joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a010
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x41a031
cmp eax, 5
jae 0x41a035
xor eax, eax
jmp 0x41a037
mov al, 1
add esp, 0x94
ret

Function at 0x41a074
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00403ec4
xor eax, eax
push ebp
push 0x41a0d2
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.dnsapi.dll_DnsFlushResolverCache_2
mov eax, dword [ebx]
call fcn.0040430c
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x41a0b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a0dc
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a0dc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41a658
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403f18
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.0040430c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41a6fb
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040430c
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41a6f2
cmp dword [ebp - 0xc], 1
jne 0x41a6f2
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0040459c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.0040430c
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebx]
call fcn.0040430c
mov edx, eax
mov eax, ebx
call fcn.004040bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41a704
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
mov edx, 0x41a770
call fcn.00403f18
xor eax, eax
push ebp
push 0x41a756
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.004040f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a760
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a7f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
mov edx, 0x41a878
call fcn.00403f18
xor eax, eax
push ebp
push 0x41a85e
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push 0x41a880
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x41a854
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004060c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a868
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a884
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a944
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x41a95c
call fcn.00403f18
xor eax, eax
push ebp
push 0x41a91f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004060c4
push dword [ebx]
push 0x41a96c
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 2]
call fcn.004060c4
push dword [ebp - 0x28]
mov eax, ebx
mov edx, 3
call fcn.00404210
push dword [ebx]
push 0x41a96c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004060c4
push dword [ebp - 0x2c]
mov eax, ebx
mov edx, 3
call fcn.00404210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a929
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a94b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x416000
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
pushal
push 0x416031
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x41603a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [0x416047]
push 0
push 0
push 0
push edx
push 0
push 0
call eax
popal
jmp loc.0040b63a

Function at 0x499f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x43c015
lea edi, [esi - 0x3b015]
push edi
or ebp, 0xffffffff
jmp 0x499f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x499f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499f28
mov eax, 1
add ebx, ebx
jne 0x499f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x499f40
jne 0x499f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499f40
xor ecx, ecx
sub eax, 3
jb 0x499f70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x499fe2
mov ebp, eax
add ebx, ebx
jne 0x499f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x499f88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x499fac
inc ecx
add ebx, ebx
jne 0x499f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x499f8d
jne 0x499fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499f8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x499fcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x499fbd
jmp 0x499f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x499fcc
add edi, ecx
jmp 0x499f2e
pop esi
mov edi, esi
mov ecx, 0x51
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x499fea
cmp byte [edi], 1
jne 0x499fea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x499fef
lea edi, [esi + 0x95000]
mov eax, dword [edi]
or eax, eax
je 0x49a05e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b484]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b568]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49a01c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b570]
or eax, eax
je 0x49a058
mov dword [ebx], eax
add ebx, 4
jmp 0x49a039
call dword [esi + 0x9b56c]
mov ebp, dword [esi + 0x9b574]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49a092
sub esp, 0xffffff80
jmp 0x402d30
Function at 0x4035a0
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4035b4
inc dword [0x4c8614]
add dword [0x4c49ac], 0x110
mov edx, dword [0x4c49ac]
push esi
push edi
mov ecx, 0x44
mov esi, 0x4c70d8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4035e3
push 0
mov eax, 0x4ca630
call fcn.00415e20
cmp dword [0x4c8640], 0
mov dword [0x4cb100], 0
mov dword [0x4cb104], 0
je 0x40360b
push 0x4c8ca8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40368f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x40363a
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x40363a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cb10c], 0
je 0x40364c
cmp dword [0x4cb108], 0
jne 0x403655
cmp byte [esi + 0xee], 0
je 0x40368f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40368f
cmp dword [0x4cb10c], 0
jge 0x403677
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cb10c]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x4042f0
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404314
push esi
call fcn.004045c0
test eax, eax
jne 0x404314
push str.Cant_open_clipboard_for_writing.
call fcn.004043f0
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40434d
cmp dword [esi + 0x18], ebx
je 0x40433f
cmp dword [esi + 8], ebx
je 0x404334
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a1bbc
call fcn.004043f0
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404386
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x4043ad
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x4043ad
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x4043a3
cmp dword [esi + 8], ebx
je 0x404398
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4043c2
mov dword [esi + 4], ebx
jmp 0x404386
cmp dword [esi + 0x18], ebx
je 0x4043df
cmp dword [esi + 8], ebx
je 0x4043d4
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a1bdc
call fcn.004043f0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4044c0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x4044d0
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40459f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.0048de57
add esp, 0xc
test eax, eax
je 0x404596
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.0048d609
add esp, 8
test eax, eax
je 0x404596
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.0048d609
add esp, 8
test eax, eax
je 0x404596
lea edx, [esp]
push str.Native
push edx
call fcn.0048d609
add esp, 8
test eax, eax
je 0x404596
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.0048d609
add esp, 8
test eax, eax
je 0x404596
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.0048d609
add esp, 8
test eax, eax
je 0x40458c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.0048d609
add esp, 8
test eax, eax
jne 0x4045a5
test esi, esi
je 0x404596
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x4045c0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0
je 0x4045d2
mov eax, 1
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x4c84a8]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
push ecx
mov edi, eax
call ebx
test eax, eax
jne 0x404640
mov eax, dword [0x4c48b0]
cmp eax, 0xffffffff
je 0x404611
test eax, eax
je 0x404656
call esi
mov edx, dword [0x4c48b0]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x404656
push 1
push 0x8000012f
mov dword [0x4c48b4], 0
call fcn.00401360
mov eax, dword [0x4c84a8]
add esp, 8
push eax
mov dword [0x4c48b4], 1
call ebx
test eax, eax
je 0x4045f2
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx + 0x18], 1
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x407ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4c73b0], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x407b6b
mov al, byte [0x4c73b2]
cmp al, 0xa0
je 0x407ad6
cmp al, 0x10
jne 0x407b6b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c73ac]
cmp eax, 0x16
jae 0x407b6b
test ebp, 0x100
jne case.0x407b07.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407b07.13
movzx eax, byte [eax + 0x407d14]
jmp dword [eax*4 + 0x407d0c]
mov cl, 1
jmp 0x407b14
xor cl, cl
cmp byte [0x4c73b1], 0
jne 0x407b31
xor ecx, ecx
nop
cmp byte [ecx + 0x4c7394], 0
jne 0x407b3c
inc ecx
cmp ecx, 0x16
jl 0x407b20
jmp 0x407b6b
cmp byte [esp + 0x1c], 0
je 0x407b45
test cl, cl
je 0x407b6b
mov byte [0x4c73b3], 1
jmp 0x407b49
test cl, cl
je 0x407b6b
mov cl, byte [0x4c73ab]
mov dl, byte [0x4c73aa]
mov al, byte [0x4c72b7]
mov byte [0x4c84a7], cl
mov byte [0x4c84d8], dl
mov byte [0x4c8568], al
mov cl, byte [0x4c84a7]
movzx esi, byte [esp + 0x14]
mov dl, byte [0x4c84d8]
mov al, byte [0x4c8568]
mov byte [0x4c73ab], cl
lea ecx, [esi + esi*8]
mov byte [0x4c73aa], dl
mov edx, dword [0x4c8edc]
shl ecx, 5
mov bl, byte [ecx + edx + 4]
mov byte [0x4c72b7], al
test bl, bl
je case.default.0x407ce2
cmp dword [edi + 0x10], 0xffc3d44f
setne dl
test byte [edi + 8], 0x10
mov byte [esp + 0xf], dl
je 0x407bc2
xor al, al
jmp 0x407bd7
mov eax, dword [esp + 0x1c]
push eax
mov al, byte [esp + 0x18]
call fcn.00407d70
mov dl, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], al
je 0x407cae
cmp byte [esp + 0x20], 0
jne 0x407c01
mov cl, bl
not cl
and byte [0x4c84a5], cl
test dl, dl
je 0x407c01
and byte [0x4c84a6], cl
cmp byte [esp + 0x18], 0
je case.default.0x407ce2
not bl
and byte [0x4c84a7], bl
lea ecx, [esi - 0xa0]
mov byte [esi + 0x4c84c8], 0
cmp ecx, 5
ja case.default.0x407ce2
jmp dword [ecx*4 + 0x407d38]
mov cl, byte [0x4c8569]
mov byte [0x4c84d8], cl
jmp case.default.0x407ce2
mov dl, byte [0x4c8568]
mov byte [0x4c84d8], dl
jmp case.default.0x407ce2
mov al, byte [0x4c856b]
mov byte [0x4c84d9], al
jmp case.default.0x407ce2
mov cl, byte [0x4c856a]
mov byte [0x4c84d9], cl
jmp case.default.0x407ce2
mov dl, byte [0x4c856d]
mov byte [0x4c84da], dl
jmp case.default.0x407ce2
mov al, byte [0x4c856c]
mov byte [0x4c84da], al
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4c73b4], bp
pop ebp
mov byte [0x4c73b2], al
mov byte [0x4c73b1], cl
pop ebx
je 0x407cf0
xor al, al
mov byte [0x4c73b0], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c73ac], eax
pop ecx
ret
cmp byte [esp + 0x20], 0
jne 0x407cc5
or byte [0x4c84a5], bl
test dl, dl
je 0x407cc5
or byte [0x4c84a6], bl
test al, al
je case.default.0x407ce2
or byte [0x4c84a7], bl
lea ecx, [esi - 0xa0]
mov al, 0x80
mov byte [esi + 0x4c84c8], al
cmp ecx, 5
ja case.default.0x407ce2
jmp dword [ecx*4 + 0x407d50]
mov byte [0x4c84d8], al
jmp case.default.0x407ce2
push ecx
call fcn.00407d70
add esp, 4
mov byte [0x4c73b0], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c73ac], eax
pop ecx
ret
Function at 0x407d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x407d7f
cmp al, 0x10
jne case.0x407dd6.13
cmp byte [esp + 8], 0
jne case.0x407dd6.13
cmp byte [0x4c73b3], 0
je 0x407dab
xor eax, eax
cmp byte [eax + 0x4c7394], 0
jne 0x407dab
inc eax
cmp eax, 0x16
jl 0x407d91
mov byte [0x4c73b3], 0
xor al, al
pop esi
ret
cmp byte [0x4c73b1], 0
je case.0x407dd6.13
test dword [0x4c73b4], 0x100
jne case.0x407dd6.13
movzx eax, byte [0x4c73b2]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407dd6.13
movzx eax, byte [eax + 0x407e00]
jmp dword [eax*4 + 0x407df8]
call esi
sub eax, dword [0x4c73ac]
cmp eax, 0x16
jb 0x407da7
call esi
mov dword [0x4cb2c8], eax
mov al, 1
pop esi
ret
Function at 0x408cc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4c85d8], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x408ce4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4c85dc], 0
je 0x408cf3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408f00
test al, al
jne 0x408d36
cmp byte [ebp + 0xc], al
jne 0x408d36
push 0x4c7390
push 0
push 0
push 0x408fd0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4cb2e8], eax
test eax, eax
je 0x408dc7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c7390]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x408d6c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408d46
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x408dd3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x408e3a
cmp dword [esp + 0x2c], 0
je 0x408de2
mov byte [esp + 0x1f], 1
call fcn.00409370
test al, al
jne 0x408de2
cmp byte [ebp + 0xc], al
jne 0x408ece
mov byte [ebp + 8], al
jmp 0x408d81
call fcn.00409390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x408e1e
call fcn.00409370
test al, al
jne 0x408e3a
cmp byte [ebp + 0xc], 0
jne 0x408ec7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4c85d8], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408e72
test byte [esp + 0x1e], 1
jne 0x408e8b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4c8ec8], eax
jmp 0x408e8b
mov ecx, dword [0x4cb2e8]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408e52
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x408de2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408d81
mov edx, dword [0x4cb2e8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4cb2e8], 0
call fcn.00409390
jmp 0x408df2
test byte [esp + 0x1e], 1
je 0x408e8b
mov eax, dword [0x4c8ec8]
push eax
call edi
mov dword [0x4c8ec8], 0
cmp dword [0x4c85dc], 0
je 0x408ead
test byte [esp + 0x1e], 2
jne 0x408ec7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4c8ecc], eax
jmp 0x408ec7
test byte [esp + 0x1e], 2
je 0x408ec7
mov ecx, dword [0x4c8ecc]
push ecx
call edi
mov dword [0x4c8ecc], 0
cmp byte [esp + 0x1f], 0
je 0x408f00
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
mov dword [0x4c48b4], 0
call fcn.00478ae0
add esp, 0x18
mov dword [0x4c48b4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a880
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100c
call fcn.00498e00
cmp byte [0x4cb2ec], 0
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
push esi
push edi
jne 0x40a9f5
cmp dword [0x4c8ee4], 0
jne 0x40a8b6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c8ee4], eax
mov ebx, 1
add dword [0x4cb2f0], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4cb2f0]
mov esi, dword [0x4c48c8]
mov ecx, eax
sub ecx, dword [0x4c8ee4]
mov dword [0x4c8ee8], eax
cmp edx, dword [0x4c48c4]
jbe 0x40a8ec
cmp ecx, esi
jb 0x40a950
xor edx, edx
cmp ecx, esi
jbe 0x40a909
mov dword [0x4cb2f0], 0
mov dword [0x4c8ee4], eax
test edx, edx
jne 0x40a9f5
mov esi, dword [esp + 0x1020]
mov cl, byte [esi + 0x11]
push 0
mov byte [0x4cb0e2], cl
mov ecx, dword [ebp]
add byte [ebp + 0x16], bl
push 0
push 0x4a18a4
push ecx
xor eax, eax
xor edx, edx
call fcn.0046c720
dec byte [ebp + 0x16]
add esp, 0x10
test eax, eax
jne 0x40a9c4
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x24]
call fcn.00474190
add esp, 0xc
call fcn.00409890
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
mov eax, edi
push 4
push eax
mov byte [0x4cb2ec], bl
mov dword [0x4c48b4], 0
call fcn.00478ae0
add esp, 0x18
cmp eax, 7
jne 0x40a9ab
push 0
push 0x4ca630
xor eax, eax
mov edx, ebx
call fcn.00416190
mov eax, dword [0x4c8ee8]
mov dword [0x4c48b4], ebx
mov byte [0x4cb2ec], 0
mov edx, ebx
jmp 0x40a8f2
cmp byte [ebp + 0x1b], 0
je 0x40a9f5
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40a9f5
movzx edx, word [esi]
mov eax, dword [0x4c84a8]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8