joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x4b7367]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x42027b
mov dl, byte [ebp]
test dl, dl
je 0x42027b
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x4202ce
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x420267
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x420261
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420280
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x4202a0
mov al, byte [edi]
cmp al, 0x20
je 0x42029b
cmp al, 9
jne 0x4202a0
dec edi
cmp edi, ebp
ja 0x420291
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x4202d5
cmp byte [esp + 0x30], 0
je 0x4202c3
mov ecx, dword [esp + 0x28]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.004330b0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x4202a0
dec edi
jmp 0x42028d
push esi
push ebp
push ebx
call fcn.004954d0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x430030
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4bb8dc]
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x4b73d4]
jl 0x430059
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov esi, dword [0x4bbf74]
cmp byte [esi + 0x17], 0
jne 0x430068
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x430075
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43008e
test byte [esi + 0x15], 4
je 0x430089
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
jmp 0x43009e
cmp al, 2
jne 0x430099
call fcn.00401000
jmp 0x43009e
mov eax, 0x4bd07e
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004954d0
mov eax, dword [0x4b7468]
inc dword [0x4bb8dc]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xa3], 0
mov ecx, 0x3a
mov esi, 0x4ba400
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor ebx, ebx
mov dword [0x4b7468], eax
push ebx
mov eax, 0x4bd7e0
mov dword [esi + 0x2c], ebx
call fcn.00419910
mov dword [0x4bdde0], ebx
mov dword [0x4bdde4], ebx
cmp dword [0x4bb90c], ebx
je 0x43010a
push 0x4bbf78
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, 0xffffffff
cmp byte [esi + 0xca], bl
jne 0x430124
mov byte [esi + 0xca], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x4bddec], ebx
je 0x43013a
cmp dword [0x4bdde8], ebx
jne 0x430142
cmp byte [esi + 0xca], bl
je 0x430174
mov byte [esi + 0xc8], bl
cmp byte [esi + 0xca], bl
jne 0x430174
cmp dword [0x4bddec], ebx
jge 0x430160
mov dword [esi + 0xbc], eax
jmp 0x430174
call edi
mov dword [esi + 0xb8], eax
mov edx, dword [0x4bddec]
mov dword [esi + 0xbc], edx
mov eax, dword [0x4bdd7c]
mov ebx, dword [0x4bdd80]
mov ecx, dword [0x4bddb4]
mov edx, dword [0x4bddb8]
mov ebp, eax
mov dword [0x4bdd80], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [0x4bddb8], ecx
mov dword [0x4bdd7c], eax
call edi
mov esi, dword [esp + 0xa0]
mov ecx, dword [0x4b7468]
mov dword [0x4bddf4], eax
mov dword [0x4bddf0], eax
mov dword [0x4bddb4], eax
mov dword [0x4bdb68], esi
cmp byte [ecx + 0xd5], 0
je 0x43020e
mov edx, dword [0x4bd718]
mov dword [edx*4 + 0x4bd0d8], esi
call edi
mov ecx, dword [0x4bd718]
mov dword [ecx*4 + 0x4bb068], eax
inc ecx
mov dword [0x4bd718], ecx
cmp ecx, 0x190
jl 0x43020e
mov dword [0x4bd718], 0
push 0
push 0xffffffffffffffff
push 0
push esi
call fcn.004614c0
mov esi, eax
cmp esi, 1
jne 0x430230
mov eax, dword [esp + 0xa0]
push eax
call fcn.0042e770
mov esi, eax
mov ecx, dword [0x4b7468]
mov edx, dword [ecx + 0xa0]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0x4bb8fc], edx
lea edx, [esp + 0x18]
push edx
mov dword [0x4bdd7c], ebp
mov dword [0x4bddb4], eax
mov dword [0x4bdd80], ebx
mov dword [0x4bddb8], ecx
call fcn.00403230
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x4334f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.0049fa60
cmp dword [esp + 0x2008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x2018]
mov ebx, ecx
je 0x43360f
test ebx, ebx
jne 0x433528
mov eax, dword [esp + 0x200c]
mov ebx, dword [eax + 0x388]
test ebx, ebx
je 0x433532
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x43353f
mov ecx, dword [eax + 0x148]
movzx eax, word [eax + 0x14c]
mov edx, dword [esp + 0x2014]
mov ecx, dword [ecx*4 + 0x4bb748]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.0047dd10
add esp, 0x10
cmp byte [ebp], 0
lea edi, [esp + eax + 0x10]
je 0x43358c
push ebp
lea esi, [esp + 0x2014]
push str._____Specifically:__s_n
sub esi, edi
call fcn.0047dd10
add esp, 8
mov esi, dword [esp + 0x2018]
cmp esi, 3
jne 0x4335bb
call fcn.00492117
add eax, 0x20
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00494543
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 2
jne 0x43360d
test ebx, ebx
jne 0x4335e0
mov ecx, dword [esp + 0x2014]
mov ebx, dword [ecx + 0x388]
test ebx, ebx
je 0x4335ff
mov ecx, dword [esp + 0x201c]
push ebp
push 1
push ecx
mov ecx, ebx
call fcn.00432e00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
mov edx, dword [esp + 0x201c]
push ebp
push edx
call fcn.004330b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
Function at 0x433990
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x4339bf
push 0x64
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4339c7
mov byte [esp + 0xa0], 0
push 0x7f
lea edx, [esp + 0x25]
push ebp
push edx
mov byte [esp + 0x2c], 0
call fcn.0049a020
mov esi, dword [0x4bdd98]
add esp, 0xc
cmp esi, ebp
je 0x433a0e
cmp byte [esi + 0x11], 0
je 0x433a07
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push 0x4ad618
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.0047dd50
add esp, 8
mov esi, dword [esi + 0x14]
cmp esi, ebp
jne 0x4339e6
cmp byte [esp + 0x20], 0
je 0x433a5d
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x433a20
sub eax, edx
cmp eax, 0x7b
jbe 0x433a4e
mov esi, 0x7f
sub esi, eax
push esi
lea ebx, [esp + eax + 0x24]
push 0x4aaecc
push ebx
call fcn.004954d0
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x433a5d
cmp byte [esp + eax + 0x1f], 0x20
lea eax, [esp + eax + 0x20]
jne 0x433a5d
mov byte [eax - 1], 0
mov edx, dword [0x4ba310]
cmp byte [edx + 0xd4], 0
je 0x433a7d
cmp byte [0x4bddd9], 0
mov dword [esp + 0x14], 1
je 0x433a81
mov dword [esp + 0x14], ebp
mov eax, dword [0x4bb8dc]
mov dword [esp + 0x10], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x433b8c
mov dword [esp + 0x10], 0x4a6869
mov dword [esp + 0x18], ebp
cmp dword [0x4bb8a4], ebp
mov ebp, 0x4a7b00
je 0x433ab5
mov ebp, 0x4a7afc
cmp dword [0x4bb8a0], 0
mov esi, 0x4a7b00
je 0x433ac8
mov esi, 0x4a7afc
push 1
call fcn.00412530
mov bl, al
add esp, 4
lea eax, [esp + 0x108]
call fcn.004128c0
mov ecx, dword [0x4bb8dc]
mov edx, dword [0x4bb8e0]
sub edx, dword [esp + 0x14]
push eax
mov eax, dword [0x4bb8d8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [0x4bdda0]
push ecx
mov ecx, dword [0x4bdda4]
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push ebp
push esi
lea edx, [esp + 0xcc]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.0047dd10
mov esi, dword [esp + 0x50]
add edi, eax
mov eax, esi
sub eax, edi
add esp, 0x34
add eax, 0xfffe
push eax
push edi
call fcn.0040a010
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x433b50
sub eax, ecx
add edi, eax
cmp dword [0x4bc084], 0
mov eax, str._r_nPress__F5__to_refresh.
jne 0x433b6e
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, edi
push eax
add esi, 0xfffe
call fcn.0047dd10
add esp, 4
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
dec eax
mov dword [esp + 0x18], eax
jmp 0x433aa3
Function at 0x439c00
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4bb6f8]
push esi
push edi
mov ecx, ebp
call fcn.00417010
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x13c]
call fcn.00447730
mov esi, eax
test esi, esi
je 0x439ce0
push 0
push esi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x439c7a
cmp edi, dword [0x4bd780]
je 0x439c7a
call fcn.00483760
test al, al
jne 0x439c7a
mov ecx, dword [0x4bd780]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x1c], eax
test bl, bl
je 0x439c9c
mov edx, dword [0x4bd780]
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x439ce0
lea ecx, [esp + 0x20]
push 0xfc
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x439ce0
lea eax, [esp + 0x10]
push eax
push 0x439d90
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [esp + 0x14], 0
jne 0x439d38
mov ecx, dword [0x4b7468]
cmp byte [ecx + 0xe4], 0
jne 0x439d13
mov edx, dword [0x4bbf74]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7fd8
push edx
call fcn.00481890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov ecx, dword [esp + 0x12c]
push 0x4a6869
push 0
push 0x4a7fd8
call fcn.00432b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov eax, dword [esp + 0x18]
push eax
push 0x4a68d4
mov eax, 0x101
lea ecx, [esp + 0x28]
call fcn.0047dd50
mov ecx, dword [0x4bbf74]
add esp, 8
push 1
push 0
push 0xffffffffffffffff
push 0x4a6904
push ecx
call fcn.00481890
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push edx
push ebp
call fcn.00481890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
Function at 0x439e10
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.00447730
mov edi, eax
test edi, edi
je 0x439e3e
mov esi, dword [esp + 0x1c]
push edi
call fcn.00483270
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x439e89
mov ecx, dword [0x4b7468]
cmp byte [ecx + 0xe4], 0
jne 0x439e6c
mov edx, dword [0x4bbf74]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7fd8
push edx
call fcn.00481890
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x4a6869
push 0
push 0x4a7fd8
call fcn.00432b40
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x439ec1
cmp ebp, dword [0x4bd780]
je 0x439ec1
mov esi, edi
call fcn.00483760
test al, al
jne 0x439ec1
mov eax, dword [0x4bd780]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x439f25
mov edx, dword [0x4bbf74]
push 1
push 0
push 0xffffffffffffffff
push 0x4a6904
push edx
call fcn.00481890
mov eax, dword [0x4b7468]
cmp dword [eax + 0x58], 0xffffffff
jle 0x439f25
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4bd780], eax
jne 0x439f16
mov ecx, dword [0x4b7468]
mov edx, dword [ecx + 0x58]
push 1
push edx
call fcn.00401280
add esp, 8
jmp 0x439f25
mov eax, dword [0x4b7468]
mov ecx, dword [eax + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x439f39
mov edx, dword [0x4bd780]
push 0
push ebp
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x43b860
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4bb6f8]
push eax
mov eax, dword [esp + 0x18]
call fcn.00447730
mov ebp, eax
test ebp, ebp
je 0x43b886
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x43b88b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.00481890
cmp eax, 1
je 0x43b8a9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x43b9b2
cmp byte [edi + 0x17], 0
jne 0x43b8bc
mov esi, dword [edi + 0xc]
jmp 0x43b8be
mov esi, edi
test byte [esi + 0x15], 8
je 0x43b8cb
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43b8e4
test byte [esi + 0x15], 4
je 0x43b8df
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
jmp 0x43b8f4
cmp al, 2
jne 0x43b8ef
call fcn.00401000
jmp 0x43b8f4
mov eax, 0x4bd07e
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x43b90a
mov esi, dword [edi + 0xc]
jmp 0x43b90c
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x43b924
test byte [esi + 0x15], 8
je 0x43b91f
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x43b929
mov eax, 0x4bdf44
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x43b936
mov esi, dword [edi + 0xc]
jmp 0x43b938
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x43b950
test byte [esi + 0x15], 8
je 0x43b94b
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x43b955
mov eax, 0x4bdf44
cmp dword [eax], 0
jne 0x43ba28
cmp byte [edi + 0x17], 0
jne 0x43b969
mov esi, dword [edi + 0xc]
jmp 0x43b96b
mov esi, edi
test byte [esi + 0x15], 8
je 0x43b978
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43b997
test byte [esi + 0x15], 4
je 0x43b98c
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x43ba28
cmp al, 2
jne 0x43b9a8
call fcn.00401000
mov byte [eax], 0
jmp 0x43ba28
mov eax, 0x4bd07e
mov byte [eax], 0
jmp 0x43ba28
cmp byte [edi + 0x17], 0
jne 0x43b9bd
mov esi, dword [edi + 0xc]
jmp 0x43b9bf
mov esi, edi
test byte [esi + 0x15], 8
je 0x43b9cc
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43b9e5
test byte [esi + 0x15], 4
je 0x43b9e0
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
jmp 0x43b9f5
cmp al, 2
jne 0x43b9f0
call fcn.00401000
jmp 0x43b9f5
mov eax, 0x4bd07e
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x43ba03
mov esi, dword [edi + 0xc]
jmp 0x43ba05
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x43ba1d
test byte [esi + 0x15], 8
je 0x43ba18
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x43ba22
mov eax, 0x4bdf44
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x43ba31
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x43ba56
cmp dword [0x4bd7d0], 0
je 0x43ba56
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4bd7c4
jmp fcn.00403fd0
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x43c880
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.0049fa60
push ebp
mov ebp, dword [0x4bb6f8]
push esi
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 0x7fff
jb 0x43c9aa
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push ebp
call fcn.00481890
test eax, eax
jne 0x43c8d0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
cmp byte [ebp + 0x17], 0
jne 0x43c8db
mov esi, dword [ebp + 0xc]
jmp 0x43c8dd
mov esi, ebp
test byte [esi + 0x15], 8
je 0x43c8ea
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43c903
test byte [esi + 0x15], 4
je 0x43c8fe
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
jmp 0x43c913
cmp al, 2
jne 0x43c90e
call fcn.00401000
jmp 0x43c913
mov eax, 0x4bd07e
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x43c965
cmp byte [ebp + 0x17], al
jne 0x43c92a
mov esi, dword [ebp + 0xc]
jmp 0x43c92c
mov esi, ebp
test byte [esi + 0x15], 8
je 0x43c939
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43c952
test byte [esi + 0x15], 4
je 0x43c94d
mov eax, esi
call fcn.00433620
mov eax, dword [esi + 8]
jmp 0x43c962
cmp al, 2
jne 0x43c95d
call fcn.00401000
jmp 0x43c962
mov eax, 0x4bd07e
mov byte [eax], 0
cmp byte [ebp + 0x17], 0
jne 0x43c970
mov eax, dword [ebp + 0xc]
jmp 0x43c972
mov eax, ebp
cmp byte [eax + 0x17], 2
jne 0x43c997
cmp dword [0x4bd7d0], 0
je 0x43c997
push 1
mov ecx, 0x4bd7c4
call fcn.00403fd0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
and byte [eax + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x43c9b7
mov eax, 0x4a6869
push 1
push 0
push edi
push eax
push ebp
call fcn.00481890
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
Function at 0x43f290
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
je 0x43f2c8
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x43f343
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push str.InstallDir
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x43f2c0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43f2c0
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], bl
jne 0x43f327
cmp eax, ebx
je 0x43f343
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], bl
jne 0x43f321
dec eax
jne 0x43f318
mov dword [esp + 0x10], eax
jmp 0x43f33f
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x43f33b
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x43f343
mov byte [esp + eax + 0x18], bl
cmp eax, ebx
jne 0x43f351
cmp edi, ebx
jne 0x43f351
mov edi, pe_nt_image_headers32
jmp 0x43f2a4
mov esi, dword [esp + 0x120]
cmp esi, ebx
je 0x43f36e
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x43f364
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x442890
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4bb6f8]
push esi
push edi
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [edi]
test cl, cl
je 0x44297e
cmp byte [edi + 1], 0
jne 0x4428fa
mov byte [esp + 0x14], cl
cmp cl, 0xa
jne 0x4428ca
mov al, 0xd
jmp 0x44296f
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
jne 0x4428ee
cmp cl, 0xff
jne 0x4428ee
xor al, al
jmp 0x44296f
and al, 0x38
neg al
sbb al, al
not al
and al, cl
jmp 0x44296f
movzx esi, cl
test esi, 0xffffff80
jne 0x442917
push 2
push esi
call fcn.0049303e
add esp, 8
test eax, eax
je 0x442917
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x44293b
mov al, byte [edi + 1]
call fcn.0040a260
cmp al, 0x4b
jne 0x44293b
push 0x10
lea eax, [edi + 2]
push 0
push eax
call fcn.004933d7
add esp, 0xc
jmp 0x44296f
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esi*8 + 0x4b81d8]
push edi
push eax
call fcn.00491a51
add esp, 8
test eax, eax
je 0x4429b1
inc esi
cmp esi, 0x6d
jl 0x442940
mov eax, edi
call fcn.00412c00
movzx ecx, ax
test cx, cx
je 0x44297e
call fcn.00413360
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
jne 0x4429fb
push 0
lea ebx, [esp + 0x18]
mov eax, edi
call fcn.00455fc0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4429be
push 1
push eax
push 0xffffffffffffffff
push 0x4a6869
push ebp
call fcn.00481890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov cl, byte [esi*8 + 0x4b81dc]
mov byte [esp + 0x13], cl
jmp 0x442973
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
call fcn.00456260
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.004811e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov ecx, dword [esp + 0x12c]
movzx ebx, byte [ecx]
test ebx, 0xffffff80
jne 0x442a1f
push 2
push ebx
call fcn.0049303e
add esp, 8
test eax, eax
je 0x442a1f
and bl, 0xdf
cmp bl, 0x50
je 0x442a32
xor eax, eax
cmp bl, 0x54
setne al
dec eax
and eax, 2
jmp 0x442a37
mov eax, 1
mov bl, byte [esp + 0x13]
push eax
call fcn.004561b0
add esp, 4
test al, al
mov eax, 0x4ae7f8
jne 0x442a52
mov eax, 0x4ae7fc
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.00481890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
Function at 0x442a70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
mov esi, ecx
mov ecx, dword [0x4bb6f8]
push edi
call fcn.00417010
test esi, esi
je 0x442be6
cmp byte [esi], 0
je 0x442be6
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.004954d0
lea eax, [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x134], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x442ac0
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
je 0x442ae9
lea ecx, [eax + 1]
cmp ecx, 0x105
jae 0x442be6
mov byte [esp + eax + 0x30], 0x5c
mov byte [esp + eax + 0x31], 0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4be930], 1
jne 0x442b1f
or dword [0x4be930], 1
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4be92c], eax
jmp 0x442b24
mov eax, dword [0x4be92c]
test eax, eax
je 0x442b72
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x442be6
cmp byte [ebp + 0xc], 0
je 0x442b5f
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x442bb4
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x442bb4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x442be6
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x14]
jne 0x442ba3
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x4bbf74]
push 1
push 0
push 0xffffffffffffffff
push 0x4a6904
push ecx
call fcn.00481890
mov eax, dword [0x4bb6f8]
push 0x18
push edi
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x4b7468]
cmp byte [edx + 0xe4], 0
jne 0x442c13
mov eax, dword [0x4bbf74]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7fd8
push eax
call fcn.00481890
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x4a6869
push 0
push 0x4a7fd8
call fcn.00432b40
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8