joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6ed0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
cmp dword [0x121098c], 0
jge 0x4a6eff
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a7046
mov eax, dword [0x121098c]
movsx ecx, word [eax*4 + 0x608078]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x121098c]
movsx eax, word [edx*4 + 0x60807a]
mov dword [ebp - 4], eax
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.00458220
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4a7032
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x4a7032
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x4a7032
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x4a7032
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a6fab
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x14], edx
jmp 0x4a6fb4
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edx, dword [0x6bdfcc]
add edx, 0x1f4
cmp edx, dword [ebp - 0x14]
jae 0x4a701c
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov eax, dword [0xfd5768]
push eax
call fcn.00585f40
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a700a
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4a7013
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [0x6bdfcc], edx
push 0xf0
push 0x140
push 0x33
call fcn.005af300
add esp, 0xc
jmp 0x4a7046
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4a7050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
cmp dword [0x121098c], 0
jge 0x4a707f
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a71fe
mov eax, dword [0x121098c]
movsx ecx, word [eax*4 + 0x608078]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x121098c]
movsx eax, word [edx*4 + 0x60807a]
mov dword [ebp - 4], eax
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.00458220
add esp, 0xc
mov dword [ebp - 0xc], eax
push 8
mov eax, dword [ebp - 4]
shl eax, 1
push eax
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.00458220
add esp, 0xc
mov dword [ebp - 0x10], eax
movsx edx, word [0x120e5d4]
cmp edx, 1
je 0x4a7116
cmp dword [ebp - 0xc], 1
je 0x4a7116
cmp dword [ebp - 0x10], 1
jne 0x4a71d9
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x4a71c3
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x4a71c3
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x4a71c3
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a7168
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4a7171
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov edx, dword [0x6bdfcc]
add edx, 0x1f4
cmp edx, dword [ebp - 0x18]
jae 0x4a71c3
mov eax, dword [0xfd5768]
push eax
call fcn.00586fc0
add esp, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a71b1
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x1c], edx
jmp 0x4a71ba
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [0x6bdfcc], edx
push 0xf0
push 0x140
push 0x33
call fcn.005af300
add esp, 0xc
jmp 0x4a71fe
push 0
push 4
push 0x5ee5e0
call fcn.00461de0
add esp, 0xc
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4a7210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
cmp dword [0x121098c], 0
jge 0x4a723f
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a73c4
mov eax, dword [0x121098c]
movsx ecx, word [eax*4 + 0x608078]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x121098c]
movsx eax, word [edx*4 + 0x60807a]
mov dword [ebp - 4], eax
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0xca9a20
call fcn.005b75e0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0xca99f0
call fcn.005b75e0
push eax
call fcn.00458220
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4a73b0
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x4a73b0
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x4a73b0
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x4a73b0
mov eax, dword [0x1286220]
imul eax, eax, 0x30
mov ecx, dword [eax + 0x1286284]
and ecx, 1
je 0x4a7389
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a7302
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x14], edx
jmp 0x4a730b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edx, dword [0x6bdfcc]
add edx, 0x1f4
cmp edx, dword [ebp - 0x14]
jae 0x4a7373
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov eax, dword [0xfd5768]
push eax
call fcn.00586180
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4a7361
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4a736a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [0x6bdfcc], edx
push 0xf0
push 0x140
push 0x33
call fcn.005af300
add esp, 0xc
jmp 0x4a73ae
push 0
push 4
push 0x5ee5f4
call fcn.00461de0
add esp, 0xc
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
jmp 0x4a73c4
push 0xf0
push 0x140
push 0x37
call fcn.005af300
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x515140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00515420
push 0x5f2520
push 0x5f2524
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x515177
call fcn.00515420
xor eax, eax
jmp 0x515271
push 0x180
push 0x102
push 0x5f2538
call fcn.005cf5f6
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5151b6
mov eax, dword [ebp - 0x10]
push eax
call fcn.005cf4f7
add esp, 4
mov dword [0xd283bc], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005cf42a
add esp, 4
jmp 0x5151ce
call fcn.00515420
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x515271
mov eax, dword [ebp - 4]
push eax
call fcn.005ce984
add esp, 4
test eax, eax
je 0x5151f3
call fcn.00515420
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x515271
mov edx, dword [ebp - 4]
push edx
push 0x50f4
push 1
push 0xd22a70
call fcn.005cdfc1
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.005ce984
add esp, 4
test eax, eax
je 0x515233
call fcn.00515420
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
xor eax, eax
jmp 0x515271
cmp dword [0xd22a70], 0x13
jne 0x515246
call fcn.00515610
cmp eax, 1
jne 0x51524d
call fcn.00515420
jmp 0x515260
call fcn.005152e0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x515260
call fcn.00515420
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x515280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5f254c
push str.dataWinSaveDate
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5152c8
call fcn.00515500
mov eax, dword [ebp - 4]
push eax
push 0x50f4
push 1
push 0xd22a70
call fcn.005cdb90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd459
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x51a060
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.0051d000
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x51a08c
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x51a095
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0xccdec4], edx
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x51a0bf
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x51a0c8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [0xcda6fc], edx
cmp dword [0x121bbe0], 9
jne 0x51a108
cmp dword [0x121bbdc], 3
jne 0x51a108
mov dword [0x62494c], 9
mov eax, dword [0x121bbdc]
mov dword [0x625554], eax
push 0x10
call fcn.00599ef0
add esp, 4
mov byte [0xf10f82], 1
mov esp, ebp
pop ebp
ret
Function at 0x553a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0xf110b0], 0
jne 0x553a79
mov eax, 1
jmp 0x553c3d
cmp dword [0xccd680], 0
jne 0x553b0a
mov eax, dword [0xf110b0]
cmp dword [eax + 0x294], 0
jne 0x553aae
mov ecx, dword [0xf110b0]
mov edx, dword [ecx + 0x2a8]
sub edx, 2
mov eax, dword [0xf110b0]
mov dword [eax + 0x2a8], edx
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x2b0], 1
mov dword [0xf1c134], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553ae9
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x553af2
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0xf1c130], edx
mov dword [0xccd680], 1
jmp 0x553bbb
cmp dword [0xccd680], 1
jne 0x553b69
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553b34
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x553b3d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0xf1c130]
add edx, 0x7d0
cmp edx, dword [ebp - 8]
jae 0x553b67
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 5
mov dword [0xccd680], 2
jmp 0x553bbb
cmp dword [0xccd680], 2
jne 0x553bbb
mov ecx, dword [0xf110b0]
cmp dword [ecx + 0x2dc], 2
jl 0x553bbb
mov edx, dword [0xf110b0]
cmp dword [edx + 0x294], 0
jne 0x553ba1
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 0x10
jmp 0x553bb1
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x2b0], 6
mov dword [0xccd680], 3
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553bdc
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x553be5
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [0xcb27f8]
mov eax, dword [0xf1c130]
lea ecx, [eax + edx + 0x1194]
cmp ecx, dword [ebp - 0xc]
jae 0x553c22
mov dword [0xccd680], 4
mov edx, dword [0xf110b0]
mov eax, dword [edx + 0x24]
or eax, 2
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x24], eax
mov eax, 1
jmp 0x553c3d
push 0
mov edx, dword [0xf1c134]
push edx
push 0x64
mov eax, dword [0xf110b0]
push eax
call fcn.00592b40
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x553c50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0xf110b0], 0
jne 0x553c69
mov eax, 1
jmp 0x553e2d
cmp dword [0xccd680], 0
jne 0x553cfa
mov eax, dword [0xf110b0]
cmp dword [eax + 0x294], 0
jne 0x553c9e
mov ecx, dword [0xf110b0]
mov edx, dword [ecx + 0x2a8]
sub edx, 1
mov eax, dword [0xf110b0]
mov dword [eax + 0x2a8], edx
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x2b0], 1
mov dword [0xf1c13c], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553cd9
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x553ce2
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0xf1c138], edx
mov dword [0xccd680], 1
jmp 0x553dab
cmp dword [0xccd680], 1
jne 0x553d59
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553d24
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x553d2d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0xf1c138]
add edx, 0x7d0
cmp edx, dword [ebp - 8]
jae 0x553d57
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 5
mov dword [0xccd680], 2
jmp 0x553dab
cmp dword [0xccd680], 2
jne 0x553dab
mov ecx, dword [0xf110b0]
cmp dword [ecx + 0x2dc], 2
jl 0x553dab
mov edx, dword [0xf110b0]
cmp dword [edx + 0x294], 0
jne 0x553d91
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 0x10
jmp 0x553da1
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x2b0], 6
mov dword [0xccd680], 3
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553dcc
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x553dd5
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [0xcb27f8]
mov eax, dword [0xf1c138]
lea ecx, [eax + edx + 0x1194]
cmp ecx, dword [ebp - 0xc]
jae 0x553e12
mov dword [0xccd680], 4
mov edx, dword [0xf110b0]
mov eax, dword [edx + 0x24]
or eax, 2
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x24], eax
mov eax, 1
jmp 0x553e2d
push 0
mov edx, dword [0xf1c13c]
push edx
push 0x64
mov eax, dword [0xf110b0]
push eax
call fcn.00592b40
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x553e40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0xf110b0], 0
jne 0x553e59
mov eax, 1
jmp 0x553f8d
cmp dword [0xccd680], 0
jne 0x553eba
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 5
mov dword [0xf1c144], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553e9c
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x553ea5
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0xf1c140], edx
mov dword [0xccd680], 1
jmp 0x553f0b
cmp dword [0xccd680], 1
jne 0x553f0b
mov eax, dword [0xf110b0]
cmp dword [eax + 0x2dc], 4
jl 0x553f0b
mov ecx, dword [0xf110b0]
cmp dword [ecx + 0x294], 0
jne 0x553ef2
mov edx, dword [0xf110b0]
mov dword [edx + 0x2b0], 0x10
jmp 0x553f01
mov eax, dword [0xf110b0]
mov dword [eax + 0x2b0], 6
mov dword [0xccd680], 2
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x553f2c
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x553f35
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0xcb27f8]
mov eax, dword [0xf1c140]
lea ecx, [eax + edx + 0x1194]
cmp ecx, dword [ebp - 8]
jae 0x553f72
mov dword [0xccd680], 3
mov edx, dword [0xf110b0]
mov eax, dword [edx + 0x24]
or eax, 2
mov ecx, dword [0xf110b0]
mov dword [ecx + 0x24], eax
mov eax, 1
jmp 0x553f8d
push 0
mov edx, dword [0xf1c144]
push edx
push 0x64
mov eax, dword [0xf110b0]
push eax
call fcn.00592b40
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x566260
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x121bbbc], 0
jne 0x566274
jmp 0x56647d
cmp dword [0x121bbe0], 0xa
jne 0x566282
jmp 0x56647d
movsx eax, word [0xbff7a4]
test eax, eax
jne 0x56647d
movsx ecx, word [0xc199b0]
test ecx, ecx
jne 0x56647d
push 0
mov ecx, 0xca9a00
call fcn.005b73a0
movzx edx, al
test edx, edx
je 0x56647d
cmp dword [ebp + 8], 0
jl 0x56647d
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x5662e2
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x5662eb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [0xf1c15c]
add edx, 0x1f4
cmp edx, dword [ebp - 4]
jae 0x56647d
mov eax, dword [0x121bbbc]
mov ecx, dword [eax + 0xc]
cmp dword [ecx + 0x38], 0
je 0x566356
cmp dword [ebp + 8], 0
je 0x56634a
cmp dword [ebp + 8], 2
je 0x56634a
cmp dword [ebp + 8], 4
je 0x56634a
cmp dword [ebp + 8], 6
je 0x56634a
cmp dword [ebp + 8], 8
je 0x56634a
cmp dword [ebp + 8], 0xa
je 0x56634a
cmp dword [ebp + 8], 0xc
je 0x56634a
cmp dword [ebp + 8], 0xe
je 0x56634a
cmp dword [ebp + 8], 0x10
je 0x56634a
cmp dword [ebp + 8], 0x11
jne 0x566351
mov dword [ebp + 8], 1
jmp 0x566407
mov edx, dword [0x121bbbc]
cmp dword [edx + 0x2a8], 0x186a0
jl 0x56637d
mov eax, dword [0x121bbbc]
cmp dword [eax + 0x2a8], 0x18a87
jle 0x566407
mov ecx, dword [0x121bbbc]
cmp dword [ecx + 0x2a8], 0x19a28
jl 0x5663a1
mov edx, dword [0x121bbbc]
cmp dword [edx + 0x2a8], 0x1a130
jle 0x566407
mov eax, dword [0x121bbbc]
cmp dword [eax + 0x2a8], 0x1af0e
jl 0x5663c4
mov ecx, dword [0x121bbbc]
cmp dword [ecx + 0x2a8], 0x1af25
jle 0x566407
cmp dword [ebp + 8], 0
je 0x566400
cmp dword [ebp + 8], 2
je 0x566400
cmp dword [ebp + 8], 4
je 0x566400
cmp dword [ebp + 8], 6
je 0x566400
cmp dword [ebp + 8], 8
je 0x566400
cmp dword [ebp + 8], 0xa
je 0x566400
cmp dword [ebp + 8], 0xc
je 0x566400
cmp dword [ebp + 8], 0xe
je 0x566400
cmp dword [ebp + 8], 0x10
je 0x566400
cmp dword [ebp + 8], 0x11
jne 0x566407
mov dword [ebp + 8], 1
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x62e428]
push eax
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov ecx, dword [0xfd5768]
push ecx
call fcn.00586d00
add esp, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [edx*4 + 0x62e3e0]
push eax
call fcn.00596380
add esp, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x56646b
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x566474
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [0xf1c15c], edx
mov esp, ebp
pop ebp
ret
Function at 0x56e0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0xce22b8], 0
je 0x56e18a
cmp dword [0xd2eb38], 0
jne 0x56e0fe
mov dword [0xd27d70], 1
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x56e0e7
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x56e0f0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [0xd2eb38], edx
jmp 0x56e188
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x56e11f
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x56e128
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0xd2eb38]
add edx, 0x3e8
cmp edx, dword [ebp - 8]
jae 0x56e188
mov eax, dword [0xd27d70]
add eax, 1
mov dword [0xd27d70], eax
mov ecx, dword [0xd27d70]
and ecx, 1
mov dword [0xd27d70], ecx
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x56e176
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x56e17f
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [0xd2eb38], edx
jmp 0x56e19e
mov dword [0xd27d70], 0
mov dword [0xd2eb38], 0
mov esp, ebp
pop ebp
ret

Function at 0x570e60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x570e87
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x570e90
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [0xf1c170]
add edx, 0x1f4
cmp edx, dword [ebp - 4]
ja 0x570ed9
call fcn.00471000
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x570ec7
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 8], edx
jmp 0x570ed0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [0xf1c170], edx
mov esp, ebp
pop ebp
ret
Function at 0x574c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf1ce28]
or eax, 1
mov dword [0xf1ce28], eax
mov ecx, dword [0xf1ce2c]
or ecx, 1
mov dword [0xf1ce2c], ecx
mov edx, dword [0xf1ce30]
or edx, 1
mov dword [0xf1ce30], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.005b7340
mov ecx, dword [ebp - 0xc]
mov dword [0xf1cdac], ecx
mov edx, dword [ebp - 8]
mov dword [0xf1cdb0], edx
mov al, byte [ebp - 4]
mov byte [0xf1cdb4], al
lea ecx, [ebp - 0x10]
call fcn.005b7380
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x20]
call fcn.005b7340
mov edx, dword [ebp - 0x1c]
mov dword [0xf1cdbc], edx
mov eax, dword [ebp - 0x18]
mov dword [0xf1cdc0], eax
mov cl, byte [ebp - 0x14]
mov byte [0xf1cdc4], cl
lea ecx, [ebp - 0x20]
call fcn.005b7380
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x574d1e
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x574d27
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [0xf1ce34], edx
mov dword [0xf1ce38], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00574af0
add esp, 0xc
cmp eax, dword [0x62f304]
jl 0x574d6a
push 1
mov edx, dword [0xfd5768]
push edx
call fcn.00587db0
add esp, 8
call fcn.00574780
mov esp, ebp
pop ebp
ret

Function at 0x574e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf1ce28]
or eax, 1
mov dword [0xf1ce28], eax
mov ecx, dword [0xf1ce2c]
or ecx, 0x10
mov dword [0xf1ce2c], ecx
mov edx, dword [0xf1ce2c]
or edx, 1
mov dword [0xf1ce2c], edx
mov eax, dword [0xf1ce30]
or eax, 1
mov dword [0xf1ce30], eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.005b7340
mov edx, dword [ebp - 0xc]
mov dword [0xf1cdac], edx
mov eax, dword [ebp - 8]
mov dword [0xf1cdb0], eax
mov cl, byte [ebp - 4]
mov byte [0xf1cdb4], cl
lea ecx, [ebp - 0x10]
call fcn.005b7380
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x20]
call fcn.005b7340
mov eax, dword [ebp - 0x1c]
mov dword [0xf1cdbc], eax
mov ecx, dword [ebp - 0x18]
mov dword [0xf1cdc0], ecx
mov dl, byte [ebp - 0x14]
mov byte [0xf1cdc4], dl
lea ecx, [ebp - 0x20]
call fcn.005b7380
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x574edb
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x574ee4
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [0xf1ce34], edx
mov dword [0xf1ce38], 0
mov esp, ebp
pop ebp
ret