joyce8/EMBER2024-capa huggingface dataset:
Function at 0x535624
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x5d8440]
call fcn.005ccd20
test al, al
je 0x535673
mov eax, dword [0x5d8440]
test byte [eax + 0x77], 4
je 0x535649
cmp byte [0x5d6768], 0
je 0x535673
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d8890]
cmp eax, dword [0x5d8894]
jbe 0x535673
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x714]
cmp eax, dword [ebx + 0x718]
jbe 0x535673
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x535678
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
jmp 0x58d850
jne 0x535694
mov eax, dword [0x5d8440]
test dword [eax + 0x74], 0x4000000
jle 0x535694
xor eax, eax
pop ebx
ret
mov eax, dword [0x5d8440]
jmp 0x58d900
imul edx, eax, 0xe
mov eax, 0x172
call fcn.00493908
mov edx, dword [0x5d8440]
movsx edx, byte [edx + 0xd0]
imul edx, edx, 0x3c
add edx, eax
mov eax, 0x320
call fcn.00493908
mov ebx, dword [0x5d6c44]
add ebx, 0x190
sub ebx, eax
test ebx, ebx
jge 0x5356dd
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d70e4]
cmp eax, ebx
jbe 0x53570d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d6cc8]
cmp eax, dword [0x5d6cc4]
jb 0x53570d
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d70e4], eax
mov al, 1
jmp 0x53570f
xor eax, eax
pop ebx
ret
cmp dword [0x58d440], 0
jne 0x58d85d
xor eax, eax
pop ebx
ret
cmp byte [0x5d676a], 0
jmp 0x535680
test eax, eax
jne 0x58d908
xor eax, eax
pop ebx
ret
movzx eax, byte [eax + 0x8c]
jmp 0x5356a0

Function at 0x535714
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d8880]
cmp eax, dword [0x5d70b8]
jb 0x535748
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d6a1c]
cmp eax, dword [0x5d6a18]
jl 0x535748
mov eax, dword [0x5d8440]
jmp 0x58d9c0
jle 0x53574b
xor eax, eax
ret
mov al, 1
ret
test eax, eax
jne 0x58d9c9
jmp 0x535748
test dword [eax + 0x74], 0x4000000
jmp 0x535746

Function at 0x535e4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
cmp byte [0x5d8849], 0
jne 0x535e69
cmp byte [0x5d70fc], 0
jne 0x535e69
cmp byte [0x5d6f72], 0
je 0x535ea3
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [0x5d6c40]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x535e8f
cmp eax, 0x2710
jbe 0x535e98
jmp 0x535e91
jle 0x535e98
mov byte [0x5d6f72], 0
xor ebx, ebx
xor eax, eax
mov dword [0x5d8858], eax
jmp 0x535eee
cmp byte [0x5d8848], 0
je 0x535eec
cmp edx, dword [0x5d8858]
jne 0x535eec
xor ebx, ebx
mov esi, dword [0x5d8898]
add esi, 0x190
cmp esi, 0x320
jae 0x535ecf
mov esi, 0x320
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d8868]
cmp esi, eax
jae 0x535eee
mov bl, 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d8868], eax
jmp 0x535eee
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5362ac
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, 0x5d6a0c
xor eax, eax
push ebp
push 0x53640f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x9ba], 0
jne 0x5363f1
mov eax, dword [ebp - 4]
mov byte [eax + 0x9ba], 1
xor eax, eax
push ebp
push 0x5363ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [0x5d6a08]
call fcn.004046dc
mov eax, 0x5d6a08
call fcn.00404414
cmp dword [ebx], 0
je 0x5363d2
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
jmp 0x5363c2
cmp byte [0x5d6784], 0
je 0x536360
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
push edx
push eax
mov eax, dword [0x5d6b58]
cdq
cmp edx, dword [esp + 4]
jne 0x53635c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x536360
jmp 0x5363d2
pop edx
pop eax
jl 0x5363d2
mov edx, dword [ebx]
mov eax, 0x536424
call fcn.00404a18
test eax, eax
je 0x5363d2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x536424
mov edx, 0x536430
mov eax, dword [ebx]
call fcn.004932b4
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00404468
cmp dword [ebp - 8], 0
je 0x5363b2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0053645c
mov eax, dword [0x5d3a50]
mov eax, dword [eax]
call fcn.0048536c
jmp 0x5363c2
mov edx, dword [ebx]
mov eax, 0x536424
call fcn.00404a18
test eax, eax
je 0x5363d2
mov eax, dword [ebx]
call fcn.004046d4
cmp eax, 2
jge 0x536327
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5363f1
mov eax, dword [ebp - 4]
mov byte [eax + 0x9ba], 0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536416
lea eax, [ebp - 0x1c]
call fcn.00404414
lea eax, [ebp - 8]
call fcn.00404414
ret
Function at 0x5414d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x5414ed
mov eax, dword [0x5d3a50]
mov eax, dword [eax]
call fcn.0048536c
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x5414e1
pop esi
pop ebx
ret

Function at 0x5414fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x541523
mov eax, dword [0x5d3a50]
mov eax, dword [eax]
call fcn.0048536c
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x2710
ja 0x54152f
mov eax, dword [ebx + 0x9f4]
cmp byte [eax + 0x30], 0
jne 0x541509
mov eax, 0x64
call fcn.005414d4
pop esi
pop ebx
ret
Function at 0x541630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [0x5d6c84]
mov dword [eax + 0xa34], edx
cmp dword [0x5d8440], 0
je 0x541849
cmp byte [0x5d8849], 0
jne 0x541849
mov byte [0x5d6dd0], 1
xor eax, eax
push ebp
push 0x541842
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x5d70f0]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 8]
cmp eax, dword [ebp - 8]
jle 0x5416e6
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00419afc
mov edi, eax
mov byte [ebp - 9], 1
mov eax, dword [0x5d843c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5416db
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x5d843c]
call fcn.00419afc
cmp edi, eax
jne 0x5416d7
mov eax, dword [0x5d70f0]
mov eax, dword [eax + 0x10]
mov cl, 1
mov edx, dword [ebp - 8]
call fcn.00499b48
mov byte [ebp - 9], 0
jmp 0x5416db
inc esi
dec ebx
jne 0x5416af
cmp byte [ebp - 9], 0
je 0x54167f
inc dword [ebp - 8]
jmp 0x54167f
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x5d843c]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
jle 0x541784
mov edx, dword [ebp - 8]
mov eax, dword [0x5d843c]
call fcn.00419afc
push dword [eax + 0x100]
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
cmp eax, 0xea60
jbe 0x54177c
xor eax, eax
push ebp
push 0x541775
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [0x5d843c]
call fcn.00419afc
cmp eax, dword [0x5d6770]
jne 0x541748
xor eax, eax
mov dword [0x5d6770], eax
mov edx, dword [ebp - 8]
mov eax, dword [0x5d843c]
call fcn.00419afc
call fcn.004035e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5416eb
mov edx, dword [ebp - 8]
mov eax, dword [0x5d843c]
call fcn.004199ec
ret
inc dword [ebp - 8]
jmp 0x5416eb
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x5d838c]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
jle 0x5417dd
mov edx, dword [ebp - 8]
mov eax, dword [0x5d838c]
call fcn.00419afc
push dword [eax + 0x4b]
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
cmp eax, 0xea60
jbe 0x5417d8
mov edx, dword [ebp - 8]
mov eax, dword [0x5d838c]
call fcn.00419afc
xor edx, edx
call fcn.00402734
mov edx, dword [ebp - 8]
mov eax, dword [0x5d838c]
call fcn.004199ec
jmp 0x541789
inc dword [ebp - 8]
jmp 0x541789
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x5d6dc8]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 8]
jle 0x54182d
mov edx, dword [ebp - 8]
mov eax, dword [0x5d6dc8]
call fcn.00419afc
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x10]
cmp eax, 0xea60
jb 0x541828
mov edx, dword [ebp - 8]
mov eax, dword [0x5d6dc8]
call fcn.004199ec
mov edx, 0x14
mov eax, ebx
call fcn.00402734
jmp 0x5417e2
inc dword [ebp - 8]
jmp 0x5417e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541849
mov byte [0x5d6dd0], 0
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x544cd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
xor ebx, ebx
cmp byte [0x5d6f71], 0
je 0x544d60
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [0x5d6c40]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x544d0d
cmp eax, 0x7d0
jbe 0x544d60
jmp 0x544d0f
jle 0x544d60
mov ecx, dword [esp]
mov edx, ebp
mov eax, dword [0x5d70ac]
call fcn.005b8708
mov edi, eax
test edi, edi
jle 0x544d60
mov ecx, dword [esp]
mov edx, ebp
mov eax, dword [0x5d70ac]
call fcn.005b8744
test al, al
jne 0x544d60
push ebp
mov eax, dword [esp + 4]
push eax
push 0
mov ecx, edi
mov edx, 0x3ea
mov eax, esi
call fcn.00533510
mov byte [0x5d6f72], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6c40], eax
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x548400
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x5485b6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5d8440], 0
je 0x54858b
test edx, edx
jl 0x54858b
mov esi, edx
imul eax, esi, 0x35
push esi
lea esi, [eax + 0x5d7100]
lea edi, [ebp - 0x3d]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
cmp byte [0x5d870c], 0
je 0x548476
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d6bb0]
cmp eax, 0x2710
jb 0x54858b
xor eax, eax
mov al, byte [ebp - 0x2e]
call fcn.005c4508
mov edx, eax
mov al, 1
sub edx, 1
jae 0x5484af
mov eax, dword [0x5d8440]
mov al, byte [eax + 0x64]
test al, al
jne 0x54849f
cmp byte [ebp - 0x2e], 0xa
jne 0x54858b
cmp al, 1
jne 0x5484ad
cmp byte [ebp - 0x2e], 0xb
jne 0x54858b
mov al, 1
test al, al
je 0x54858b
push esi
lea esi, [ebp - 0x3d]
mov edi, 0x5d870c
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6bb0], eax
imul eax, esi, 0x35
mov byte [eax + 0x5d7100], 0
mov eax, dword [ebp - 4]
mov dword [0x5d8708], eax
cmp byte [0x5d6ce0], 0
je 0x548564
mov edx, 0x5485c4
lea eax, [ebp - 0x58]
call fcn.00402cf4
lea edx, [ebp - 0x3d]
lea eax, [ebp - 0x58]
mov cl, 0x13
call fcn.00402cc4
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x70]
call fcn.00402cf4
mov edx, 0x5485cc
lea eax, [ebp - 0x70]
mov cl, 0x17
call fcn.00402cc4
lea edx, [ebp - 0x70]
lea eax, [ebp - 0x44]
call fcn.00404678
push dword [ebp - 0x44]
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.005c5524
push dword [ebp - 0x74]
push 0x5485dc
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404794
push 0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0xa
mov eax, ebx
call fcn.005612e0
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x3d]
call fcn.00404678
mov eax, dword [ebp - 0x78]
push eax
mov dl, byte [ebp - 4]
mov ecx, dword [ebp - 0x11]
mov eax, ebx
call fcn.00534008
mov byte [ebp - 0x3d], 0
mov eax, ebx
call fcn.0053ec88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5485bd
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404438
lea eax, [ebp - 0x44]
call fcn.00404414
lea eax, [ebp - 8]
call fcn.00404414
ret
Function at 0x552270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, 0x5d6fc8
xor eax, eax
push ebp
push 0x5523cb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5d8440], 0
je 0x5523b5
mov eax, dword [0x5d8440]
cmp byte [eax + 0x78], 0
jne 0x5523b5
cmp byte [0x5d8849], 0
jne 0x5523b5
cmp byte [0x5d884a], 0
jne 0x5523b5
cmp byte [0x5d6ba0], 0
jne 0x5523b5
cmp byte [0x5d6b91], 0
jne 0x5523b5
mov eax, dword [ebx]
cmp byte [eax + 4], 0
je 0x5523b5
mov eax, dword [ebx]
cmp dword [eax + 0x874], 0xffffffff
jne 0x55230d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
sub eax, dword [edx + 0x8a0]
cmp eax, 0x3e8
jbe 0x55230d
xor edx, edx
mov eax, dword [ebx]
call fcn.005a8ac8
mov eax, dword [ebx]
cmp byte [eax + 0x86e], 0
je 0x552357
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
sub eax, dword [edx + 0x850]
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x854]
cdq
cmp edx, dword [esp + 4]
jne 0x552341
cmp eax, dword [esp]
pop edx
pop eax
jae 0x552357
jmp 0x552345
pop edx
pop eax
jge 0x552357
mov eax, dword [ebx]
mov byte [eax + 0x895], 1
mov eax, dword [ebx]
mov byte [eax + 0x86e], 0
mov eax, dword [ebx]
cmp byte [eax + 0x895], 0
je 0x5523b5
jmp 0x552396
mov eax, dword [ebx]
add eax, 0x888
call fcn.00404414
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.005a4ac0
cmp dword [ebp - 4], 0
je 0x5523ac
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
call fcn.005a8bd0
mov eax, dword [0x5d3a50]
mov eax, dword [eax]
call fcn.0048536c
mov eax, dword [ebx]
cmp byte [eax + 0x895], 0
je 0x5523ac
mov eax, dword [ebx]
cmp byte [eax + 0x896], 0
je 0x552364
mov eax, dword [ebx]
mov byte [eax + 0x896], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5523d2
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x5523d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x55260f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5d6904], 0
je 0x552421
cmp dword [0x5d6900], 3
jge 0x552421
mov edx, 0x552624
mov eax, esi
call fcn.005455fc
test eax, eax
je 0x552421
mov byte [0x5d6905], 1
jmp 0x5525f4
mov bl, 1
cmp byte [0x5d6798], 0
jne 0x5524f6
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d679c]
cmp eax, 0x5dc
jbe 0x5524f6
mov byte [0x5d6798], 1
mov byte [0x5d6799], 0
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d679c], eax
cmp byte [0x5d6db8], 0
je 0x55249e
push 0x552638
lea edx, [ebp - 8]
mov eax, dword [0x5d8440]
mov eax, dword [eax + 0x11c]
call fcn.005c8c80
push dword [ebp - 8]
push 0x552650
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404794
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0055a548
cmp byte [0x5d6dac], 0
je 0x5525f4
push 0x55265c
lea edx, [ebp - 0x10]
mov eax, dword [0x5d8440]
mov eax, dword [eax + 0x11c]
call fcn.005c8c80
push dword [ebp - 0x10]
push 0x552674
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404794
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5d70a8]
mov eax, dword [eax + 0x5cc]
mov eax, dword [eax + 0x90]
call fcn.00497644
jmp 0x5525f4
mov eax, dword [0x5d70ac]
mov eax, dword [eax + 0x7c]
call fcn.005c81d8
test al, al
je 0x55251d
mov ecx, 2
mov edx, 0x552680
mov eax, esi
call fcn.0054cd0c
mov ebx, eax
xor bl, 1
test bl, bl
je 0x5525f4
cmp byte [0x5d6689], 0
je 0x552587
cmp dword [0x5d668c], 0
jne 0x55257e
mov dword [0x5d668c], 1
mov eax, dword [0x5d8440]
movzx eax, word [eax + 0x120]
mov dword [0x5d6690], eax
mov eax, dword [0x5d8440]
movzx eax, word [eax + 0x122]
mov dword [0x5d6694], eax
push 0xff
mov ecx, 0xffffff
mov edx, 0x552694
mov eax, dword [0x5d70a4]
call fcn.005b2b94
jmp 0x5525f4
cmp dword [0x5d668c], 1
je 0x5525f4
mov byte [0x5d6905], 0
push 0xff0000
mov ecx, 0xffffff
mov edx, 0x5526b4
mov eax, dword [0x5d70a4]
call fcn.005b2b94
push 0xff0000
mov ecx, 0xffffff
mov edx, 0x5526d4
mov eax, dword [0x5d70a4]
call fcn.005b2b94
push 0xff0000
mov ecx, 0xffffff
mov edx, 0x552718
mov eax, dword [0x5d70a4]
call fcn.005b2b94
mov eax, 0x5d6948
mov edx, 0x55275c
call fcn.00404468
mov edx, 0x1770
mov eax, esi
call fcn.00551474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552616
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404438
ret
Function at 0x55a5bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55a7c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5d678c], 0
jne 0x55a5f1
mov bl, 1
jmp 0x55a7a5
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x5d6da4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x55a74c
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x5d6da4]
call fcn.00419afc
mov ebx, eax
cmp dword [ebx], 0
je 0x55a744
cmp byte [ebx + 0x38], 0
je 0x55a744
mov edx, dword [ebx + 4]
mov eax, dword [0x5d70f0]
call fcn.005b4df8
mov dword [ebp - 0x10], eax
mov byte [ebp - 9], 1
cmp dword [ebp - 0x10], 0
je 0x55a68a
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c], eax
mov eax, dword [0x5d8440]
movzx eax, word [eax + 0x122]
push eax
mov eax, dword [0x5d8440]
movzx ecx, word [eax + 0x120]
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 0x122]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x120]
call fcn.005c40cc
cmp eax, 4
jle 0x55a69d
mov byte [ebp - 9], 0
jmp 0x55a69d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2c]
cmp eax, 0xbb8
jbe 0x55a69d
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
jne 0x55a744
push 0x55a7d8
mov eax, dword [0x5d70ac]
push dword [eax + 0x7c]
push 0x55a7ec
lea edx, [ebp - 0x18]
mov eax, dword [0x5d8440]
movzx eax, word [eax + 0x120]
call fcn.00408cf0
push dword [ebp - 0x18]
push 0x55a7ec
lea edx, [ebp - 0x1c]
mov eax, dword [0x5d8440]
movzx eax, word [eax + 0x122]
call fcn.00408cf0
push dword [ebp - 0x1c]
push 0x55a7f8
lea eax, [ebp - 0x14]
mov edx, 7
call fcn.00404794
inc dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebx + 0x20]
call fcn.00404820
jne 0x55a71d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x24]
cmp eax, 0x2710
jbe 0x55a72a
mov ecx, ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0055a38c
cmp byte [0x5d6d98], 0
jne 0x55a744
mov byte [0x5d6d98], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6d9c], eax
inc edi
dec esi
jne 0x55a60a
cmp dword [ebp - 8], 0
jne 0x55a759
mov byte [0x5d6d98], 0
cmp byte [0x5d6d98], 0
je 0x55a79c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d6d9c]
cmp eax, 0x249f0
jbe 0x55a79c
mov byte [0x5d6d98], 0
mov eax, 0x5d6bb8
mov edx, 0x55a804
call fcn.00404468
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.00557694
mov byte [0x5d6db9], 0
mov bl, byte [0x5d6d98]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a7c7
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404438
ret
Function at 0x560de0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.004074c4
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x560e2c
push 0
push 0
push 0x560e3c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_GetWindowInfo
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
cmp eax, 0x1e
jge 0x560e28
mov eax, 0x1e
mov esp, ebp
pop ebp
ret
Function at 0x56f678
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x56f89b
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x56f880
lea eax, [ebp - 4]
mov edx, dword [0x5d3260]
add edx, 0x35
call fcn.00404678
mov eax, dword [ebp - 4]
mov edx, dword [0x5d3cbc]
mov edx, dword [edx]
call fcn.00404820
je 0x56f6ec
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5d3250]
sub eax, dword [edx]
cmp eax, 0x3e8
jbe 0x56f880
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5d3250]
mov dword [edx], eax
call fcn.0056f5bc
jmp 0x56f880
mov eax, dword [0x5d379c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5d379c]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx edx, word [eax + 0x122]
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx eax, word [eax + 0x120]
call fcn.005c40a0
dec eax
jne 0x56f867
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
xor edx, edx
call fcn.005cf318
mov eax, dword [0x5d37a0]
mov eax, dword [eax]
call fcn.00535578
test al, al
je 0x56f880
mov eax, dword [0x5d37a0]
mov eax, dword [eax]
call fcn.00535678
test al, al
je 0x56f880
mov eax, dword [0x5d37a0]
mov eax, dword [eax]
call fcn.00535624
test al, al
je 0x56f880
mov esi, 0xbc7
mov eax, dword [ebx + 4]
push eax
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx edx, word [eax + 0x122]
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx eax, word [eax + 0x120]
mov ecx, dword [ebx]
call fcn.005c420c
mov edi, eax
and edi, 0xff
inc dword [ebx + 8]
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx eax, word [eax + 0x122]
push eax
push edi
push 0
push 0
push 0
push 0
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx ecx, word [eax + 0x120]
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
mov edx, esi
call fcn.005cc4e8
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx eax, word [eax + 0x122]
push eax
push edi
push 0
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
movzx ecx, word [eax + 0x120]
mov eax, dword [0x5d37a0]
mov eax, dword [eax]
mov edx, esi
call fcn.0053398c
push 0x56f8b4
lea edx, [ebp - 8]
mov eax, dword [ebx + 8]
call fcn.00408cf0
push dword [ebp - 8]
push 0x56f8c4
mov eax, dword [0x5d3368]
mov edx, 3
call fcn.00404794
mov eax, dword [0x5d3b10]
mov byte [eax], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5d3f30]
mov dword [edx], eax
mov eax, dword [0x5d340c]
mov byte [eax], 1
mov eax, dword [0x5d3cbc]
mov eax, dword [eax + 4]
cmp eax, dword [ebx + 8]
jg 0x56f880
mov eax, dword [0x5d379c]
xor edx, edx
mov dword [eax], edx
jmp 0x56f880
mov eax, dword [0x5d34c0]
mov eax, dword [eax]
cmp byte [eax + 0x119], 0
jne 0x56f880
mov eax, dword [0x5d379c]
xor edx, edx
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f8a2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404438
ret