joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0c08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov eax, dword [0x566c0c]
cmp dword [eax + 0xf4], 0
jl 0x4e0cb1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567198]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x566c0c]
mov eax, dword [eax + 0x100]
cdq
cmp edx, dword [esp + 4]
jne 0x4e0c50
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4e0cb1
jmp 0x4e0c54
pop edx
pop eax
jge 0x4e0cb1
cmp byte [ebp - 1], 0
jne 0x4e0c72
mov eax, dword [0x567948]
mov eax, dword [eax]
mov eax, dword [eax + 0x74]
mov edx, dword [0x566c0c]
cmp eax, dword [edx + 0x104]
jge 0x4e0cb1
mov eax, dword [0x566c0c]
mov eax, dword [eax + 0xf4]
call fcn.00524894
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jl 0x4e0cb1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567198]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004dffe0
mov ebx, eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e0e18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x567948]
cmp dword [eax], 0
je 0x4e0ebd
mov eax, dword [0x567948]
mov eax, dword [eax]
cmp byte [eax + 0x3c], 0
jne 0x4e0ebd
mov eax, dword [0x566c0c]
cmp byte [eax + 0x130], 0
je 0x4e0ebd
mov eax, dword [0x567948]
mov eax, dword [eax]
mov eax, dword [eax + 0x70]
mov edx, dword [0x566c0c]
cmp eax, dword [edx + 0x138]
jge 0x4e0ebd
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x56708c]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x566c0c]
imul eax, dword [eax + 0x134], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4e0e90
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4e0ebd
jmp 0x4e0e94
pop edx
pop eax
jge 0x4e0ebd
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x56708c]
mov dword [edx], eax
push 0
push 0
push 0
mov eax, dword [0x567948]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov edx, 0x1410
mov eax, ebx
call fcn.004ce440
pop ebx
ret

Function at 0x4e0ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x5673b0]
cmp dword [eax], 0
je 0x4e0f48
mov eax, dword [0x5673b0]
mov eax, dword [eax]
cmp byte [eax + 0x3c], 0
jne 0x4e0f48
mov eax, dword [0x566c0c]
cmp byte [eax + 0x108], 0
je 0x4e0f48
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x70]
mov edx, dword [0x566c0c]
cmp eax, dword [edx + 0x110]
jge 0x4e0f48
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567488]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x566c0c]
imul eax, dword [eax + 0x10c], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4e0f30
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4e0f48
jmp 0x4e0f34
pop edx
pop eax
jge 0x4e0f48
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567488]
mov dword [edx], eax
mov eax, ebx
call fcn.004c59ec
pop ebx
ret
Function at 0x4e0f4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4e108e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x566c0c]
cmp byte [eax + 0x39], 0
je 0x4e1070
mov eax, dword [0x5673b0]
cmp dword [eax], 0
je 0x4e1070
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567564]
sub eax, dword [edx]
cmp eax, 0x7d0
jbe 0x4e1070
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x567564]
mov dword [edx], eax
mov esi, 0xd
mov ebx, dword [0x5670b0]
cmp byte [ebx], 0
je 0x4e1063
movzx edi, word [ebx + 0xaa]
movzx eax, di
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld xword [0x4e109c]
fmulp st(1)
call fcn.0040367c
cmp di, 0x1388
ja 0x4e0fe9
mov ax, 0x7d0
movzx edx, word [ebx + 0xa8]
cmp ax, dx
jbe 0x4e1063
cmp dx, 0x3e8
jae 0x4e1022
mov edx, ebx
lea eax, [ebp - 0x30]
call fcn.00403b8c
mov edx, 0x4e10a8
lea eax, [ebp - 0x30]
mov cl, 0x26
call fcn.00403b5c
lea edx, [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.004057b8
jmp 0x4e1046
mov edx, ebx
lea eax, [ebp - 0x4c]
call fcn.00403b8c
mov edx, 0x4e10c0
lea eax, [ebp - 0x4c]
mov cl, 0x1b
call fcn.00403b5c
lea edx, [ebp - 0x4c]
lea eax, [ebp - 4]
call fcn.004057b8
push 0xff
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x567128]
mov eax, dword [eax]
mov ecx, 0xffff
mov edx, dword [ebp - 4]
call fcn.00552a30
add ebx, 0xac
dec esi
jne 0x4e0fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1095
lea eax, [ebp - 0x50]
call fcn.00405544
lea eax, [ebp - 4]
call fcn.00405544
ret
Function at 0x4e45f4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.004059d4
xor eax, eax
push ebp
push 0x4e46f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5673b0]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
mov eax, dword [ebx]
cmp edx, eax
jne 0x4e469e
movzx eax, word [ebx + 6]
movzx edx, word [ebx + 8]
shl edx, 0x10
or eax, edx
mov edx, dword [0x5673b0]
mov edx, dword [edx]
mov dword [edx + 0x44], eax
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [0x5673b0]
mov eax, dword [eax]
movzx eax, byte [eax + 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov dx, 0x2d
call fcn.00541090
push 0x28
push 0xffff00
mov eax, dword [0x567128]
mov eax, dword [eax]
mov ecx, 0x1e
mov edx, 0x4e470c
call fcn.005528fc
jmp 0x4e46e0
mov edx, dword [0x566ba4]
mov edx, dword [edx]
xchg edx, eax
call fcn.00533078
mov ebx, eax
test ebx, ebx
je 0x4e46e0
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x14]
push eax
movzx eax, byte [ebx + 0x18]
push eax
push 0
push 0
push 0
mov ecx, dword [ebx + 0xc]
mov dx, 0x2d
mov eax, ebx
call fcn.00541090
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004797d8
mov dword [ebx + 0x44], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e46fd
lea eax, [ebp - 4]
call fcn.00405544
ret
Function at 0x4e5ba8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov eax, dword [ebp - 4]
call fcn.004059d4
xor eax, eax
push ebp
push 0x4e5dbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [ebp - 9], 0
mov byte [ebp - 0xa], 0
mov eax, dword [0x566c54]
mov eax, dword [eax]
call fcn.0048a4c0
xor eax, eax
push ebp
push 0x4e5d9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x566c54]
mov eax, dword [eax]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4e5cc1
inc esi
mov dword [ebp - 8], 0
mov eax, dword [0x566c54]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0041c194
mov ebx, eax
cmp dword [ebx + 8], 0
jle 0x4e5caf
xor edx, edx
mov eax, ebx
call fcn.0041c194
mov eax, dword [eax]
movzx edx, word [edi + 6]
cmp eax, edx
jne 0x4e5cab
xor edx, edx
mov eax, ebx
call fcn.0041c194
mov eax, dword [eax + 4]
movzx edx, word [edi + 8]
cmp eax, edx
jne 0x4e5cab
mov eax, dword [ebx + 8]
dec eax
test eax, eax
jl 0x4e5ca3
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041c194
mov eax, dword [eax + 8]
cmp eax, dword [edi]
jne 0x4e5c9d
mov edx, esi
mov eax, ebx
call fcn.0041c194
mov byte [eax + 0x28], 1
mov edx, esi
mov eax, ebx
call fcn.0041c194
add eax, 0x2c
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, 0x2710
pop edx
mov dword [edx], eax
mov byte [ebp - 0xa], 1
jmp 0x4e5ca3
inc esi
dec dword [ebp - 0x10]
jne 0x4e5c60
cmp byte [ebp - 0xa], 0
jne 0x4e5cc1
jmp 0x4e5cc1
xor ebx, ebx
jmp 0x4e5cb1
xor ebx, ebx
cmp byte [ebp - 9], 0
jne 0x4e5cc1
inc dword [ebp - 8]
dec esi
jne 0x4e5c10
cmp byte [ebp - 0xa], 0
jne 0x4e5d80
test ebx, ebx
jne 0x4e5ceb
mov dl, 1
mov eax, dword [0x4198c0]
call fcn.00404618
mov ebx, eax
mov eax, dword [0x566c54]
mov eax, dword [eax]
mov edx, ebx
call fcn.0041c03c
mov edx, dword [0x47bd00]
mov eax, 0x30
call fcn.00406754
mov esi, eax
mov eax, dword [edi]
mov dword [esi + 8], eax
movzx eax, word [edi + 6]
mov dword [esi], eax
movzx eax, word [edi + 8]
mov dword [esi + 4], eax
movzx eax, word [edi + 0xa]
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0049eebc
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x10]
call fcn.00405598
mov eax, 0xbb8
call fcn.004035f4
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
mov dword [esi + 0x14], eax
mov byte [esi + 0x20], 0
mov byte [esi + 0x28], 1
xor eax, eax
mov dword [esi + 0x24], eax
call sub.kernel32.dll_GetTickCount_1
sub eax, 0x2710
mov dword [esi + 0x2c], eax
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.0041c210
mov eax, dword [0x566c0c]
cmp byte [eax + 0x33], 0
je 0x4e5d80
mov eax, dword [0x5678ac]
mov eax, dword [eax]
mov edx, esi
call fcn.00526458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5da1
mov eax, dword [0x566c54]
mov eax, dword [eax]
call fcn.0048a4cc
ret
Function at 0x4f9270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
mov eax, dword [edi]
cmp dword [eax + 0xd30], 1
jne 0x4f933c
mov eax, dword [edi]
cmp dword [eax + 0xd48], 0x14
jge 0x4f9300
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + 0xd50]
cmp eax, 0x64
jbe 0x4f9446
mov eax, dword [edi]
mov eax, dword [eax + 0xd48]
mov ecx, 5
cdq
idiv ecx
mov ecx, eax
cmp ecx, 4
jne 0x4f92db
mov eax, 6
call fcn.004035f4
inc eax
mov edx, dword [edi]
mov dword [edx + 0xd3c], eax
jmp 0x4f92e6
add ecx, 8
mov eax, dword [edi]
mov dword [eax + 0xd3c], ecx
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
mov dword [edx + 0xd50], eax
mov eax, dword [edi]
inc dword [eax + 0xd48]
jmp 0x4f9446
mov eax, dword [edi]
mov eax, dword [eax + 0xd38]
mov edx, dword [edi]
mov dword [edx + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + 0xd50]
cmp eax, 0x5dc
jbe 0x4f9446
mov eax, dword [edi]
mov eax, dword [eax + 0x3cc]
xor edx, edx
call fcn.0047f9f4
jmp 0x4f9446
mov byte [ebp - 1], 1
mov eax, dword [edi]
mov eax, dword [eax + 0xd30]
dec eax
test eax, eax
jl 0x4f9431
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
add esi, esi
add esi, esi
sub esi, ebx
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd48]
mov edx, dword [edi]
cmp eax, dword [edx + esi*4 + 0xd4c]
jge 0x4f93fc
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + esi*4 + 0xd50]
cmp eax, 0x64
jbe 0x4f93f6
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd48]
mov ecx, 5
cdq
idiv ecx
cmp eax, 4
jne 0x4f93b8
mov eax, 6
call fcn.004035f4
inc eax
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
jmp 0x4f93df
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
sub eax, ebx
mov edx, dword [edi]
mov eax, dword [edx + eax*4 + 0xd48]
mov ecx, 5
cdq
idiv ecx
add eax, 8
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd50], eax
mov eax, dword [edi]
inc dword [eax + esi*4 + 0xd48]
mov byte [ebp - 1], 0
jmp 0x4f9427
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd38]
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + esi*4 + 0xd50]
cmp eax, 0x7d0
jae 0x4f9427
mov byte [ebp - 1], 0
inc ebx
dec dword [ebp - 8]
jne 0x4f9357
cmp byte [ebp - 1], 0
je 0x4f9446
mov eax, dword [edi]
mov eax, dword [eax + 0x3cc]
xor edx, edx
call fcn.0047f9f4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x51ba80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
mov eax, dword [edi]
cmp dword [eax + 0xd30], 1
jne 0x51bb4c
mov eax, dword [edi]
cmp dword [eax + 0xd48], 0x14
jge 0x51bb10
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + 0xd50]
cmp eax, 0x64
jbe 0x51bc56
mov eax, dword [edi]
mov eax, dword [eax + 0xd48]
mov ecx, 5
cdq
idiv ecx
mov ecx, eax
cmp ecx, 4
jne 0x51baeb
mov eax, 6
call fcn.004035f4
inc eax
mov edx, dword [edi]
mov dword [edx + 0xd3c], eax
jmp 0x51baf6
add ecx, 8
mov eax, dword [edi]
mov dword [eax + 0xd3c], ecx
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
mov dword [edx + 0xd50], eax
mov eax, dword [edi]
inc dword [eax + 0xd48]
jmp 0x51bc56
mov eax, dword [edi]
mov eax, dword [eax + 0xd38]
mov edx, dword [edi]
mov dword [edx + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + 0xd50]
cmp eax, 0x5dc
jbe 0x51bc56
mov eax, dword [edi]
mov eax, dword [eax + 0x724]
xor edx, edx
call fcn.0047f9f4
jmp 0x51bc56
mov byte [ebp - 1], 1
mov eax, dword [edi]
mov eax, dword [eax + 0xd30]
dec eax
test eax, eax
jl 0x51bc41
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
add esi, esi
add esi, esi
sub esi, ebx
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd48]
mov edx, dword [edi]
cmp eax, dword [edx + esi*4 + 0xd4c]
jge 0x51bc0c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + esi*4 + 0xd50]
cmp eax, 0x64
jbe 0x51bc06
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd48]
mov ecx, 5
cdq
idiv ecx
cmp eax, 4
jne 0x51bbc8
mov eax, 6
call fcn.004035f4
inc eax
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
jmp 0x51bbef
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
sub eax, ebx
mov edx, dword [edi]
mov eax, dword [edx + eax*4 + 0xd48]
mov ecx, 5
cdq
idiv ecx
add eax, 8
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd50], eax
mov eax, dword [edi]
inc dword [eax + esi*4 + 0xd48]
mov byte [ebp - 1], 0
jmp 0x51bc37
mov eax, dword [edi]
mov eax, dword [eax + esi*4 + 0xd38]
mov edx, dword [edi]
mov dword [edx + esi*4 + 0xd3c], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [edi]
sub eax, dword [edx + esi*4 + 0xd50]
cmp eax, 0x7d0
jae 0x51bc37
mov byte [ebp - 1], 0
inc ebx
dec dword [ebp - 8]
jne 0x51bb67
cmp byte [ebp - 1], 0
je 0x51bc56
mov eax, dword [edi]
mov eax, dword [eax + 0x724]
xor edx, edx
call fcn.0047f9f4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x522cec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x522e8d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x522e7f
cmp byte [ebx], 0
je 0x522e7f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 2
lea ecx, [ebp - 8]
movzx edx, word [ebx + 0x2e]
mov eax, dword [0x4b0124]
call fcn.004b30f8
mov esi, eax
test esi, esi
je 0x522d86
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00470930
lea eax, [ebp - 0x2c]
push eax
push esi
push 1
push 0
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x522d66
adc ecx, 0
add ecx, dword [ebp - 0x18]
inc ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
sub edx, dword [esi + 8]
sar edx, 1
jns 0x522d7a
adc edx, 0
add edx, dword [ebp - 0x1c]
dec edx
mov eax, dword [ebp - 4]
call fcn.00470af4
cmp dword [ebp + 8], 0
je 0x522e7f
cmp word [ebx + 0x8d], 0
jl 0x522e7f
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x8d]
cmp eax, edx
jle 0x522e7f
cmp byte [ebx + 0x91], 0
jbe 0x522e7f
movzx eax, byte [ebx + 0x91]
mov edx, 0xa
call fcn.0047a1ec
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.0047a1ec
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 8]
cmp esi, eax
ja 0x522e0e
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 8], eax
inc byte [edi + 4]
movzx eax, byte [edi + 4]
cmp al, byte [ebx + 0x91]
jb 0x522e1e
mov byte [edi + 4], 0
movsx edx, word [ebx + 0x8d]
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x522e7f
movzx edx, word [ebx + 0x8f]
movzx ecx, byte [edi + 4]
add edx, ecx
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
je 0x522e7f
push esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
sub ecx, edx
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x522e5f
adc ecx, 0
add ecx, edx
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edx, eax
sub edx, dword [esi + 8]
sar edx, 1
jns 0x522e74
adc edx, 0
add edx, eax
dec edx
mov eax, dword [ebp - 4]
call fcn.0047ad58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522e94
ret
Function at 0x522ea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x523041
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x523033
cmp byte [ebx], 0
je 0x523033
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 2
lea ecx, [ebp - 8]
movzx edx, word [ebx + 0x2e]
mov eax, dword [0x4b0124]
call fcn.004b30f8
mov esi, eax
test esi, esi
je 0x522f3a
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00470930
lea eax, [ebp - 0x2c]
push eax
push esi
push 1
push 0
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x522f1a
adc ecx, 0
add ecx, dword [ebp - 0x18]
inc ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
sub edx, dword [esi + 8]
sar edx, 1
jns 0x522f2e
adc edx, 0
add edx, dword [ebp - 0x1c]
dec edx
mov eax, dword [ebp - 4]
call fcn.00470af4
cmp dword [ebp + 8], 0
je 0x523033
cmp word [ebx + 0x8d], 0
jl 0x523033
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x8d]
cmp eax, edx
jle 0x523033
cmp byte [ebx + 0x91], 0
jbe 0x523033
movzx eax, byte [ebx + 0x91]
mov edx, 0xa
call fcn.0047a1ec
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.0047a1ec
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 8]
cmp esi, eax
ja 0x522fc2
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 8], eax
inc byte [edi + 4]
movzx eax, byte [edi + 4]
cmp al, byte [ebx + 0x91]
jb 0x522fd2
mov byte [edi + 4], 0
movsx edx, word [ebx + 0x8d]
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x523033
movzx edx, word [ebx + 0x8f]
movzx ecx, byte [edi + 4]
add edx, ecx
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
je 0x523033
push esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
sub ecx, edx
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x523013
adc ecx, 0
add ecx, edx
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edx, eax
sub edx, dword [esi + 8]
sar edx, 1
jns 0x523028
adc edx, 0
add edx, eax
dec edx
mov eax, dword [ebp - 4]
call fcn.0047ad58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523048
ret
Function at 0x523054
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x5231f8
cmp byte [ebx], 0
je 0x5231f8
mov edi, dword [ebp + 8]
movzx edx, word [ebx + 0x2e]
mov cl, 1
mov eax, dword [0x4b0124]
call fcn.004b33ec
mov esi, eax
test esi, esi
je 0x5230d9
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00470930
lea eax, [ebp - 0x2c]
push eax
push esi
push 1
push 0
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x5230b9
adc ecx, 0
add ecx, dword [ebp - 0x18]
inc ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
sub edx, dword [esi + 8]
sar edx, 1
jns 0x5230cd
adc edx, 0
add edx, dword [ebp - 0x1c]
dec edx
mov eax, dword [ebp - 4]
call fcn.00470af4
cmp dword [ebp + 8], 0
je 0x5231f8
cmp word [ebx + 0x92], 0
jl 0x5231f8
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx edx, word [ebx + 0x92]
cmp eax, edx
jle 0x5231f8
cmp byte [ebx + 0x96], 0
jbe 0x5231f8
movzx eax, byte [ebx + 0x96]
mov edx, 0xa
call fcn.0047a1ec
mov ecx, 0xa
cdq
idiv ecx
push eax
mov eax, 0x64
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xa
call fcn.0047a1ec
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 8]
cmp esi, eax
ja 0x523161
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 8], eax
inc byte [edi + 4]
movzx eax, byte [edi + 4]
cmp al, byte [ebx + 0x96]
jb 0x523171
mov byte [edi + 4], 0
movsx edx, word [ebx + 0x92]
mov eax, dword [0x566f54]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
je 0x5231f8
lea eax, [ebp - 0xc]
push eax
movzx edx, word [ebx + 0x94]
movzx eax, byte [edi + 4]
add edx, eax
lea ecx, [ebp - 8]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x18]
mov esi, eax
movsx eax, word [ebx + 0x97]
add dword [ebp - 8], eax
movsx eax, word [ebx + 0x99]
add dword [ebp - 0xc], eax
test esi, esi
je 0x5231f8
push esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
sub ecx, edx
sub ecx, dword [esi + 4]
sar ecx, 1
jns 0x5231d2
adc ecx, 0
add ecx, edx
add ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edx, eax
sub edx, dword [esi + 8]
sar edx, 1
jns 0x5231ea
adc edx, 0
add edx, eax
add edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.0047ad58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8