joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e6864
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e69c5
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
test al, al
jne 0x5e69c3
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e69c5
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e69c5
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e69bf
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e6977
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 7
mov dx, 0xea
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e69c5
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e69cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e6b2d
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
test al, al
jne 0x5e6b2b
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e6b2d
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e6b2d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e6b27
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e6adf
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 8
mov dx, 0xea
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e6b2d
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e6b34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e6c76
mov byte [esp], 0
mov eax, 0xa
call fcn.00403484
test eax, eax
jne 0x5e6b6f
mov dl, 2
mov eax, esi
call fcn.005ea878
dec eax
jle 0x5e6b6f
mov byte [esp], 1
jmp 0x5e6b8d
lea ecx, [esp + 1]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.00660e38
test al, al
je 0x5e6b8d
movzx edi, byte [esp + 1]
mov byte [esp], 2
cmp byte [esp], 0
jbe 0x5e6c45
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e6c43
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esp]
dec al
je 0x5e6bdb
dec al
je 0x5e6c2a
dec al
je 0x5e6c0a
jmp 0x5e6c3c
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
push 3
push 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.005eaa20
jmp 0x5e6c3c
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
jmp 0x5e6c3c
mov ecx, edi
mov edx, dword [esi + 0x380]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.00667e24
mov bl, 1
test bl, bl
jne 0x5e6c76
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e6c6f
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e6c76
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5e6f88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e70a4
push 0x1391
mov edx, edi
mov cl, 4
mov eax, esi
call fcn.005e9e7c
test al, al
jne 0x5e70a2
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e70a4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e709e
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0xe
push 0
push 0x12c
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e70a4
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e76b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e789b
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [esi + 0xc28]
jbe 0x5e7782
call sub.kernel32.dll_GetTickCount_1
add eax, 0x7d0
mov dword [esi + 0xc28], eax
mov eax, 0xa
call fcn.00403484
cmp eax, 3
jge 0x5e7782
push 1
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.006758f8
test eax, eax
jle 0x5e7782
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dx, 0xe9
mov eax, esi
call fcn.006633cc
mov eax, 0x10
call fcn.00403484
mov ebx, eax
sub ebx, 8
add ebx, dword [esi + 0x24]
mov eax, 0x10
call fcn.00403484
sub eax, 8
add eax, dword [esi + 0x28]
push eax
push 2
mov ecx, ebx
mov edx, dword [esi + 0x2e0]
mov eax, esi
call fcn.00670890
mov bl, 1
jmp 0x5e789b
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e786e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e786a
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0x15
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e789b
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e7894
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e789b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e78a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e7a22
cmp byte [esi + 0xc20], 0
je 0x5e7913
cmp byte [esi + 0xc2c], 0
jne 0x5e7913
mov byte [esi + 0xc2c], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e7a22
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
test al, al
jne 0x5e7a20
cmp byte [esi + 0xc20], 0
je 0x5e7a22
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e7a22
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e7a1c
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0x16
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e7a22
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e7a28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e7b89
mov edx, 0x1391
mov eax, esi
call fcn.005e99c8
test al, al
jne 0x5e7b87
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e7b89
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e7b89
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e7b83
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e7b3b
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 1
mov dx, 0xea
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e7b89
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e7e34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e7fac
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e7f7f
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e7f7f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e7f7b
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e7f33
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 2
mov dx, 0xea
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e7fac
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5e7fa5
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e7fac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5e7fb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e81ba
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e8103
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e8103
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e80fc
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0066835c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e80b4
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 3
mov dx, 0xea
mov eax, esi
call fcn.006633cc
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e81ba
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x5e81b3
mov ebp, dword [esi + 0x380]
mov edi, dword [ebp + 0x24]
mov eax, dword [esi + 0x24]
sub eax, edi
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
cmp ecx, 4
jg 0x5e81a2
mov eax, dword [esi + 0x380]
push dword [eax + 0x24]
mov eax, dword [esi + 0x24]
pop edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp ecx, 4
jg 0x5e81a2
mov eax, dword [esi + 0x28]
push eax
mov edx, dword [ebp + 0x28]
mov eax, edi
mov ecx, dword [esi + 0x24]
call fcn.0049fed8
movzx eax, al
push eax
push 5
lea eax, [esi + 0xbec]
push eax
lea eax, [esi + 0xbf0]
push eax
mov edx, dword [esi + 0x380]
mov ecx, dword [edx + 0x28]
mov edx, dword [edx + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0067510c
mov ecx, dword [esi + 0xbf0]
mov edx, dword [esi + 0xbec]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e81ba
mov ecx, dword [ebp + 0x28]
mov edx, edi
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5e81ba
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e86b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5e88c7
mov dl, 2
mov eax, esi
call fcn.005ea878
dec eax
jle 0x5e88b7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e88b3
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, ebx
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
sub edx, 2
add eax, 2
sub eax, edx
jl 0x5e88ac
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
sub edx, 2
add eax, 2
sub eax, edx
jl 0x5e889e
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 0x2e0]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
call fcn.00673738
test al, al
je 0x5e8890
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5e8890
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5e8890
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbf0
test eax, eax
je 0x5e8882
cmp byte [eax], 1
jne 0x5e8882
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5e8882
cmp byte [ebx + 0x2e4], 0
jne 0x5e8882
cmp byte [ebx + 0x2ec], 0
jne 0x5e8882
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5e8882
cmp byte [ebx + 0x319], 0
je 0x5e8830
cmp byte [esi + 0x31b], 0
je 0x5e8882
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.00668380
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5e8882
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.00668730
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5e87d3
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5e8785
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5e8769
mov eax, esi
call fcn.00667e24
mov al, 1
jmp 0x5e88c7
push 0x1391
mov edx, ebx
mov cl, 2
mov eax, esi
call fcn.005e9e7c
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x5e88d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5e8a35
push 0x1391
mov edx, edi
mov cl, 2
mov eax, esi
call fcn.005e9e7c
test al, al
jne 0x5e8a33
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005ea2bc
test al, al
je 0x5e8a35
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0066a398
test al, al
je 0x5e8a35
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5e8a2f
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.006633cc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.0066b858
mov ebx, eax
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x190
mov cx, 5
mov dx, 0xea
mov eax, esi
call fcn.006633cc
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5e8a0c
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5e8a35
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret