joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466af4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x466b93
cmp dword [ebx + 0x94], 0
jne 0x466b8d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x466a7c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x466b8d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x466b53
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x466b8d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419d28
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x466b62
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x466dac
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x49bcd8]
cmp dword [eax + 0x30], 0
je 0x466f09
test bl, bl
jne 0x466e5a
cmp dword [esi + 0x9c], 0
jne 0x466e4f
mov eax, esi
call fcn.00469748
push eax
push 0x466cd8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x466e20
mov eax, dword [0x49bcd8]
call fcn.00469e28
test al, al
je 0x466e20
mov eax, dword [0x49bcfc]
call fcn.00405e44
mov edi, eax
cmp edi, 0
jl 0x466e20
push 0
mov eax, dword [0x49bcfc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x466e0a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x466e4f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00419d28
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x466e2f
inc dword [esi + 0x9c]
jmp 0x466f09
cmp dword [esi + 0x9c], 0
jle 0x466f09
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x466f09
cmp dword [esi + 0x44], 0
je 0x466eb5
mov eax, dword [0x49bcd8]
call fcn.00469e28
test al, al
je 0x466eb5
mov eax, dword [0x49bcfc]
call fcn.00405e44
mov edi, eax
cmp edi, 0
jl 0x466eb5
push 5
mov eax, dword [0x49bcfc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x466e9f
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x466ee4
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00419d28
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x466ec4
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x49bcfc
mov ecx, 1
mov edx, dword [0x466cb8]
call fcn.00405ff8
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4679d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x467a42
mov eax, ebx
call fcn.00469e28
test al, al
jne 0x467a42
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404bc4
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x467a2f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x467a4f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b28
jmp 0x467a4f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b28
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x468f4c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x468fba
mov eax, esi
call fcn.00451ac8
test al, al
je 0x468fba
mov eax, dword [ebx + 0x84]
call fcn.00451728
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x468fba
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x468fae
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451728
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044958c
jmp 0x468fba
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00468d88
pop esi
pop ebx
ret
Function at 0x46a404
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407ab4]
call fcn.004055f4
xor eax, eax
push ebp
push 0x46a5a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4959d0], 0
jne 0x46a45f
mov ecx, dword [0x4964f0]
mov dl, 1
mov eax, dword [0x4080b4]
call fcn.0040cdbc
call fcn.004044fc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004035bc
mov eax, ebx
call fcn.00405414
mov dword [ebp - 0x24], eax
mov esi, 0x46a5b4
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004066dc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405424
test eax, eax
jle 0x46a548
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46a534
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d44
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x46a4da
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404d5c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x46a4f0
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404d5c
mov eax, dword [ebp - 0x54]
call fcn.00404f64
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d44
mov eax, dword [ebp - 0x58]
call fcn.00404f64
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x46a536
xor eax, eax
test al, al
je 0x46a541
mov ebx, 0x15
jmp 0x46a54d
mov ebx, 0x10
jmp 0x46a54d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4959d0]
call fcn.0046a284
mov eax, dword [ebp - 4]
call fcn.0046a284
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004066f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a5ac
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404af8
lea eax, [ebp - 0xc]
mov edx, dword [0x407ab4]
call fcn.004056c4
ret
Function at 0x478dc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x478dee
mov eax, ebx
call fcn.00479874
cmp dword [ebx + 0x40], 0
je 0x478de7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x478e5f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x478e51
cmp dword [ebx + 8], 0
je 0x478e10
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x478e22
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x478e51
cmp dword [ebx + 8], 0
je 0x478e03
cmp eax, 3
je 0x478e35
dec eax
jne 0x478e03
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x478e03
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x478e03
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x478e7d
cmp dword [ebx + 0x14], 0xcc
je 0x478e7d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00478e88
pop ebx
ret

Function at 0x48ac3c
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x48acef
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x48ad04
mov edx, dword [0x49bf58]
call fcn.00404dec
mov eax, dword [ebp - 4]
call fcn.004099a0
test al, al
jne 0x48ac8b
mov eax, 0x48ad20
call fcn.0043bf84
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0
lea eax, [ebp - 8]
mov ecx, 0x48ad04
mov edx, dword [0x49bf58]
call fcn.00404dec
mov eax, dword [ebp - 8]
call fcn.00404f64
push eax
call sub.kernel32.dll_WinExec
push 0x48ad50
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
mov dword [ebx + 0x41c], esi
mov eax, dword [ebx + 0x3f4]
call fcn.00451728
push eax
push esi
call sub.user32.dll_SetParent
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48acf6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404af8
ret
Function at 0x48dae8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404f54
xor eax, eax
push ebp
push 0x48dc62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x48dc78
call fcn.00404efc
jne 0x48db8f
push 0
push 0
push 0
push 0x10
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
push 0
push 0
push 0
push 0xba
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
push 0
push 2
push 0
push 0xba
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
push 0
push 2
push 0
push 0x10
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
jmp 0x48dc44
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0048bbac
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48dbd4
push 0
push 0
push 0
push ebx
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
push 0
push 2
push 0
push ebx
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
jmp 0x48dc44
mov eax, dword [ebp - 4]
test eax, eax
je 0x48dbe0
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x48dc44
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
movzx edx, byte [edx + ecx - 1]
call fcn.00404cbc
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.0048bbac
mov ebx, eax
push 0
push 0
push 0
push ebx
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
mov eax, dword [0x4967ec]
mov eax, dword [eax]
call fcn.00467e8c
push 0
push 2
push 0
push ebx
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
inc dword [ebp - 8]
dec esi
jne 0x48dbed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dc69
lea eax, [ebp - 0xc]
call fcn.00404ad4
lea eax, [ebp - 4]
call fcn.00404ad4
ret
Function at 0x490c24
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x490d00
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x490d1c
push ebx
push 0x490d28
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404e68
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004035bc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
movzx eax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00409a4c
mov eax, dword [ebp - 0x5c]
call fcn.00404f64
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f64
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x490ce2
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490d07
lea eax, [ebp - 0x5c]
call fcn.00404ad4
lea eax, [ebp - 4]
call fcn.00404ad4
ret
Function at 0x5f35f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ax, sp
and al, 0x4e
push ebp
pushal
daa
sete al
or bp, 0xdeb8
mov dword [esp + 0x1c], esi
daa
dec bp
mov dword [esp + 0x18], edi
cmp al, al
mov dword [esp + 0x14], ebx
sbb bp, ax
cmc
btr ax, bp
mov dword [esp + 0x10], edx
shl al, cl
sub bp, sp
mov dword [esp + 0xc], edx
cmc
lea ebp, [esp + 0x28]
stc
bsr ax, bx
rol ax, 0xc
aaa
mov eax, dword [ebp]
mov byte [esp], dl
pushal
clc
test eax, eax
push 0xf9d0f75f
push 0xe55d1c2a
lea esp, [esp + 0x34]
je 0x63df88
stc
pushal
test dx, dx
mov esi, dword [eax + 0x3c]
inc dh
shld edx, ecx, 0x1d
adc dh, ch
shl dl, cl
add esi, eax
clc
bsf edx, esp
movzx dx, al
mov edx, dword [esi + 0x78]
mov byte [esp], al
call fcn.0063fc76
add byte [eax], al
inc edi
je 0x5f36dc
jns 0x5f36fe
je 0x5f36f2
insd dword es:[edi], dx
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x5f36d9
add byte [eax + 0x20], ch
shl dword [ecx], 1
xchg ebx, eax
call fcn.00644139
xchg edi, eax
mov dl, 0x29
cmc
scasb al, byte es:[edi]
cmp eax, 0x2e543325
dec ebp
retf
retf
and eax, dword [edi - 0x3b]
mov dl, 0x87
loopne 0x5f36d1
xchg eax, esp
out dx, al
ljmp 0x7f80:0xae99d58
lds eax, [edi + ebp*8 - 0x62c68fcc]
test dword [eax + 0x709a51d1], 0x9bb8c9e0
pop eax
invalid
jo 0x5f36e0
leave
mov eax, 0xecc5589b

Function at 0x63f060
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [esp], 0xff
pushal
jmp 0x6413ee
pushfd
push ebp
stc
push word [esp + 0xc]
popf
jmp 0x57d5a1
inc esi
call fcn.0063ed37
add byte [eax], al
inc edi
Function at 0x404860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x17c]
cmp eax, 0x64
jae 0x404884
call edi
sub eax, dword [esi + 0x17c]
cmp eax, 0x64
jb 0x404877
call edi
mov ecx, esi
mov dword [esi + 0x17c], eax
call fcn.00404ad0
mov ecx, dword [0x431308]
cmp ecx, 6
jne 0x4048ad
mov dword [esi + 0x174], 2
pop edi
xor al, al
pop esi
ret
cmp ecx, 3
jne 0x4049b3
mov al, byte [esi + 0x178]
test al, al
jne 0x404999
mov al, byte [esi + 0x179]
test al, al
jne 0x404999
mov al, byte [esi + 0x17a]
test al, al
jne 0x404999
lea ecx, [esi + 0xdc]
call fcn.00412140
test al, al
je 0x40492e
mov eax, dword [esi + 0x164]
mov ecx, dword [esi + 0x168]
mov edx, dword [esi + 0x154]
mov dword [esi + 0x15c], eax
mov eax, dword [esi + 0x158]
mov dword [esi + 0x16c], 0
mov dword [esi + 0x160], ecx
mov dword [esi + 0x164], edx
mov dword [esi + 0x168], eax
pop edi
mov al, 1
pop esi
ret
lea ecx, [esi + 0x104]
call fcn.00412140
test al, al
je 0x40497b
mov ecx, dword [esi + 0x164]
mov edx, dword [esi + 0x168]
mov dword [esi + 0x154], ecx
mov ecx, dword [esi + 0x15c]
mov dword [esi + 0x158], edx
mov edx, dword [esi + 0x160]
mov eax, 1
mov dword [esi + 0x164], ecx
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], edx
pop edi
pop esi
ret
lea ecx, [esi + 0x12c]
call fcn.00412140
test al, al
je 0x404929
mov dword [esi + 0x174], 2
pop edi
xor al, al
pop esi
ret
mov byte [esi + 0x17a], 0
mov byte [esi + 0x179], 0
mov byte [esi + 0x178], 0
pop edi
mov al, 1
pop esi
ret
mov eax, 1
cmp ecx, eax
jne 0x404a38
mov ecx, dword [0x4312f8]
mov edi, dword [0x4312fc]
cmp ecx, 0x2d0
jl 0x404a10
cmp ecx, 0x2e2
jge 0x404a10
cmp edi, 0x9c
jl 0x4049f0
cmp edi, 0xb6
jge 0x4049f0
mov byte [esi + 0x178], al
jmp 0x404a38
cmp ecx, 0x2e2
jge 0x404a10
cmp edi, 0x1c4
jl 0x404a10
cmp edi, 0x1de
jge 0x404a10
mov byte [esi + 0x179], al
jmp 0x404a38
mov edx, dword [esi + 0x164]
cmp ecx, edx
jl 0x404a38
add edx, 0x1a
cmp ecx, edx
jge 0x404a38
mov ecx, dword [esi + 0x168]
cmp edi, ecx
jl 0x404a38
add ecx, 0x1a
cmp edi, ecx
jge 0x404a38
mov byte [esi + 0x17a], al
mov cl, byte [esi + 0x178]
test cl, cl
je 0x404a66
mov edi, dword [esi + 0x168]
dec edi
mov ecx, edi
mov dword [esi + 0x168], edi
cmp ecx, 0xbc
jge 0x404acd
mov dword [esi + 0x168], 0xbc
pop edi
pop esi
ret
mov cl, byte [esi + 0x179]
test cl, cl
je 0x404a94
mov edi, dword [esi + 0x168]
inc edi
mov ecx, edi
mov dword [esi + 0x168], edi
cmp ecx, 0x1a6
jle 0x404acd
mov dword [esi + 0x168], 0x1a6
pop edi
pop esi
ret
mov cl, byte [esi + 0x17a]
test cl, cl
je 0x404acd
mov ecx, dword [0x431304]
cmp ecx, 0xbc
jge 0x404aba
mov ecx, 0xbc
pop edi
mov dword [esi + 0x168], ecx
pop esi
ret
cmp ecx, 0x1a6
jle 0x404ac7
mov ecx, 0x1a6
mov dword [esi + 0x168], ecx
pop edi
pop esi
ret
Function at 0x40c8d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 8]
cmp eax, 0x64
jae 0x40c8ee
call edi
sub eax, dword [esi + 8]
cmp eax, 0x64
jb 0x40c8e4
call edi
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0040c910
test al, al
pop edi
pop esi
setne al
ret

Function at 0x40d220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x88]
cmp eax, 0x64
jae 0x40d246
call edi
sub eax, dword [esi + 0x88]
cmp eax, 0x64
jb 0x40d239
call edi
mov dword [esi + 0x88], eax
mov al, byte [esi + 0x85]
test al, al
jne 0x40d2c4
push 0x26
lea ebx, [esi + 0x18]
push 0x70
push 0x58
push 0xb9
mov ecx, ebx
call fcn.004142f0
push 0x26
push 0x70
push 0x7e
push 0xb9
lea ecx, [esi + 0x2c]
call fcn.004142f0
push 0x26
push 0x70
push 0xa4
push 0xb9
lea ecx, [esi + 0x68]
call fcn.004142f0
push 0x26
push 0x70
push 0xca
push 0xb9
lea ecx, [esi + 0x40]
call fcn.004142f0
push 0x26
push 0x70
push 0xf0
push 0xb9
lea ecx, [esi + 0x54]
call fcn.004142f0
jmp 0x40d2ed
lea ebx, [esi + 0x18]
mov edi, 0x82
mov ebp, ebx
push 0x28
push 0x78
push edi
push 0x136
mov ecx, ebp
call fcn.004142f0
add edi, 0x2a
add ebp, 0x14
cmp edi, 0x12a
jl 0x40d2ce
mov ecx, esi
call fcn.0040d460
mov eax, dword [0x431308]
cmp eax, 3
jne 0x40d446
mov al, byte [esi + 0x85]
test al, al
jne 0x40d336
mov eax, dword [0x4312fc]
mov ecx, dword [0x4312f8]
push eax
push ecx
lea ecx, [esi + 0x68]
call fcn.00414310
test al, al
je 0x40d336
mov dword [esi + 0x8c], 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
xor edi, edi
mov ebp, ebx
mov edx, dword [0x4312fc]
mov eax, dword [0x4312f8]
push edx
push eax
mov ecx, ebp
call fcn.00414310
test al, al
jne 0x40d368
inc edi
add ebp, 0x14
cmp edi, 4
jl 0x40d33a
mov byte [esi + 0x85], al
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
mov al, byte [esi + 0x85]
test al, al
jne 0x40d39c
lea eax, [edi + 3]
cmp eax, 4
mov dword [esi + 0x8c], eax
je 0x40d387
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov ecx, esi
mov byte [esi + 0x85], 1
call fcn.0040db90
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
mov dword [esi + 0x90], edi
mov eax, dword [esi + edi*4 + 0x94]
test eax, eax
jl 0x40d452
cmp eax, 7
jg 0x40d452
mov eax, dword [esi + edi*4 + 0xa4]
test eax, eax
jle 0x40d452
mov eax, dword [esi + edi*4 + 0xb4]
test eax, eax
jle 0x40d452
mov eax, dword [esi + edi*4 + 0xd4]
test eax, eax
jle 0x40d452
mov eax, dword [esi + edi*4 + 0xe4]
test eax, eax
jl 0x40d452
mov dword [0x4312f4], 0
mov ecx, dword [esi + 0x90]
pop edi
mov edx, dword [esi + ecx*4 + 0x104]
mov dword [0x42fa1c], edx
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + eax*4 + 0x114]
mov dword [0x4312f0], ecx
mov edx, dword [esi + 0x90]
mov eax, dword [esi + edx*4 + 0x124]
mov dword [0x4312e8], eax
mov ecx, dword [esi + 0x90]
xor al, al
mov edx, dword [esi + ecx*4 + 0x134]
pop esi
pop ebp
mov dword [0x4312ec], edx
pop ebx
ret
cmp eax, 6
jne 0x40d452
mov byte [esi + 0x85], 0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x40e010
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x30]
cmp eax, 0x64
jae 0x40e031
call edi
sub eax, dword [esi + 0x30]
cmp eax, 0x64
jb 0x40e027
call edi
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.0040e1d0
test al, al
jne 0x40e1b3
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [0x431308]
cmp eax, 6
jne 0x40e06c
mov dword [esi + 0xc], 3
pop edi
xor al, al
pop esi
add esp, 0x28
ret
cmp eax, 3
jne 0x40e104
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [0x4312fc]
mov ecx, dword [0x4312f8]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.00410dd0
cmp ax, 0x7e0
jne 0x40e09e
mov dword [esi + 0x10], 1
jmp 0x40e104
cmp ax, 0xffff
jne 0x40e0ad
mov dword [esi + 0x10], 2
jmp 0x40e104
test ax, ax
jne 0x40e0bb
mov dword [esi + 0x10], 3
jmp 0x40e104
cmp ax, 0x7ff
jne 0x40e0ca
mov dword [esi + 0x10], 4
jmp 0x40e104
cmp ax, 0xffe0
jne 0x40e0d9
mov dword [esi + 0x10], 5
jmp 0x40e104
cmp ax, 0xf81f
jne 0x40e0e8
mov dword [esi + 0x10], 6
jmp 0x40e104
cmp ax, 0xf800
jne 0x40e0f7
mov dword [esi + 0x10], 7
jmp 0x40e104
cmp ax, 0x1f
jne 0x40e104
mov dword [esi + 0x10], 8
mov esi, dword [esi + 0x10]
test esi, esi
je 0x40e1b3
mov eax, dword [0x42f524]
mov edx, dword [str.0123456789abcdefg]
mov ecx, dword [0x42f528]
mov dword [esp + 0x20], eax
mov ax, word [0x42f530]
mov dword [esp + 0x1c], edx
mov edx, dword [0x42f52c]
mov dword [esp + 0x24], ecx
mov ecx, dword [str.pwav0_yx_x.wav]
mov word [esp + 0x2c], ax
mov eax, dword [0x42f8c8]
mov dword [esp + 0x28], edx
mov edx, dword [0x42f8c4]
mov dword [esp + 8], ecx
mov cx, word [0x42f8cc]
mov dword [esp + 0x10], eax
xor eax, eax
mov word [esp + 0x2e], 0
mov dword [esp + 0xc], edx
mov dl, byte [0x42f8ce]
mov word [esp + 0x14], cx
mov cl, byte [esp + esi + 0x1c]
mov dword [esp + 0x17], eax
mov byte [esp + 0x16], dl
mov byte [esp + 0x1b], al
mov byte [esp + 0xf], cl
call edi
xor edx, edx
mov ecx, 3
div ecx
lea eax, [esp + 8]
push 0x64
push eax
push 0
push 0
mov dl, byte [esp + edx + 0x2c]
mov byte [esp + 0x21], dl
call fcn.0040f8d0
add esp, 0x10
pop edi
mov al, 1
pop esi
add esp, 0x28
ret