joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40efe2
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov ebp, ecx
lea eax, [esp + 0x1c]
push edi
push 0x20
push dword [esp + 0x48]
mov esi, dword [ebp + 4]
sub esi, 6
mov dword [esp + 0x18], ebp
push eax
mov dword [esp + 0x24], esi
call fcn.00420320
add esp, 0xc
xor ebx, ebx
xor edx, edx
xor edi, edi
test esi, esi
jle 0x40f062
cmp ebx, dword [ebp + 4]
jg 0x40f1c6
cmp edi, esi
jge 0x40f04f
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x40f04b
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x40f02b
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x40f055
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x40f016
cmp ebx, dword [ebp + 4]
jg 0x40f1c6
mov edi, 0x43e198
movzx eax, byte [esp + esi*4 + 0x1d]
mov cl, byte [esp + 0x20]
xor cl, byte [eax + 0x43e098]
mov byte [esp + 0x20], cl
movzx eax, byte [esp + esi*4 + 0x1e]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x21], al
movzx eax, byte [esp + esi*4 + 0x1f]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x22], al
movzx eax, byte [esp + esi*4 + 0x1c]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x23], al
mov al, byte [edi]
xor al, cl
inc edi
mov byte [esp + 0x20], al
mov dword [esp + 0x1c], edi
cmp esi, 8
je 0x40f0f3
cmp esi, 1
jle 0x40f0e7
lea eax, [esi - 1]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], eax
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x40f0d5
sub dword [esp + 0x14], 1
jne 0x40f0d2
xor edi, edi
test esi, esi
jle 0x40f1b9
jmp 0x40f171
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 3
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x40f102
sub dword [esp + 0x14], 1
jne 0x40f0ff
movzx eax, byte [esp + 0x2c]
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 3
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x30], al
movzx eax, byte [esp + 0x2d]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x31], al
movzx eax, byte [esp + 0x2e]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x32], al
movzx eax, byte [esp + 0x2f]
mov al, byte [eax + 0x43e098]
xor byte [esp + 0x33], al
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x40f15f
sub dword [esp + 0x14], 1
jne 0x40f15c
cmp ebx, dword [ebp + 4]
jg 0x40f1bc
cmp edi, esi
jge 0x40f1a6
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x40f1a2
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x40f182
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x40f1ac
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x40f171
cmp ebx, dword [ebp + 4]
mov edi, dword [esp + 0x1c]
jle 0x40f070
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x403050
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403064
inc dword [0x4c0e78]
add dword [0x4bd4c4], 0xf8
mov edx, dword [0x4bd4c4]
push esi
push edi
mov ecx, 0x3e
mov esi, 0x4bf970
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403093
push 0
mov eax, 0x4c3000
call fcn.00414e70
cmp dword [0x4c0ea0], 0
mov dword [0x4c38a0], 0
mov dword [0x4c38a4], 0
je 0x4030bb
push 0x4c1690
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40313f
or ecx, 0xffffffff
cmp byte [esi + 0xe6], 0
jne 0x4030ea
xor eax, eax
cmp byte [esp + 0x14], 0x64
sete al
mov byte [esi + 0xe6], al
test al, al
je 0x4030ea
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c38ac], 0
je 0x4030fc
cmp dword [0x4c38a8], 0
jne 0x403105
cmp byte [esi + 0xe6], 0
je 0x40313f
cmp byte [esi + 0xe6], 0
mov byte [esi + 0xe4], 0
jne 0x40313f
cmp dword [0x4c38ac], 0
jge 0x403127
pop edi
mov dword [esi + 0xd8], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd4], eax
mov edx, dword [0x4c38ac]
mov dword [esi + 0xd8], edx
pop edi
pop esi
ret
Function at 0x403d20
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x403d43
call fcn.00404030
test eax, eax
jne 0x403d43
push str.Cant_open_clipboard_for_writing.
call fcn.00403e20
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403d7c
cmp dword [esi + 0x18], ebx
je 0x403d6e
cmp dword [esi + 8], ebx
je 0x403d63
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49c414
call fcn.00403e20
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x403db5
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x403ddc
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x403ddc
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x403dd2
cmp dword [esi + 8], ebx
je 0x403dc7
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403df1
mov dword [esi + 4], ebx
jmp 0x403db5
cmp dword [esi + 0x18], ebx
je 0x403e0e
cmp dword [esi + 8], ebx
je 0x403e03
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49c434
call fcn.00403e20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x403ef0
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
lea eax, [esi - 0xc000]
sub esp, 0x20c
cmp eax, 0x3fff
ja 0x403f8d
push 0x104
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.00482612
add esp, 0xc
test eax, eax
je 0x403f84
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x403f84
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x403f84
lea edx, [esp]
push str.Native
push edx
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x403f84
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x403f93
xor eax, eax
add esp, 0x20c
ret
xor ecx, ecx
mov word [esp], cx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push edi
call ebx
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
mov ebp, eax
call edi
test eax, eax
jne 0x404020
lea ecx, [ecx]
cmp esi, 0xf
je 0x40401e
lea edx, [esp + 0xc]
push str.OwnerLink
push edx
call fcn.00481dd9
add esp, 8
test eax, eax
je 0x40401e
mov eax, dword [0x4bd3bc]
cmp eax, 0xffffffff
je 0x403fea
test eax, eax
je 0x40401e
call ebx
mov ecx, dword [0x4bd3bc]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40401e
push 1
push 0x8000012f
mov dword [0x4bd3c0], 0
call fcn.00401350
add esp, 8
push esi
mov dword [0x4bd3c0], 1
call edi
test eax, eax
je 0x403fb0
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x404030
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x4040ba
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x4c0d1c]
push eax
call ebx
test eax, eax
jne 0x4040af
mov eax, dword [0x4bd3bc]
cmp eax, 0xffffffff
je 0x40407f
test eax, eax
je 0x4040c6
call esi
mov ecx, dword [0x4bd3bc]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4040c6
push 1
push 0x8000012f
mov dword [0x4bd3c0], 0
call fcn.00401350
mov edx, dword [0x4c0d1c]
add esp, 8
push edx
mov dword [0x4bd3c0], 1
call ebx
test eax, eax
je 0x404060
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407470
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4bfc28], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x40752b
mov al, byte [0x4bfc2a]
cmp al, 0xa0
je 0x407496
cmp al, 0x10
jne 0x40752b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4bfc24]
cmp eax, 0x16
jae 0x40752b
test ebp, 0x100
jne case.0x4074c7.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x4074c7.13
movzx eax, byte [eax + 0x4076d4]
jmp dword [eax*4 + 0x4076cc]
mov cl, 1
jmp 0x4074d4
xor cl, cl
cmp byte [0x4bfc29], 0
jne 0x4074f1
xor ecx, ecx
nop
cmp byte [ecx + 0x4bfc0c], 0
jne 0x4074fc
inc ecx
cmp ecx, 0x16
jl 0x4074e0
jmp 0x40752b
cmp byte [esp + 0x1c], 0
je 0x407505
test cl, cl
je 0x40752b
mov byte [0x4bfc2b], 1
jmp 0x407509
test cl, cl
je 0x40752b
mov cl, byte [0x4bfc23]
mov dl, byte [0x4bfc22]
mov al, byte [0x4bfb2f]
mov byte [0x4c0d1b], cl
mov byte [0x4c0d50], dl
mov byte [0x4c0de0], al
mov cl, byte [0x4c0d1b]
movzx esi, byte [esp + 0x14]
mov dl, byte [0x4c0d50]
mov al, byte [0x4c0de0]
mov byte [0x4bfc23], cl
lea ecx, [esi + esi*8]
mov byte [0x4bfc22], dl
mov edx, dword [0x4c18c0]
shl ecx, 5
mov bl, byte [ecx + edx + 4]
mov byte [0x4bfb2f], al
test bl, bl
je case.default.0x4076a2
cmp dword [edi + 0x10], 0xffc3d44f
setne dl
test byte [edi + 8], 0x10
mov byte [esp + 0xf], dl
je 0x407582
xor al, al
jmp 0x407597
mov eax, dword [esp + 0x1c]
push eax
mov al, byte [esp + 0x18]
call fcn.00407730
mov dl, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], al
je 0x40766e
cmp byte [esp + 0x20], 0
jne 0x4075c1
mov cl, bl
not cl
and byte [0x4c0d19], cl
test dl, dl
je 0x4075c1
and byte [0x4c0d1a], cl
cmp byte [esp + 0x18], 0
je case.default.0x4076a2
not bl
and byte [0x4c0d1b], bl
lea ecx, [esi - 0xa0]
mov byte [esi + 0x4c0d40], 0
cmp ecx, 5
ja case.default.0x4076a2
jmp dword [ecx*4 + 0x4076f8]
mov cl, byte [0x4c0de1]
mov byte [0x4c0d50], cl
jmp case.default.0x4076a2
mov dl, byte [0x4c0de0]
mov byte [0x4c0d50], dl
jmp case.default.0x4076a2
mov al, byte [0x4c0de3]
mov byte [0x4c0d51], al
jmp case.default.0x4076a2
mov cl, byte [0x4c0de2]
mov byte [0x4c0d51], cl
jmp case.default.0x4076a2
mov dl, byte [0x4c0de5]
mov byte [0x4c0d52], dl
jmp case.default.0x4076a2
mov al, byte [0x4c0de4]
mov byte [0x4c0d52], al
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4bfc2c], bp
pop ebp
mov byte [0x4bfc2a], al
mov byte [0x4bfc29], cl
pop ebx
je 0x4076b0
xor al, al
mov byte [0x4bfc28], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bfc24], eax
pop ecx
ret
cmp byte [esp + 0x20], 0
jne 0x407685
or byte [0x4c0d19], bl
test dl, dl
je 0x407685
or byte [0x4c0d1a], bl
test al, al
je case.default.0x4076a2
or byte [0x4c0d1b], bl
lea ecx, [esi - 0xa0]
mov al, 0x80
mov byte [esi + 0x4c0d40], al
cmp ecx, 5
ja case.default.0x4076a2
jmp dword [ecx*4 + 0x407710]
mov byte [0x4c0d50], al
jmp case.default.0x4076a2
push ecx
call fcn.00407730
add esp, 4
mov byte [0x4bfc28], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bfc24], eax
pop ecx
ret
Function at 0x407730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x40773f
cmp al, 0x10
jne case.0x407796.13
cmp byte [esp + 8], 0
jne case.0x407796.13
cmp byte [0x4bfc2b], 0
je 0x40776b
xor eax, eax
cmp byte [eax + 0x4bfc0c], 0
jne 0x40776b
inc eax
cmp eax, 0x16
jl 0x407751
mov byte [0x4bfc2b], 0
xor al, al
pop esi
ret
cmp byte [0x4bfc29], 0
je case.0x407796.13
test dword [0x4bfc2c], 0x100
jne case.0x407796.13
movzx eax, byte [0x4bfc2a]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407796.13
movzx eax, byte [eax + 0x4077c0]
jmp dword [eax*4 + 0x4077b8]
call esi
sub eax, dword [0x4bfc24]
cmp eax, 0x16
jb 0x407767
call esi
mov dword [0x4c3c30], eax
mov al, 1
pop esi
ret
Function at 0x4085c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4c0e4c], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x4085e4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4c0e50], 0
je 0x4085f3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408800
test al, al
jne 0x408636
cmp byte [ebp + 0xc], al
jne 0x408636
push 0x4bfc08
push 0
push 0
push 0x4088d0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c3c44], eax
test eax, eax
je 0x4086c7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4bfc08]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40866c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408646
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4086d3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x40873a
cmp dword [esp + 0x2c], 0
je 0x4086e2
mov byte [esp + 0x1f], 1
call fcn.00408c80
test al, al
jne 0x4086e2
cmp byte [ebp + 0xc], al
jne 0x4087ce
mov byte [ebp + 8], al
jmp 0x408681
call fcn.00408ca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x40871e
call fcn.00408c80
test al, al
jne 0x40873a
cmp byte [ebp + 0xc], 0
jne 0x4087c7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4c0e4c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408772
test byte [esp + 0x1e], 1
jne 0x40878b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4c18ac], eax
jmp 0x40878b
mov ecx, dword [0x4c3c44]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408752
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x4086e2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408681
mov edx, dword [0x4c3c44]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4c3c44], 0
call fcn.00408ca0
jmp 0x4086f2
test byte [esp + 0x1e], 1
je 0x40878b
mov eax, dword [0x4c18ac]
push eax
call edi
mov dword [0x4c18ac], 0
cmp dword [0x4c0e50], 0
je 0x4087ad
test byte [esp + 0x1e], 2
jne 0x4087c7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4c18b0], eax
jmp 0x4087c7
test byte [esp + 0x1e], 2
je 0x4087c7
mov ecx, dword [0x4c18b0]
push ecx
call edi
mov dword [0x4c18b0], 0
cmp byte [esp + 0x1f], 0
je 0x408800
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
mov dword [0x4bd3c0], 0
call fcn.0046b2c0
add esp, 0x18
mov dword [0x4bd3c0], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409e40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1038
call fcn.004932a0
cmp byte [0x4c3c48], 0
push esi
push edi
jne 0x409ff9
cmp dword [0x4c18cc], 0
jne 0x409e73
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c18cc], eax
mov edi, 1
add dword [0x4c3c4c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4c3c4c]
mov esi, dword [0x4bd3d4]
mov ecx, eax
sub ecx, dword [0x4c18cc]
mov dword [0x4c18d0], eax
cmp edx, dword [0x4bd3d0]
jbe 0x409f29
cmp ecx, esi
jae 0x409f29
push ecx
push edx
mov dword [esp + 0x44], edi
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x4c]
call fcn.00466f40
add esp, 0xc
call fcn.00409090
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
mov eax, edi
push 4
push eax
mov byte [0x4c3c48], 1
mov dword [0x4bd3c0], 0
call fcn.0046b2c0
add esp, 0x18
cmp eax, 7
jne 0x409f0d
push 0
push 0
push 1
mov ecx, 0x4c3000
call fcn.004151b0
mov eax, dword [0x4c18d0]
mov edx, dword [esp + 0x3c]
mov dword [0x4bd3c0], 1
mov byte [0x4c3c48], 0
jmp 0x409f2f
xor edx, edx
cmp ecx, esi
jbe 0x409f46
mov dword [0x4c3c4c], 0
mov dword [0x4c18cc], eax
test edx, edx
jne 0x409ff9
mov esi, dword [ebp + 8]
mov cl, byte [esi + 0x11]
mov byte [0x4c387a], cl
cmp byte [esi + 0x1a], 0
je 0x409fbd
cmp byte [esi + 0x1b], 0
je 0x409fbd
mov byte [esp + 0x3b], 1
call fcn.0040b8c0
mov ecx, dword [0x4bd4c4]
inc byte [ebx + 0x1f]
mov eax, dword [ebx]
mov esi, dword [ecx + 0xbc]
push 0
push 0
mov dword [ecx + 0xbc], eax
mov ecx, dword [eax + 4]
push 1
call fcn.00423660
mov edx, dword [0x4bd4c4]
mov dword [edx + 0xbc], esi
dec byte [ebx + 0x1f]
cmp byte [esp + 0x3b], 0
mov edi, eax
je 0x409fad
mov esi, dword [ebp + 8]
call fcn.0040b7f0
test edi, edi
jne 0x409fc4
mov byte [ebx + 0x23], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 0x3b], 0
jmp 0x409f68
cmp byte [ebx + 0x23], 0
je 0x409ff9
mov byte [ebx + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 4]
cmp eax, 0x3e8
ja 0x409ff9
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov edx, dword [0x4c0d1c]
push 0
push ecx
push 0x312
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40e4c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push esi
mov esi, eax
movzx eax, word [esp + 0x44]
lea ecx, [esp + 0x20]
test eax, 0xffffff80
je 0x40e4e4
mov ecx, 0x30
mov word [esp + 0x20], cx
lea ecx, [esp + 0x22]
push 0xa
push ecx
push eax
call fcn.00481b55
add esp, 0xc
test esi, esi
jle 0x40e5a7
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, esi
cmp dword [0x4c28e8], 0
jne 0x40e55f
call edi
sub eax, dword [0x4c38b4]
mov edx, dword [0x4bd4c4]
cmp eax, dword [edx + 0xd0]
jbe 0x40e55f
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40e558
push 1
push 0xffffffffffffffff
mov dword [0x4bd3c0], 0
call fcn.00401350
add esp, 8
mov dword [0x4bd3c0], 1
call edi
mov dword [0x4c38b4], eax
cmp dword [0x4c28e8], 2
je 0x40e573
mov esi, dword [esp + 0x4c]
call fcn.0040cb60
jmp 0x40e57c
lea eax, [esp + 0x28]
call fcn.0040e5b0
cmp dword [0x4c28e8], 2
jne 0x40e590
mov ecx, dword [0x4bd4c4]
mov esi, dword [ecx + 0x60]
jmp 0x40e599
mov edx, dword [0x4bd4c4]
mov esi, dword [edx + 0x5c]
call fcn.004104e0
dec ebp
jne 0x40e502
pop edi
pop ebp
pop esi
add esp, 0x3c
ret

Function at 0x40e5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4c28e8], 0
push esi
mov esi, eax
je 0x40e5c7
mov al, byte [0x4bfc48]
jmp 0x40e6be
cmp dword [0x4c0e4c], 0
je 0x40e5da
mov al, byte [0x4c0d19]
jmp 0x40e6be
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e5f7
mov bl, 0x10
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
je 0x40e60b
or bl, 0x20
push 0xa2
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e61f
or bl, 1
push 0xa3
call edi
mov edx, 0x8000
test dx, ax
je 0x40e633
or bl, 2
push 0xa4
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e647
or bl, 4
push 0xa5
call edi
mov edx, 0x8000
test dx, ax
je 0x40e65b
or bl, 8
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e66c
or bl, 0x40
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40e67d
or bl, 0x80
cmp dword [0x4c0e4c], 0
je 0x40e6ba
mov al, bl
not al
and al, byte [0x4c0d19]
je 0x40e6ba
mov cl, byte [0x4c0d1b]
not al
and byte [0x4c0d19], al
and byte [0x4c0d1a], al
and cl, al
mov al, cl
mov byte [0x4c0d1b], cl
mov ecx, 0x4c0d40
call fcn.00411070
pop edi
mov al, bl
pop ebx
mov byte [esp + 4], al
mov ecx, dword [esp + 4]
push 1
and al, 0xc4
push 0
or al, 4
movzx edx, al
push 0
push ecx
push edx
mov eax, 0xffc3d44f
call fcn.004108c0
movzx eax, word [esi]
add esp, 0x14
cmp eax, 0x30
jb 0x40e71f
lea ebx, [ebx]
cmp ax, 0x39
ja 0x40e71f
mov al, byte [esi]
push 0xffc3d44d
push 0
add al, 0x30
push 0
movzx ecx, al
push 0
push ecx
push 2
call fcn.0040e9a0
movzx eax, word [esi + 2]
add esi, 2
add esp, 0x18
cmp eax, 0x30
jae 0x40e6f0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
call fcn.0040e9a0
add esp, 0x18
pop esi
pop ecx
ret
Function at 0x40fdc0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [ebp]
push edi
cmp esi, 0x80000000
je 0x40ff6c
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
cmp eax, 0x80000000
je 0x40ff6c
mov edx, dword [0x4c28e8]
cmp edx, 2
jne 0x40fe3d
movzx ebx, byte [esp + 0x2c]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
mov edi, eax
call fcn.00410140
add esp, 4
call fcn.004105b0
cmp byte [esp + 0x2c], 0
je 0x40ff6c
mov eax, dword [esp + 0x24]
mov dword [ebp], SysReAllocString
mov dword [eax], SysReAllocString
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x2c], 0
je 0x40fe93
cmp edx, 1
jne 0x40fe79
cmp dword [0x4bfc40], 0x80000000
jne 0x40fe66
push 0x4bfc40
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x4bfc40]
add dword [ebp], ecx
mov edx, dword [0x4bfc44]
add dword [edi], edx
jmp 0x40fea8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add dword [ebp], ecx
add dword [edi], edx
jmp 0x40fea8
mov eax, dword [0x4bd4c4]
test byte [eax + 0xe8], 2
jne 0x40fea8
mov ebx, ebp
call fcn.004682d0
cmp dword [0x4c28e8], 1
jne 0x40fec2
mov ecx, dword [ebp]
mov dword [0x4bfc40], ecx
mov edx, dword [edi]
mov dword [0x4bfc44], edx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov ebx, eax
call esi
mov esi, eax
mov eax, dword [ebp]
shl eax, 0x10
cdq
idiv ebx
inc eax
mov dword [ebp], eax
mov eax, dword [edi]
shl eax, 0x10
cdq
idiv esi
lea ecx, [eax + 1]
mov eax, dword [esp + 0x28]
mov dword [edi], ecx
test eax, eax
js 0x40ff55
cmp eax, 0x64
jle 0x40ff05
mov dword [esp + 0x28], 0x64
jmp 0x40ff09
test eax, eax
je 0x40ff55
cmp dword [0x4c28e8], 1
je 0x40ff55
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x28]
mov edx, dword [edi]
mov eax, dword [ebp]
push ecx
push edx
push eax
mov eax, dword [esp + 0x20]
shl eax, 0x10
cdq
idiv esi
mov esi, eax
mov eax, dword [esp + 0x1c]
shl eax, 0x10
cdq
idiv ebx
lea ecx, [eax + 1]
lea eax, [esi + 1]
call fcn.0044da00
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [ebp]
push 0x8001
xor eax, eax
call fcn.0040ff80
add esp, 4
call fcn.004105b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret