dee42
call fcn.0040d5d4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x12]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xe]
call fcn.0040d58c
call fcn.0040d600
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1a]
push eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x14]
call fcn.0040d2ac
mov eax, dword [select]
mov eax, dword [eax + 0x15c]
call fcn.0040adb8
test al, al
jne 0x5decc1
mov eax, dword [select]
mov eax, dword [eax + 0x15c]
call fcn.0040afd4
mov eax, dword [select]
push dword [eax + 0x15c]
lea edx, [ebp - 0x1ec]
movzx eax, word [ebp - 0xe]
call fcn.0040a784
push dword [ebp - 0x1ec]
push 0x5dee84
lea edx, [ebp - 0x1f0]
movzx eax, word [ebp - 0x10]
call fcn.0048ade0
push dword [ebp - 0x1f0]
push 0x5dee84
lea edx, [ebp - 0x1f4]
movzx eax, word [ebp - 0x12]
call fcn.0048ade0
push dword [ebp - 0x1f4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405728
mov eax, dword [ebp - 4]
call fcn.0040adb8
test al, al
jne 0x5ded3e
push 0
mov eax, dword [ebp - 4]
call fcn.00405824
push eax
call sub.kernel32.dll_CreateDirectoryA
push dword [ebp - 4]
push 0x5dee90
lea edx, [ebp - 0x1f8]
xor eax, eax
call fcn.0040a784
push dword [ebp - 0x1f8]
push 0x5dee84
lea edx, [ebp - 0x1fc]
movzx eax, word [ebp - 0x14]
call fcn.0048ade0
push dword [ebp - 0x1fc]
push 0x5dee9c
movzx eax, word [ebp - 0x16]
mov ecx, 0xa
xor edx, edx
div ecx
add eax, eax
lea eax, [eax + eax*4]
lea edx, [ebp - 0x200]
call fcn.0048ade0
push dword [ebp - 0x200]
push 0x5deea8
lea eax, [ebp - 8]
mov edx, 8
call fcn.00405728
mov eax, dword [ebp - 8]
call fcn.0040ad94
test al, al
jne 0x5dedcb
lea eax, [ebp - 0x1e8]
call fcn.00403604
call fcn.004030f0
jmp 0x5deddb
lea eax, [ebp - 0x1e8]
call fcn.00403610
call fcn.004030f0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5dee32
inc ebx
xor esi, esi
lea ecx, [ebp - 0x208]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
mov edx, 0x5deeb8
call fcn.004056ac
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x1e8]
call fcn.00405b44
call fcn.00403dd0
call fcn.004030f0
inc esi
dec ebx
jne 0x5deded
lea eax, [ebp - 0x1e8]
call fcn.0040393c
call fcn.004030f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dee74
lea eax, [ebp - 0x208]
mov edx, 8
call fcn.004053b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b8
ret
Function at 0x5e3e68
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x6c1434]
push eax
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x5e3f77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6c0ec4]
mov eax, dword [eax]
call fcn.005f35cc
mov eax, dword [0x6c04b4]
mov eax, dword [eax]
call fcn.004d3778
mov eax, dword [0x6c0604]
mov eax, dword [eax]
call fcn.004cc5bc
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0xabcfe4]
cmp eax, 0x2710
jbe 0x5e3f5e
call sub.kernel32.dll_GetTickCount_1
mov dword [0xabcfe4], eax
mov eax, dword [0x6c0f8c]
mov eax, dword [eax]
call fcn.004d853c
mov eax, dword [0x6c10e4]
mov eax, dword [eax]
call fcn.004d076c
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
call fcn.00499450
xor eax, eax
push ebp
push 0x5e3f57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x5e3f3d
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
jae 0x5e3f37
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x5e3f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e3f5e
mov eax, dword [0x6c0c04]
mov eax, dword [eax]
call fcn.0049945c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e3f7e
mov eax, dword [0x6c1434]
push eax
call sub.kernel32.dll_LeaveCriticalSection
ret