joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489d0c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x541568
xor edx, edx
mov dl, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x489d1a
xor ebx, ebx
mov ecx, 0x541168
mov eax, ebx
mov edx, 8
test al, 1
je 0x489d4a
shr eax, 1
xor eax, esi
jmp 0x489d4c
shr eax, 1
dec edx
jne 0x489d40
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x489d39
pop esi
pop ebx
ret

Function at 0x489d60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x541168
mov ebx, 0xedb88200
test esi, esi
jne 0x489d7d
xor eax, eax
jmp 0x489e80
cmp dword [0x541164], 0
je 0x489d8b
call fcn.00489d0c
xor ebx, 0xffffffff
cmp edi, 8
jl 0x489e5b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x489d97
test edi, edi
je 0x489e7b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x489e5f
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49eb30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x49eb49
mov eax, dword [0x544dc0]
mov eax, dword [eax]
call fcn.0045da64
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x49eb3d
pop esi
pop ebx
ret
Function at 0x4ab0dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x544738]
cmp dword [eax], 0
je 0x4ab123
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x544f3c]
sub eax, dword [edx]
cmp eax, 0xea60
jbe 0x4ab123
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x544f3c]
mov dword [edx], eax
mov eax, dword [0x545074]
cmp dword [eax], 0
je 0x4ab123
mov edx, dword [0x545074]
mov edx, dword [edx]
mov eax, ebx
call fcn.004ab128
pop ebx
ret

Function at 0x4adfb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov eax, dword [0x544738]
mov eax, dword [eax]
imul edx, dword [eax + 0x3c], 0xe
mov eax, 0x172
call fcn.00470300
mov edx, dword [0x544738]
mov edx, dword [edx]
movsx edx, byte [edx + 0xc0]
mov ecx, dword [0x5446e8]
imul edx, dword [ecx]
add edx, eax
mov eax, 0x320
call fcn.00470300
mov edx, 0x578
mov ecx, dword [0x544734]
cmp byte [ecx], 0
je 0x4ae00e
mov ebx, edx
sub ebx, eax
add ebx, 0x5dc
jmp 0x4ae012
mov ebx, edx
sub ebx, eax
mov eax, dword [0x544aa4]
cmp byte [eax + 0xf], 0
je 0x4ae063
mov eax, dword [0x544738]
mov eax, dword [eax]
movzx eax, byte [eax + 0xa3]
imul ebx
mov dword [esp], eax
fild dword [esp]
fdiv dword [0x4ae090]
call fcn.0040333c
sub ebx, eax
mov eax, dword [0x544738]
mov eax, dword [eax]
movsx eax, word [eax + 0x2a2]
imul ebx
mov dword [esp], eax
fild dword [esp]
fdiv dword [0x4ae094]
call fcn.00403330
sub ebx, eax
test ebx, ebx
jge 0x4ae069
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x378]
cmp eax, ebx
jbe 0x4ae087
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x378], eax
mov al, 1
jmp 0x4ae089
xor eax, eax
pop edx
pop esi
pop ebx
ret
Function at 0x4ba5b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov eax, dword [ebp - 4]
call fcn.00405540
xor eax, eax
push ebp
push 0x4ba7cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [ebp - 9], 0
mov byte [ebp - 0xa], 0
mov eax, dword [0x544fd0]
mov eax, dword [eax]
call fcn.005380b0
xor eax, eax
push ebp
push 0x4ba7aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x544fd0]
mov eax, dword [eax]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4ba6d1
inc esi
mov dword [ebp - 8], 0
mov eax, dword [0x544fd0]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0041bce4
mov ebx, eax
cmp dword [ebx + 8], 0
jle 0x4ba6bf
xor edx, edx
mov eax, ebx
call fcn.0041bce4
mov eax, dword [eax]
movzx edx, word [edi + 6]
cmp eax, edx
jne 0x4ba6bb
xor edx, edx
mov eax, ebx
call fcn.0041bce4
mov eax, dword [eax + 4]
movzx edx, word [edi + 8]
cmp eax, edx
jne 0x4ba6bb
mov eax, dword [ebx + 8]
dec eax
test eax, eax
jl 0x4ba6b3
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041bce4
mov eax, dword [eax + 8]
cmp eax, dword [edi]
jne 0x4ba6ad
mov edx, esi
mov eax, ebx
call fcn.0041bce4
mov byte [eax + 0x28], 1
mov edx, esi
mov eax, ebx
call fcn.0041bce4
add eax, 0x2c
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, 0x2710
pop edx
mov dword [edx], eax
mov byte [ebp - 0xa], 1
jmp 0x4ba6b3
inc esi
dec dword [ebp - 0x10]
jne 0x4ba670
cmp byte [ebp - 0xa], 0
jne 0x4ba6d1
jmp 0x4ba6d1
xor ebx, ebx
jmp 0x4ba6c1
xor ebx, ebx
cmp byte [ebp - 9], 0
jne 0x4ba6d1
inc dword [ebp - 8]
dec esi
jne 0x4ba620
cmp byte [ebp - 0xa], 0
jne 0x4ba790
test ebx, ebx
jne 0x4ba6fb
mov dl, 1
mov eax, dword [0x419498]
call fcn.00404220
mov ebx, eax
mov eax, dword [0x544fd0]
mov eax, dword [eax]
mov edx, ebx
call fcn.0041bb74
mov edx, dword [0x47e6b0]
mov eax, 0x30
call fcn.004061bc
mov esi, eax
mov eax, dword [edi]
mov dword [esi + 8], eax
movzx eax, word [edi + 6]
mov dword [esi], eax
movzx eax, word [edi + 8]
mov dword [esi + 4], eax
movzx eax, word [edi + 0xa]
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0048e388
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x10]
call fcn.004050d4
mov eax, 0xbb8
call fcn.00403984
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
mov dword [esi + 0x14], eax
mov byte [esi + 0x20], 0
mov byte [esi + 0x28], 1
xor eax, eax
mov dword [esi + 0x24], eax
call sub.kernel32.dll_GetTickCount_1
sub eax, 0x2710
mov dword [esi + 0x2c], eax
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.0041bd68
mov eax, dword [0x544f94]
cmp byte [eax + 0x33], 0
je 0x4ba790
mov eax, dword [0x544bf4]
mov eax, dword [eax]
mov edx, esi
call fcn.005332e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba7b1
mov eax, dword [0x544fd0]
mov eax, dword [eax]
call fcn.005380bc
ret
Function at 0x4bd594
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4bd59c
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405540
xor eax, eax
push ebp
push 0x4bd712
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00405118
push 2
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x3a
mov byte [ebp - 0x22], 9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046fbf8
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.00405118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd719
lea eax, [ebp - 0x3c]
mov edx, 6
call fcn.004050a4
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004050a4
ret
Function at 0x4bdec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x44]
cmp eax, 0x1388
jbe 0x4bdf29
mov eax, dword [0x54488c]
cmp dword [eax], 0xffffffff
jne 0x4bdf29
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x44], eax
mov eax, dword [0x544db4]
cmp byte [eax], 0
je 0x4bdf29
mov eax, dword [0x54ddf8]
call fcn.004be058
test al, al
je 0x4bdf29
mov eax, dword [0x54ddf8]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.00435f84
mov eax, dword [0x54ddf8]
mov eax, dword [eax + 0x328]
xor edx, edx
call fcn.00461e58
mov eax, ebx
call fcn.0042256c
pop ebx
ret
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x48]
cmp eax, 0x3e8
jbe 0x4bdf88
mov eax, dword [0x54488c]
cmp dword [eax], 0xffffffff
jne 0x4bdf88
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x48], eax
mov eax, dword [0x544948]
cmp byte [eax], 0
je 0x4bdf88
call fcn.004bde08
test al, al
je 0x4bdf88
mov eax, dword [0x54ddf8]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.00435f84
mov eax, dword [0x54ddf8]
mov eax, dword [eax + 0x328]
xor edx, edx
call fcn.00461e58
mov eax, ebx
call fcn.0042256c
pop ebx
ret

Function at 0x4be8d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test ebx, ebx
jbe 0x4be987
mov eax, dword [0x544dd0]
cmp dword [eax], 0
jle 0x4be966
call sub.kernel32.dll_GetTickCount_1
push eax
mov eax, ebx
pop edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, dword [0x544dd0]
mov eax, dword [eax]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
cmp ecx, 0x5dc
jle 0x4be91f
mov eax, dword [0x544aa0]
inc dword [eax]
jmp 0x4be928
mov eax, dword [0x544aa0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x544aa0]
cmp dword [eax], 4
jle 0x4be987
xor edx, edx
mov eax, dword [esi + 0x328]
call fcn.00461e58
xor edx, edx
mov eax, dword [esi + 0x350]
call fcn.00435f84
mov eax, dword [0x5452a8]
mov eax, dword [eax]
mov cx, word [0x4be98c]
mov edx, 0x4be998
call fcn.004d5de0
jmp 0x4be987
mov eax, dword [0x544aa0]
xor edx, edx
mov dword [eax], edx
call sub.kernel32.dll_GetTickCount_1
push eax
mov eax, ebx
pop edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x544dd0]
mov dword [edx], eax
pop esi
pop ebx
ret
Function at 0x4bfe70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c0077
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x544dd8]
cmp byte [eax], 0
jne 0x4c0061
mov eax, dword [0x544f9c]
cmp byte [eax + 8], 0
jne 0x4c0061
mov eax, dword [0x544ed8]
cmp byte [eax], 0
je 0x4bff27
mov eax, dword [0x544de0]
mov eax, dword [eax + 0xb0]
mov edx, dword [0x5452a8]
mov edx, dword [edx]
cmp eax, dword [edx + 0x300]
jne 0x4bff27
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5449a0]
sub eax, dword [edx]
cmp eax, 0x64
jbe 0x4bff27
mov edi, 6
mov ebx, dword [0x545088]
mov esi, dword [0x5447f8]
mov eax, ebx
mov edx, esi
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004038f4
je 0x4bff13
push esi
push edi
mov edi, esi
mov esi, ebx
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esi, 0xa8
add ebx, 0xa8
dec edi
jne 0x4bfef4
jmp 0x4c0061
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x545060]
sub eax, dword [edx]
cmp eax, 0x1f4
jbe 0x4c0061
mov eax, dword [0x544ed8]
cmp byte [eax], 0
jne 0x4c0061
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x545060]
mov dword [edx], eax
mov edi, 6
mov ebx, dword [0x545088]
mov esi, dword [0x5447f8]
cmp byte [ebx], 0
je 0x4bff8f
mov eax, ebx
mov edx, esi
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004038f4
je 0x4bff8f
push esi
push edi
mov edi, esi
mov esi, ebx
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esi, 0xa8
add ebx, 0xa8
dec edi
jne 0x4bff6b
mov edi, 6
mov eax, dword [0x545088]
mov dword [ebp - 0x10], eax
mov esi, dword [0x5447f8]
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x4c004d
cmp byte [esi], 0
je 0x4c004d
mov byte [ebp - 9], 0
mov dword [ebp - 8], 0x28
mov ebx, dword [0x545088]
add ebx, 0x3f0
cmp byte [ebx], 0
je 0x4c000d
mov eax, ebx
mov edx, esi
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004038f4
jne 0x4c000d
mov eax, dword [ebp - 0x10]
push esi
push edi
mov edi, eax
mov esi, ebx
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov byte [ebx], 0
mov byte [ebp - 9], 1
jmp 0x4c0018
add ebx, 0xa8
dec dword [ebp - 8]
jne 0x4bffdd
cmp byte [ebp - 9], 0
jne 0x4c004d
call fcn.0052dfac
cmp eax, 0x28
jg 0x4c004d
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004052f4
mov eax, dword [ebp - 0x14]
call fcn.0052df08
test eax, eax
jl 0x4c004a
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004c0088
jmp 0x4c004d
mov byte [esi], 0
add esi, 0xa8
add dword [ebp - 0x10], 0xa8
dec edi
jne 0x4bffb1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c007e
lea eax, [ebp - 0x14]
call fcn.00405080
ret
Function at 0x4c0088
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c0191
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
sub eax, 0x2e
jae 0x4c017b
mov eax, dword [0x544f9c]
cmp byte [eax + 8], 0
jne 0x4c017b
mov eax, dword [0x544dd8]
cmp byte [eax], 0
je 0x4c00e4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5448ac]
sub eax, dword [edx]
cmp eax, 0x1388
jbe 0x4c00e4
mov eax, dword [0x544dd8]
mov byte [eax], 0
mov eax, dword [0x544dd8]
cmp byte [eax], 0
jne 0x4c017b
imul eax, edi, 0x15
mov edx, dword [0x545088]
cmp byte [edx + eax*8], 0
je 0x4c017b
imul eax, edi, 0x15
mov edx, dword [0x545088]
cmp byte [edx + eax*8 + 0x3e], 3
jbe 0x4c0121
imul eax, edi, 0x15
mov edx, dword [0x545088]
cmp byte [edx + eax*8 + 0x3e], 0x1f
jne 0x4c017b
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5448ac]
mov dword [edx], eax
imul ebx, edi, 0x15
mov eax, dword [0x545088]
mov edx, dword [0x544dd8]
push esi
push edi
lea esi, [eax + ebx*8]
mov edi, edx
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x545088]
mov byte [eax + ebx*8], 0
lea eax, [ebp - 4]
mov edx, dword [0x544dd8]
call fcn.004052f4
mov ecx, dword [ebp - 4]
mov edx, dword [0x544dd8]
mov edx, dword [edx + 0xa0]
mov eax, esi
call fcn.004ac408
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0198
lea eax, [ebp - 4]
call fcn.00405080
ret

Function at 0x4c01a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c02a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
sub eax, 0x28
jae 0x4c0293
mov eax, dword [0x544f9c]
cmp byte [eax + 8], 0
jne 0x4c0293
mov eax, dword [0x544ec0]
cmp byte [eax], 0
je 0x4c01fc
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x54499c]
sub eax, dword [edx]
cmp eax, 0x1388
jbe 0x4c01fc
mov eax, dword [0x544ec0]
mov byte [eax], 0
mov eax, dword [0x544ec0]
cmp byte [eax], 0
jne 0x4c0293
imul eax, edi, 0x15
mov edx, dword [0x54516c]
cmp byte [edx + eax*8], 0
je 0x4c0293
imul eax, edi, 0x15
mov edx, dword [0x54516c]
cmp byte [edx + eax*8 + 0x3e], 3
jbe 0x4c0239
imul eax, edi, 0x15
mov edx, dword [0x54516c]
cmp byte [edx + eax*8 + 0x3e], 0x1f
jne 0x4c0293
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x54499c]
mov dword [edx], eax
imul ebx, edi, 0x15
mov eax, dword [0x54516c]
mov edx, dword [0x544ec0]
push esi
push edi
lea esi, [eax + ebx*8]
mov edi, edx
mov ecx, 0x2a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x54516c]
mov byte [eax + ebx*8], 0
lea eax, [ebp - 4]
mov edx, dword [0x544ec0]
call fcn.004052f4
mov ecx, dword [ebp - 4]
mov edx, dword [0x544ec0]
mov edx, dword [edx + 0xa0]
mov eax, esi
call fcn.004ac4a8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c02b0
lea eax, [ebp - 4]
call fcn.00405080
ret
Function at 0x4c0320
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov eax, dword [0x544f94]
cmp dword [eax + 0x9c], 0
jl 0x4c03c9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x544558]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xa4]
cdq
cmp edx, dword [esp + 4]
jne 0x4c0368
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4c03c9
jmp 0x4c036c
pop edx
pop eax
jge 0x4c03c9
cmp byte [ebp - 1], 0
jne 0x4c038a
mov eax, dword [0x544738]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov edx, dword [0x544f94]
cmp eax, dword [edx + 0xa8]
jge 0x4c03c9
mov eax, dword [0x544f94]
mov eax, dword [eax + 0x9c]
call fcn.0052dff4
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jl 0x4c03c9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x544558]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004c0088
mov ebx, eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c03d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov eax, dword [0x544f94]
cmp dword [eax + 0xb8], 0
jl 0x4c0479
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5445f4]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xc0]
cdq
cmp edx, dword [esp + 4]
jne 0x4c0418
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4c0479
jmp 0x4c041c
pop edx
pop eax
jge 0x4c0479
cmp byte [ebp - 1], 0
jne 0x4c043a
mov eax, dword [0x544738]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov edx, dword [0x544f94]
cmp eax, dword [edx + 0xc4]
jge 0x4c0479
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xb8]
call fcn.0052dff4
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jl 0x4c0479
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5445f4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004c0088
mov ebx, eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c05f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov eax, dword [0x544f94]
cmp dword [eax + 0xa0], 0
jl 0x4c069d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x545244]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xac]
cdq
cmp edx, dword [esp + 4]
jne 0x4c063c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4c069d
jmp 0x4c0640
pop edx
pop eax
jge 0x4c069d
cmp byte [ebp - 1], 0
jne 0x4c065e
mov eax, dword [0x544738]
mov eax, dword [eax]
mov eax, dword [eax + 0x58]
mov edx, dword [0x544f94]
cmp eax, dword [edx + 0xb0]
jge 0x4c069d
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xa0]
call fcn.0052dff4
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jl 0x4c069d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x545244]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004c0088
mov ebx, eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c06a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
mov eax, dword [0x544f94]
cmp dword [eax + 0xbc], 0
jl 0x4c074d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5452c4]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xc8]
cdq
cmp edx, dword [esp + 4]
jne 0x4c06ec
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4c074d
jmp 0x4c06f0
pop edx
pop eax
jge 0x4c074d
cmp byte [ebp - 1], 0
jne 0x4c070e
mov eax, dword [0x544738]
mov eax, dword [eax]
mov eax, dword [eax + 0x58]
mov edx, dword [0x544f94]
cmp eax, dword [edx + 0xcc]
jge 0x4c074d
mov eax, dword [0x544f94]
mov eax, dword [eax + 0xbc]
call fcn.0052dff4
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jl 0x4c074d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5452c4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004c0088
mov ebx, eax
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret