joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5094ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor edx, edx
push ebp
push 0x5095f3
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 0xc1
jne 0x5094d9
mov ebx, 0x480d30
jmp 0x509587
xor ebx, ebx
mov edx, dword [0x586404]
mov edx, dword [edx]
mov dword [edx + 0x5e4], eax
call fcn.004b9988
mov esi, eax
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5e4], 0
jne 0x509575
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x586404]
mov eax, dword [eax]
add eax, 0x5fc
call fcn.0040aab4
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x586404]
mov eax, dword [eax]
add eax, 0x390
call fcn.0040aab4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x505dbc]
pop ecx
call fcn.00505f24
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x50960c
call fcn.004054c0
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040a188
mov ebx, eax
test ebx, ebx
jne 0x509587
mov eax, dword [0x586404]
mov eax, dword [eax]
mov byte [eax + 0x379], 1
jmp 0x509587
call fcn.004b9988
sub eax, esi
cmp eax, 0x4e20
jbe 0x5094f0
test ebx, ebx
jbe 0x5095d8
lea edx, [ebp - 0x1c]
mov eax, dword [0x586a9c]
mov eax, dword [eax]
call fcn.0040aab4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 8]
call fcn.005092cc
cmp dword [ebp - 8], 0
je 0x5095d8
lea edx, [ebp - 0xc]
mov eax, 0x509618
call fcn.005092cc
cmp dword [ebp - 0xc], 0
jne 0x5095cb
lea edx, [ebp - 0xc]
mov eax, 0x509630
call fcn.005092cc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409b44
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5095fa
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004051cc
ret
Function at 0x50eb2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
xor edi, edi
mov eax, ebx
call fcn.005107bc
mov eax, ebx
call fcn.00511c88
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.00511cb0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x50eb6d
dec eax
or eax, 0xfffffffe
inc eax
mov edx, dword [ebp - 8]
and edx, 0x80000001
jns 0x50eb7d
dec edx
or edx, 0xfffffffe
inc edx
cmp eax, edx
je 0x50eb84
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
call fcn.004b9988
mov esi, eax
jmp 0x50ec65
call fcn.004b9988
sub eax, esi
mov ecx, 0x190
xor edx, edx
div ecx
cmp edi, eax
ja 0x50ebbe
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0050b7f8
inc edi
call fcn.004b9988
sub eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebp + 8]
cdq
cmp edx, dword [esp + 4]
jne 0x50ebdf
cmp eax, dword [esp]
pop edx
pop eax
jae 0x50ebe7
jmp 0x50ec79
pop edx
pop eax
jl 0x50ec79
mov eax, ebx
call fcn.00511c88
cmp eax, dword [ebp - 0x10]
jne 0x50ebff
mov eax, ebx
call fcn.00511cb0
cmp eax, dword [ebp - 0x14]
je 0x50ec05
mov byte [ebp - 9], 1
jmp 0x50ec79
mov eax, dword [0x58d174]
call fcn.00511c88
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
add esp, 0xfffffffc
fstp dword [esp]
wait
mov eax, dword [0x58d174]
call fcn.00511cb0
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
add esp, 0xfffffffc
fstp dword [esp]
wait
fild dword [ebp - 0x18]
add esp, 0xfffffffc
fstp dword [esp]
wait
fild dword [ebp - 0x1c]
add esp, 0xfffffffc
fstp dword [esp]
wait
call fcn.004b7ec4
fcomp dword [0x50ec98]
wait
fnstsw ax
sahf
jae 0x50ec5e
mov byte [ebp - 9], 1
jmp 0x50ec79
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x50eb9c
cmp byte [ebp - 9], 0
jne 0x50ec89
mov eax, 0x50eca4
call fcn.004b8ff8
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x50f220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, edx
mov ebx, eax
mov esi, 0xfa
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp byte [eax + 0x5cd], 0
je 0x50f244
mov esi, 0x190
call fcn.004b9988
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x50f265
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x50f27a
jmp 0x50f269
pop edx
pop eax
jle 0x50f27a
call fcn.004b9988
sub eax, dword [ebx + 0x88]
push eax
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp byte [eax + 0x380], 0
je 0x50f29a
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5d8], 2
jne 0x50f2a3
push ebp
push edi
call fcn.00509d14
jmp 0x50f2ba
push ebp
push edi
push 0x7f8
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SendMessageA
call fcn.004b9988
mov dword [ebx + 0x88], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x511430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 6], 0
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0050ca68
test al, al
je 0x5115e5
mov eax, dword [0x58d178]
mov byte [eax + 0x17d], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.0050edd8
movzx esi, ax
mov eax, dword [ebp - 4]
call fcn.0050fbe4
movzx edi, ax
mov eax, dword [ebp - 4]
call fcn.00511c88
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00511cb0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.0050eb28
xor eax, eax
push ebp
push 0x5115de
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004b9988
mov ebx, eax
jmp 0x5115b4
call fcn.004b9988
sub eax, ebx
cmp eax, 0x320
ja 0x5115c8
mov eax, dword [ebp - 4]
call fcn.0050bdb8
test al, al
jne 0x5115c8
mov eax, dword [ebp - 4]
call fcn.00511ce0
test al, al
jne 0x5115c8
mov eax, dword [ebp - 4]
call fcn.0050edd8
movzx eax, ax
cmp esi, eax
jne 0x511506
mov eax, dword [ebp - 4]
call fcn.0050fbe4
movzx eax, ax
cmp edi, eax
je 0x51150f
mov byte [ebp - 6], 1
jmp 0x5115c8
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0050ca68
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3c]
jle 0x51158e
call fcn.004b9988
mov ebx, eax
jmp 0x511578
call fcn.004b9988
sub eax, ebx
cmp eax, 0x12c
ja 0x511588
mov eax, dword [ebp - 4]
call fcn.0050edd8
movzx eax, ax
cmp esi, eax
jne 0x511588
mov eax, dword [ebp - 4]
call fcn.0050fbe4
movzx eax, ax
cmp edi, eax
jne 0x511588
mov eax, dword [ebp - 4]
call fcn.00511c88
cmp eax, dword [ebp - 0xc]
jne 0x511588
mov eax, dword [ebp - 4]
call fcn.00511cb0
cmp eax, dword [ebp - 0x10]
jne 0x511588
push 0x32
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x51152b
mov byte [ebp - 6], 1
jmp 0x5115c8
mov eax, dword [0x58d178]
cmp byte [eax + 0x17d], 0
jne 0x5115c8
xor ecx, ecx
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.00511884
push 0xc8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x5114b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5115e5
mov eax, dword [ebp - 4]
call fcn.0051163c
ret
movzx eax, byte [ebp - 6]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x512694
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
xor ebx, ebx
call fcn.004b9988
mov ebp, eax
xor esi, esi
mov eax, dword [0x58d178]
call fcn.005125c0
mov eax, dword [0x58d178]
mov byte [eax + 0x24], 0
mov edx, 0x512744
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x512722
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x58d178]
cmp byte [eax + 0x24], 0
je 0x5126df
mov bl, 1
jmp 0x512732
call fcn.004b9988
sub eax, ebp
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x5126fc
cmp eax, dword [esp]
pop edx
pop eax
jae 0x512700
jmp 0x512732
pop edx
pop eax
jl 0x512732
call fcn.004b9988
sub eax, ebp
cmp eax, 0x1f4
jbe 0x512722
test esi, esi
jne 0x512722
mov edx, 0x512744
mov eax, dword [0x58d174]
call fcn.0050babc
inc esi
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x5126c9
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5132d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405628
xor eax, eax
push ebp
push 0x513334
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x58d19c
mov edx, dword [ebp - 4]
call fcn.004051fc
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x51329c
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51333b
lea eax, [ebp - 4]
call fcn.004051a8
ret
Function at 0x513f6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x210], edx
xor eax, eax
push ebp
push 0x51411b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x208]
xor ecx, ecx
mov edx, 0xff
call fcn.004039a4
lea eax, [ebp - 0x208]
push eax
push 0x513e5c
call sub.user32.dll_EnumWindows
mov edi, 0x80
lea ebx, [ebp - 0x208]
mov esi, dword [ebx]
test esi, esi
je 0x5140fd
mov eax, esi
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x210]
mov eax, 8
call fcn.0040a11c
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
mov edx, 0x514134
call fcn.004054c0
mov eax, dword [ebp - 0x20c]
call fcn.004b8ff8
call fcn.004b9988
mov dword [ebp - 8], eax
push 0x514148
push 0
push 1
call sub.kernel32.dll_GetCurrentProcessId
mov edx, eax
mov ecx, 0x514158
mov eax, dword [ebx]
call fcn.004b982c
mov esi, eax
call fcn.004b9988
sub eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x218]
call fcn.0040a0cc
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x514164
call fcn.004054c0
mov eax, dword [ebp - 0x214]
call fcn.004b8ff8
test esi, esi
jbe 0x5140f3
push esi
call sub.user32.dll_GetParent
mov esi, eax
jmp 0x5140a6
push esi
call sub.user32.dll_GetParent
mov ebx, eax
test ebx, ebx
je 0x5140b6
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x1c]
je 0x5140b6
mov esi, ebx
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x51408c
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x220]
mov eax, 8
call fcn.0040a11c
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
mov edx, 0x514178
call fcn.004054c0
mov eax, dword [ebp - 0x21c]
call fcn.004b8ff8
jmp 0x5140fd
add ebx, 4
dec edi
jne 0x513fdf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514122
lea eax, [ebp - 0x220]
mov edx, 6
call fcn.004051cc
ret
Function at 0x51a8d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51aa4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], 0xa
mov dl, 1
mov eax, dword [0x41b508]
call fcn.004041b0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51aa12
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00517dd4
jmp 0x51a9ef
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0041dea4
mov ebx, eax
cmp byte [ebp - 5], 0
jne 0x51a9de
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.005243d8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409c3c
cmp dword [ebp - 0x18], 0
jne 0x51a9de
mov eax, ebx
call fcn.005246c0
mov esi, eax
mov eax, ebx
call fcn.005246d0
mov edi, eax
push 0xc8
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
mov dword [ebp - 0x14], eax
jmp 0x51a9ce
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, ebx
call fcn.005246c0
cmp esi, eax
jne 0x51a9a6
mov eax, ebx
call fcn.005246d0
cmp edi, eax
je 0x51a9bf
mov eax, ebx
call fcn.005243a0
movzx eax, ax
mov edx, dword [ebp - 4]
mov dword [edx + 0x188], eax
mov byte [ebp - 5], 1
jmp 0x51a9de
call fcn.004b9988
sub eax, dword [ebp - 0x14]
cmp eax, 0x320
ja 0x51a9de
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x51a989
mov eax, ebx
call fcn.004041e0
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0041dd98
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x51a932
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51aa19
mov eax, dword [ebp - 0xc]
call fcn.004041e0
ret

Function at 0x51bfc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, edx
lea edi, [esp]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov edi, eax
xor ebx, ebx
mov eax, dword [edi + 0x374]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x51c081
mov eax, dword [edi + 0x374]
mov edx, esi
call fcn.0041dea4
mov ebp, eax
mov eax, dword [ebp + 4]
cmp eax, dword [esp + 4]
jne 0x51c04f
mov eax, dword [ebp + 8]
cmp eax, dword [esp + 8]
jne 0x51c04f
cmp dword [ebp + 0xc], 2
jge 0x51c04f
call fcn.004b9988
sub eax, dword [ebp + 0x14]
cmp eax, 0x7d0
jbe 0x51c04f
mov eax, dword [ebp]
cmp eax, dword [esp]
jne 0x51c034
mov bl, 1
jmp 0x51c077
mov edx, 0x18
mov eax, ebp
call fcn.00402f6c
mov eax, dword [edi + 0x374]
mov edx, esi
call fcn.0041dd98
jmp 0x51c077
call fcn.004b9988
sub eax, dword [ebp + 0x14]
cmp eax, 0x493e0
jbe 0x51c077
mov edx, 0x18
mov eax, ebp
call fcn.00402f6c
mov eax, dword [edi + 0x374]
mov edx, esi
call fcn.0041dd98
dec esi
cmp esi, 0xffffffff
jne 0x51bff2
mov eax, ebx
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51c240
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x5d0]
dec eax
sub eax, 0xc7
jae 0x51c3db
mov eax, dword [0x58d174]
call fcn.0050edd8
sub ax, 1
je 0x51c281
sub ax, 0x64
je 0x51c281
sub ax, 0x64
jne 0x51c3db
mov eax, dword [0x58d174]
call fcn.0050e4d4
test al, al
jne 0x51c3db
mov eax, dword [0x58d178]
xor edx, edx
mov dword [eax + 0x1e0], edx
mov edx, esp
mov ecx, 0xc
mov eax, esi
call fcn.00517a8c
test al, al
je 0x51c3db
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp byte [eax + 0x5cd], 0
je 0x51c2db
mov eax, 0x1f4
call fcn.004033c4
add eax, 0xc8
push eax
call sub.kernel32.dll_Sleep_2
mov eax, dword [esp]
call fcn.005243a0
mov edi, eax
mov eax, dword [esp]
call fcn.005246d0
push eax
push 3
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
call fcn.005246c0
mov ecx, eax
xor edx, edx
mov eax, dword [0x58d178]
call fcn.00522bb0
mov eax, dword [esp]
call fcn.00524270
cmp eax, 2
jle 0x51c374
mov eax, dword [esp]
call fcn.005246d0
push eax
mov eax, dword [esp + 4]
call fcn.005246c0
mov edx, eax
mov eax, dword [0x58d174]
pop ecx
call fcn.0050f220
call fcn.004b9988
mov ebx, eax
jmp 0x51c364
push 0x64
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, ebx
cmp eax, 0x3e8
ja 0x51c374
mov eax, dword [esp]
call fcn.00524270
cmp eax, 2
jle 0x51c374
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x51c342
mov eax, dword [esp]
call fcn.005243a0
movzx edx, ax
mov eax, dword [0x58d174]
call fcn.0050c550
push 0xc8
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
mov edx, edi
mov eax, esi
call fcn.00522ad8
test al, al
jne 0x51c3c7
mov eax, dword [0x58d178]
cmp dword [eax + 0x1e0], 3
jne 0x51c3c7
mov eax, dword [0x58d178]
call fcn.005205b4
mov eax, dword [0x58d178]
xor edx, edx
mov dword [eax + 0x1e0], edx
push 0xc8
call sub.kernel32.dll_Sleep_2
mov bl, 1
mov eax, dword [esp]
call fcn.004041e0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5200f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
mov byte [esp + 4], 0
mov dword [edi + 0x108], 0xffffffff
call fcn.004b9988
mov ebx, eax
xor esi, esi
jmp 0x520150
cmp dword [edi + 0x108], 0
jge 0x52015e
call fcn.004b9988
sub eax, ebx
mov ecx, 0x320
xor edx, edx
div ecx
cmp esi, eax
jne 0x520146
movzx ecx, word [esp]
mov edx, ebp
mov eax, dword [0x58d174]
call fcn.005102e8
inc esi
push 0xc8
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, ebx
cmp eax, 0x7d0
jb 0x520118
cmp dword [edi + 0x108], 0
jl 0x52016c
mov byte [esp + 4], 1
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x520444
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], edx
mov ebx, eax
mov byte [esp + 4], 0
mov dword [ebx + 0x108], 0xffffffff
mov byte [ebx + 0x92], 0
call fcn.004b9988
mov esi, eax
xor edi, edi
mov eax, dword [0x58d174]
call fcn.0050fbe4
mov ebp, eax
jmp 0x5204cb
cmp byte [ebx + 0x92], 0
jne 0x5204d9
cmp dword [ebx + 0x108], 0
jge 0x5205a5
mov eax, dword [0x58d174]
call fcn.0050fbe4
cmp bp, ax
jne 0x5204d9
call fcn.004b9988
sub eax, esi
mov ecx, 0x258
xor edx, edx
div ecx
cmp edi, eax
jne 0x5204c4
mov edx, dword [esp]
mov eax, dword [0x58d174]
call fcn.0050c550
inc edi
push 0x32
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
jb 0x52047d
cmp byte [ebx + 0x92], 0
je 0x5205a5
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x5d0]
add eax, 0xffffff40
sub eax, 2
jae 0x520561
mov eax, ebx
call fcn.00521dd0
lea eax, [esp + 0xd]
push eax
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [esp + 5]
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [esp + 0x11]
add eax, 0x3c
push eax
mov eax, dword [esp + 0x11]
add eax, 0xa0
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 6
call sub.user32.dll_mouse_event
mov eax, dword [esp + 9]
push eax
mov eax, dword [esp + 9]
push eax
call sub.user32.dll_SetCursorPos
mov byte [ebx + 0x93], 1
jmp 0x520599
push 0x280096
push 0
push 0x201
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SendMessageA
push 0x280096
push 0
push 0x202
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SendMessageA
push 0x32
call sub.kernel32.dll_Sleep_2
mov byte [esp + 4], 1
movzx eax, byte [esp + 4]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x520754
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
xor ebx, ebx
mov eax, dword [0x58d174]
call fcn.0050fbe4
movzx edi, ax
xor ebp, ebp
mov eax, ebp
sub eax, 1
jb 0x520781
je 0x5207de
dec eax
je 0x5207ef
dec eax
je 0x520800
jmp 0x52080f
mov eax, dword [0x58d174]
call fcn.0050e550
test al, al
je 0x5207a0
mov edx, 0x520870
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x52080f
mov eax, dword [0x58d174]
call fcn.0050e610
test al, al
je 0x5207bf
mov edx, 0x520880
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x52080f
mov eax, dword [0x58d174]
call fcn.0050e5e4
test al, al
je 0x52080f
mov edx, 0x520890
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x52080f
mov edx, 0x520870
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x52080f
mov edx, 0x520880
mov eax, dword [0x58d174]
call fcn.0050babc
jmp 0x52080f
mov edx, 0x520890
mov eax, dword [0x58d174]
call fcn.0050babc
call fcn.004b9988
mov esi, eax
jmp 0x520843
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x58d174]
call fcn.0050fbe4
movzx eax, ax
cmp edi, eax
setne bl
test bl, bl
jne 0x520853
call fcn.004b9988
sub eax, esi
cmp eax, 0x3e8
ja 0x520853
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x520818
test bl, bl
jne 0x520861
inc ebp
cmp ebp, 4
jne 0x520769
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x521dd0
Capabilities:
Hide graphical window

Disassembly:
push 1
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SetWindowPos
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x586404]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SetForegroundWindow
ret
Function at 0x5220b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebp, edx
mov byte [esp], 0
mov eax, dword [0x58d178]
mov byte [eax + 0x24], 0
mov edx, ebp
mov eax, dword [0x58d174]
call fcn.0050f354
call fcn.004b9988
mov ebx, eax
xor esi, esi
jmp 0x522163
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x58d178]
cmp byte [eax + 0x24], 0
je 0x5220fd
mov byte [esp], 1
jmp 0x522177
call fcn.004b9988
sub eax, ebx
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x52211a
cmp eax, dword [esp]
pop edx
pop eax
jae 0x52211e
jmp 0x522177
pop edx
pop eax
jl 0x522177
call fcn.004b9988
sub eax, ebx
cmp eax, 0x1f4
jbe 0x522163
test esi, esi
jne 0x522163
mov eax, dword [0x58d178]
cmp byte [eax + 0x1b5], 0
je 0x522156
mov eax, dword [0x58d178]
cmp dword [eax + 0x1b8], 3
jne 0x522156
push 0xbb8
call sub.kernel32.dll_Sleep_2
mov edx, ebp
mov eax, dword [0x58d174]
call fcn.0050f354
inc esi
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x5220e5
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x522184
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebp, edx
mov byte [esp], 0
call fcn.004b9988
mov ebx, eax
xor esi, esi
mov eax, dword [0x58d178]
call fcn.005125c0
mov eax, dword [0x58d178]
mov byte [eax + 0x24], 0
mov edx, ebp
mov eax, dword [0x58d174]
call fcn.0050f354
jmp 0x522213
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x58d178]
cmp byte [eax + 0x24], 0
je 0x5221d3
mov byte [esp], 1
jmp 0x522223
call fcn.004b9988
sub eax, ebx
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x5221f0
cmp eax, dword [esp]
pop edx
pop eax
jae 0x5221f4
jmp 0x522223
pop edx
pop eax
jl 0x522223
call fcn.004b9988
sub eax, ebx
cmp eax, 0x1f4
jbe 0x522213
test esi, esi
jne 0x522213
mov edx, ebp
mov eax, dword [0x58d174]
call fcn.0050f354
inc esi
mov eax, dword [0x586750]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x5221bb
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret