joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62801c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
mov esi, dword [ebx + 0x410]
test esi, esi
je 0x6281e5
lea ecx, [ebp - 0x21]
mov edx, esi
mov eax, ebx
call fcn.006a1ea4
test al, al
je 0x6281b8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x6281b2
movzx eax, byte [ebp - 0x21]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x154]
sub ecx, eax
mov edx, eax
mov eax, ebx
call fcn.006ad27c
mov dword [ebp - 0x10], eax
movzx eax, byte [ebx + 0x2c]
movzx edx, byte [esi + 0x706e98]
add eax, edx
and eax, 7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x36c]
call fcn.006b70f4
test al, al
je 0x62815f
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x36c]
call fcn.006b7460
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x62815f
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x62815f
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 0x20]
call fcn.006a9bc4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x62815f
lea edx, [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 0x20]
call fcn.006a9f54
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x16c]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x174]
push eax
push ebx
push 0
push 0x190
mov cx, 0xa4
mov edx, 0x9e
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0x18]
inc esi
cmp esi, 3
jl 0x6280a4
cmp dword [ebp - 0xc], 1
jle 0x62818f
push 0
push 0
mov eax, dword [ebx + 0x410]
push eax
push 0
push 0
movzx ecx, byte [ebx + 0x2c]
mov dx, 0xc0
mov eax, ebx
call fcn.006a4724
jmp 0x6281ab
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.006a9ba0
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 1], 1
jmp 0x6281e5
mov eax, dword [ebx + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [ebx + 0x36c]
jne 0x6281de
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x6281e5
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6281f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x410], 0
je 0x628391
cmp byte [esi + 0xda8], 0
je 0x62826a
cmp byte [esi + 0xdb4], 0
jne 0x62826a
mov eax, edi
mov byte [esi + 0x2c], al
mov byte [esi + 0xdb4], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x628391
lea ecx, [ebp - 1]
mov edx, dword [esi + 0x410]
mov eax, esi
call fcn.006a1ea4
test al, al
je 0x628364
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x628360
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
push 1
mov ecx, dword [esi + 0x158]
mov ebx, dword [esi + 0x154]
sub ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.006ad27c
mov dword [ebp - 8], eax
cmp byte [esi + 0xda8], 0
je 0x6282f9
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9bc4
add eax, eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
call fcn.004035bc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x62833d
lea edx, [ebp - 8]
mov ecx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9f54
mov edx, dword [ebp - 8]
push edx
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x16c]
push edx
mov edx, dword [eax + 0x174]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.006a9ba0
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x628391
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [esi + 0x36c]
jne 0x62838a
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x628391
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x628610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x410], 0
je 0x62880a
mov dl, 2
mov eax, esi
call fcn.00629dd0
dec eax
jle 0x6287e7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x6287e3
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.006a9ba0
push 1
mov ecx, dword [esi + 0x158]
mov eax, dword [esi + 0x154]
sub ecx, eax
mov edx, eax
mov eax, esi
call fcn.006ad27c
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x24]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x6287dc
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], edx
mov eax, dword [esi + 0x28]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x6287d0
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x36c]
call fcn.006b56c4
test al, al
je 0x6287c4
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
je 0x6287c4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x6287c4
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
call fcn.00420a68
test eax, eax
je 0x6287b8
cmp byte [eax], 1
jne 0x6287b8
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x6287b8
cmp byte [ebx + 0x370], 0
jne 0x6287b8
cmp byte [ebx + 0x378], 0
jne 0x6287b8
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x6287b8
cmp byte [ebx + 0x3a5], 0
je 0x62876d
cmp byte [esi + 0x3a7], 0
je 0x6287b8
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.006a9bc4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x6287b8
lea edx, [ebp - 8]
mov ecx, esi
mov eax, ebx
call fcn.006a9f54
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0x16c]
push eax
mov eax, dword [ebx + 0x174]
push eax
push esi
push 0
push 0x258
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x628716
inc dword [ebp - 0x10]
dec dword [ebp - 0x20]
jne 0x6286cf
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x6286b9
mov eax, esi
call fcn.006a965c
mov al, 1
jmp 0x62880a
cmp byte [esi + 0xdb4], 0
je 0x6287fe
mov edx, 0x1391
mov eax, esi
call fcn.00628f68
jmp 0x62880a
mov edx, 0xc0
mov eax, esi
call fcn.00628f68
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x628810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x410], 0
je 0x6289f7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x6289e9
mov dl, 2
mov eax, esi
call fcn.00629dd0
dec eax
jle 0x628945
lea ecx, [ebp - 0x15]
mov edx, dword [esi + 0x410]
mov eax, esi
call fcn.006a1ea4
test al, al
je 0x628945
movzx eax, byte [ebp - 0x15]
push eax
push 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x36c]
call fcn.006b70f4
test al, al
je 0x628945
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x36c]
call fcn.006b7460
test eax, eax
jne 0x628945
movzx eax, byte [ebp - 0x15]
mov byte [esi + 0x2c], al
mov dword [ebp - 0x10], 3
mov eax, esi
call fcn.006a1e68
mov edi, eax
test edi, edi
je 0x62893c
movzx edx, byte [esi + 0x2c]
mov ecx, 1
mov eax, edi
call fcn.006ad7e8
dec eax
jne 0x628945
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, esi
call fcn.006b262c
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x36c]
call fcn.006b56fc
test eax, eax
jle 0x628945
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, esi
call fcn.006a6004
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0x9d
mov eax, esi
call fcn.006a4724
mov bl, 1
dec dword [ebp - 0x10]
jne 0x6288bd
test bl, bl
je 0x6289e9
movzx eax, byte [ebp - 4]
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
push 1
mov ecx, dword [esi + 0x158]
mov edi, dword [esi + 0x154]
sub ecx, edi
mov edx, edi
mov eax, esi
call fcn.006ad27c
mov ecx, eax
mov edx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9bc4
sar eax, 1
jns 0x628999
adc eax, 0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x6289e0
lea edx, [ebp - 0x14]
mov ecx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9f54
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x16c]
push edx
mov edx, dword [eax + 0x174]
push edx
push esi
push 0
push 0x320
mov cx, 0xa4
mov edx, 0x9e
mov edi, dword [eax]
call dword [edi + 0x18]
mov eax, esi
call fcn.006a965c
jmp 0x6289f7
mov edx, 0x1391
mov eax, esi
call fcn.00628f68
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x628a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x410], 0
je 0x628b18
mov edx, 0x1391
mov eax, esi
call fcn.00628f68
test al, al
jne 0x628b16
mov ecx, dword [esi + 0x23c]
mov edx, dword [esi + 0x410]
mov eax, esi
call fcn.00629820
test al, al
je 0x628b18
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x628b12
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
push 1
mov ecx, dword [esi + 0x158]
mov eax, dword [esi + 0x154]
sub ecx, eax
mov edx, eax
mov eax, esi
call fcn.006ad27c
push eax
mov edx, dword [esi + 0x410]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x410]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006a4724
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x628b18
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x628f68
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x410]
test edi, edi
je 0x6290c4
lea ecx, [ebp - 5]
mov edx, edi
mov eax, esi
call fcn.006a1ea4
test al, al
je 0x629097
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x629093
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
cmp dword [ebp - 4], 0xc0
jne 0x629078
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
push 1
mov ecx, dword [esi + 0x158]
mov ebx, dword [esi + 0x154]
sub ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.006ad27c
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9bc4
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fmul dword [0x6290d0]
call fcn.004035bc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x62908c
lea edx, [ebp - 0xc]
mov ecx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9f54
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x16c]
push edx
mov edx, dword [eax + 0x174]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x62908c
movzx ecx, byte [ebp - 5]
mov edx, dword [esi + 0x410]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x6290c4
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [esi + 0x36c]
jne 0x6290bd
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x6290c4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6290d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x410]
test edi, edi
je 0x629230
lea ecx, [ebp - 1]
mov edx, edi
mov eax, esi
call fcn.006a1ea4
test al, al
je 0x629203
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x6291ff
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
movzx eax, byte [ebp - 1]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x158]
mov eax, dword [esi + 0x154]
sub ecx, eax
mov edx, eax
mov eax, esi
call fcn.006ad27c
mov ebx, eax
cmp byte [esi + 0xdb4], 0
jne 0x62915d
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9bc4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x6291b3
lea edx, [ebp - 8]
mov ecx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9f54
mov edx, dword [ebp - 8]
push edx
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x16c]
push edx
mov edx, dword [eax + 0x174]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xdb4], 0
jne 0x6291dc
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
jmp 0x6291f8
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.006a9ba0
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x629230
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [esi + 0x36c]
jne 0x629229
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x629230
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x62923c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x410]
test edi, edi
je 0x6293ed
mov ecx, dword [esi + 0x23c]
mov edx, edi
mov eax, esi
call fcn.00629820
test al, al
je 0x6293c0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x6293bc
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
movzx eax, byte [ebp - 4]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x158]
mov eax, dword [esi + 0x154]
sub ecx, eax
mov edx, eax
mov eax, esi
call fcn.006ad27c
mov ebx, eax
cmp byte [esi + 0xdb4], 0
jne 0x6292ce
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9d70
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x629324
lea edx, [ebp - 0xc]
mov ecx, esi
mov eax, dword [esi + 0x410]
call fcn.006a9f54
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x16c]
push edx
mov edx, dword [eax + 0x174]
push edx
push esi
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xdb4], 0
jne 0x629373
push 0
push 0
mov eax, dword [esi + 0x410]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006a4724
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006a4724
jmp 0x6293b5
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.006a9ba0
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006a4724
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x6293ed
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [esi + 0x36c]
jne 0x6293e6
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x6293ed
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6293f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x410], 0
je 0x6295fd
mov esi, dword [ebx + 0x410]
mov eax, dword [esi + 0x36c]
cmp eax, dword [ebx + 0x36c]
jne 0x6295d0
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x6295d0
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x6295d0
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004e49e0
test al, al
je 0x6295d0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x6295ca
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
push 1
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x154]
sub ecx, eax
mov edx, eax
mov eax, ebx
call fcn.006ad27c
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x62957e
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x36c]
call fcn.006b70f4
test al, al
je 0x629574
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x36c]
call fcn.006b7460
mov edi, eax
test edi, edi
je 0x629574
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x629574
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.006a9bc4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x629574
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.006a9f54
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [edi + 0x16c]
push eax
mov eax, dword [edi + 0x174]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x6294dd
cmp dword [ebp + 8], 0xc0
jne 0x6295a7
push 0
push 0
mov eax, dword [ebx + 0x410]
push eax
push 0
push 0
movzx ecx, byte [ebx + 0x2c]
mov dx, 0xc0
mov eax, ebx
call fcn.006a4724
jmp 0x6295c3
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
movzx ecx, word [ebp + 8]
mov dx, 0x9a
mov eax, ebx
call fcn.006a9ba0
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 3], 1
jmp 0x6295fd
mov eax, dword [ebx + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [ebx + 0x36c]
jne 0x6295f6
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x6295fd
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4