joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [ebp + 0xc]
call fcn.00405814
xor eax, eax
push ebp
push 0x50d6e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x50be7c]
mov eax, 0x34
call fcn.0040647c
mov ebx, eax
mov eax, ebx
call fcn.00405394
lea eax, [ebx + 4]
call fcn.00405394
lea eax, [ebx + 8]
mov edx, dword [ebp + 0xc]
call fcn.004053e8
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], edi
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2c], eax
mov byte [ebx + 0x30], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x50d6c2
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.0041fbfc
test eax, eax
jne 0x50d6be
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.0041fd58
mov ebx, esi
jmp 0x50d6d3
inc esi
dec edi
jne 0x50d6a0
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.0041fa54
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d6f0
lea eax, [ebp + 0xc]
call fcn.00405394
ret

Function at 0x5116a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5116fb
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x5116f1
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x5116ff
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x546e18
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405814
xor eax, eax
push ebp
push 0x546fc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x546fa5
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.00403ae0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405824
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x546fa5
mov eax, dword [ebp - 0x14]
call fcn.00402f7c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x546f9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x546f88
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x546fd8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x546f88
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x546fe4
call fcn.0040bb24
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00405630
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.004039d0
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546fa5
mov eax, dword [ebp - 0xc]
call fcn.00402fb0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546fcd
lea eax, [ebp - 0x118]
call fcn.00405394
lea eax, [ebp - 4]
call fcn.00405394
ret
Function at 0x563830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x563928
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x563924
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
movzx eax, byte [esi + 0x2c]
mov byte [esp], al
lea ecx, [esi + 0x28]
lea edx, [esi + 0x24]
mov eax, dword [esi + 0x380]
call fcn.006108ec
mov ebp, dword [esi + 0x380]
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.00641644
mov byte [esi + 0x2c], al
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov word [esp + 2], 0
lea edx, [esp + 2]
mov ecx, dword [esi + 0x380]
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x20]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060e818
mov eax, dword [esi + 0x380]
xor edx, edx
mov dword [eax + 0x390], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
movzx edx, al
mov eax, esi
call fcn.0060cde0
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x56392f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x563a64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x563b5c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x563b58
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
movzx eax, byte [esi + 0x2c]
mov byte [esp], al
lea ecx, [esi + 0x28]
lea edx, [esi + 0x24]
mov eax, dword [esi + 0x380]
call fcn.006108ec
mov ebp, dword [esi + 0x380]
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.00641644
mov byte [esi + 0x2c], al
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov word [esp + 2], 0
lea edx, [esp + 2]
mov ecx, dword [esi + 0x380]
mov eax, esi
mov ebp, dword [eax]
call dword [ebp + 0x20]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060e818
mov eax, dword [esi + 0x380]
xor edx, edx
mov dword [eax + 0x390], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
movzx eax, byte [esp]
mov byte [esi + 0x2c], al
movzx edx, al
mov eax, esi
call fcn.0060cde0
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x563b63
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5adb28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5add1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6c092c]
cmp dword [eax], 0
je 0x5add03
test ebx, ebx
je 0x5add03
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx]
cmp eax, dword [ebx + 4]
jbe 0x5add03
mov eax, dword [ebx + 8]
sub eax, 0x64
jne 0x5add03
mov eax, dword [ebx + 0xc]
cmp eax, 0x12d
jg 0x5adbbc
je 0x5adcce
cmp eax, 0xca
jg 0x5adba3
je 0x5adc57
sub eax, 0xc8
je 0x5adbe1
dec eax
je 0x5adc1c
jmp 0x5add03
sub eax, 0xcb
je 0x5adc8f
sub eax, 0x61
je 0x5adcc3
jmp 0x5add03
sub eax, 0x12e
je 0x5adcd9
dec eax
je 0x5adce4
dec eax
je 0x5adcef
dec eax
je 0x5adcfa
jmp 0x5add03
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [ebx]
jb 0x5add03
call sub.kernel32.dll_GetTickCount_1
imul edx, dword [ebx + 0x20], 0x5265c00
add eax, edx
mov dword [ebx], eax
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6c092c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x24]
mov edx, esi
call fcn.00634cf8
jmp 0x5add03
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [ebx]
jb 0x5add03
call sub.kernel32.dll_GetTickCount_1
imul edx, dword [ebx + 0x20], 0x36ee80
add eax, edx
mov dword [ebx], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6c092c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x24]
mov edx, esi
call fcn.00634cf8
jmp 0x5add03
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [ebx]
jb 0x5add03
call sub.kernel32.dll_GetTickCount_1
imul edx, dword [ebx + 0x20], 0xea60
add eax, edx
mov dword [ebx], eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x6c092c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x24]
mov edx, esi
call fcn.00634cf8
jmp 0x5add03
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [ebx]
jb 0x5add03
call sub.kernel32.dll_GetTickCount_1
imul edx, dword [ebx + 0x20], 0x3e8
add eax, edx
mov dword [ebx], eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x6c092c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x24]
mov edx, esi
call fcn.00634cf8
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005adee4
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005ade14
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005aded8
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005adedc
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005adee0
jmp 0x5add03
mov edx, ebx
mov eax, esi
call fcn.005add2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5add25
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004053b8
ret
Function at 0x5b3080
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
mov byte [esp], 0
cmp dword [ebx + 0x380], 0
je 0x5b31f5
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5b31f5
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
mov esi, dword [ebx + 0x380]
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
call fcn.00641644
mov byte [ebx + 0x2c], al
mov eax, ebx
call fcn.005b2fb0
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.0060f9fc
lea esi, [ebx + 0x108]
mov eax, dword [esi + 0xa]
shr eax, 0x10
sub ax, word [esi + 0xa]
movsx eax, ax
inc eax
call fcn.00403484
movzx edx, word [esi + 0xa]
add eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x414]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5b31ea
inc edi
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x414]
call fcn.0041fbfc
mov esi, dword [eax]
test esi, esi
je 0x5b31df
cmp byte [esi + 0x2ec], 0
jne 0x5b31df
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b31df
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jg 0x5b31df
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x5b31df
movzx eax, word [esp + 8]
push eax
movzx eax, word [esi + 0x24]
movzx edx, word [esi + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
push esi
push 0
push 0x190
mov cx, 0xdc
mov edx, ebx
mov eax, ebx
mov ebp, dword [eax]
call dword [ebp + 0x18]
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 8
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, ebx
call fcn.0060aa6c
inc dword [esp + 4]
dec edi
jne 0x5b3143
mov eax, ebx
call fcn.0060f4c4
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b3cf8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov ebx, eax
mov byte [esp], 0
cmp dword [ebx + 0x380], 0
je 0x5b3e5b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3fc]
cmp eax, dword [ebx + 0xb60]
jle 0x5b3e5b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x384], eax
movzx eax, byte [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, ebx
call fcn.0060f9fc
mov eax, dword [ebx + 0x112]
shr eax, 0x10
sub ax, word [ebx + 0x112]
movsx eax, ax
inc eax
call fcn.00403484
movzx edx, word [ebx + 0x112]
add eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x414]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5b3e50
inc edi
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x414]
call fcn.0041fbfc
mov esi, dword [eax]
test esi, esi
je 0x5b3e45
cmp byte [esi + 0x2ec], 0
jne 0x5b3e45
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b3e45
mov eax, dword [ebx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jg 0x5b3e45
mov eax, dword [ebx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
jl 0x5b3e45
mov ecx, dword [esp + 8]
mov edx, ebx
mov eax, esi
call fcn.0060fbdc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x5b3e45
lea edx, [esp + 0xc]
mov ecx, ebx
mov eax, esi
call fcn.0060fdd0
movzx eax, word [esp + 0xc]
push eax
movzx eax, word [esi + 0x11e]
push eax
movzx eax, word [esi + 0x122]
push eax
push ebx
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x18]
inc dword [esp + 4]
dec edi
jne 0x5b3d9b
mov eax, ebx
call fcn.0060f4c4
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5b49e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov byte [esp + 1], cl
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0x380], 0
je 0x5b4ba3
mov esi, dword [edi + 0x380]
mov eax, dword [esi + 0x2e0]
cmp eax, dword [edi + 0x2e0]
jne 0x5b4ba3
mov eax, dword [edi + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [esp + 1]
cmp eax, edx
jg 0x5b4ba3
mov eax, dword [edi + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [esp + 1]
cmp eax, edx
jg 0x5b4ba3
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [esi + 0x24]
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x24]
call fcn.00645188
test al, al
je 0x5b4ba3
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x3fc]
cmp eax, dword [edi + 0xb60]
jle 0x5b4ba1
movzx eax, byte [esp]
mov byte [edi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x384], eax
push 1
mov ecx, dword [edi + 0x112]
shr ecx, 0x10
movzx eax, word [edi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, edi
call fcn.00612ef8
mov dword [esp + 0x10], eax
movzx esi, byte [esp + 1]
test esi, esi
jle 0x5b4b7e
mov dword [esp + 4], 1
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x2e0]
call fcn.0066f574
test al, al
je 0x5b4b73
push 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0x2e0]
call fcn.0066f8e0
mov ebx, eax
test ebx, ebx
je 0x5b4b73
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b4b73
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, ebx
call fcn.0060fa20
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
jle 0x5b4b73
lea edx, [esp + 0x14]
mov ecx, edi
mov eax, ebx
call fcn.0060fdd0
movzx eax, word [esp + 0x14]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push edi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 4]
dec esi
jne 0x5b4acf
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, edi
call fcn.0060f9fc
mov eax, edi
call fcn.0060f4c4
mov bl, 1
mov eax, ebx
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x5b7408
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b7569
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
test al, al
jne 0x5b7567
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b7569
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b7569
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b7563
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b751b
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 7
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b7569
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b7570
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b76d1
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
test al, al
jne 0x5b76cf
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b76d1
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b76d1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b76cb
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b7683
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 8
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b76d1
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b76d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b781a
mov byte [esp], 0
mov eax, 0xa
call fcn.00403484
test eax, eax
jne 0x5b7713
mov dl, 2
mov eax, esi
call fcn.005bb41c
dec eax
jle 0x5b7713
mov byte [esp], 1
jmp 0x5b7731
lea ecx, [esp + 1]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.006084d8
test al, al
je 0x5b7731
movzx edi, byte [esp + 1]
mov byte [esp], 2
cmp byte [esp], 0
jbe 0x5b77e9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b77e7
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esp]
dec al
je 0x5b777f
dec al
je 0x5b77ce
dec al
je 0x5b77ae
jmp 0x5b77e0
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
push 3
push 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.005bb5c4
jmp 0x5b77e0
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [esi + 0x2c]
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
jmp 0x5b77e0
mov ecx, edi
mov edx, dword [esi + 0x380]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x90]
mov eax, esi
call fcn.0060f4c4
mov bl, 1
test bl, bl
jne 0x5b781a
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5b7813
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b781a
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5b7b2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b7c48
push 0x1391
mov edx, edi
mov cl, 4
mov eax, esi
call fcn.005baa20
test al, al
jne 0x5b7c46
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b7c48
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b7c42
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0xe
push 0
push 0x12c
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b7c48
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret