joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b9bd4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5b9df2
mov dl, 2
mov eax, esi
call fcn.005bb41c
dec eax
jle 0x5b9dcf
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b9dcb
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5b9dc4
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5b9db6
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x2e0]
call fcn.0066dba0
test al, al
je 0x5b9da8
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5b9da8
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5b9da8
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbfc
test eax, eax
je 0x5b9d9a
cmp byte [eax], 1
jne 0x5b9d9a
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5b9d9a
cmp byte [ebx + 0x2e4], 0
jne 0x5b9d9a
cmp byte [ebx + 0x2ec], 0
jne 0x5b9d9a
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b9d9a
cmp byte [ebx + 0x319], 0
je 0x5b9d48
cmp byte [esi + 0x31b], 0
je 0x5b9d9a
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.0060fa20
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5b9d9a
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.0060fdd0
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x258
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5b9ceb
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5b9c9d
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5b9c85
mov eax, esi
call fcn.0060f4c4
mov al, 1
jmp 0x5b9df2
cmp byte [esi + 0xc2c], 0
je 0x5b9de6
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
jmp 0x5b9df2
mov edx, 0xc0
mov eax, esi
call fcn.005ba56c
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x5b9df8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b9ff6
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b9fe8
mov dl, 2
mov eax, esi
call fcn.005bb41c
dec eax
jle 0x5b9f34
lea ecx, [esp + 0x10]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.006084d8
test al, al
je 0x5b9f34
movzx eax, byte [esp + 0x10]
push eax
push 2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0066f574
test al, al
je 0x5b9f34
push 1
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x2e0]
call fcn.0066f8e0
test eax, eax
jne 0x5b9f34
movzx eax, byte [esp + 0x10]
mov byte [esi + 0x2c], al
mov ebp, 3
mov eax, esi
call fcn.006084a0
mov edi, eax
test edi, edi
je 0x5b9f2d
movzx edx, byte [esi + 0x2c]
mov ecx, 1
mov eax, edi
call fcn.006132f8
dec eax
jne 0x5b9f34
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, esi
call fcn.00617d9c
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0066dbd8
test eax, eax
jle 0x5b9f34
mov eax, dword [esp + 4]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x28], eax
mov eax, esi
call fcn.0060c318
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0x9d
mov eax, esi
call fcn.0060aa6c
mov bl, 1
dec ebp
jne 0x5b9ea8
test bl, bl
je 0x5b9fe8
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx edi, word [esi + 0x112]
sub cx, di
movsx ecx, cx
movzx edx, di
mov eax, esi
call fcn.00612ef8
mov ecx, eax
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fa20
sar eax, 1
jns 0x5b9f91
adc eax, 0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x5b9fdf
lea edx, [esp + 0xc]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fdd0
movzx edx, word [esp + 0xc]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0x320
mov cx, 0xa4
mov edx, 0x9e
mov edi, dword [eax]
call dword [edi + 0x18]
mov eax, esi
call fcn.0060f4c4
jmp 0x5b9ff6
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
mov ebx, eax
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ba000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5ba11f
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
test al, al
jne 0x5ba11d
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5ba11f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5ba119
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [esp + 8]
push eax
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5ba11f
mov bl, 1
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5ba56c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5ba6d7
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.006084d8
test al, al
je 0x5ba6aa
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5ba6a6
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
cmp ebp, 0xc0
jne 0x5ba68b
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.00612ef8
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fa20
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul dword [0x5ba6e4]
call fcn.00403560
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5ba69f
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fdd0
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x5ba69f
movzx ecx, byte [esp]
mov edx, dword [esi + 0x380]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5ba6d7
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5ba6d0
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5ba6d7
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ba6e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5ba850
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.006084d8
test al, al
je 0x5ba823
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5ba81f
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
cmp byte [esi + 0xc2c], 0
jne 0x5ba776
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fa20
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5ba7d3
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fdd0
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xc2c], 0
jne 0x5ba7fc
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
jmp 0x5ba818
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5ba850
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5ba849
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5ba850
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5ba858
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5baa15
mov ecx, dword [esi + 0x1b0]
mov edx, edi
mov eax, esi
call fcn.005bae60
test al, al
je 0x5ba9e8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5ba9e4
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [ebp - 4]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
cmp byte [esi + 0xc2c], 0
jne 0x5ba8f3
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fbdc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5ba94c
lea edx, [ebp - 0xc]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fdd0
movzx edx, word [ebp - 0xc]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xc2c], 0
jne 0x5ba99b
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
jmp 0x5ba9dd
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5baa15
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5baa0e
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5baa15
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5baa20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x380], 0
je 0x5bac31
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [ebx + 0x2e0]
jne 0x5bac04
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5bac04
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5bac04
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.00645188
test al, al
je 0x5bac04
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5babfe
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
push 1
mov ecx, dword [ebx + 0x112]
shr ecx, 0x10
movzx eax, word [ebx + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, ebx
call fcn.00612ef8
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x5babb2
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x2e0]
call fcn.0066f574
test al, al
je 0x5baba8
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2e0]
call fcn.0066f8e0
mov edi, eax
test edi, edi
je 0x5baba8
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5baba8
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.0060fa20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x5baba8
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.0060fdd0
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [edi + 0x11e]
push eax
movzx eax, word [edi + 0x122]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x5bab0e
cmp dword [ebp + 8], 0xc0
jne 0x5babdb
push 0
push 0
mov eax, dword [ebx + 0x380]
push eax
push 0
push 0
movzx ecx, byte [ebx + 0x2c]
mov dx, 0xc0
mov eax, ebx
call fcn.0060aa6c
jmp 0x5babf7
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
movzx ecx, word [ebp + 8]
mov dx, 0x9a
mov eax, ebx
call fcn.0060f9fc
mov eax, ebx
call fcn.0060f4c4
mov byte [ebp - 3], 1
jmp 0x5bac31
mov eax, dword [ebx + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [ebx + 0x2e0]
jne 0x5bac2a
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x5bac31
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5bac40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x380], 0
je 0x5bae2a
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [ebx + 0x2e0]
jne 0x5badfd
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5badfd
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5badfd
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.00645188
test al, al
je 0x5badfd
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5badf7
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
push 0
push 0
mov eax, dword [ebx + 0x380]
push eax
push 0
push 0
movzx ecx, byte [ebp - 1]
mov dx, 0xc0
mov eax, ebx
call fcn.0060aa6c
push 1
mov ecx, dword [ebx + 0x112]
shr ecx, 0x10
movzx eax, word [ebx + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, ebx
call fcn.00612ef8
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x5badf0
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x2e0]
call fcn.0066f574
test al, al
je 0x5bade6
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2e0]
call fcn.0066f8e0
mov edi, eax
test edi, edi
je 0x5bade6
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5bade6
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.0060fbdc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x5bade6
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.0060fdd0
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [edi + 0x11e]
push eax
movzx eax, word [edi + 0x122]
push eax
push ebx
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x5bad4c
mov eax, ebx
call fcn.0060f4c4
mov byte [ebp - 3], 1
jmp 0x5bae2a
mov eax, dword [ebx + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [ebx + 0x2e0]
jne 0x5bae23
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x5bae2a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5be758
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5be928
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x5be8cc
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.0066cac0
xor eax, eax
push ebp
push 0x5be8ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x68]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x1e90]
cmp esi, dword [edi + 8]
jge 0x5be891
mov eax, edi
mov edx, esi
call fcn.0041fbfc
mov ebx, eax
test ebx, ebx
je 0x5be86d
cmp byte [ebx + 0x2e4], 0
jne 0x5be842
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5be86d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x36c]
cmp eax, dword [ebx + 0x368]
jbe 0x5be81f
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x36c], eax
mov eax, ebx
call fcn.0060b4e8
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5be86d
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x370], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x5be86d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0x493e0
jbe 0x5be86d
mov eax, ebx
call fcn.00404430
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
mov edx, esi
call fcn.0041faa0
jmp 0x5be891
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x6c1080]
cmp eax, dword [edx]
jbe 0x5be88b
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], esi
mov byte [ebp - 0xd], 1
jmp 0x5be891
inc esi
jmp 0x5be7bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5be8b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.0066cacc
ret
Function at 0x5bf2c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x5bf3f7
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edi, dword [eax + 8]
dec edi
sub edi, esi
jl 0x5bf3df
inc edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.0041fbfc
mov ebx, eax
test ebx, ebx
je 0x5bf3b9
cmp byte [ebx + 0x2e4], 0
jne 0x5bf38e
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5bf3b9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x36c]
cmp eax, dword [ebx + 0x368]
jbe 0x5bf36b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x36c], eax
mov eax, ebx
call fcn.0060b4e8
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5bf3b9
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x370], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x5bf3b9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0x493e0
jbe 0x5bf3b9
mov eax, ebx
call fcn.00404430
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.0041faa0
jmp 0x5bf3df
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x6c1080]
cmp eax, dword [edx]
jbe 0x5bf3d7
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], esi
mov byte [ebp - 0xd], 1
jmp 0x5bf3df
inc esi
dec edi
jne 0x5bf312
cmp byte [ebp - 0xd], 0
jne 0x5bf3ed
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x6c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bf40b
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed0], ebx
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x1ed4]
jbe 0x5bf432
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret