joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e9e7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x380], 0
je 0x5ea08d
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [ebx + 0x2e0]
jne 0x5ea060
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5ea060
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5ea060
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004a3a1c
test al, al
je 0x5ea060
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5ea05a
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
push 1
mov ecx, dword [ebx + 0x112]
shr ecx, 0x10
movzx eax, word [ebx + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, ebx
call fcn.0066b858
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x5ea00e
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x2e0]
call fcn.0067510c
test al, al
je 0x5ea004
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2e0]
call fcn.00675478
mov edi, eax
test edi, edi
je 0x5ea004
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5ea004
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.00668380
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x5ea004
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.00668730
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [edi + 0x11e]
push eax
movzx eax, word [edi + 0x122]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x5e9f6a
cmp dword [ebp + 8], 0xc0
jne 0x5ea037
push 0
push 0
mov eax, dword [ebx + 0x380]
push eax
push 0
push 0
movzx ecx, byte [ebx + 0x2c]
mov dx, 0xc0
mov eax, ebx
call fcn.006633cc
jmp 0x5ea053
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
movzx ecx, word [ebp + 8]
mov dx, 0x9a
mov eax, ebx
call fcn.0066835c
mov eax, ebx
call fcn.00667e24
mov byte [ebp - 3], 1
jmp 0x5ea08d
mov eax, dword [ebx + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [ebx + 0x2e0]
jne 0x5ea086
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x5ea08d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5ea09c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 3], 0
cmp dword [ebx + 0x380], 0
je 0x5ea286
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [ebx + 0x2e0]
jne 0x5ea259
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5ea259
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ebp - 2]
cmp eax, edx
jg 0x5ea259
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.004a3a1c
test al, al
je 0x5ea259
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5ea253
movzx eax, byte [ebp - 1]
mov byte [ebx + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
push 0
push 0
mov eax, dword [ebx + 0x380]
push eax
push 0
push 0
movzx ecx, byte [ebp - 1]
mov dx, 0xc0
mov eax, ebx
call fcn.006633cc
push 1
mov ecx, dword [ebx + 0x112]
shr ecx, 0x10
movzx eax, word [ebx + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, ebx
call fcn.0066b858
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 2]
test esi, esi
jle 0x5ea24c
mov dword [ebp - 8], 1
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x2e0]
call fcn.0067510c
test al, al
je 0x5ea242
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2e0]
call fcn.00675478
mov edi, eax
test edi, edi
je 0x5ea242
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5ea242
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, edi
call fcn.0066853c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x5ea242
lea edx, [ebp - 0x18]
mov ecx, ebx
mov eax, edi
call fcn.00668730
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [edi + 0x11e]
push eax
movzx eax, word [edi + 0x122]
push eax
push ebx
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov eax, edi
mov edi, dword [eax]
call dword [edi + 0x18]
inc dword [ebp - 8]
dec esi
jne 0x5ea1a8
mov eax, ebx
call fcn.00667e24
mov byte [ebp - 3], 1
jmp 0x5ea286
mov eax, dword [ebx + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [ebx + 0x2e0]
jne 0x5ea27f
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x84]
jmp 0x5ea286
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5edbb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5edd84
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x5edd28
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.006778e4
xor eax, eax
push ebp
push 0x5edd09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x68]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x1e90]
cmp esi, dword [edi + 8]
jge 0x5edced
mov eax, edi
mov edx, esi
call fcn.0041fbf0
mov ebx, eax
test ebx, ebx
je 0x5edcc9
cmp byte [ebx + 0x2e4], 0
jne 0x5edc9e
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5edcc9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x36c]
cmp eax, dword [ebx + 0x368]
jbe 0x5edc7b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x36c], eax
mov eax, ebx
call fcn.00663e48
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5edcc9
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x370], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x5edcc9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0x493e0
jbe 0x5edcc9
mov eax, ebx
call fcn.00404430
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
mov edx, esi
call fcn.0041fa94
jmp 0x5edced
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x6c1080]
cmp eax, dword [edx]
jbe 0x5edce7
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], esi
mov byte [ebp - 0xd], 1
jmp 0x5edced
inc esi
jmp 0x5edc17
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edd10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e90]
call fcn.006778f0
ret
Function at 0x5ee724
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x5ee853
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edi, dword [eax + 8]
dec edi
sub edi, esi
jl 0x5ee83b
inc edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.0041fbf0
mov ebx, eax
test ebx, ebx
je 0x5ee815
cmp byte [ebx + 0x2e4], 0
jne 0x5ee7ea
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5ee815
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x36c]
cmp eax, dword [ebx + 0x368]
jbe 0x5ee7c7
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x36c], eax
mov eax, ebx
call fcn.00663e48
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x370]
cmp eax, dword [ebx + 0x374]
jle 0x5ee815
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x370], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x5ee815
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0x493e0
jbe 0x5ee815
mov eax, ebx
call fcn.00404430
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e94]
mov edx, esi
call fcn.0041fa94
jmp 0x5ee83b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov edx, dword [0x6c1080]
cmp eax, dword [edx]
jbe 0x5ee833
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], esi
mov byte [ebp - 0xd], 1
jmp 0x5ee83b
inc esi
dec edi
jne 0x5ee76e
cmp byte [ebp - 0xd], 0
jne 0x5ee849
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x6c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ee867
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed0], ebx
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x1ed4]
jbe 0x5ee88e
mov eax, dword [ebp - 4]
mov dword [eax + 0x1ed4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5eec08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5eed5d
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
xor edx, edx
push ebp
push 0x5eed12
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2c]
mov edx, dword [select]
cmp eax, dword [edx + 0x1a04]
jbe 0x5eec77
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push ebp
call fcn.005eeb50
pop ecx
mov eax, dword [0x6c10e4]
mov eax, dword [eax]
call fcn.004d08a0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x30]
cmp eax, 0x2710
jbe 0x5eecaa
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
call fcn.005ec1dc
mov edx, eax
mov eax, dword [0x6c0d50]
mov eax, dword [eax]
call fcn.004df308
cmp byte [0x6c01fc], 0
jne 0x5eed08
mov byte [0x6c01fc], 1
xor edx, edx
push ebp
push 0x5eecea
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6c13c4]
cmp dword [eax], 0
je 0x5eece0
mov eax, dword [0x6c13c4]
mov eax, dword [eax]
mov dl, 1
call fcn.00486634
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5eed08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5eed47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eed64
lea eax, [ebp - 8]
call fcn.00405394
ret
Function at 0x5f1c7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405814
xor eax, eax
push ebp
push 0x5f1e3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5f1e1c
inc edi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x10]
call fcn.0041fbf0
mov ebx, eax
test ebx, ebx
je 0x5f1e12
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055f8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00409e3c
test eax, eax
jne 0x5f1e12
test esi, esi
je 0x5f1e12
movzx eax, byte [ebx + 0xf]
mov byte [esi + 0x22a], al
movzx eax, byte [ebx + 0x10]
mov byte [esi + 0x22b], al
movzx eax, word [ebx + 0x11]
mov word [esi + 0x228], ax
movzx eax, word [ebx + 0x13]
mov word [esi + 0x34], ax
movzx eax, byte [ebx + 0x15]
mov byte [esi + 0x264], al
movzx eax, byte [ebx + 0x17]
mov byte [esi + 0x263], al
movzx eax, byte [ebx + 0x18]
mov byte [esi + 0x265], al
mov eax, dword [ebx + 0x1a]
mov dword [esi + 0x104], eax
movzx eax, word [ebx + 0x20]
mov word [esi + 0x4a], ax
movzx eax, word [ebx + 0x20]
mov word [esi + 0x4e], ax
mov word [esi + 0x4c], 0
movzx eax, word [ebx + 0x1e]
mov word [esi + 0x50], ax
movzx eax, word [ebx + 0x22]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x36], edx
movzx eax, word [ebx + 0x24]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x3a], edx
movzx eax, word [ebx + 0x26]
movzx edx, word [ebx + 0x28]
shl edx, 0x10
or eax, edx
mov dword [esi + 0x3e], eax
movzx eax, word [ebx + 0x2a]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x42], edx
movzx eax, word [ebx + 0x2c]
mov edx, eax
shl eax, 0x10
or edx, eax
mov dword [esi + 0x46], edx
movzx eax, byte [ebx + 0x2e]
mov byte [esi + 0x260], al
movzx eax, byte [ebx + 0x30]
mov byte [esi + 0x22c], al
mov eax, dword [ebx + 0x32]
mov dword [esi + 0xb48], eax
movzx eax, word [ebx + 0x36]
mov dword [esi + 0xb4c], eax
movzx eax, word [ebx + 0x38]
mov dword [esi + 0xb54], eax
movzx eax, word [ebx + 0x3a]
mov dword [esi + 0xb60], eax
mov eax, dword [ebx + 0x41]
mov dword [esi + 0xbac], eax
movzx eax, byte [ebx + 0x3c]
test al, al
jbe 0x5f1e0a
mov byte [esi + 0x292], al
mov eax, dword [ebx + 0x3d]
mov dword [ebp - 0xc], eax
jmp 0x5f1e1c
inc dword [ebp - 0x10]
dec edi
jne 0x5f1cc7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1e41
lea eax, [ebp - 0x14]
call fcn.00405394
lea eax, [ebp - 4]
call fcn.00405394
ret
Function at 0x5f2148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
mov eax, dword [ebp + 0x1ea4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f2233
mov eax, dword [ebp + 0x1ea4]
cmp dword [eax + 8], 0
jle 0x5f2233
mov edx, edi
call fcn.0041fbf0
mov ebx, eax
test ebx, ebx
je 0x5f2229
cmp dword [ebx], 0
je 0x5f2229
mov eax, dword [ebx]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5f21cd
mov edx, esi
mov eax, dword [ebx]
call fcn.0041fbf0
test eax, eax
je 0x5f21c7
cmp byte [eax + 0x2ec], 0
jne 0x5f21be
cmp byte [eax + 0x2e4], 0
jne 0x5f21be
cmp byte [eax + 0x2b4], 0
jne 0x5f21c7
mov edx, esi
mov eax, dword [ebx]
call fcn.0041fa94
dec esi
cmp esi, 0xffffffff
jne 0x5f2196
mov eax, dword [ebx]
cmp dword [eax + 8], 0
jle 0x5f21f1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
ja 0x5f21f1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
cmp eax, 0x2bf20
jbe 0x5f2229
mov eax, dword [ebx]
call fcn.00404430
xor esi, esi
cmp dword [ebx + esi*4 + 0xc], 0
je 0x5f220a
mov eax, dword [ebx + esi*4 + 0xc]
mov edx, dword [eax]
call dword [edx + 4]
inc esi
cmp esi, 8
jl 0x5f21fa
mov edx, 0x2c
mov eax, ebx
call fcn.00402fb0
mov eax, dword [ebp + 0x1ea4]
mov edx, edi
call fcn.0041fa94
dec edi
cmp edi, 0xffffffff
jne 0x5f2161
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f5bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0xc04]
cmp eax, 0xbb8
jbe 0x5f5c0b
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0xc04], eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.00675074
cmp eax, 2
jl 0x5f5bf2
mov byte [esi + 0xc09], 1
mov edx, dword [esi + 0x380]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
jne 0x5f5c0b
xor eax, eax
mov dword [esi + 0x380], eax
cmp byte [esi + 0xc09], 0
je 0x5f5c42
mov edi, dword [esi + 0x24]
mov ebp, dword [esi + 0x28]
mov eax, 8
call fcn.00403484
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.0066ae18
cmp edi, dword [esi + 0x24]
jne 0x5f5c39
cmp ebp, dword [esi + 0x28]
je 0x5f5c42
mov byte [esi + 0xc09], 0
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5f5c4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
mov edi, dword [esi + 0x380]
test edi, edi
je 0x5f5ce6
mov ecx, esp
mov edx, edi
mov eax, esi
call fcn.00660e38
test al, al
je 0x5f5cb9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5f5cb5
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx ecx, byte [esp]
mov edx, dword [esi + 0x380]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.00667e24
mov bl, 1
jmp 0x5f5ce6
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5f5cdf
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5f5ce6
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5f6378
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x2ec], 0
jne 0x5f63e0
cmp byte [ebx + 0xc08], 0
jne 0x5f63e0
cmp byte [ebx + 0x2e4], 0
jne 0x5f63e0
mov eax, ebx
call fcn.00661c1c
test al, al
je 0x5f63e0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x1f40
ja 0x5f63ce
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x3e8
jbe 0x5f63e0
cmp dword [ebx + 0x380], 0
jne 0x5f63e0
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x404], eax
mov eax, ebx
call fcn.006722b0
mov eax, ebx
call fcn.005f5cf0
pop ebx
ret

Function at 0x5f78a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
cmp byte [ebx + 0x2e4], 0
jne 0x5f79b1
cmp byte [ebx + 0x2ec], 0
jne 0x5f79b1
mov eax, ebx
call fcn.00661c1c
test al, al
je 0x5f79b1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x400]
cmp eax, dword [ebx + 0xb48]
jl 0x5f79b1
cmp byte [ebx + 0x31a], 0
je 0x5f7972
mov eax, dword [ebx + 0x414]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5f79b1
inc edi
xor ebp, ebp
mov edx, ebp
mov eax, dword [ebx + 0x414]
call fcn.0041fbf0
mov esi, dword [eax]
test esi, esi
je 0x5f796c
cmp byte [esi + 0x2ec], 0
jne 0x5f796c
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5f796c
cmp byte [esi + 0x319], 0
je 0x5f7943
cmp byte [ebx + 0x31b], 0
je 0x5f796c
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x5f796c
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x5f796c
mov eax, ebx
call fcn.005f7824
jmp 0x5f79b1
inc ebp
dec edi
jne 0x5f7908
jmp 0x5f79b1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x1f40
ja 0x5f799f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x3e8
jbe 0x5f79b1
cmp dword [ebx + 0x380], 0
jne 0x5f79b1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x404], eax
mov eax, ebx
call fcn.006722b0
mov eax, ebx
call fcn.005f5cf0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f857c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
cmp byte [ebx + 0x2ec], 0
jne 0x5f8726
cmp byte [ebx + 0xc08], 0
jne 0x5f8726
cmp byte [ebx + 0x2e4], 0
jne 0x5f8726
mov eax, ebx
call fcn.00661c1c
test al, al
je 0x5f8726
cmp byte [ebx + 0xc21], 0
je 0x5f8601
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x1f40
ja 0x5f85ef
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x404]
cmp eax, 0x3e8
jbe 0x5f8601
cmp dword [ebx + 0x380], 0
jne 0x5f8601
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x404], eax
mov eax, ebx
call fcn.006722b0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0xc18]
cmp eax, 0x2710
jbe 0x5f8726
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0xc18], eax
cmp byte [ebx + 0xc22], 0
je 0x5f869b
cmp dword [ebx + 0x380], 0
je 0x5f869b
mov eax, ebx
call fcn.006696c4
cmp eax, 5
jl 0x5f869b
lea ecx, [esp + 4]
mov edx, esp
mov eax, dword [ebx + 0x380]
call fcn.0066924c
push 0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x2e0]
call fcn.006739dc
test al, al
je 0x5f8687
mov eax, dword [esp + 4]
push eax
push 0
mov ecx, dword [esp + 8]
mov edx, dword [ebx + 0x2e0]
mov eax, ebx
call fcn.00670890
jmp 0x5f872d
xor ecx, ecx
mov edx, dword [ebx + 0x2e0]
mov eax, ebx
call fcn.00671ab8
jmp 0x5f872d
mov ecx, dword [ebx + 0xc24]
movzx eax, word [ebx + 0x122]
mov esi, 7
xor edx, edx
div esi
push eax
movzx eax, word [ebx + 0x11e]
pop edx
mov esi, edx
xor edx, edx
div esi
mov edx, 7
sub edx, eax
mov dword [ebx + 0xc24], edx
mov eax, dword [ebx + 0xc24]
cmp eax, 2
jl 0x5f86ee
cmp ecx, eax
je 0x5f86ee
mov byte [ebx + 0xc20], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0xc1c], eax
cmp byte [ebx + 0xc20], 0
je 0x5f8726
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0xc1c]
cmp eax, 0x1f40
jae 0x5f8715
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x9c]
jmp 0x5f8726
mov byte [ebx + 0xc20], 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, ebx
call fcn.005f5cf0
pop ecx
pop edx
pop esi
pop ebx
ret