joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4115c1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp byte [0x460250], 0
push esi
push edi
jne 0x411729
cmp dword [0x45e434], 0
jne 0x4115ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x45e434], eax
inc dword [0x46024c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x46024c]
mov esi, dword [0x45b0ec]
mov edx, eax
sub edx, dword [0x45e434]
cmp ecx, dword [0x45b0e8]
mov dword [0x45e438], eax
jbe 0x411694
cmp edx, esi
jae 0x411694
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [ebp - 0x80c]
mov dword [ebp - 8], 1
call fcn.0040a3cc
add esp, 0xc
call fcn.004113ff
fldz
push ecx
push ecx
fstp qword [esp]
xor esi, esi
push esi
push esi
mov eax, edi
push 4
push eax
mov byte [0x460250], 1
mov dword [0x45b0d4], esi
call fcn.0043b30a
add esp, 0x18
cmp eax, 7
jne 0x41167c
push esi
push esi
push 1
mov ecx, 0x45fb58
call fcn.0041741a
mov eax, dword [0x45e438]
mov dword [0x45b0d4], 1
mov byte [0x460250], 0
jmp 0x41169c
and dword [ebp - 8], 0
cmp edx, esi
jbe 0x4116ae
and dword [0x46024c], 0
cmp dword [ebp - 8], 0
mov dword [0x45e434], eax
jne 0x411729
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x11]
mov byte [0x45ffe9], al
cmp byte [esi + 0x1a], 0
je 0x4116f2
cmp byte [esi + 0x1b], 0
je 0x4116f2
mov byte [ebp + 0xb], 1
call fcn.00410ec3
mov ecx, dword [ebx]
inc byte [ebx + 0x19]
call fcn.004062b9
dec byte [ebx + 0x19]
cmp byte [ebp + 0xb], 0
mov edi, eax
je 0x4116e8
call fcn.00411399
test edi, edi
jne 0x4116f8
mov byte [ebx + 0x1d], 0
jmp 0x411729
mov byte [ebp + 0xb], 0
jmp 0x4116ce
cmp byte [ebx + 0x1d], 0
je 0x411729
mov byte [ebx + 0x1d], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 4]
cmp eax, 0x3e8
ja 0x411729
movzx eax, word [esi]
push 0
push eax
push 0x312
push dword [0x45d9cc]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
leave
ret 4

Function at 0x411b8b
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x411b95
mov al, 0xd
ret
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov edx, eax
shr edx, 8
cmp dl, 0xff
jne 0x411bb4
cmp al, 0xff
jne 0x411bb4
xor al, al
ret
test esi, esi
je 0x411c03
mov cl, dl
and cl, 6
cmp cl, 6
jne 0x411bd0
cmp byte [0x46021a], 0
je 0x411bd0
or byte [esi], 8
jmp 0x411bf2
test dl, 2
je 0x411be1
mov cl, byte [esi]
test cl, 3
jne 0x411be1
or cl, 1
mov byte [esi], cl
test dl, 4
je 0x411bf2
mov cl, byte [esi]
test cl, 0xc
jne 0x411bf2
or cl, 4
mov byte [esi], cl
test dl, 1
je 0x411c03
mov cl, byte [esi]
test cl, 0x30
jne 0x411c03
or cl, 0x10
mov byte [esi], cl
ret
Function at 0x411f94
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x45db00], 0
je 0x411faa
cmp byte [esp + 4], 0
jne 0x411faa
mov al, byte [0x45d9e8]
ret
push ebx
xor bl, bl
cmp byte [0x460211], bl
push esi
push edi
jne 0x41204a
cmp byte [0x460212], bl
jne 0x41204a
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x411fe1
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x411ff0
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x411fff
or bl, 1
push 0xa3
call edi
test si, ax
je 0x41200e
or bl, 2
push 0xa4
call edi
test si, ax
je 0x41201d
or bl, 4
push 0xa5
call edi
test si, ax
je 0x41202c
or bl, 8
push 0x5b
call edi
test si, ax
je 0x412038
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x4120c5
or bl, 0x80
jmp 0x4120c5
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x41206e
push 0x10
call ebp
test si, ax
je 0x412070
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x412082
push 0x11
call ebp
test si, ax
je 0x412085
or bl, 1
push 0x12
call edi
test si, ax
jne 0x412097
push 0x12
call ebp
test si, ax
je 0x41209a
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x4120ac
push 0x5b
call ebp
test si, ax
je 0x4120af
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x4120c1
push 0x5c
call ebp
test si, ax
je 0x4120c4
or bl, 0x80
pop ebp
cmp dword [0x45db00], 0
je 0x4120fe
mov al, bl
not al
and al, byte [0x45d9e8]
je 0x4120fe
not al
and byte [0x45d9ea], al
and byte [0x45d9e8], al
and byte [0x45d9e9], al
mov cl, byte [0x45d9ea]
mov eax, 0x45d9f0
call fcn.00411ad2
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x413238
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi]
mov ecx, 0x80000000
cmp eax, ecx
je 0x4133a6
push ebx
mov ebx, dword [esi]
cmp ebx, ecx
je 0x4133a5
cmp dword [0x45f458], 2
jne 0x41329a
push ebx
mov bl, byte [ebp + 0xc]
neg bl
push 0
sbb ebx, ebx
and ebx, ecx
or ebx, 1
call fcn.00411941
pop ecx
pop ecx
call fcn.00411e6d
cmp byte [ebp + 0xc], 0
je 0x4133a5
mov eax, 0x80000000
mov dword [edi], eax
mov dword [esi], eax
jmp 0x4133a5
or word [edx], 0x8001
cmp byte [ebp + 0xc], 0
je 0x4132e5
cmp dword [0x45f458], 1
jne 0x4132d1
cmp dword [0x45c8f0], ecx
jne 0x4132c1
push 0x45c8f0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x45c8f0]
add dword [edi], eax
mov eax, dword [0x45c8f4]
add dword [esi], eax
jmp 0x4132f8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
add dword [edi], eax
mov eax, dword [ebp - 8]
jmp 0x4132cd
mov eax, dword [0x45b170]
test byte [eax + 0xc8], 2
jne 0x4132f8
call fcn.00438daf
cmp dword [0x45f458], 1
jne 0x41330f
mov eax, dword [edi]
mov dword [0x45c8f0], eax
mov eax, dword [esi]
mov dword [0x45c8f4], eax
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov dword [ebp - 4], eax
call ebx
mov ebx, eax
mov eax, dword [edi]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
inc eax
mov dword [edi], eax
mov eax, dword [esi]
shl eax, 0x10
cdq
idiv ebx
inc eax
cmp dword [ebp + 8], 0
mov dword [esi], eax
jl 0x41338e
push 0x64
pop ecx
cmp dword [ebp + 8], ecx
jle 0x41334a
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], 0
je 0x41338e
cmp dword [0x45f458], 1
je 0x41338e
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
shl eax, 0x10
cdq
idiv ebx
push dword [ebp + 8]
mov ebx, dword [esi]
push dword [edi]
mov edi, eax
mov eax, dword [ebp - 0xc]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
inc edi
mov ecx, eax
inc ecx
mov eax, edi
call fcn.0042a868
pop ecx
pop ecx
jmp 0x4133a5
push eax
push dword [edi]
mov eax, 0x8001
push 0
call fcn.004131e6
add esp, 0xc
call fcn.00411e6d
pop ebx
pop edi
pop esi
leave
ret
Function at 0x413875
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
movzx esi, byte [esp + 0xc]
mov bl, al
mov ecx, esi
mov eax, 0x90
cmp ecx, eax
jg 0x4138fe
je 0x4138f4
sub ecx, 0x5b
cmp ecx, 0x14
ja case.0x413897.93
jmp dword [ecx*4 + 0x41399c]
mov eax, 0x15b
jmp 0x41398b
mov eax, 0x15c
jmp 0x41398b
push 0x52
jmp 0x413934
push 0x4f
jmp 0x413934
push 0x50
jmp 0x413934
push 0x51
jmp 0x413934
push 0x4b
jmp 0x413934
push 0x4c
jmp 0x413934
push 0x4d
jmp 0x413934
push 0x47
jmp 0x413934
push 0x48
jmp 0x413934
push 0x49
jmp 0x413934
push 0x53
jmp 0x413934
mov eax, 0x135
jmp 0x41398b
push 0x37
jmp 0x413934
push 0x4a
jmp 0x413934
push 0x4e
jmp 0x413934
mov eax, 0x145
jmp 0x41398b
sub ecx, 0xa0
je 0x413932
dec ecx
je 0x41392b
dec ecx
je 0x413927
dec ecx
je 0x413920
dec ecx
je 0x41391c
dec ecx
jne case.0x413897.93
mov eax, 0x138
jmp 0x41398b
push 0x38
jmp 0x413934
mov eax, 0x11d
jmp 0x41398b
push 0x1d
jmp 0x413934
mov eax, 0x136
jmp 0x41398b
push 0x2a
pop eax
jmp 0x41398b
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ax, ax
je 0x413999
cmp esi, 0x2e
jg 0x413977
cmp esi, 0x2d
jge 0x41396a
cmp esi, 3
je 0x413986
cmp esi, 0xd
je 0x41396a
cmp esi, 0x20
jle 0x41398b
cmp esi, 0x28
jle 0x41396a
cmp esi, 0x2c
je 0x413986
jmp 0x41398b
test bl, bl
movzx eax, ax
je 0x413999
or ax, 0x100
jmp 0x413999
sub esi, 0x5d
je 0x413986
sub esi, 0x12
je 0x413986
sub esi, 0x21
jne 0x41398b
or eax, 0x100
neg bl
movzx eax, ax
sbb ebx, ebx
not ebx
and ebx, eax
mov ax, bx
pop esi
pop ebx
ret
Function at 0x413a35
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp dword [0x45f458], ebp
push esi
push edi
je 0x413a4d
mov al, byte [0x45c8f8]
jmp 0x413bb5
cmp dword [0x45db00], ebp
je 0x413a5f
mov al, byte [0x45d9e8]
jmp 0x413bb5
push ebx
xor bl, bl
cmp byte [0x460211], bl
jne 0x413afd
cmp byte [0x460212], bl
jne 0x413afd
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x413a94
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x413aa3
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x413ab2
or bl, 1
push 0xa3
call edi
test si, ax
je 0x413ac1
or bl, 2
push 0xa4
call edi
test si, ax
je 0x413ad0
or bl, 4
push 0xa5
call edi
test si, ax
je 0x413adf
or bl, 8
push 0x5b
call edi
test si, ax
je 0x413aeb
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x413b78
or bl, 0x80
jmp 0x413b78
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x413b20
push 0x10
call ebp
test si, ax
je 0x413b22
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x413b34
push 0x11
call ebp
test si, ax
je 0x413b37
or bl, 1
push 0x12
call edi
test si, ax
jne 0x413b49
push 0x12
call ebp
test si, ax
je 0x413b4c
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x413b5e
push 0x5b
call ebp
test si, ax
je 0x413b61
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x413b73
push 0x5c
call ebp
test si, ax
je 0x413b76
or bl, 0x80
xor ebp, ebp
cmp dword [0x45db00], ebp
je 0x413bb0
mov al, bl
not al
and al, byte [0x45d9e8]
je 0x413bb0
not al
and byte [0x45d9ea], al
and byte [0x45d9e8], al
and byte [0x45d9e9], al
mov cl, byte [0x45d9ea]
mov eax, 0x45d9f0
call fcn.00411ad2
xor eax, eax
mov al, bl
pop ebx
push 1
mov byte [esp + 0x10], al
push ebp
push ebp
push dword [esp + 0x18]
and eax, 0xffffffc4
or eax, 4
push eax
mov eax, 0xffc3d44f
call fcn.00412104
mov esi, dword [esp + 0x28]
add esp, 0x14
xor eax, eax
mov edi, 0xffc3d44d
jmp 0x413bf8
cmp al, 0x39
jg 0x413bfe
push edi
push ebp
add al, 0x30
push ebp
push ebp
push eax
push 2
call fcn.00412730
add esp, 0x18
inc esi
mov al, byte [esi]
cmp al, 0x30
jge 0x413be2
push edi
push ebp
push ebp
push ebp
push 0x12
push 1
call fcn.00412730
add esp, 0x18
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x414ff8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push esi
mov esi, eax
lea eax, [ebp - 0x10]
jge 0x415013
mov byte [ebp - 0x10], 0x30
lea eax, [ebp - 0xf]
push 0xa
push eax
movzx eax, byte [ebp + 8]
push eax
call dword [sym.imp.MSVCR71.dll__itoa]
add esp, 0xc
cmp esi, ebx
jle 0x4150b1
mov dword [ebp + 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x45f458], ebx
jne 0x415087
call esi
sub eax, dword [0x460024]
mov ecx, dword [0x45b170]
cmp eax, dword [ecx + 0xb0]
jbe 0x415087
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x415080
push 1
push 0xffffffffffffffff
mov dword [0x45b0d4], ebx
call fcn.0040d9dd
pop ecx
pop ecx
mov dword [0x45b0d4], 1
call esi
mov dword [0x460024], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00413a35
cmp dword [0x45f458], 2
mov eax, dword [0x45b170]
pop ecx
jne 0x4150a4
mov eax, dword [eax + 0x60]
jmp 0x4150a7
mov eax, dword [eax + 0x5c]
call fcn.00411e1b
dec dword [ebp + 8]
jne 0x415035
pop esi
pop ebx
leave
ret

Function at 0x4155fd
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ecx
movzx eax, byte [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push eax
call ebp
mov ecx, dword [esp + 0x18]
and al, 1
neg al
sbb eax, eax
xor edi, edi
inc eax
inc eax
inc edi
cmp ecx, edi
mov dword [esp + 0xc], eax
je 0x41562f
cmp ecx, 2
jne 0x4156fa
cmp eax, ecx
je 0x4156fa
push ebx
xor ebx, ebx
cmp byte [esp + 0x18], 0x90
push esi
mov esi, 0xffc3d44d
jne 0x41566b
cmp byte [0x460211], bl
je 0x415659
call fcn.004156ff
jmp 0x4156f4
push esi
push ebx
push ebx
push ebx
push 0x90
push edi
call fcn.00412730
add esp, 0x18
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
push 2
call fcn.00412730
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x45fb18]
sete byte [esp + 0x13]
cmp byte [esp + 0x13], bl
je 0x4156b2
push edi
push 0xffffffffffffffff
mov dword [0x45b0d4], ebx
call fcn.0040d9dd
pop ecx
pop ecx
mov dword [0x45b0d4], edi
cmp byte [esp + 0x1c], 0x14
jne 0x4156f4
cmp dword [esp + 0x20], 2
jne 0x4156f4
push 0x14
call ebp
test al, 1
je 0x4156f4
push esi
push ebx
push ebx
push ebx
push 0x10
push 2
call fcn.00412730
add esp, 0x18
cmp byte [esp + 0x13], bl
je 0x4156f4
push edi
push 0xffffffffffffffff
mov dword [0x45b0d4], ebx
call fcn.0040d9dd
pop ecx
pop ecx
mov dword [0x45b0d4], edi
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
pop ecx
ret
Function at 0x415728
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45e404]
test eax, eax
je 0x415808
mov ecx, dword [0x45e408]
imul ecx, ecx, 0x70
add eax, ecx
mov cl, byte [ebp + 8]
mov byte [eax + 5], cl
mov cl, byte [ebp + 0xc]
mov byte [eax], cl
mov cx, word [ebp + 0x10]
mov word [eax + 2], cx
push esi
mov byte [eax + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x46022c]
mov dword [0x45e40c], eax
test ecx, ecx
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
jge 0x41577f
fadd dword [0x458a60]
mov ecx, dword [0x45e408]
fmul dword [0x458a64]
mov edx, dword [0x45e404]
imul ecx, ecx, 0x70
mov dword [0x46022c], eax
fstp dword [ecx + edx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x45e404]
mov esi, eax
mov eax, dword [0x45e408]
imul eax, eax, 0x70
test esi, esi
je 0x4157d6
cmp esi, dword [0x45e410]
je 0x4157cf
push 0x64
lea eax, [eax + ecx + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4157e7
mov byte [eax + ecx + 0xc], 0
jmp 0x4157e7
lea eax, [eax + ecx + 0xc]
push 0x453d48
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
inc dword [0x45e408]
mov eax, dword [0x45e408]
cmp eax, dword [0x45b0d8]
mov dword [0x45e410], esi
pop esi
jl 0x415808
and dword [0x45e408], 0
leave
ret

Function at 0x41584e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x45c268]
jne 0x41585b
call fcn.00449097
mov eax, dword [0x45c918]
mov ecx, dword [eax]
add dword [0x45c918], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x415892
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x45c268]
jne 0x41589f
call fcn.00449097
mov eax, dword [0x45c918]
mov ecx, dword [eax]
add dword [0x45c918], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x4158d4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x45c268]
jne 0x4158e2
call fcn.00449097
mov eax, dword [0x45c918]
mov eax, dword [eax]
add dword [0x45c918], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x415928
fadd qword [0x458a50]
fmul qword [0x458a80]
pop ecx
ret
Function at 0x415930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
inc esi
mov dword [0x45c920], eax
push edi
mov edx, esi
mov eax, 0x45c920
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x45d2dc
jl 0x415945
pop edi
mov dword [0x45c268], esi
mov dword [0x45f45c], esi
pop esi
ret

Function at 0x4173be
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.0043ccfb
mov eax, dword [0x45db08]
test eax, eax
pop ecx
pop ecx
je 0x4173e3
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x460234]
push esi
xor esi, esi
cmp word [eax], si
jbe 0x41740f
mov eax, dword [esi*4 + 0x45e440]
test eax, eax
je 0x417402
push 1
call fcn.0040fa5a
mov eax, dword [0x460234]
movzx eax, word [eax]
inc esi
cmp esi, eax
jl 0x4173f0
push dword [esp + 8]
call dword [sym.imp.MSVCR71.dll_exit]
pop esi

Function at 0x417f58
Capabilities:
Get graphical window text

Disassembly:
cmp eax, 0x2af8
jae 0x417fc1
mov ecx, dword [ecx*4 + 0x45e0f8]
test ecx, ecx
je 0x417fc1
cmp eax, dword [ecx + 0xc]
jae 0x417fc1
test edx, edx
mov ecx, dword [ecx + 0x14]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + 8]
je 0x417fa2
test ecx, ecx
je 0x417f96
push dword [ecx + 0x18]
push edx
call sub.MSVCR71.dll_strcpy
push eax
call sub.MSVCR71.dll_strlen
add esp, 0xc
ret
push 0x40
push edx
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextA]
ret
test ecx, ecx
je 0x417fb0
push dword [ecx + 0x18]
call sub.MSVCR71.dll_strlen
pop ecx
ret
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, 0x3f
jbe 0x417fca
push 0x3f
pop eax
ret
test edx, edx
je 0x417fc8
mov byte [edx], 0
xor eax, eax
ret
Function at 0x419aad
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x45e2f0]
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
mov esi, eax
call fcn.0040161c
cmp dword [ebp + 8], ebx
je 0x419b32
cmp edi, ebx
je 0x419ada
cmp byte [edi], bl
jne 0x419ae2
cmp esi, ebx
je 0x419b32
cmp byte [esi], bl
je 0x419b32
lea eax, [ebp - 8]
push eax
push 0x2001f
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419b32
cmp esi, ebx
je 0x419b3b
cmp byte [esi], bl
je 0x419b3b
push str.ahk_default
push esi
call dword [sym.imp.MSVCR71.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x419b19
mov esi, 0x45282f
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x419b63
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push dword [ebp - 8]
call fcn.00419e1f
pop ecx
push dword [ebp - 8]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x419b32
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x419b32
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
jmp 0x419b35
Function at 0x419e1f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x419ec4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419ecc
push dword [ebp - 0xc]
call fcn.00419e1f
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x419ecc
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x419ecc
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x419e59
mov al, 1
jmp 0x419ece
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42152c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x45e2f0]
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
call fcn.0040161c
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
call fcn.0043a26f
mov esi, eax
cmp esi, ebx
je 0x421615
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0043a33c
cmp eax, ebx
pop ecx
mov dword [ebp + 0x14], eax
je 0x421615
push ebx
push esi
mov byte [ebp + 0x1f], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, ebx
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp + 0x18], eax
je 0x4215b5
cmp eax, dword [0x45fb18]
je 0x4215b5
call fcn.0043b24f
test al, al
jne 0x4215b5
push 1
push dword [ebp + 0x18]
push dword [0x45fb18]
call edi
test eax, eax
setne byte [ebp + 0x1f]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x421604
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov eax, dword [0x45b170]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x421604
cmp eax, 0x19
jge 0x4215fa
cmp byte [0x460211], bl
je 0x4215fa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421604
push 1
push eax
call fcn.0040d9dd
pop ecx
pop ecx
cmp byte [ebp + 0x1f], bl
je 0x421615
push ebx
push dword [ebp + 0x18]
push dword [0x45fb18]
call edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 0x18
Function at 0x42161f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov ecx, dword [0x45e2f0]
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x454094
call fcn.0040161c
mov ecx, dword [0x45d970]
push 1
push ebx
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x14], ecx
call fcn.0040161c
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
call fcn.0043a26f
mov esi, eax
cmp esi, ebx
je 0x421703
push ebx
push esi
mov byte [ebp + 0x1b], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, ebx
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp + 0x14], eax
je 0x4216ad
cmp eax, dword [0x45fb18]
je 0x4216ad
call fcn.0043b24f
test al, al
jne 0x4216ad
push 1
push dword [ebp + 0x14]
push dword [0x45fb18]
call edi
test eax, eax
setne byte [ebp + 0x1b]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0x1b], bl
mov dword [ebp - 4], eax
je 0x4216c7
push ebx
push dword [ebp + 0x14]
push dword [0x45fb18]
call edi
cmp dword [ebp - 4], ebx
je 0x421703
lea eax, [ebp - 0x118]
push 0xfc
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x421703
lea eax, [ebp - 0x10]
push eax
push 0x43a581
push esi
mov dword [ebp - 8], ebx
mov byte [ebp - 0xc], bl
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0xc], bl
jne 0x421708
xor eax, eax
inc eax
jmp 0x42174b
push dword [ebp - 8]
mov eax, 0x101
push 0x452984
lea ecx, [ebp - 0x118]
call fcn.0040a406
pop ecx
pop ecx
mov ecx, dword [0x45e2f0]
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
call fcn.0040161c
mov ecx, dword [ebp - 0x14]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
call fcn.0040161c
pop edi
pop esi
pop ebx
leave
ret 0x14