joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
push edi
xor bl, bl
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], bl
mov byte [esp + 0x88], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x89]
mov byte [esp + 0xec], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x3f
mov dword [esp + 0x11], eax
lea edi, [esp + 0xed]
mov dword [esp + 0x15], eax
mov byte [esp + 0x10], bl
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xec]
push ecx
stosb byte es:[edi], al
call fcn.00410510
mov edi, str.register.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xec]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xec]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x28]
push 0x64
lea edx, [esp + 0x18]
push ecx
push edx
push str.Name
push str.zbshareware
call esi
lea eax, [esp + 0x24]
push eax
call fcn.00410e00
add esp, 4
test al, al
jne 0x4170b3
mov byte [0x423220], bl
mov edi, 0x607
lea edx, [esp + 0xec]
lea eax, [esp + 0x88]
push edx
push 0x64
lea ecx, [esp + 0x18]
push eax
push ecx
push str.Code
push str.zbshareware
call esi
lea edx, [esp + 0x88]
push edx
call fcn.00410e90
add esp, 4
test al, al
jne 0x4170cc
mov byte [0x423220], bl
jmp 0x4170e6
cmp byte [0x423220], bl
je 0x41706f
lea ecx, [esp + 0x24]
push ecx
call fcn.00410fd0
add esp, 4
mov edi, eax
jmp 0x417074
cmp byte [0x423220], bl
je 0x4170e6
lea eax, [esp + 0x88]
push eax
call fcn.00411030
add esp, 4
jmp 0x4170eb
mov eax, 0xd4
cmp edi, eax
je 0x417107
pop edi
pop esi
mov byte [0x423220], bl
pop ebp
mov byte [0x4230fc], 1
pop ebx
add esp, 0x1dc
ret
mov al, byte [0x423220]
mov byte [0x4230fc], bl
cmp al, bl
jne 0x41711d
mov byte [0x4230fc], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret

Function at 0x40894e
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
sub ecx, ecx
dec ecx
call fcn.00408966
or ecx, ecx
xor dword [esi], edi
inc esi
inc ecx
cmp esi, eax
jne fcn.0040894e
ret
Function at 0x543ba0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..CQSN____1
lea edi, [esi - 0xe3000]
push edi
or ebp, 0xffffffff
jmp 0x543bc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x543bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543bb8
mov eax, 1
add ebx, ebx
jne 0x543bdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x543bec
jne 0x543bfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543bfc
dec eax
add ebx, ebx
jne 0x543bf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x543bd0
xor ecx, ecx
sub eax, 3
jb 0x543c14
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x543c86
sar eax, 1
mov ebp, eax
jmp 0x543c1f
add ebx, ebx
jne 0x543c1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x543c2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x543c50
inc ecx
add ebx, ebx
jne 0x543c3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x543c31
jne 0x543c4d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x543c31
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x543c70
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x543c61
jmp 0x543bbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x543c70
add edi, ecx
jmp 0x543bbe
pop esi
mov edi, esi
mov ecx, 0x4ca8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x543c8e
cmp byte [edi], 0x12
jne 0x543c8e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x543c93
lea edi, [esi + 0x140000]
mov eax, dword [edi]
or eax, eax
je 0x543d0b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x150258]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15030c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x543cc0
mov ecx, edi
jns 0x543cef
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x150310]
or eax, eax
je 0x543d05
mov dword [ebx], eax
add ebx, 4
jmp 0x543cdd
call dword [esi + 0x150314]
popal
jmp section..CQSN___
Function at 0x52b4a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
mov byte [esp], bh
lea esp, [esp]
call 0x52b4a4
adc eax, 0x124648d
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x52b4c4
push word [esp + 1]
mov dword [esp], eax
jmp 0x52b494
pushfd
neg ecx
jns 0x52b4f3
mov al, byte [esp]
mov esi, dword [esp]
mov edi, 0x229cda46
jmp 0x52b51d
mov al, byte [esp]
jmp 0x52b4fc
mov esi, dword [esp]
mov edi, 0x229cda46
jmp 0x52b51d

Function at 0x52b4ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
mov byte [esp], bh
lea esp, [esp]
call 0x52b4a4
adc eax, 0x124648d
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x52b4c4
push word [esp + 1]
mov dword [esp], eax
jmp 0x52b494
pushfd
neg ecx
jns 0x52b4f3
mov al, byte [esp]
mov esi, dword [esp]
mov edi, 0x229cda46
jmp 0x52b51d
mov al, byte [esp]
jmp 0x52b4fc
mov esi, dword [esp]
mov edi, 0x229cda46
jmp 0x52b51d
Function at 0x66deab
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
pop dword [esp + 3]
push dword [esp + 8]
push edx
xor ebx, esi
bswap ebx
jmp 0x66ded0
lea ecx, [ecx + 0x3b]
clc
neg eax
inc al
xchg ecx, edx
bsr di, bp
jmp 0x66de76
xchg edi, ebp
mov dl, dh
stc
clc
lea ecx, [esp + edi]
jmp 0x66de90
pop ebp
clc
inc al
pop dword [esp + 3]
mov dl, 0xc4
add esp, 0xc
jmp 0x66df13
mov cl, 0x4a
bswap eax
xor bp, 0x17a4
mov dword [esp + 0x11], eax
mov ch, byte [esp + 0x14]
sete dh
jmp 0x66deb6
neg esi
mov word [esp], dx
lea ebp, [ecx + 0xbb]
mov dh, byte [esp]
lea ebp, [ecx + 0x63]
lea esi, [ebx + esi]
jmp 0x66def4

Function at 0x66df2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
jmp 0x66df33
mov al, 0xbe
push word [esp]
sub esp, 0x14
lea ebx, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 5]
jmp 0x66df7f
mov dh, byte [esp + 0xf]
pop word [esp + 0x11]
bsr di, cx
add al, dh
sub esp, 0xa
rdtsc
jmp 0x66df5e

Function at 0x66ee6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
setp dh
xchg byte [esp + 0x2c], al
not dx
push edx
mov dx, 0x380d
jmp 0x66ee8e
jmp 0x66ee56
setne ah
mov ah, byte [esp + 5]
mov al, 0x26
mov bh, byte [esp + 0x16]
inc dl
xchg ah, bl
jmp 0x66eec2
pop ecx
xchg dx, cx
cld
xchg bp, bx
ror esi, 0x1b
mov dl, dh
jmp 0x66ee70
bswap edi
mov al, 0x56
popal
mov dword [esp + 2], eax
push word [esp + 0xe]
xchg dx, si
jmp 0x66ef99
neg edx
cpuid
neg si
lea eax, reloc.WINMM.dll_midiStreamOut
pop word [esp + 9]
xchg dword [esp + 0xf], edi
jmp 0x66ee9d
mov al, 0x96
push dword [esp + 0xa]
not dh
rdtsc
mov cx, 0x29d3
bswap edx
jmp 0x66ef02
mov ah, byte [esp + 0x10]
xchg byte [esp + 8], al
add esp, 2
lea esp, [esp + 3]
not esi
pop ax
jmp 0x66ef18
stc
xchg ch, dl
xchg bh, cl
lea ecx, [eax*4]
lea esi, [ecx + 0xe3]
lea esp, [esp]
jmp 0x66ef33
Function at 0x66f4b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1c
inc edx
not ebp
push edx
mov eax, dword [esp + 0x26]
rol di, cl
jmp 0x66f07f
xchg cx, dx
mov cx, 0xcc4b
setae ah
mov bx, 0x1b05
mov ah, byte [esp]
sub esp, 0x12
jmp 0x66efef
rcr ebp, 0x11
bswap edi
shr edi, 3
lea ecx, [ebx + esi]
xor dl, ch
btr edi, edx
jmp 0x66f060
lea ecx, [esi + edi]
xchg dx, cx
mov dx, 0x8eb5
xchg ebx, ebp
xchg bh, cl
cpuid
jmp 0x66f01e
bswap edx
mov bx, 0xa401
mov ax, word [esp]
mov bx, dx
mov ax, sp
bswap esi
jmp 0x66f035
mov eax, dword [esp]
xchg cx, bx
setbe ch
mov al, byte [esp]
mov bl, bh
not dh
jmp 0x66f0b5
lea ebx, [esi + 0x8d]
not di
sub esp, 0x1e
lea esp, [esp + 0x51]
rdtsc
xchg bp, ax
jmp 0x66f04c
btr ecx, esp
xchg bp, bx
neg bp
stc
shr ch, 5
mov si, word [esp + 2]
jmp 0x66f11e
setl ah
push edx
bswap edi
mov di, sp
xchg dword [esp], ebx
mov esi, dword [esp + 3]
jmp 0x66f095
mov edx, dword [esp]
mov bl, 0xd0
rdtsc
not esi
rdtsc
add ax, 0xd336
jmp 0x66f008
pop word [esp]
bsr bp, bp
pop bx
inc al
clc
xchg esi, eax
call fcn.0066f0e9
sub eax, dword [edx - 3]
int3
pop word [esp]
mov byte [esp], ch
push word [esp + 1]
xchg byte [esp + 2], dl
setle ah
bsf di, si
jmp 0x66f104
mov ecx, 0xd9c33b0
xchg di, ax
bswap ebx
lea eax, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 4]
mov ax, 0x4de9
jmp 0x66f0d5
bswap ecx
xchg word [esp + 1], bp
bsf bp, si
xchg byte [esp], al
mov bx, di
neg edi
jmp 0x66f18c
jmp 0x66f476

Function at 0x66f859
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 7], ch
lea edx, [eax*4]
jmp 0x66f8c9
xchg byte [esp + 0xc], al
pop word [esp + 0xb]
lea esp, [esp + 8]
rdtsc
inc di
lea eax, [esi*4]
mov edi, 0xc581bbf6
not si
mov ebp, 0x6a4264e4
jmp 0x66f866

Function at 0x66fc2d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push eax
jmp 0x66b016
call fcn.0066b01b
call 0x66f077
jmp 0x66fdab
movzx ebx, word [eax + 0x3c]
jmp 0x66fd5d
mov dword [esp], eax
push dword [esp + 4]
jmp 0x66fc3a
mov dword [esp + 2], esi
mov byte [esp + 5], ch
push word [esp + 9]
jmp 0x66fc84
mov dword [esp + 6], ebp
lea esp, [esp + 1]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x66fccb
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x66f072
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x66fcb0
xchg ecx, eax
invalid
sub eax, 0x10000
jmp 0x66fdaf
add ebx, eax
cmp word [ebx], 0x4550
je 0x66aef4
jne 0x66fd12
pop ss
mov ebx, dword [ebx]
jle 0x66fcfe
imul edi, dword [edi + reloc.WINMM.dll_midiStreamOut], 0xa939abdd
enter 0xffffffffffff9e3b, 0xffffffffffffff8b
xor al, 0xdd
stosd dword es:[edi], eax
cmp dword [ecx - reloc.WINMM.dll_midiStreamOut], ebp
sbb cl, byte [eax - 0x1014e511]
jg 0x66fd76
mov bh, byte [ecx + 0x32]
invalid
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x66f0a9
jne 0x66fd12
rcr byte [eax - 0x32], 0xa9
pop eax
out dx, eax
mov ch, 0x25
dec esp
mov edi, 0x34a6383a
push ebx
scasb al, byte es:[edi]
sub dword [edi - 0x25], edx
dec ebx
fisttp qword cs:[edi]
mov edi, 0x44b5d23c
mov byte [0xf899098b], al
or ebp, eax
sub ebp, dword [edx + reloc.WINMM.dll_midiStreamOut]
dec edi
iretd
Function at 0x401d64
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0xf]
xor ebx, ebx
sub eax, ebx
push edi
je 0x401e68
dec eax
je 0x401dc5
dec eax
je 0x401da0
dec eax
je 0x401d8e
push dword [esi + 0x10]
push dword [ebp + 8]
call dword [esi + 8]
jmp 0x401e06
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x401e21
mov byte [eax], bl
jmp 0x401e21
mov esi, dword [ebp + 8]
push esi
mov ecx, 0x466180
call fcn.00442b78
cmp eax, 0xffffffff
jne 0x401db5
xor eax, eax
cmp esi, ebx
je 0x401e73
mov byte [eax + esi], bl
jmp 0x401e73
cmp byte [0x46534d], bl
jne 0x401e25
cmp dword [esi + 4], ebx
jne 0x401e25
cmp dword [0x468f54], esi
mov edi, dword [ebp + 8]
jne 0x401de1
cmp edi, ebx
jne 0x401e11
push ebx
lea eax, [ebp + 0xb]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
je 0x401e0d
cmp edi, ebx
mov dword [0x468f54], ebx
je 0x401e0a
push edi
push dword [esi + 0x10]
call fcn.004389cc
pop ecx
pop ecx
jmp 0x401e73
dec eax
jmp 0x401e73
cmp edi, ebx
je 0x401e1b
mov byte [edi], bl
mov dword [0x468f54], ebx
jmp 0x401e21
mov dword [0x468f54], esi
xor eax, eax
jmp 0x401e73
mov edi, dword [ebp + 8]
cmp edi, ebx
mov eax, dword [esi + 4]
je 0x401e73
cmp eax, ebx
jne 0x401e37
mov byte [edi], bl
jmp 0x401e21
mov ecx, dword [esi]
cmp edi, ecx
je 0x401e73
cmp eax, 0x186a0
jb 0x401e5e
push eax
push ecx
push edi
call fcn.00455650
mov eax, dword [esi + 4]
add esp, 0xc
mov byte [edi + eax], bl
mov eax, dword [esi + 4]
jmp 0x401e73
mov byte [edi], al
inc edi
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x401e5a
mov byte [edi], bl
jmp 0x401e55
push dword [ebp + 8]
mov ecx, dword [esi + 4]
call fcn.00401d64
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40af17
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp byte [0x4651f0], bl
push esi
je 0x40b09a
cmp byte [0x463069], bl
je 0x40b09a
cmp dword [0x465370], ebx
jne 0x40b09a
cmp dword [0x465360], ebx
jg 0x40b09a
cmp byte [0x465364], bl
jne 0x40b09a
cmp byte [0x4651f1], bl
je 0x40b09a
mov eax, dword [0x46535c]
cmp eax, dword [0x463078]
jge 0x40b09a
mov esi, dword [0x4660f4]
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x40b09a
push edi
cmp byte [esi + 0x11], bl
je 0x40b06e
cmp byte [esi + 0x10], 1
jae 0x40b06e
mov eax, dword [esi + 0xc]
cmp eax, dword [0x465164]
jl 0x40b06e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub eax, dword [esi + 8]
cmp eax, dword [esi + 4]
jb 0x40b06e
cmp dword [ebp - 4], ebx
jne 0x40b006
mov ecx, dword [0x465b20]
inc dword [0x46535c]
push 0x80
call fcn.00401d39
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00438c79
push 0xc8
lea eax, [ebp - 0x14c]
push 0x465138
push eax
call fcn.00455650
add esp, 0x18
cmp byte [esi + 0x12], bl
mov dword [esi + 8], edi
je 0x40b015
mov ecx, esi
call fcn.0040aed7
inc dword [ebp - 4]
cmp dword [0x46537c], ebx
je 0x40b02b
push 0x465b28
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esi]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
push ebx
push ebx
push dword [esi + 0xc]
call fcn.0040b4ee
mov ecx, dword [esi]
add esp, 0x10
inc byte [esi + 0x10]
call fcn.0040595f
dec byte [esi + 0x10]
cmp byte [0x465351], bl
je 0x40b06e
push 0xa
push dword [0x465208]
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40b06e
mov byte [0x465351], bl
mov esi, dword [esi + 0x14]
cmp esi, ebx
jne 0x40af8f
cmp dword [ebp - 4], ebx
pop edi
je 0x40b09a
push ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040b337
add esp, 0xc
mov al, 1
jmp 0x40b09c
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x40e608
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
push edi
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
lea eax, [esi + 0x14]
jne 0x40e62d
lea eax, [ebp + 0x17]
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
jne 0x40e66f
push 0x459be0
push edi
call fcn.00438f35
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x40e66f
push 0x458844
push ebx
call fcn.00401a22
pop ecx
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
jne 0x40e66f
test esi, esi
je 0x40e66c
mov byte [esi + 0x18], 1
mov byte [ebx], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
push edi
call fcn.00413156
mov bl, al
add esp, 0x14
test bl, bl
mov byte [ebp + 0x14], bl
je 0x40e779
cmp byte [ebp + 0x10], 0
je 0x40e72b
cmp bl, 0x9e
je 0x40e6ae
cmp bl, 0x9f
jne 0x40e748
cmp byte [ebp + 0x18], 0
je 0x40e6cf
push 1
push 0
push 0xffffffffffffffff
push 0x459bdc
mov ecx, dword [0x465b20]
call fcn.00401592
jmp 0x40e7e9
push edi
push str.__s__is_not_allowed_as_a_prefix_key.
mov esi, 0x200
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00409c5f
add esp, 0x10
cmp byte [0x466134], 0
lea eax, [ebp - 0x210]
je 0x40e70d
push str.__The_current_thread_will_exit.
push esi
push eax
call fcn.00409cfa
add esp, 0xc
jmp 0x40e7d3
push 0
fldz
push ecx
push ecx
fstp qword [esp]
push 0
push 0x10000
push eax
call fcn.0043b5df
add esp, 0x18
jmp 0x40e7e9
test esi, esi
je 0x40e748
push 2
push 0x459b90
push edi
call fcn.00441854
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [esi + 0x19], al
push dword [ebp + 0x14]
call fcn.00444490
test byte [ebp - 1], 0x30
pop ecx
mov byte [ebp - 2], al
je 0x40e805
cmp bl, 0x41
jb 0x40e805
cmp bl, 0x5a
ja 0x40e805
and byte [ebp - 1], 0xcf
jmp 0x40e805
push edi
call fcn.00412efe
test ax, ax
pop ecx
jne 0x40e814
push 1
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0042247e
add esp, 0xc
test ax, ax
mov dword [ebp - 0xc], eax
jne 0x40e7ed
cmp byte [ebp + 0x18], al
je 0x40e7b5
push 1
push 0
push 0xffffffffffffffff
push 0x459b8c
jmp 0x40e6bf
test esi, esi
je 0x40e7e9
push edi
push str.__s__is_not_a_valid_key_name.__The_current_thread_will_exit.
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.00409c5f
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x4585d8
mov ecx, 0x465c88
push eax
call fcn.0044a7cd
xor eax, eax
jmp 0x40e84f
mov eax, dword [ebp - 8]
inc dword [0x466ed4]
mov byte [eax], 4
mov eax, dword [ebp - 0x10]
mov bl, al
mov byte [eax + 0x466ec4], 1
cmp byte [ebp - 2], 0
je 0x40e811
mov eax, dword [ebp - 8]
mov byte [eax], 2
mov eax, dword [ebp - 0xc]
cmp byte [ebp + 0x10], 0
je 0x40e827
test esi, esi
je 0x40e84c
mov byte [esi + 0x13], bl
mov word [esi + 0xa], ax
jmp 0x40e84c
test esi, esi
je 0x40e84c
mov word [esi + 8], ax
xor eax, eax
mov al, byte [ebp - 1]
mov byte [esi + 0x12], bl
and eax, 0xffffffd5
push eax
call fcn.0040fa37
or dword [esi + 0xc], eax
mov al, byte [ebp - 1]
and al, 0x2a
or byte [esi + 0x10], al
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f3dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
cmp byte [0x466eec], bl
mov dword [ebp - 8], ecx
jne 0x40f541
cmp dword [0x4663c4], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x40f40d
call edi
mov dword [0x4663c4], eax
inc dword [0x466ee8]
push esi
call edi
mov ecx, dword [0x466ee8]
mov esi, dword [0x463080]
mov edx, eax
sub edx, dword [0x4663c4]
cmp ecx, dword [0x46307c]
mov dword [0x4663c8], eax
jbe 0x40f4ae
cmp edx, esi
jae 0x40f4ae
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
xor esi, esi
lea eax, [ebp - 0x80c]
push 0x800
inc esi
push eax
mov dword [ebp - 0xc], esi
call fcn.00409c5f
add esp, 0x14
call fcn.0040f1d1
fldz
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
lea eax, [ebp - 0x80c]
push 4
push eax
mov byte [0x466eec], 1
mov byte [0x463069], bl
call fcn.0043b5df
add esp, 0x18
cmp eax, 7
jne 0x40f49a
push ebx
push ebx
push esi
mov ecx, 0x465c88
call fcn.004152c3
mov eax, dword [0x4663c8]
mov byte [0x463069], 1
mov byte [0x466eec], bl
jmp 0x40f4b5
cmp edx, esi
mov dword [ebp - 0xc], ebx
jbe 0x40f4c5
cmp dword [ebp - 0xc], ebx
mov dword [0x466ee8], ebx
mov dword [0x4663c4], eax
jne 0x40f53f
mov ecx, dword [ebp - 8]
mov al, byte [ecx + 0x11]
mov byte [0x466119], al
cmp byte [ecx + 0x1a], bl
je 0x40f50d
cmp byte [ecx + 0x1b], bl
je 0x40f50d
mov byte [ebp - 1], 1
call fcn.0040ec66
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
inc byte [esi + 0x19]
call fcn.0040595f
dec byte [esi + 0x19]
cmp byte [ebp - 1], bl
mov dword [ebp + 8], eax
je 0x40f503
mov ecx, dword [ebp - 8]
call fcn.0040f165
cmp dword [ebp + 8], ebx
jne 0x40f512
mov byte [esi + 0x1d], bl
jmp 0x40f53f
mov byte [ebp - 1], bl
jmp 0x40f4e3
cmp byte [esi + 0x1d], bl
je 0x40f53f
mov byte [esi + 0x1d], bl
call edi
sub eax, dword [esi + 4]
cmp eax, 0x3e8
ja 0x40f53f
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push ebx
push eax
push 0x312
push dword [0x465208]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x40f994
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x40f99e
mov al, 0xd
ret
push ebx
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ebx, eax
shr ebx, 8
cmp bl, 0xff
jne 0x40f9bf
cmp al, 0xff
jne 0x40f9bf
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40fa12
mov dl, bl
and dl, 6
cmp dl, 6
jne 0x40f9df
cmp byte [0x466349], 0
je 0x40f9df
or byte [ecx], 8
jmp 0x40fa01
test bl, 2
je 0x40f9f0
mov dl, byte [ecx]
test dl, 3
jne 0x40f9f0
or dl, 1
mov byte [ecx], dl
test bl, 4
je 0x40fa01
mov dl, byte [ecx]
test dl, 0xc
jne 0x40fa01
or dl, 4
mov byte [ecx], dl
test bl, 1
je 0x40fa12
mov dl, byte [ecx]
test dl, 0x30
jne 0x40fa12
or dl, 0x10
mov byte [ecx], dl
pop ebx
ret
Function at 0x40fcbe
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 3
jge 0x40fcd2
mov eax, dword [ebp + 0x10]
jmp 0x40fd83
push ebx
mov bl, byte [ebp + 8]
test bl, bl
push esi
mov esi, dword [ebp + 0x10]
mov byte [esi], 0
jne 0x40fcf8
cmp word [ebp + 0xc], 0
je 0x40fd7f
push dword [ebp + 0xc]
call fcn.004115a8
mov bl, al
jmp 0x40fd0d
cmp word [ebp + 0xc], 0
jne 0x40fd15
push 0
push dword [ebp + 8]
call fcn.0041166b
pop ecx
mov dword [ebp + 0xc], eax
cmp word [ebp + 0xc], 0
pop ecx
je 0x40fd33
cmp bl, 0x9e
je 0x40fd33
cmp bl, 0x9f
je 0x40fd33
movzx eax, word [ebp + 0xc]
push edi
push esi
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x40fd7f
mov eax, dword [0x4641c8]
xor ecx, ecx
test eax, eax
jle 0x40fd5a
cmp byte [ecx*8 + 0x463e0c], bl
je 0x40fd4c
inc ecx
cmp ecx, eax
jl 0x40fd3e
cmp ecx, eax
jge 0x40fd5a
push edi
push dword [ecx*8 + 0x463e08]
jmp 0x40fd76
movzx eax, bl
push eax
call fcn.0043c035
test eax, eax
pop ecx
je 0x40fd70
mov byte [esi], bl
mov byte [esi + 1], 0
jmp 0x40fd7f
push edi
push str.not_found
push esi
call fcn.00438c79
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x40fd86
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x465338], 0
je 0x40fd9c
cmp byte [esp + 4], 0
jne 0x40fd9c
mov al, byte [0x465224]
ret
push ebx
xor bl, bl
cmp byte [0x466341], bl
push esi
push edi
jne 0x40fe3c
cmp byte [0x466342], bl
jne 0x40fe3c
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x40fdd3
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x40fde2
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x40fdf1
or bl, 1
push 0xa3
call edi
test si, ax
je 0x40fe00
or bl, 2
push 0xa4
call edi
test si, ax
je 0x40fe0f
or bl, 4
push 0xa5
call edi
test si, ax
je 0x40fe1e
or bl, 8
push 0x5b
call edi
test si, ax
je 0x40fe2a
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x40feb7
or bl, 0x80
jmp 0x40feb7
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x40fe60
push 0x10
call ebp
test si, ax
je 0x40fe62
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x40fe74
push 0x11
call ebp
test si, ax
je 0x40fe77
or bl, 1
push 0x12
call edi
test si, ax
jne 0x40fe89
push 0x12
call ebp
test si, ax
je 0x40fe8c
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x40fe9e
push 0x5b
call ebp
test si, ax
je 0x40fea1
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x40feb3
push 0x5c
call ebp
test si, ax
je 0x40feb6
or bl, 0x80
pop ebp
cmp dword [0x465338], 0
je 0x40fef4
mov al, bl
not al
and al, byte [0x465224]
je 0x40fef4
not al
and byte [0x465226], al
and byte [0x465224], al
and byte [0x465225], al
xor eax, eax
mov al, byte [0x465226]
push eax
push 0x465228
call fcn.0040f8d6
pop ecx
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
ret