joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b8258
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b843f
call sub.kernel32.dll_GetTickCount_1
cmp eax, dword [esi + 0xc28]
jbe 0x5b8326
call sub.kernel32.dll_GetTickCount_1
add eax, 0x7d0
mov dword [esi + 0xc28], eax
mov eax, 0xa
call fcn.00403484
cmp eax, 3
jge 0x5b8326
push 1
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0066fd60
test eax, eax
jle 0x5b8326
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dx, 0xe9
mov eax, esi
call fcn.0060aa6c
mov eax, 0x10
call fcn.00403484
mov ebx, eax
sub ebx, 8
add ebx, dword [esi + 0x24]
mov eax, 0x10
call fcn.00403484
sub eax, 8
add eax, dword [esi + 0x28]
push eax
push 2
mov ecx, ebx
mov edx, dword [esi + 0x2e0]
mov eax, esi
call fcn.00617f30
mov bl, 1
jmp 0x5b843f
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b8412
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b840e
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0x15
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b843f
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5b8438
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b843f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b8448
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b85c6
cmp byte [esi + 0xc20], 0
je 0x5b84b7
cmp byte [esi + 0xc2c], 0
jne 0x5b84b7
mov byte [esi + 0xc2c], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x14d8
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b85c6
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
test al, al
jne 0x5b85c4
cmp byte [esi + 0xc20], 0
je 0x5b85c6
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b85c6
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b85c0
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
push eax
mov edx, dword [esi + 0x380]
movzx eax, word [edx + 0x24]
movzx edx, word [edx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
push 0x190
mov cx, 0xdc
mov eax, esi
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x24]
push edx
mov eax, dword [eax + 0x28]
push eax
push 0x16
push 0
push 0x168
xor ecx, ecx
mov dx, 0xc9
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b85c6
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b85cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b872d
mov edx, 0x1391
mov eax, esi
call fcn.005ba56c
test al, al
jne 0x5b872b
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b872d
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b872d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b8727
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b86df
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x3e8
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 1
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b872d
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b89d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b8b50
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b8b23
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b8b23
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b8b1f
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b8ad7
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 2
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b8b50
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5b8b49
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b8b50
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b8b58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b8d5e
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b8ca7
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b8ca7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b8ca0
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 5
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b8c58
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x258
mov cx, 3
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b8d5e
mov eax, dword [esi + 0x380]
mov eax, dword [eax + 0x2e0]
cmp eax, dword [esi + 0x2e0]
jne 0x5b8d57
mov ebp, dword [esi + 0x380]
mov edi, dword [ebp + 0x24]
mov eax, dword [esi + 0x24]
sub eax, edi
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
cmp ecx, 4
jg 0x5b8d46
mov eax, dword [esi + 0x380]
push dword [eax + 0x24]
mov eax, dword [esi + 0x24]
pop edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp ecx, 4
jg 0x5b8d46
mov eax, dword [esi + 0x28]
push eax
mov edx, dword [ebp + 0x28]
mov eax, edi
mov ecx, dword [esi + 0x24]
call fcn.00641644
movzx eax, al
push eax
push 5
lea eax, [esi + 0xbec]
push eax
lea eax, [esi + 0xbf0]
push eax
mov edx, dword [esi + 0x380]
mov ecx, dword [edx + 0x28]
mov edx, dword [edx + 0x24]
mov eax, dword [esi + 0x2e0]
call fcn.0066f574
mov ecx, dword [esi + 0xbf0]
mov edx, dword [esi + 0xbec]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b8d5e
mov ecx, dword [ebp + 0x28]
mov edx, edi
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b8d5e
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b9258
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5b946b
mov dl, 2
mov eax, esi
call fcn.005bb41c
dec eax
jle 0x5b945b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b9457
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, ebx
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
sub edx, 2
add eax, 2
sub eax, edx
jl 0x5b9450
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
sub edx, 2
add eax, 2
sub eax, edx
jl 0x5b9442
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 0x2e0]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
call fcn.0066dba0
test al, al
je 0x5b9434
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5b9434
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5b9434
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbfc
test eax, eax
je 0x5b9426
cmp byte [eax], 1
jne 0x5b9426
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5b9426
cmp byte [ebx + 0x2e4], 0
jne 0x5b9426
cmp byte [ebx + 0x2ec], 0
jne 0x5b9426
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b9426
cmp byte [ebx + 0x319], 0
je 0x5b93d4
cmp byte [esi + 0x31b], 0
je 0x5b9426
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.0060fa20
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5b9426
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.0060fdd0
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x1f4
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5b9377
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5b9329
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5b930d
mov eax, esi
call fcn.0060f4c4
mov al, 1
jmp 0x5b946b
push 0x1391
mov edx, ebx
mov cl, 2
mov eax, esi
call fcn.005baa20
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x5b9474
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b95d9
push 0x1391
mov edx, edi
mov cl, 2
mov eax, esi
call fcn.005baa20
test al, al
jne 0x5b95d7
mov ecx, 7
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.005bae60
test al, al
je 0x5b95d9
mov eax, dword [esi + 0x380]
push eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.00611a38
test al, al
je 0x5b95d9
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b95d3
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx eax, word [esi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, esi
call fcn.00612ef8
mov ebx, eax
mov eax, dword [esi + 0x380]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
push 0
push 0x190
mov cx, 5
mov dx, 0xea
mov eax, esi
call fcn.0060aa6c
push ebx
mov ecx, dword [esi + 0x380]
movzx eax, word [ecx + 0x24]
movzx edx, word [ecx + 0x28]
shl edx, 0x10
or eax, edx
push eax
push 3
mov eax, dword [esi + 0x380]
push eax
push 0
mov eax, dword [ecx + 0x24]
sub eax, dword [esi + 0x24]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 0x28]
sub eax, dword [esi + 0x28]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sar ebx, 1
jns 0x5b95b0
adc ebx, 0
mov eax, ebx
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x320
push eax
mov edx, esi
mov eax, esi
mov cx, 0xdc
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b95d9
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b95e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor ebx, ebx
mov esi, dword [edi + 0x380]
test esi, esi
je 0x5b97ac
lea ecx, [esp + 0x18]
mov edx, esi
mov eax, edi
call fcn.006084d8
test al, al
je 0x5b977f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [edi + 0x3fc]
cmp eax, dword [edi + 0xb60]
jle 0x5b977b
movzx eax, byte [esp + 0x18]
mov byte [edi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [edi + 0x384], eax
xor esi, esi
xor eax, eax
mov dword [esp + 4], eax
push 1
mov ecx, dword [edi + 0x112]
shr ecx, 0x10
movzx eax, word [edi + 0x112]
sub cx, ax
movsx ecx, cx
movzx edx, ax
mov eax, edi
call fcn.00612ef8
mov dword [esp + 8], eax
movzx eax, byte [edi + 0x2c]
movzx edx, byte [esi + 0x6b7250]
add eax, edx
and eax, 7
mov dword [esp], eax
mov eax, dword [esp]
push eax
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x2e0]
call fcn.0066f574
test al, al
je 0x5b9727
push 1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x2e0]
call fcn.0066f8e0
mov ebx, eax
test ebx, ebx
je 0x5b9727
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b9727
inc dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, edi
mov eax, ebx
call fcn.0060fa20
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x5b9727
lea edx, [esp + 0xc]
mov ecx, edi
mov eax, ebx
call fcn.0060fdd0
movzx eax, word [esp + 0xc]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push edi
push 0
push 0x190
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc esi
cmp esi, 3
jl 0x5b9670
cmp dword [esp + 4], 1
jle 0x5b9758
push 0
push 0
mov eax, dword [edi + 0x380]
push eax
push 0
push 0
movzx ecx, byte [edi + 0x2c]
mov dx, 0xc0
mov eax, edi
call fcn.0060aa6c
jmp 0x5b9774
movzx eax, byte [edi + 0x2c]
push eax
mov eax, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, edi
call fcn.0060f9fc
mov eax, edi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b97ac
mov eax, dword [edi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [edi + 0x2e0]
jne 0x5b97a5
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b97ac
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x5b97b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x380], 0
je 0x5b9969
cmp byte [esi + 0xc20], 0
je 0x5b982f
cmp byte [esi + 0xc2c], 0
jne 0x5b982f
mov eax, edi
mov byte [esi + 0x2c], al
mov byte [esi + 0xc2c], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, edi
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b9969
mov ecx, esp
mov edx, dword [esi + 0x380]
mov eax, esi
call fcn.006084d8
test al, al
je 0x5b993c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b9938
mov eax, edi
mov byte [esi + 0x2c], al
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.00612ef8
mov dword [esp + 4], eax
cmp byte [esi + 0xc20], 0
je 0x5b98cb
mov ecx, dword [esp + 4]
mov edx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fa20
add eax, eax
mov dword [esp + 8], eax
fild dword [esp + 8]
call fcn.00403560
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5b9915
lea edx, [esp + 4]
mov ecx, esi
mov eax, dword [esi + 0x380]
call fcn.0060fdd0
movzx edx, word [esp + 4]
push edx
mov eax, dword [esi + 0x380]
movzx edx, word [eax + 0x11e]
push edx
movzx edx, word [eax + 0x122]
push edx
push esi
push 0
push 0xc8
mov cx, 0xa4
mov edx, 0x9e
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [esi + 0x2c]
push eax
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x28]
push eax
mov cx, 0x1391
mov dx, 0x9a
mov eax, esi
call fcn.0060f9fc
mov eax, esi
call fcn.0060f4c4
mov bl, 1
jmp 0x5b9969
mov eax, dword [esi + 0x380]
mov edx, dword [eax + 0x2e0]
cmp edx, dword [esi + 0x2e0]
jne 0x5b9962
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x84]
jmp 0x5b9969
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5b9974
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov ebx, edx
mov esi, eax
xor eax, eax
cmp dword [esi + 0x380], 0
je 0x5b9b92
mov dl, 2
mov eax, esi
call fcn.005bb41c
dec eax
jle 0x5b9b82
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x3fc]
cmp eax, dword [esi + 0xb60]
jle 0x5b9b7e
mov byte [esi + 0x2c], bl
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3fc], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x384], eax
push 0
push 0
mov eax, dword [esi + 0x380]
push eax
push 0
push 0
mov ecx, ebx
mov dx, 0xc0
mov eax, esi
call fcn.0060aa6c
push 1
mov ecx, dword [esi + 0x112]
shr ecx, 0x10
movzx ebx, word [esi + 0x112]
sub cx, bx
movsx ecx, cx
movzx edx, bx
mov eax, esi
call fcn.00612ef8
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [0x5b9b98]
call fcn.00403560
mov dword [esp], eax
mov eax, dword [esi + 0x24]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5b9b77
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x28]
mov edx, eax
dec edx
inc eax
sub eax, edx
jl 0x5b9b69
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 0x2e0]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
call fcn.0066dba0
test al, al
je 0x5b9b5b
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], 0
je 0x5b9b5b
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5b9b5b
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
call fcn.0041fbfc
test eax, eax
je 0x5b9b4d
cmp byte [eax], 1
jne 0x5b9b4d
mov ebx, dword [eax + 1]
test ebx, ebx
je 0x5b9b4d
cmp byte [ebx + 0x2e4], 0
jne 0x5b9b4d
cmp byte [ebx + 0x2ec], 0
jne 0x5b9b4d
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
test al, al
je 0x5b9b4d
cmp byte [ebx + 0x319], 0
je 0x5b9afb
cmp byte [esi + 0x31b], 0
je 0x5b9b4d
mov ecx, dword [esp]
mov edx, esi
mov eax, ebx
call fcn.0060fa20
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5b9b4d
lea edx, [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.0060fdd0
movzx eax, word [esp + 4]
push eax
movzx eax, word [ebx + 0x11e]
push eax
movzx eax, word [ebx + 0x122]
push eax
push esi
push 0
push 0x190
mov cx, 0xa4
mov edx, 0x9e
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x18]
inc dword [esp + 0x10]
dec dword [esp + 0x20]
jne 0x5b9a9e
inc dword [esp + 0xc]
dec dword [esp + 0x1c]
jne 0x5b9a50
inc dword [esp + 8]
dec dword [esp + 0x18]
jne 0x5b9a38
mov eax, esi
call fcn.0060f4c4
mov al, 1
jmp 0x5b9b92
push 0x1391
mov edx, ebx
mov cl, 2
mov eax, esi
call fcn.005baa20
add esp, 0x28
pop esi
pop ebx
ret