Masking schemes are classical countermeasures against Side-Channel Attacks on cryptographic implementations. This paper investigates the eectiveness of masking when the code does not run in constant time. We prove that in this case, a rst-order Correlation Power Analysis can break an otherwise perfect masking scheme. Furthermore, with an in-depth leakage analysis on traces generated at a pre-silicon stage, we pinpoint the leaking instructions and recover a complex leakage model.