joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5667f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov ebp, dword [0x586a98]
xor ebx, ebx
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5d0], 1
jne 0x5668eb
mov eax, dword [0x586404]
mov eax, dword [eax]
cmp dword [eax + 0x5b0], 2
jl 0x5668eb
mov eax, dword [ebp]
mov byte [eax + 0x92], 0
mov eax, dword [ebp]
mov byte [eax + 0x91], 1
mov eax, dword [ebp]
mov byte [eax + 0x90], 1
mov eax, dword [ebp]
mov edx, 0x5668fc
call fcn.00512050
call fcn.004b9988
mov edi, eax
jmp 0x5668c7
push 0x12c
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp]
cmp byte [eax + 0x92], 0
je 0x5668b9
mov eax, dword [ebp]
cmp byte [eax + 0x91], 0
jne 0x566888
mov eax, dword [ebp]
cmp byte [eax + 0x90], 0
jne 0x5668a0
mov eax, dword [ebp]
cmp byte [eax + 0x91], 0
je 0x5668b9
mov eax, dword [ebp]
cmp byte [eax + 0x90], 0
jne 0x5668b9
mov eax, dword [ebp]
mov edx, 0x56690c
call fcn.00512050
push 0x1f4
call sub.kernel32.dll_Sleep_2
jmp 0x5668cd
call fcn.004b9988
sub eax, edi
cmp eax, 0x3e8
ja 0x5668cd
cmp byte [esi + 0xd], 0
je 0x56685a
mov eax, dword [ebp]
cmp byte [eax + 0x92], 0
je 0x5668e5
mov eax, dword [ebp]
cmp byte [eax + 0x91], 0
jne 0x5668e9
xor ebx, ebx
jmp 0x5668eb
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56a8e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov edx, dword [0x50ad94]
call fcn.00405e14
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x56aa65
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
mov dl, 1
mov eax, dword [0x41b508]
call fcn.004041b0
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x56aa42
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00514a6c
jmp 0x56aa1f
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dea4
mov ebx, eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebx]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005170b8
cmp byte [ebp - 0x19], 0
jne 0x56aa09
cmp byte [ebp - 0x16], 0x6b
jne 0x56aa09
cmp dword [ebx + 8], 0xa
jl 0x56aa09
mov eax, dword [ebx + 8]
mov edx, dword [edi]
cmp eax, dword [edx + 0xe4]
jl 0x56a9a7
mov eax, dword [edi]
movzx ecx, word [eax + 0xe4]
movzx edx, word [ebx + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00510fe8
jmp 0x56a9c9
mov eax, dword [ebx + 8]
mov ecx, 0xa
cdq
idiv ecx
mov ecx, eax
add ecx, ecx
lea ecx, [ecx + ecx*4]
movzx edx, word [ebx + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00510fe8
call fcn.004b9988
mov esi, eax
jmp 0x56a9fd
push 0x64
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
ja 0x56aa05
lea ecx, [ebp - 0x54]
movzx edx, word [ebx]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050d5c8
test al, al
jne 0x56aa05
mov eax, dword [edi]
cmp byte [eax + 0xd], 0
je 0x56a9d2
mov byte [ebp - 0x19], 1
mov edx, 0x34
mov eax, ebx
call fcn.00402f6c
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dd98
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
jg 0x56a944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56aa49
mov eax, dword [ebp - 0x20]
call fcn.004041e0
ret
Function at 0x56aa78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov edx, dword [0x50ad94]
call fcn.00405e14
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x56abf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
mov dl, 1
mov eax, dword [0x41b508]
call fcn.004041b0
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x56abd6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.0051b834
jmp 0x56abb3
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dea4
mov ebx, eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebx]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005170b8
cmp byte [ebp - 0x19], 0
jne 0x56ab9d
cmp byte [ebp - 0x16], 0x6b
jne 0x56ab9d
cmp dword [ebx + 8], 0xa
jl 0x56ab9d
mov eax, dword [ebx + 8]
mov edx, dword [edi]
cmp eax, dword [edx + 0xe4]
jl 0x56ab3b
mov eax, dword [edi]
movzx ecx, word [eax + 0xe4]
movzx edx, word [ebx + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511044
jmp 0x56ab5d
mov eax, dword [ebx + 8]
mov ecx, 0xa
cdq
idiv ecx
mov ecx, eax
add ecx, ecx
lea ecx, [ecx + ecx*4]
movzx edx, word [ebx + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511044
call fcn.004b9988
mov esi, eax
jmp 0x56ab91
push 0x64
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
ja 0x56ab99
lea ecx, [ebp - 0x54]
movzx edx, word [ebx]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050d5c8
test al, al
jne 0x56ab99
mov eax, dword [edi]
cmp byte [eax + 0xd], 0
je 0x56ab66
mov byte [ebp - 0x19], 1
mov edx, 0x34
mov eax, ebx
call fcn.00402f6c
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dd98
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
jg 0x56aad8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56abdd
mov eax, dword [ebp - 0x20]
call fcn.004041e0
ret
Function at 0x56acc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56add7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00513bf4
test al, al
je 0x56ad07
push 0x32
call sub.kernel32.dll_Sleep_2
call fcn.0040c448
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 0x56adf4
call fcn.0040d048
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x56ae04
call fcn.004054c0
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.0050fbf0
call fcn.004b9988
mov esi, eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x56adb3
push 0x32
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00515954
mov ebx, eax
mov byte [edi], bl
test bl, bl
je 0x56ad7f
lea eax, [edi + 4]
mov edx, dword [ebp - 4]
call fcn.004051fc
mov byte [ebp - 0xd], 1
jmp 0x56adbc
call fcn.004b9988
sub eax, esi
cmp eax, 0x7d0
ja 0x56adbc
call fcn.004b9988
sub eax, esi
cmp eax, 0x3e8
jbe 0x56adb3
cmp dword [ebp - 0x14], 0
jne 0x56adb3
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.0050fbf0
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
je 0x56ad50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56adde
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051cc
ret
Function at 0x56ae60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050e874
cmp eax, 0x3c
jl 0x56b022
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511bf8
test al, al
je 0x56af33
mov eax, dword [ebp - 4]
cmp dword [eax + 0x184], 1
je 0x56af33
lea ecx, [ebp - 0x3c]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, 4
call fcn.0050c9b0
test al, al
je 0x56aec5
cmp dword [ebp - 0x20], 5
jg 0x56b022
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050e8f4
mov ebx, eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050b184
add ebx, eax
cmp ebx, 0x19
jl 0x56b022
lea edx, [ebp - 0x3c]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 0xa
call fcn.0050b4a4
test al, al
jne 0x56b022
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056e9d0
test al, al
je 0x56b022
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056bb48
mov eax, dword [ebp - 8]
call fcn.004041e0
jmp 0x56b022
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511bf8
test al, al
je 0x56af53
mov eax, dword [ebp - 4]
cmp dword [eax + 0x184], 1
jne 0x56b022
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056e9d0
test al, al
jne 0x56afb8
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511bf8
test al, al
jne 0x56b022
mov eax, dword [ebp - 4]
cmp dword [eax + 0x180], 0
jne 0x56af9a
call fcn.004b9988
mov edx, dword [ebp - 4]
mov dword [edx + 0x180], eax
jmp 0x56b022
call fcn.004b9988
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x180]
cmp eax, 0xdbba0
jbe 0x56b022
push ebp
call fcn.0056ae08
pop ecx
jmp 0x56b022
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056c934
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.004041e0
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.00511bf8
test al, al
jne 0x56b022
test bl, bl
jne 0x56b01b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x180], 0
jne 0x56affd
call fcn.004b9988
mov edx, dword [ebp - 4]
mov dword [edx + 0x180], eax
jmp 0x56b022
call fcn.004b9988
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x180]
cmp eax, 0xdbba0
jbe 0x56b022
push ebp
call fcn.0056ae08
pop ecx
jmp 0x56b022
push ebp
call fcn.0056ae08
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56d3f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x56d60f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x56d5ec
lea edx, [ebp - 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.005100f0
test al, al
je 0x56d4fa
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x56d4fa
lea edx, [ebp - 0x10]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050f318
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050da60
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov edx, 0x56d62c
call fcn.00521e50
call fcn.004b9988
mov esi, eax
xor ebx, ebx
jmp 0x56d4f1
push 0x64
call sub.kernel32.dll_Sleep_2
call fcn.004b9988
sub eax, esi
cmp eax, 0xbb8
ja 0x56d4fa
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.005111c4
test eax, eax
je 0x56d4fa
call fcn.004b9988
sub eax, esi
cmp eax, 0x4b0
jbe 0x56d4f1
test ebx, ebx
jne 0x56d4f1
lea edx, [ebp - 0x14]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050f318
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050da60
inc ebx
mov eax, dword [ebp - 8]
cmp byte [eax + 0xd], 0
je 0x56d49b
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.005111c4
test eax, eax
jne 0x56d5ec
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x56d5ec
call fcn.004b9988
mov esi, eax
xor ebx, ebx
jmp 0x56d5df
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x14]
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.004064c4
mov edx, eax
lea ecx, [ebp - 0x18]
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, 0x56d648
mov edx, 2
call fcn.0050fc98
push 0x7d0
call sub.kernel32.dll_Sleep_2
inc ebx
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x14]
imul eax, eax, 0x1f4
add eax, 0x1388
cdq
push edx
push eax
call fcn.004b9988
sub eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x56d5c8
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x56d5cc
jmp 0x56d5ec
pop edx
pop eax
jg 0x56d5ec
lea edx, [ebp - 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.005100f0
test al, al
jne 0x56d5ec
mov eax, dword [ebp - 8]
cmp byte [eax + 0xd], 0
je 0x56d536
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d616
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004051cc
lea eax, [ebp - 4]
call fcn.004051a8
ret
Function at 0x570c7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405628
mov esi, dword [0x586a98]
xor eax, eax
push ebp
push 0x570e0e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [esi]
mov byte [eax + 0x34c], 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x570e28
mov eax, 0x570e38
call fcn.004b8700
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x198]
call fcn.00405474
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, 2
call fcn.0050fc98
mov eax, dword [esi]
add eax, 0x350
mov edx, dword [ebp - 4]
call fcn.004051fc
call fcn.004b9988
mov edi, eax
jmp 0x570d29
push 0x32
call sub.kernel32.dll_Sleep_2
mov eax, dword [esi]
cmp byte [eax + 0x34c], 0
jne 0x570d35
call fcn.004b9988
sub eax, edi
cmp eax, 0x1f4
ja 0x570d35
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
je 0x570d09
mov eax, dword [esi]
cmp byte [eax + 0x34c], 0
je 0x570deb
call fcn.004b9988
mov edi, eax
jmp 0x570ddb
push 0x64
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 8]
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0051828c
test al, al
je 0x570d74
mov eax, dword [ebp - 8]
call fcn.004041e0
mov bl, 1
jmp 0x570deb
call fcn.004b9988
sub eax, edi
cmp eax, 0x2710
jbe 0x570ddb
mov eax, dword [esi]
cmp dword [eax + 0x348], 2
jne 0x570deb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x14]
mov eax, dword [esi]
call fcn.005127b8
push dword [ebp - 0x14]
push 0x570e4c
push 0x570e60
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040553c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x194]
mov ecx, dword [eax]
call dword [ecx + 0x74]
jmp 0x570deb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
je 0x570d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570e15
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004051cc
lea eax, [ebp - 4]
call fcn.004051a8
ret
Function at 0x570e68
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x570e70
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [0x586a98]
xor eax, eax
push ebp
push 0x571089
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
mov eax, dword [eax + 0x348]
dec eax
je 0x570ea2
dec eax
je 0x570eb9
jmp 0x570ece
push ebp
lea eax, [ebp - 0x14]
call fcn.005706dc
pop ecx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.00405240
jmp 0x570ece
push ebp
lea eax, [ebp - 0x18]
call fcn.00570990
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00405240
cmp dword [ebp - 8], 0
jne 0x570ee3
mov eax, 0x5710a0
call fcn.004b8ff8
jmp 0x571066
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x5710bc
call fcn.004054c0
mov eax, dword [ebp - 0x1c]
call fcn.004b8ff8
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050c648
mov ebx, eax
add ebx, ebx
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050f20c
add ebx, eax
mov dword [ebp - 0xc], ebx
mov edi, 3
push ebp
mov eax, dword [ebp - 8]
call fcn.00570c7c
pop ecx
test al, al
je 0x570f8f
mov eax, dword [esi]
cmp byte [eax + 0x3a4], 0
jne 0x571066
call fcn.004b9988
mov ebx, eax
jmp 0x570f78
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [esi]
cmp dword [eax + 0x350], 0
je 0x570f81
lea ecx, [ebp - 0x10]
mov eax, dword [esi]
mov edx, dword [ebp - 8]
call fcn.0051828c
test al, al
je 0x570f81
call fcn.004b9988
sub eax, ebx
cmp eax, 0x2710
ja 0x570f81
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x570f47
mov eax, dword [esi]
cmp dword [eax + 0x350], 0
je 0x570f8f
dec edi
jne 0x570f21
mov eax, dword [esi]
cmp dword [eax + 0x350], 0
jne 0x571066
mov eax, dword [esi]
cmp dword [eax + 0x348], 2
jne 0x571004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov edx, dword [ebp - 8]
call fcn.005705d0
test al, al
jne 0x571004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x24]
mov eax, dword [esi]
call fcn.005127b8
push dword [ebp - 0x24]
push 0x5710cc
push 0x5710e0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040553c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov ecx, dword [eax]
call dword [ecx + 0x74]
call fcn.004b9988
mov ebx, eax
jmp 0x57105d
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050c648
mov esi, eax
add esi, esi
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050f20c
add esi, eax
mov eax, esi
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x57104b
cmp eax, dword [esp]
pop edx
pop eax
jae 0x57104f
jmp 0x571066
pop edx
pop eax
jl 0x571066
call fcn.004b9988
sub eax, ebx
cmp eax, 0x7d0
ja 0x571066
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x57100d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571090
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004051cc
lea eax, [ebp - 8]
call fcn.004051a8
ret
Function at 0x5710e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov esi, eax
xor eax, eax
push ebp
push 0x57128f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5712a8
push 0
push 1
call sub.kernel32.dll_GetCurrentProcessId
mov edx, eax
mov ecx, 0x5712b8
mov eax, esi
call fcn.004b982c
mov ebx, eax
test ebx, ebx
jne 0x57114e
push 0x5712a8
push 0
push 1
call sub.kernel32.dll_GetCurrentProcessId
mov edx, eax
mov ecx, 0x5712c8
mov eax, esi
call fcn.004b982c
mov ebx, eax
test ebx, ebx
je 0x5711f8
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x28]
mov eax, 4
call fcn.0040a11c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5712d8
call fcn.004054c0
mov eax, dword [ebp - 0x24]
call fcn.004b8ff8
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_GetCursorPos
add ebx, 5
push ebx
mov eax, dword [ebp - 8]
add eax, 5
push eax
call sub.user32.dll_SetCursorPos
push 1
push esi
call sub.user32.dll_ShowWindow
push 1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.user32.dll_SetWindowPos
push 0
push 0
push 0
push 0
push 6
call sub.user32.dll_mouse_event
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetCursorPos
push 0x5712a8
push 0
push 1
call sub.kernel32.dll_GetCurrentProcessId
mov edx, eax
mov ecx, 0x5712f0
mov eax, esi
call fcn.004b982c
mov ebx, eax
test ebx, ebx
je 0x571268
push 0xc8
call sub.kernel32.dll_Sleep_2
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x30]
mov eax, 8
call fcn.0040a11c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x571300
call fcn.004054c0
mov eax, dword [ebp - 0x2c]
call fcn.004b8ff8
mov eax, dword [0x586a98]
mov eax, dword [eax]
mov dword [eax + 0x39c], ebx
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005203e4
mov bl, 1
mov eax, 0x571318
call fcn.004b8ff8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571296
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.004051cc
ret
Function at 0x574420
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov esi, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x50ad94]
call fcn.00405e14
xor eax, eax
push ebp
push 0x574693
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b508]
call fcn.004041b0
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x574670
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050c5bc
jmp 0x57464d
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dea4
mov edi, eax
cmp byte [esi + 0xc8], 0
je 0x574496
cmp dword [edi + 4], 0x16
jl 0x5744ad
cmp byte [esi + 0xc8], 0
jne 0x5745a2
cmp dword [edi + 4], 0x16
jl 0x5745a2
movzx eax, word [edi]
mov word [ebp - 0x26], ax
lea ecx, [ebp - 0x18]
mov edx, dword [edi]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005170b8
mov edx, edi
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00521240
mov ebx, eax
xor bl, 1
test bl, bl
je 0x574637
cmp dword [ebp - 0x1c], 0
jne 0x574637
cmp byte [esi + 0xc8], 0
je 0x574506
lea eax, [ebp - 0x5c]
mov cl, 1
mov edx, 2
call fcn.005742f8
test al, al
jne 0x57452a
cmp byte [esi + 0xc8], 0
jne 0x574637
lea eax, [ebp - 0x5c]
mov cl, 1
mov edx, 1
call fcn.005742f8
test al, al
je 0x574637
mov edx, dword [edi + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.0050f2cc
call fcn.004b9988
mov dword [ebp - 0x24], eax
jmp 0x574597
push 0xa
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x5c]
mov edx, dword [edi + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
call fcn.0050d67c
test al, al
je 0x57456c
movzx eax, word [ebp - 0x26]
cmp eax, dword [ebp - 0x5c]
je 0x574584
movzx eax, byte [ebp - 0x16]
dec eax
sub al, 5
jae 0x574637
mov word [esi + 0x58], 0
jmp 0x574637
call fcn.004b9988
sub eax, dword [ebp - 0x24]
cmp eax, 0xc8
ja 0x574637
cmp byte [esi + 0xd], 0
je 0x574546
jmp 0x574637
cmp byte [esi + 0xc8], 0
je 0x5745b1
cmp dword [edi + 4], 0x16
jge 0x5745c0
cmp byte [esi + 0xc8], 0
jne 0x574637
cmp dword [edi + 4], 0x16
jge 0x574637
lea ecx, [ebp - 0x18]
mov edx, dword [edi]
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.005170b8
mov edx, edi
mov eax, dword [0x586a98]
mov eax, dword [eax]
call fcn.00521240
test al, al
je 0x574637
cmp byte [esi + 0xc8], 0
je 0x5745ff
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 1
call fcn.005742f8
test al, al
jne 0x57461b
cmp byte [esi + 0xc8], 0
jne 0x574637
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 2
call fcn.005742f8
test al, al
je 0x574637
mov edx, dword [edi + 4]
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.0050f2cc
push 0xc8
call sub.kernel32.dll_Sleep_2
mov edx, 0x34
mov eax, edi
call fcn.00402f6c
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.0041dd98
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
jg 0x57447b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574677
mov eax, dword [ebp - 0x20]
call fcn.004041e0
ret
Function at 0x574cf4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call fcn.004b9988
mov ebx, eax
jmp 0x574d2e
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5865d0]
mov eax, dword [eax]
mov edx, esi
call fcn.0050d8c8
cmp edi, eax
jg 0x574d3a
call fcn.004b9988
sub eax, ebx
cmp eax, 0x3e8
ja 0x574d3a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
je 0x574d07
pop edi
pop esi
pop ebx
pop ebp
ret