joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62960c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x410], 0
je 0x6297ea
mov esi, dword [ebx + 0x410]
mov eax, dword [esi + 0x36c]
cmp eax, dword [ebx + 0x36c]
jne 0x6297bd
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x6297bd
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x6297bd
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004e49e0
test al, al
je 0x6297bd
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48c]
cmp eax, dword [ebx + 0xce0]
jle 0x6297b7
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x414], eax
push 0
push 0
mov eax, dword [ebx + 0x410]
push eax
push 0
push 0
movzx ecx, byte [ebp - 1]
mov dx, 0xc0
mov eax, ebx
call fcn.006a4724
push 1
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x154]
sub ecx, eax
mov edx, eax
mov eax, ebx
call fcn.006ad27c
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x6297b0
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x36c]
call fcn.006b70f4
test al, al
je 0x6297a6
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x36c]
call fcn.006b7460
mov edi, eax
test edi, edi
je 0x6297a6
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x6297a6
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.006a9d70
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x6297a6
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.006a9f54
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [edi + 0x16c]
push eax
mov eax, dword [edi + 0x174]
push eax
push ebx
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x62970f
mov eax, ebx
call fcn.006a965c
mov byte [ebp - 3], 1
jmp 0x6297ea
mov eax, dword [ebx + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [ebx + 0x36c]
jne 0x6297e3
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x6297ea
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x62d180
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62d350
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x62d2f4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.006b9af4
xor eax, eax
push ebp
push 0x62d2d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x68]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x1e90]
cmp esi, dword [edi + 8]
jge 0x62d2b9
mov eax, edi
mov edx, esi
call fcn.00420a68
mov ebx, eax
test ebx, ebx
je 0x62d295
cmp byte [ebx + 0x370], 0
jne 0x62d26a
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x400]
cmp eax, dword [ebx + 0x404]
jle 0x62d295
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0x3f8]
jbe 0x62d247
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
mov eax, ebx
call fcn.006a51a4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x400]
cmp eax, dword [ebx + 0x404]
jle 0x62d295
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x400], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x62d295
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x374]
cmp eax, 0x493e0
jbe 0x62d295
mov eax, ebx
call fcn.0040448c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
mov edx, esi
call fcn.0042090c
jmp 0x62d2b9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x707d84]
cmp eax, dword [edx]
jbe 0x62d2b3
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], esi
mov byte [ebp - 0xd], 1
jmp 0x62d2b9
inc esi
jmp 0x62d1e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62d2dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.006b9b04
ret
Function at 0x62ddc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x62def7
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edi, dword [eax + 8]
dec edi
sub edi, esi
jl 0x62dedf
inc edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.00420a68
mov ebx, eax
test ebx, ebx
je 0x62deb9
cmp byte [ebx + 0x370], 0
jne 0x62de8e
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x400]
cmp eax, dword [ebx + 0x404]
jle 0x62deb9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0x3f8]
jbe 0x62de6b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
mov eax, ebx
call fcn.006a51a4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x400]
cmp eax, dword [ebx + 0x404]
jle 0x62deb9
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x400], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x62deb9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x374]
cmp eax, 0x493e0
jbe 0x62deb9
mov eax, ebx
call fcn.0040448c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.0042090c
jmp 0x62dedf
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x707d84]
cmp eax, dword [edx]
jbe 0x62ded7
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], esi
mov byte [ebp - 0xd], 1
jmp 0x62dedf
inc esi
dec edi
jne 0x62de12
cmp byte [ebp - 0xd], 0
jne 0x62deed
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x6c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62df0b
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed0], ebx
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x1ed4]
jbe 0x62df32
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62e2ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62e401
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
xor edx, edx
push ebp
push 0x62e3b6
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2c]
mov edx, dword [0x7070f8]
cmp eax, dword [edx + 0x1a18]
jbe 0x62e31b
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push ebp
call fcn.0062e1f4
pop ecx
mov eax, dword [0x707de8]
mov eax, dword [eax]
call fcn.005122c4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x30]
cmp eax, 0x2710
jbe 0x62e34e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
call fcn.0062b750
mov edx, eax
mov eax, dword [0x707a48]
mov eax, dword [eax]
call fcn.00520ea8
cmp byte [0x706e9c], 0
jne 0x62e3ac
mov byte [0x706e9c], 1
xor edx, edx
push ebp
push 0x62e38e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x7080ec]
cmp dword [eax], 0
je 0x62e384
mov eax, dword [0x7080ec]
mov eax, dword [eax]
mov dl, 1
call fcn.00488e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62e3ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62e3eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62e408
lea eax, [ebp - 8]
call fcn.004054d0
ret
Function at 0x6318bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ea4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x6319b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ea4]
cmp dword [eax + 8], 0
jle 0x6319b4
mov edx, edi
call fcn.00420a68
mov ebx, eax
test ebx, ebx
je 0x6319aa
cmp dword [ebx], 0
je 0x6319aa
mov eax, dword [ebx]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x63194b
mov edx, esi
mov eax, dword [ebx]
call fcn.00420a68
test eax, eax
je 0x631945
cmp byte [eax + 0x378], 0
jne 0x63193c
cmp byte [eax + 0x370], 0
jne 0x63193c
cmp byte [eax + 0x340], 0
jne 0x631945
mov edx, esi
mov eax, dword [ebx]
call fcn.0042090c
dec esi
cmp esi, 0xffffffff
jne 0x631914
mov eax, dword [ebx]
cmp dword [eax + 8], 0
jle 0x63196f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
ja 0x63196f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, 0x2bf20
jbe 0x6319aa
mov eax, dword [ebx]
call fcn.0040448c
xor esi, esi
cmp dword [ebx + esi*4 + 0xc], 0
je 0x631988
mov eax, dword [ebx + esi*4 + 0xc]
mov edx, dword [eax]
call dword [edx + 4]
inc esi
cmp esi, 8
jl 0x631978
mov edx, 0x2c
mov eax, ebx
call fcn.0040300c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ea4]
mov edx, edi
call fcn.0042090c
dec edi
cmp edi, 0xffffffff
jne 0x6318dc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x635354
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0xd8c]
cmp eax, 0xbb8
jbe 0x6353b2
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0xd8c], eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x36c]
call fcn.006b7050
cmp eax, 2
jl 0x635399
mov byte [esi + 0xd91], 1
mov edx, dword [esi + 0x410]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
jne 0x6353b2
xor eax, eax
mov dword [esi + 0x410], eax
cmp byte [esi + 0xd91], 0
je 0x6353ef
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x28]
mov dword [ebp - 4], eax
mov eax, 8
call fcn.004034e0
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.006ac77c
cmp edi, dword [esi + 0x24]
jne 0x6353e6
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x28]
je 0x6353ef
mov byte [esi + 0xd91], 0
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6353f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x410]
test edi, edi
je 0x635496
lea ecx, [ebp - 1]
mov edx, edi
mov eax, esi
call fcn.006a1ea4
test al, al
je 0x635469
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x48c]
cmp eax, dword [esi + 0xce0]
jle 0x635465
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x48c], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x414], eax
movzx ecx, byte [ebp - 1]
mov edx, dword [esi + 0x410]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.006a965c
mov bl, 1
jmp 0x635496
mov eax, dword [esi + 0x410]
mov edx, dword [eax + 0x36c]
cmp edx, dword [esi + 0x36c]
jne 0x63548f
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x635496
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x635b3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [ebx + 0x378], 0
jne 0x635ba7
cmp byte [ebx + 0xd90], 0
jne 0x635ba7
cmp byte [ebx + 0x370], 0
jne 0x635ba7
mov eax, ebx
call fcn.006a2f84
test al, al
je 0x635ba7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x1f40
ja 0x635b95
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x3e8
jbe 0x635ba7
cmp dword [ebx + 0x410], 0
jne 0x635ba7
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x494], eax
mov eax, ebx
call fcn.006b41d4
mov eax, ebx
call fcn.006354a0
pop ebx
pop ebp
ret

Function at 0x637104
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
cmp byte [ebx + 0x370], 0
jne 0x637220
cmp byte [ebx + 0x378], 0
jne 0x637220
mov eax, ebx
call fcn.006a2f84
test al, al
je 0x637220
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x490]
cmp eax, dword [ebx + 0xcc8]
jl 0x637220
cmp byte [ebx + 0x3a6], 0
je 0x6371e1
mov eax, dword [ebx + 0x4a4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x637220
inc edi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x4a4]
call fcn.00420a68
mov esi, dword [eax]
test esi, esi
je 0x6371d9
cmp byte [esi + 0x378], 0
jne 0x6371d9
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x6371d9
cmp byte [esi + 0x3a5], 0
je 0x6371b0
cmp byte [ebx + 0x3a7], 0
je 0x6371d9
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x6371d9
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x6371d9
mov eax, ebx
call fcn.00637078
jmp 0x637220
inc dword [ebp - 4]
dec edi
jne 0x637174
jmp 0x637220
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x1f40
ja 0x63720e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x3e8
jbe 0x637220
cmp dword [ebx + 0x410], 0
jne 0x637220
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x494], eax
mov eax, ebx
call fcn.006b41d4
mov eax, ebx
call fcn.006354a0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x637e84
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x378], 0
jne 0x63802b
cmp byte [ebx + 0xd90], 0
jne 0x63802b
cmp byte [ebx + 0x370], 0
jne 0x63802b
mov eax, ebx
call fcn.006a2f84
test al, al
je 0x63802b
cmp byte [ebx + 0xda9], 0
je 0x637f0c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x1f40
ja 0x637efa
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x494]
cmp eax, 0x3e8
jbe 0x637f0c
cmp dword [ebx + 0x410], 0
jne 0x637f0c
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x494], eax
mov eax, ebx
call fcn.006b41d4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0xda0]
cmp eax, 0x2710
jbe 0x63802b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0xda0], eax
cmp byte [ebx + 0xdaa], 0
je 0x637fa2
cmp dword [ebx + 0x410], 0
je 0x637fa2
mov eax, ebx
call fcn.006aaf38
cmp eax, 5
jl 0x637fa2
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x410]
call fcn.006aaab0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x36c]
call fcn.006b5968
test al, al
je 0x637f8e
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x36c]
mov eax, ebx
call fcn.006b27c0
jmp 0x638032
xor ecx, ecx
mov edx, dword [ebx + 0x36c]
mov eax, ebx
call fcn.006b39c4
jmp 0x638032
mov ecx, dword [ebx + 0xdac]
mov eax, dword [ebx + 0x174]
mov esi, 7
xor edx, edx
div esi
push eax
mov eax, dword [ebx + 0x16c]
pop edx
mov esi, edx
xor edx, edx
div esi
mov edx, 7
sub edx, eax
mov dword [ebx + 0xdac], edx
mov eax, dword [ebx + 0xdac]
cmp eax, 2
jl 0x637ff3
cmp ecx, eax
je 0x637ff3
mov byte [ebx + 0xda8], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0xda4], eax
cmp byte [ebx + 0xda8], 0
je 0x63802b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0xda4]
cmp eax, 0x1f40
jae 0x63801a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x9c]
jmp 0x63802b
mov byte [ebx + 0xda8], 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, ebx
call fcn.006354a0
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x649dcc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405960
mov eax, dword [ebp - 8]
call fcn.00405960
xor eax, eax
push ebp
push 0x64a018
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x649e44
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x649e44
push 1
push 0x64a030
push dword [ebp - 4]
push 0x64a044
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405874
mov edx, dword [ebp - 0x14]
mov cl, 1
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
mov eax, dword [esi + 0x1258]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x649e68
push 1
xor ecx, ecx
mov edx, 0x64a08c
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
cmp byte [esi + 0x125c], 0
jne 0x649e86
push 1
xor ecx, ecx
mov edx, 0x64a0ac
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
mov eax, dword [esi + 0x36c]
cmp byte [eax + 0x4e], 0
je 0x649ea7
push 1
xor ecx, ecx
mov edx, 0x64a0cc
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x1254]
cmp eax, 0x2710
jae 0x649ece
push 1
xor ecx, ecx
mov edx, 0x64a0e8
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x1254], eax
mov byte [ebp - 0xd], 0
mov eax, dword [esi + 0x1258]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jl 0x649fda
inc edi
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x1258]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
test ebx, ebx
je 0x649fd0
mov byte [ebp - 0xd], 1
cmp byte [ebx + 0x370], 0
jne 0x649f32
cmp byte [ebx + 0x378], 0
jne 0x649f32
cmp byte [ebx + 0xd46], 0
jne 0x649f6f
push 1
push 0x64a104
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi + 0x1258]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1c]
push 0x64a110
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405874
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, esi
call fcn.006a6c7c
jmp 0x649ff0
cmp byte [ebx + 0x124d], 0
je 0x649f83
mov edx, ebx
mov eax, esi
call fcn.0069ea38
jmp 0x649fd0
push 1
mov edx, 0x64a128
lea eax, [ebp - 0x34]
call fcn.00403a20
lea edx, [ebx + 0x15]
lea eax, [ebp - 0x34]
mov cl, 0x10
call fcn.004039f0
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x58]
call fcn.00403a20
mov edx, 0x64a12c
lea eax, [ebp - 0x58]
mov cl, 0x22
call fcn.004039f0
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x20]
call fcn.00405744
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, esi
call fcn.006a6c7c
inc dword [ebp - 0xc]
dec edi
jne 0x649efb
cmp byte [ebp - 0xd], 0
jne 0x649ff0
push 1
xor ecx, ecx
mov edx, 0x64a148
mov eax, esi
call fcn.006a6c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a01f
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004054f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f4
ret
Function at 0x64a534
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405960
mov eax, dword [ebp - 8]
call fcn.00405960
xor eax, eax
push ebp
push 0x64a702
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x64a5a5
mov eax, dword [ebp - 8]
cmp byte [eax], 0x3f
jne 0x64a5a5
push 1
push 0x64a718
push dword [ebp - 4]
push 0x64a72c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405874
mov edx, dword [ebp - 0xc]
mov cl, 1
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
cmp byte [ebx + 0x1238], 0
jne 0x64a5c3
push 1
xor ecx, ecx
mov edx, 0x64a76c
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
mov eax, dword [ebx + 0x36c]
cmp byte [eax + 0x4d], 0
je 0x64a5e4
push 1
xor ecx, ecx
mov edx, 0x64a784
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
cmp dword [ebx + 0x1248], 0
jne 0x64a61d
cmp byte [ebx + 0x2d], 0
jne 0x64a608
push 1
xor ecx, ecx
mov edx, 0x64a7a0
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
push 1
xor ecx, ecx
mov edx, 0x64a7b8
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
mov eax, dword [ebx + 0x1248]
cmp byte [eax + 0x370], 0
jne 0x64a63e
cmp byte [eax + 0x378], 0
jne 0x64a63e
cmp byte [eax + 0xd46], 0
jne 0x64a66b
cmp byte [ebx + 0x2d], 0
jne 0x64a659
push 1
xor ecx, ecx
mov edx, 0x64a7d0
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
push 1
xor ecx, ecx
mov edx, 0x64a7f4
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x1250]
cmp eax, 0x2710
jae 0x64a68f
push 1
xor ecx, ecx
mov edx, 0x64a818
mov eax, ebx
call fcn.006a6c7c
jmp 0x64a6e7
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x1250], eax
mov esi, dword [ebx + 0x1248]
cmp byte [esi + 0x124c], 0
je 0x64a6b4
mov edx, esi
mov eax, ebx
call fcn.0069ea38
jmp 0x64a6e7
push 1
lea edx, [esi + 0x15]
lea eax, [ebp - 0x30]
call fcn.00403a20
mov edx, 0x64a82c
lea eax, [ebp - 0x30]
mov cl, 0x1e
call fcn.004039f0
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
call fcn.00405744
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, ebx
call fcn.006a6c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a709
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004054f4
ret