joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8904]
cmp byte [0x101f8639], 0
je 0x10042354
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f88f4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042354
comiss xmm1, dword [0x101f88fc]
ja 0x10042354
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f88f8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042354
comiss xmm1, dword [0x101f8900]
ja 0x10042354
cmp dword [ebp + 8], 0x201
jne 0x100422de
mov byte [0x101f8908], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8908], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x10042354
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4a0], 0
mov dword [0x101f8904], eax
je 0x1004232f
push 0x10056620
push 0x57d278
push 0xe9
mov dword [0x101fa4a0], 0
call fcn.10063f10
add esp, 0xc
pop ebp
ret 4
push 0x10056610
push 0x57d278
push 0xe9
call fcn.10063f10
add esp, 0xc
mov dword [0x101fa4a0], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x10042360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f88bc]
cmp byte [0x101f8639], 0
je 0x100424ab
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f88ac]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100424ab
comiss xmm1, dword [0x101f88b4]
ja 0x100424ab
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f88b0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100424ab
comiss xmm1, dword [0x101f88b8]
ja 0x100424ab
cmp dword [ebp + 8], 0x201
jne 0x100423ee
mov byte [0x101f88c0], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f88c0], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x100424ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4a4], 0
mov dword [0x101f88bc], eax
je 0x10042463
push 0x10056640
push 0x74cd50
push 0xe9
mov dword [0x101fa4a4], 0
call fcn.10063f10
push 0x10056680
push 0x72d1cc
push 0xe9
call fcn.10063f10
push 0x55
push 0x608fb0
call fcn.10063e10
add esp, 0x20
pop ebp
ret 4
push 0xc3
push 0x608fb0
call fcn.10063e10
push 0x10056630
push 0x74cd50
push 0xe9
call fcn.10063f10
push 0x10056670
push 0x72d1cc
push 0xe9
call fcn.10063f10
add esp, 0x20
mov dword [0x101fa4a4], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x100424c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8994]
cmp byte [0x101f8639], 0
je 0x100425c4
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8984]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100425c4
comiss xmm1, dword [0x101f898c]
ja 0x100425c4
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8988]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100425c4
comiss xmm1, dword [0x101f8990]
ja 0x100425c4
cmp dword [ebp + 8], 0x201
jne 0x1004254e
mov byte [0x101f8998], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8998], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x100425c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4a8], 0
mov dword [0x101f8994], eax
je 0x1004259f
push 0x10056660
push 0x771328
push 0xe9
mov dword [0x101fa4a8], 0
call fcn.10063f10
add esp, 0xc
pop ebp
ret 4
push 0x10056650
push 0x771328
push 0xe9
call fcn.10063f10
add esp, 0xc
mov dword [0x101fa4a8], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x100425d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8afc]
cmp byte [0x101f8639], 0
je 0x100426e7
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8aec]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100426e7
comiss xmm1, dword [0x101f8af4]
ja 0x100426e7
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8af0]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x100426e7
comiss xmm1, dword [0x101f8af8]
ja 0x100426e7
cmp dword [ebp + 8], 0x201
jne 0x1004265e
mov byte [0x101f8b00], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8b00], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x100426e7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4ac], 0
mov dword [0x101f8afc], eax
je 0x100426bb
push 0xe8
mov edx, 0x5655c0
mov dword [0x101fa4ac], 0
mov ecx, 0x588661
call fcn.10063ab0
push 0x55
push 0x51ee20
call fcn.10063e10
add esp, 0xc
pop ebp
ret 4
push 0xc3
push 0x51ee20
call fcn.10063e10
push 5
mov ecx, 0x588661
call fcn.10063f90
add esp, 0xc
mov dword [0x101fa4ac], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x100426f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8b44]
cmp byte [0x101f8639], 0
je 0x10042807
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8b34]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042807
comiss xmm1, dword [0x101f8b3c]
ja 0x10042807
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8b38]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042807
comiss xmm1, dword [0x101f8b40]
ja 0x10042807
cmp dword [ebp + 8], 0x201
jne 0x1004277e
mov byte [0x101f8b48], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8b48], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x10042807
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4b0], 0
mov ecx, 0x576ddb
mov dword [0x101f8b44], eax
je 0x100427e3
push 0xe8
mov edx, 0x5655c0
mov dword [0x101fa4b0], 0
call fcn.10063ab0
push 0xe8
mov edx, 0x5655c0
mov ecx, 0x5883f4
call fcn.10063ab0
add esp, 8
pop ebp
ret 4
push 5
call fcn.10063f90
push 5
mov ecx, 0x5883f4
call fcn.10063f90
add esp, 8
mov dword [0x101fa4b0], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x10042810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8b8c]
cmp byte [0x101f8639], 0
je 0x10042907
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8b7c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042907
comiss xmm1, dword [0x101f8b84]
ja 0x10042907
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8b80]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042907
comiss xmm1, dword [0x101f8b88]
ja 0x10042907
cmp dword [ebp + 8], 0x201
jne 0x1004289e
mov byte [0x101f8b90], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8b90], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x10042907
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4b4], 0
mov ecx, 0x57655b
mov dword [0x101f8b8c], eax
je 0x100428ef
push 0xe8
mov edx, 0x6097b0
mov dword [0x101fa4b4], 0
call fcn.10063ab0
add esp, 4
pop ebp
ret 4
push 5
call fcn.10063f90
add esp, 4
mov dword [0x101fa4b4], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x10042910
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f8bd4]
cmp byte [0x101f8639], 0
je 0x10042a27
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f8bc4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042a27
comiss xmm1, dword [0x101f8bcc]
ja 0x10042a27
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8bc8]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042a27
comiss xmm1, dword [0x101f8bd0]
ja 0x10042a27
cmp dword [ebp + 8], 0x201
jne 0x1004299e
mov byte [0x101f8bd8], 1
mov al, 1
mov dword [0xe8cb3c], 1
pop ebp
ret 4
mov byte [0x101f8bd8], 0
mov dword [0xe8cb3c], 1
cmp eax, 0x1f4
jb 0x10042a27
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101fa4b8], 0
mov dword [0x101f8bd4], eax
je 0x100429fb
push 0x55
push 0x5edfe0
mov dword [0x101fa4b8], 0
call fcn.10063e10
push 0xe8
mov edx, 0x95a1e0
mov ecx, 0x5f8924
call fcn.10063ab0
add esp, 0xc
pop ebp
ret 4
push 5
mov ecx, 0x5f8924
call fcn.10063f90
push 0xc3
push 0x5edfe0
call fcn.10063e10
add esp, 0xc
mov dword [0x101fa4b8], 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x10042a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101f879c]
cmp byte [0x101f8639], 0
je 0x10042ad5
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f878c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042ad5
comiss xmm1, dword [0x101f8794]
ja 0x10042ad5
movd xmm1, dword [0x101fcab4]
movss xmm0, dword [0x101f8790]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10042ad5
comiss xmm1, dword [0x101f8798]
ja 0x10042ad5
cmp dword [ebp + 8], 0x201
jne 0x10042aa4
mov byte [0x101f87a0], 1
mov al, 1
pop ebp
ret 4
mov byte [0x101f87a0], 0
cmp eax, 0x1f4
jb 0x10042ad5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101f879c], eax
mov byte [0x101f8639], 0
mov dword [0xe8cb3c], 0
mov byte [0x101f863b], 0
xor al, al
pop ebp
ret 4
Function at 0x10043870
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10043a31
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x10043a2f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043a2f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043a2f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043a2f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043a2f
push 0x39
call fcn.10039dd0
test al, al
jne 0x10043a2f
push 0x48
call fcn.10039dd0
test al, al
jne 0x10043a2f
push 2
call fcn.10039dd0
test al, al
jne 0x10043a2f
push 0xd
call fcn.10039dd0
test al, al
je 0x1004392e
push 0x4d
call fcn.10039dd0
test al, al
je 0x1004392e
push 0xe
call fcn.10039dd0
test al, al
jne 0x10043a2f
push 0xd
call fcn.10039dd0
test al, al
je 0x10043953
push 8
call fcn.10039dd0
test al, al
je 0x10043953
push 0x4e
call fcn.10039dd0
test al, al
jne 0x10043a2f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x100439c7
push 0xbf
call fcn.10039e30
test al, al
je 0x10043a2f
sub esi, dword [0x101f9324]
cmp dword [ebp + 8], 0x201
jne 0x100439a5
pop edi
mov byte [0x101f9328], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9328], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10043a2f
call edi
mov dword [0x101f9324], eax
jmp 0x10043a1b
push 0xa9
call fcn.10039e30
test al, al
je 0x10043a2f
sub esi, dword [0x101f8cf4]
cmp dword [ebp + 8], 0x201
jne 0x100439fb
pop edi
mov byte [0x101f8cf8], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8cf8], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10043a2f
call edi
mov dword [0x101f8cf4], eax
mov edx, 4
mov dword [ebp + 8], 0x27904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10043c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10043dd1
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x10043dcf
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043dcf
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043dcf
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043dcf
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x10043dcf
push 0x39
call fcn.10039dd0
test al, al
jne 0x10043dcf
push 0x48
call fcn.10039dd0
test al, al
jne 0x10043dcf
push 2
call fcn.10039dd0
test al, al
jne 0x10043dcf
push 0xd
call fcn.10039dd0
test al, al
je 0x10043cce
push 0x4d
call fcn.10039dd0
test al, al
je 0x10043cce
push 0xe
call fcn.10039dd0
test al, al
jne 0x10043dcf
push 0xd
call fcn.10039dd0
test al, al
je 0x10043cf3
push 8
call fcn.10039dd0
test al, al
je 0x10043cf3
push 0x4e
call fcn.10039dd0
test al, al
jne 0x10043dcf
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10043d67
push 0xc0
call fcn.10039e30
test al, al
je 0x10043dcf
sub esi, dword [0x101f936c]
cmp dword [ebp + 8], 0x201
jne 0x10043d45
pop edi
mov byte [0x101f9370], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9370], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10043dcf
call edi
mov dword [0x101f936c], eax
jmp 0x10043dbb
push 0xaa
call fcn.10039e30
test al, al
je 0x10043dcf
sub esi, dword [0x101f8d3c]
cmp dword [ebp + 8], 0x201
jne 0x10043d9b
pop edi
mov byte [0x101f8d40], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8d40], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10043dcf
call edi
mov dword [0x101f8d3c], eax
mov edx, 4
mov dword [ebp + 8], 0x37904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10043fb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10044171
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x1004416f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004416f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004416f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004416f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004416f
push 0x39
call fcn.10039dd0
test al, al
jne 0x1004416f
push 0x48
call fcn.10039dd0
test al, al
jne 0x1004416f
push 2
call fcn.10039dd0
test al, al
jne 0x1004416f
push 0xd
call fcn.10039dd0
test al, al
je 0x1004406e
push 0x4d
call fcn.10039dd0
test al, al
je 0x1004406e
push 0xe
call fcn.10039dd0
test al, al
jne 0x1004416f
push 0xd
call fcn.10039dd0
test al, al
je 0x10044093
push 8
call fcn.10039dd0
test al, al
je 0x10044093
push 0x4e
call fcn.10039dd0
test al, al
jne 0x1004416f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10044107
push 0xc1
call fcn.10039e30
test al, al
je 0x1004416f
sub esi, dword [0x101f93b4]
cmp dword [ebp + 8], 0x201
jne 0x100440e5
pop edi
mov byte [0x101f93b8], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f93b8], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004416f
call edi
mov dword [0x101f93b4], eax
jmp 0x1004415b
push 0xab
call fcn.10039e30
test al, al
je 0x1004416f
sub esi, dword [0x101f8d84]
cmp dword [ebp + 8], 0x201
jne 0x1004413b
pop edi
mov byte [0x101f8d88], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8d88], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004416f
call edi
mov dword [0x101f8d84], eax
mov edx, 4
mov dword [ebp + 8], 0x47904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10044350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10044511
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x1004450f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004450f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004450f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004450f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004450f
push 0x39
call fcn.10039dd0
test al, al
jne 0x1004450f
push 0x48
call fcn.10039dd0
test al, al
jne 0x1004450f
push 2
call fcn.10039dd0
test al, al
jne 0x1004450f
push 0xd
call fcn.10039dd0
test al, al
je 0x1004440e
push 0x4d
call fcn.10039dd0
test al, al
je 0x1004440e
push 0xe
call fcn.10039dd0
test al, al
jne 0x1004450f
push 0xd
call fcn.10039dd0
test al, al
je 0x10044433
push 8
call fcn.10039dd0
test al, al
je 0x10044433
push 0x4e
call fcn.10039dd0
test al, al
jne 0x1004450f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x100444a7
push 0xc2
call fcn.10039e30
test al, al
je 0x1004450f
sub esi, dword [0x101f93fc]
cmp dword [ebp + 8], 0x201
jne 0x10044485
pop edi
mov byte [0x101f9400], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9400], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004450f
call edi
mov dword [0x101f93fc], eax
jmp 0x100444fb
push 0xac
call fcn.10039e30
test al, al
je 0x1004450f
sub esi, dword [0x101f8dcc]
cmp dword [ebp + 8], 0x201
jne 0x100444db
pop edi
mov byte [0x101f8dd0], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8dd0], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004450f
call edi
mov dword [0x101f8dcc], eax
mov edx, 4
mov dword [ebp + 8], 0x57904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x100446f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x100448b1
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x100448af
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x100448af
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x100448af
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x100448af
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x100448af
push 0x39
call fcn.10039dd0
test al, al
jne 0x100448af
push 0x48
call fcn.10039dd0
test al, al
jne 0x100448af
push 2
call fcn.10039dd0
test al, al
jne 0x100448af
push 0xd
call fcn.10039dd0
test al, al
je 0x100447ae
push 0x4d
call fcn.10039dd0
test al, al
je 0x100447ae
push 0xe
call fcn.10039dd0
test al, al
jne 0x100448af
push 0xd
call fcn.10039dd0
test al, al
je 0x100447d3
push 8
call fcn.10039dd0
test al, al
je 0x100447d3
push 0x4e
call fcn.10039dd0
test al, al
jne 0x100448af
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10044847
push 0xc3
call fcn.10039e30
test al, al
je 0x100448af
sub esi, dword [0x101f9444]
cmp dword [ebp + 8], 0x201
jne 0x10044825
pop edi
mov byte [0x101f9448], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9448], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100448af
call edi
mov dword [0x101f9444], eax
jmp 0x1004489b
push 0xad
call fcn.10039e30
test al, al
je 0x100448af
sub esi, dword [0x101f8e14]
cmp dword [ebp + 8], 0x201
jne 0x1004487b
pop edi
mov byte [0x101f8e18], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8e18], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100448af
call edi
mov dword [0x101f8e14], eax
mov edx, 4
mov dword [ebp + 8], 0x67904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10044a90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10044c51
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x10044c4f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044c4f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044c4f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044c4f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044c4f
push 0x39
call fcn.10039dd0
test al, al
jne 0x10044c4f
push 0x48
call fcn.10039dd0
test al, al
jne 0x10044c4f
push 2
call fcn.10039dd0
test al, al
jne 0x10044c4f
push 0xd
call fcn.10039dd0
test al, al
je 0x10044b4e
push 0x4d
call fcn.10039dd0
test al, al
je 0x10044b4e
push 0xe
call fcn.10039dd0
test al, al
jne 0x10044c4f
push 0xd
call fcn.10039dd0
test al, al
je 0x10044b73
push 8
call fcn.10039dd0
test al, al
je 0x10044b73
push 0x4e
call fcn.10039dd0
test al, al
jne 0x10044c4f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10044be7
push 0xc4
call fcn.10039e30
test al, al
je 0x10044c4f
sub esi, dword [0x101f948c]
cmp dword [ebp + 8], 0x201
jne 0x10044bc5
pop edi
mov byte [0x101f9490], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9490], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10044c4f
call edi
mov dword [0x101f948c], eax
jmp 0x10044c3b
push 0xae
call fcn.10039e30
test al, al
je 0x10044c4f
sub esi, dword [0x101f8e5c]
cmp dword [ebp + 8], 0x201
jne 0x10044c1b
pop edi
mov byte [0x101f8e60], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8e60], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10044c4f
call edi
mov dword [0x101f8e5c], eax
mov edx, 4
mov dword [ebp + 8], 0x77904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x10044e30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10044ff1
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x10044fef
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044fef
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044fef
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044fef
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x10044fef
push 0x39
call fcn.10039dd0
test al, al
jne 0x10044fef
push 0x48
call fcn.10039dd0
test al, al
jne 0x10044fef
push 2
call fcn.10039dd0
test al, al
jne 0x10044fef
push 0xd
call fcn.10039dd0
test al, al
je 0x10044eee
push 0x4d
call fcn.10039dd0
test al, al
je 0x10044eee
push 0xe
call fcn.10039dd0
test al, al
jne 0x10044fef
push 0xd
call fcn.10039dd0
test al, al
je 0x10044f13
push 8
call fcn.10039dd0
test al, al
je 0x10044f13
push 0x4e
call fcn.10039dd0
test al, al
jne 0x10044fef
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10044f87
push 0xc5
call fcn.10039e30
test al, al
je 0x10044fef
sub esi, dword [0x101f94d4]
cmp dword [ebp + 8], 0x201
jne 0x10044f65
pop edi
mov byte [0x101f94d8], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f94d8], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10044fef
call edi
mov dword [0x101f94d4], eax
jmp 0x10044fdb
push 0xaf
call fcn.10039e30
test al, al
je 0x10044fef
sub esi, dword [0x101f8ea4]
cmp dword [ebp + 8], 0x201
jne 0x10044fbb
pop edi
mov byte [0x101f8ea8], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8ea8], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x10044fef
call edi
mov dword [0x101f8ea4], eax
mov edx, 4
mov dword [ebp + 8], 0x87904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4
Function at 0x100451d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f8099], 0
je 0x10045391
push esi
push edi
push 0x16
mov esi, 0x861110
call esi
mov edi, 0x85ec20
mov ecx, eax
call edi
test al, al
jne 0x1004538f
push 0x17
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004538f
push 0x18
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004538f
push 8
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004538f
push 0x41
call esi
mov ecx, eax
call edi
test al, al
jne 0x1004538f
push 0x39
call fcn.10039dd0
test al, al
jne 0x1004538f
push 0x48
call fcn.10039dd0
test al, al
jne 0x1004538f
push 2
call fcn.10039dd0
test al, al
jne 0x1004538f
push 0xd
call fcn.10039dd0
test al, al
je 0x1004528e
push 0x4d
call fcn.10039dd0
test al, al
je 0x1004528e
push 0xe
call fcn.10039dd0
test al, al
jne 0x1004538f
push 0xd
call fcn.10039dd0
test al, al
je 0x100452b3
push 8
call fcn.10039dd0
test al, al
je 0x100452b3
push 0x4e
call fcn.10039dd0
test al, al
jne 0x1004538f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x4d
mov esi, eax
call fcn.10039dd0
mov ecx, 0x101f5d40
test al, al
je 0x10045327
push 0xc6
call fcn.10039e30
test al, al
je 0x1004538f
sub esi, dword [0x101f951c]
cmp dword [ebp + 8], 0x201
jne 0x10045305
pop edi
mov byte [0x101f9520], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f9520], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004538f
call edi
mov dword [0x101f951c], eax
jmp 0x1004537b
push 0xb0
call fcn.10039e30
test al, al
je 0x1004538f
sub esi, dword [0x101f8eec]
cmp dword [ebp + 8], 0x201
jne 0x1004535b
pop edi
mov byte [0x101f8ef0], 1
mov dword [0xe8cb3c], 1
pop esi
pop ebp
ret 4
mov byte [0x101f8ef0], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x1004538f
call edi
mov dword [0x101f8eec], eax
mov edx, 4
mov dword [ebp + 8], 0x97904c1
lea ecx, [ebp + 8]
call fcn.1005d410
pop edi
pop esi
pop ebp
ret 4