joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8a3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor ebx, ebx
mov esi, dword [edi + 0x380]
test esi, esi
je 0x5e8c08
lea ecx, [esp + 0x18]
mov edx, esi
mov eax, edi
call fcn.00660e38
test al, al
je 0x5e8bdb
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x3fc]
cmp eax, dword [edi + 0xb60]
jle 0x5e8bd7
movzx eax, byte [esp + 0x18]
mov byte [edi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x384], eax
xor esi, esi
xor eax, eax
mov dword [esp + 4], eax
push 1
mov ecx, dword [edi + 0x112]
shr ecx, 0x10
movzx eax, word [edi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, edi
call fcn.0066b858
mov dword [esp + 8], eax
movzx eax, byte [edi + 0x2c]
movzx edx, byte [esi + 0x6c01f8]
add eax, edx
and eax, 7
mov dword [esp], eax
mov eax, dword [esp]
push eax
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x2e0]
call fcn.0067510c
test al, al
je 0x5e8b83
push 1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x2e0]
call fcn.00675478
mov ebx, eax
test ebx, ebx
je 0x5e8b83
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5e8b83
inc dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, edi
mov eax, ebx
call fcn.00668380
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x5e8b83
lea edx, [esp + 0xc]
mov ecx, edi
mov eax, ebx
call fcn.00668730
movzx eax, word [esp + 0xc]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push edi
push 0
push 0x190
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc esi
cmp esi, 3
jl 0x5e8acc
cmp dword [esp + 4], 1
jle 0x5e8bb4
push 0
push 0
mov eax, dword [edi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [edi + 0x2c]
mov dx, 0xc0
mov eax, edi
call fcn.006633cc
jmp 0x5e8bd0
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, edi
call fcn.0066835c
mov eax, edi
call fcn.00667e24
mov bl, 1
jmp 0x5e8c08
mov eax, dword [edi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [edi + 0x2e0]
jne 0x5e8c01
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e8c08
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x5e8c14
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e8dc5
cmp byte [esi + 0xc20], 0
je 0x5e8c8b
cmp byte [esi + 0xc2c], 0
jne 0x5e8c8b
mov eax, edi
mov byte [esi + 0x2c], al
mov byte [esi + 0xc2c], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e8dc5
mov ecx, esp
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.00660e38
test al, al
je 0x5e8d98
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e8d94
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.0066b858
mov dword [esp + 4], eax
cmp byte [esi + 0xc20], 0
je 0x5e8d27
mov ecx, dword [esp + 4]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00668380
add eax, eax
mov dword [esp + 8], eax
fild dword [esp + 8]
call fcn.00403560
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e8d71
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.00668730
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e8dc5
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e8dbe
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e8dc5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5e8dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5e8fee
mov dl, 2
mov eax, esi
call fcn.005ea878
dec eax
jle 0x5e8fde
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e8fda
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, ebx
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.0066b858
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [0x5e8ff4]
call fcn.00403560
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5e8fd3
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5e8fc5
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 0x2e0]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
call fcn.00673738
test al, al
je 0x5e8fb7
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5e8fb7
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5e8fb7
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbf0
test eax, eax
je 0x5e8fa9
cmp byte [eax], 1
jne 0x5e8fa9
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5e8fa9
cmp byte [ebx + 0x2e4], 0
jne 0x5e8fa9
cmp byte [ebx + 0x2ec], 0
jne 0x5e8fa9
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5e8fa9
cmp byte [ebx + 0x319], 0
je 0x5e8f57
cmp byte [esi + 0x31b], 0
je 0x5e8fa9
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.00668380
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e8fa9
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.00668730
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x190
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5e8efa
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5e8eac
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5e8e94
mov eax, esi
call fcn.00667e24
mov al, 1
jmp 0x5e8fee
push 0x1391
mov edx, ebx
mov cl, 2
mov eax, esi
call fcn.005e9e7c
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x5e9030
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5e924e
mov dl, 2
mov eax, esi
call fcn.005ea878
dec eax
jle 0x5e922b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9227
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5e9220
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5e9212
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x2e0]
call fcn.00673738
test al, al
je 0x5e9204
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5e9204
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5e9204
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbf0
test eax, eax
je 0x5e91f6
cmp byte [eax], 1
jne 0x5e91f6
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5e91f6
cmp byte [ebx + 0x2e4], 0
jne 0x5e91f6
cmp byte [ebx + 0x2ec], 0
jne 0x5e91f6
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5e91f6
cmp byte [ebx + 0x319], 0
je 0x5e91a4
cmp byte [esi + 0x31b], 0
je 0x5e91f6
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.00668380
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e91f6
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.00668730
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x258
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5e9147
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5e90f9
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5e90e1
mov eax, esi
call fcn.00667e24
mov al, 1
jmp 0x5e924e
cmp byte [esi + 0xc2c], 0
je 0x5e9242
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
jmp 0x5e924e
mov edx, 0xc0
mov eax, esi
call fcn.005e99c8
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x5e9254
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e9452
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9444
mov dl, 2
mov eax, esi
call fcn.005ea878
dec eax
jle 0x5e9390
lea ecx, [esp + 0x10]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.00660e38
test al, al
je 0x5e9390
movzx eax, byte [esp + 0x10]
push eax
push 2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0067510c
test al, al
je 0x5e9390
push 1
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x2e0]
call fcn.00675478
test eax, eax
jne 0x5e9390
movzx eax, byte [esp + 0x10]
mov byte [esi + 0x2c], al
mov ebp, 3
mov eax, esi
call fcn.00660e00
mov edi, eax
test edi, edi
je 0x5e9389
movzx edx, byte [esi + 0x2c]
mov ecx, 1
mov eax, edi
call fcn.0066bc58
dec eax
jne 0x5e9390
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, esi
call fcn.006706fc
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.00673770
test eax, eax
jle 0x5e9390
mov eax, dword [esp + 4]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x28], eax
mov eax, esi
call fcn.00664c78
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0x9d
mov eax, esi
call fcn.006633cc
mov bl, 1
dec ebp
jne 0x5e9304
test bl, bl
je 0x5e9444
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx edi, word [esi + 0x112]
sub cx, di
movsx ecx, cx
movzx edx, di
mov eax, esi
call fcn.0066b858
mov ecx, eax
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00668380
sar eax, 1
jns 0x5e93ed
adc eax, 0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x5e943b
lea edx, [esp + 0xc]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.00668730
movzx edx, word [esp + 0xc]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0x320
mov cx, 0xa4
mov edx, 0x9e
mov edi, dword [eax]
call dword [edi + 0x18]
mov eax, esi
call fcn.00667e24
jmp 0x5e9452
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
mov ebx, eax
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e945c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e957b
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
test al, al
jne 0x5e9579
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e957b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9575
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [esp + 8]
push eax
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e957b
mov bl, 1
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5e99c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5e9b33
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.00660e38
test al, al
je 0x5e9b06
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9b02
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
cmp ebp, 0xc0
jne 0x5e9ae7
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.0066b858
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00668380
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul dword [0x5e9b40]
call fcn.00403560
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e9afb
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.00668730
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x5e9afb
movzx ecx, byte [esp]
mov edx, dword [esi + 0x380]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e9b33
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e9b2c
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e9b33
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e9b44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5e9cac
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.00660e38
test al, al
je 0x5e9c7f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9c7b
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
cmp byte [esi + 0xc2c], 0
jne 0x5e9bd2
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.00668380
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e9c2f
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.00668730
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xc2c], 0
jne 0x5e9c58
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
jmp 0x5e9c74
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e9cac
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e9ca5
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e9cac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5e9cb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5e9e71
mov ecx, dword [esi + 0x1b0]
mov edx, edi
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e9e44
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e9e40
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [ebp - 4]
mov byte [esi + 0x2c], al
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
cmp byte [esi + 0xc2c], 0
jne 0x5e9d4f
add ebx, ebx
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0066853c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5e9da8
lea edx, [ebp - 0xc]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.00668730
movzx edx, word [ebp - 0xc]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
cmp byte [esi + 0xc2c], 0
jne 0x5e9df7
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
jmp 0x5e9e39
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x190
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e9e71
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e9e6a
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e9e71
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4