joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fc60
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43fc7b
mov eax, 0xffffffff
jmp 0x43fc7e
add eax, 0xa
push eax
call fcn.00408730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43fcc1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43fcb0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x5492bfff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x5492bfff]
mov ebx, ecx
or ebx, esi
not esi
or esi, edx
and esi, ebx
mov ebx, 1
sub ebx, esi
mov ebp, ebx
not ebp
and ebp, 1
mov edi, 0xfb
sub edi, esi
and edi, 0xfe
or ebx, 0xfe
xor ebx, edi
lea ebx, [ebx + ebp*2]
mov byte [esp + ecx - 0x5492bfff], bl
inc ecx
dec edx
cmp ecx, 0x5492c006
jne 0x43fd50
mov esi, dword [esp]
mov ecx, dword [0x44ce64]
test ecx, ecx
je 0x43fdf7
xor edx, edx
mov ebx, dword [0x44ce68]
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x43fdc0
inc edx
cmp ecx, edx
jne 0x43fdb0
jmp 0x43fdf7
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43fdf7
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44ce6c]
mov edi, eax
call fcn.0043d480
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408740
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fe10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fe30
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43fe4b
mov eax, 0xffffffff
jmp 0x43fe4e
add eax, 0xa
push eax
call fcn.00408730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43fe91
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43fe80
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xf8fbfa05
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov ecx, 0x5492bfff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x5492bfdf]
mov esi, ecx
or esi, edi
not edi
or edi, edx
and edi, esi
mov esi, 1
sub esi, edi
mov ebx, 0xfb
sub ebx, edi
mov edi, esi
and ebx, 0xfe
or esi, 0xfe
xor esi, ebx
not edi
and edi, 1
lea ebx, [esi + edi*2]
mov byte [esp + ecx - 0x5492bfdf], bl
inc ecx
dec edx
cmp ecx, 0x5492c006
jne 0x43ff20
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44ce64]
test ecx, ecx
je 0x43ffb9
xor edx, edx
mov edi, dword [0x44ce68]
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x43ff90
inc edx
cmp ecx, edx
jne 0x43ff80
jmp 0x43ffb9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ffb9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44ce6c]
mov edi, eax
call fcn.0043d480
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408740
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43ffcf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5492bfff]
mov ebx, eax
or ebx, ecx
not ecx
or ecx, edx
and ecx, ebx
mov ebx, 1
sub ebx, ecx
mov esi, 0xfb
sub esi, ecx
mov ecx, ebx
and esi, 0xfe
or ebx, 0xfe
xor ebx, esi
not ecx
and ecx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax - 0x5492bfff], cl
inc eax
dec edx
cmp eax, 0x5492c006
jne 0x440010
mov eax, dword [esp]
mov edx, dword [0x44ce64]
test edx, edx
je 0x4400a8
xor ecx, ecx
mov ebx, dword [0x44ce68]
nop
nop
nop
cmp dword [ebx + ecx*8], 0x9c142cda
je 0x440080
inc ecx
cmp edx, ecx
jne 0x440070
jmp 0x4400a8
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, eax
je 0x4400a8
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x20
test edi, edi
je 0x4400b2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4400c1
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4400d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x5492bfff]
mov edi, eax
or edi, ebp
not ebp
or ebp, ebx
and ebp, edi
mov edi, 1
sub edi, ebp
mov esi, edi
not esi
and esi, 1
mov ecx, 0xfb
sub ecx, ebp
and ecx, 0xfe
or edi, 0xfe
xor edi, ecx
lea ecx, [edi + esi*2]
mov byte [esp + eax - 0x5492bfff], cl
inc eax
dec ebx
cmp eax, 0x5492c006
jne 0x440100
mov eax, dword [esp]
mov ebx, dword [0x44ce64]
test ebx, ebx
je 0x4401a1
xor ebp, ebp
mov edi, dword [0x44ce68]
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x440170
inc ebp
cmp ebx, ebp
jne 0x440160
jmp 0x4401a1
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4401a1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x30
cmp eax, 0x103
jne 0x440269
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5492bfff]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
mov esi, 1
sub esi, edx
mov edi, esi
not edi
and edi, 1
mov ebx, 0xfb
sub ebx, edx
and ebx, 0xfe
or esi, 0xfe
xor esi, ebx
lea edx, [esi + edi*2]
mov byte [esp + eax - 0x5492bfff], dl
inc eax
dec ecx
cmp eax, 0x5492c006
jne 0x4401d0
mov eax, dword [esp]
mov ecx, dword [0x44ce64]
test ecx, ecx
je 0x440261
xor edx, edx
mov edi, dword [0x44ce68]
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x440240
inc edx
cmp ecx, edx
jne 0x440230
jmp 0x440261
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440261
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x18
test eax, eax
js 0x440269
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x440280
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44027e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x5492bfff]
mov edi, eax
or edi, ebp
not ebp
or ebp, ebx
and ebp, edi
mov edi, 1
sub edi, ebp
mov esi, edi
not esi
and esi, 1
mov ecx, 0xfb
sub ecx, ebp
and ecx, 0xfe
or edi, 0xfe
xor edi, ecx
lea ecx, [edi + esi*2]
mov byte [esp + eax - 0x5492bfff], cl
inc eax
dec ebx
cmp eax, 0x5492c006
jne 0x4402c0
mov eax, dword [esp]
mov ebx, dword [0x44ce64]
test ebx, ebx
je 0x440361
xor ebp, ebp
mov edi, dword [0x44ce68]
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x440330
inc ebp
cmp ebx, ebp
jne 0x440320
jmp 0x440361
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x440361
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x30
cmp eax, 0x103
jne 0x440429
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5492bfff]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
mov esi, 1
sub esi, edx
mov edi, esi
not edi
and edi, 1
mov ebx, 0xfb
sub ebx, edx
and ebx, 0xfe
or esi, 0xfe
xor esi, ebx
lea edx, [esi + edi*2]
mov byte [esp + eax - 0x5492bfff], dl
inc eax
dec ecx
cmp eax, 0x5492c006
jne 0x440390
mov eax, dword [esp]
mov ecx, dword [0x44ce64]
test ecx, ecx
je 0x440421
xor edx, edx
mov edi, dword [0x44ce68]
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x440400
inc edx
cmp ecx, edx
jne 0x4403f0
jmp 0x440421
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440421
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x18
test eax, eax
js 0x440429
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x440437
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x3c]
mov bx, 0xfffc
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp word [edi + ebp], 0
lea ebp, [ebp + 2]
jne 0x440460
add ebp, 0xfffffffe
mov word [esp + 8], bp
and ebx, 4
xor ebp, 2
add ebp, ebx
mov word [esp + 0xa], bp
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf8fbfa05
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x5492bfff
xor edi, edi
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x5492bfff]
mov ebp, eax
or ebp, ebx
not ebx
or ebx, edi
and ebx, ebp
mov ebp, 1
sub ebp, ebx
mov ecx, ebp
not ecx
and ecx, 1
mov edx, 0xfb
sub edx, ebx
and edx, 0xfe
or ebp, 0xfe
xor ebp, edx
lea ecx, [ecx*2]
add ecx, ebp
mov byte [esp + eax - 0x5492bfff], cl
inc eax
dec edi
cmp eax, 0x5492c006
jne 0x4404d0
mov eax, dword [esp]
mov edi, dword [0x44ce64]
test edi, edi
je 0x440578
xor ebx, ebx
mov ebp, dword [0x44ce68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x440551
inc ebx
cmp edi, ebx
jne 0x440540
jmp 0x440578
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x440578
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x44ce6c]
call fcn.0043d480
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8
Function at 0x403520
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403534
inc dword [0x4c6624]
add dword [0x4c28ec], 0x108
mov edx, dword [0x4c28ec]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c50f0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403563
push 0
mov eax, 0x4c8640
call fcn.00415d50
cmp dword [0x4c6654], 0
mov dword [0x4c9110], 0
mov dword [0x4c9114], 0
je 0x40358b
push 0x4c6cb8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40360f
or ecx, 0xffffffff
cmp byte [esi + 0xea], 0
jne 0x4035ba
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xea], al
test al, al
je 0x4035ba
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c911c], 0
je 0x4035cc
cmp dword [0x4c9118], 0
jne 0x4035d5
cmp byte [esi + 0xea], 0
je 0x40360f
cmp byte [esi + 0xea], 0
mov byte [esi + 0xe8], 0
jne 0x40360f
cmp dword [0x4c911c], 0
jge 0x4035f7
pop edi
mov dword [esi + 0xdc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd8], eax
mov edx, dword [0x4c911c]
mov dword [esi + 0xdc], edx
pop edi
pop esi
ret
Function at 0x404270
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404294
push esi
call fcn.00404540
test eax, eax
jne 0x404294
push str.Cant_open_clipboard_for_writing.
call fcn.00404370
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4042cd
cmp dword [esi + 0x18], ebx
je 0x4042bf
cmp dword [esi + 8], ebx
je 0x4042b4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a0bac
call fcn.00404370
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404306
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40432d
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40432d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404323
cmp dword [esi + 8], ebx
je 0x404318
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404342
mov dword [esi + 4], ebx
jmp 0x404306
cmp dword [esi + 0x18], ebx
je 0x40435f
cmp dword [esi + 8], ebx
je 0x404354
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a0bcc
call fcn.00404370
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404440
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404450
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40451f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.0048d597
add esp, 0xc
test eax, eax
je 0x404516
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x404516
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x404516
lea edx, [esp]
push str.Native
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x404516
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x404516
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x40450c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
jne 0x404525
test esi, esi
je 0x404516
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x408bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4c65e8], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x408bf4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4c65ec], 0
je 0x408c03
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408e10
test al, al
jne 0x408c46
cmp byte [ebp + 0xc], al
jne 0x408c46
push 0x4c53a0
push 0
push 0
push 0x408ee0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c92f8], eax
test eax, eax
je 0x408cd7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c53a0]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x408c7c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408c56
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x408ce3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x408d4a
cmp dword [esp + 0x2c], 0
je 0x408cf2
mov byte [esp + 0x1f], 1
call fcn.00409280
test al, al
jne 0x408cf2
cmp byte [ebp + 0xc], al
jne 0x408dde
mov byte [ebp + 8], al
jmp 0x408c91
call fcn.004092a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x408d2e
call fcn.00409280
test al, al
jne 0x408d4a
cmp byte [ebp + 0xc], 0
jne 0x408dd7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4c65e8], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408d82
test byte [esp + 0x1e], 1
jne 0x408d9b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4c6ed8], eax
jmp 0x408d9b
mov ecx, dword [0x4c92f8]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408d62
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x408cf2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408c91
mov edx, dword [0x4c92f8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4c92f8], 0
call fcn.004092a0
jmp 0x408d02
test byte [esp + 0x1e], 1
je 0x408d9b
mov eax, dword [0x4c6ed8]
push eax
call edi
mov dword [0x4c6ed8], 0
cmp dword [0x4c65ec], 0
je 0x408dbd
test byte [esp + 0x1e], 2
jne 0x408dd7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4c6edc], eax
jmp 0x408dd7
test byte [esp + 0x1e], 2
je 0x408dd7
mov ecx, dword [0x4c6edc]
push ecx
call edi
mov dword [0x4c6edc], 0
cmp byte [esp + 0x1f], 0
je 0x408e10
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
mov dword [0x4c28b4], 0
call fcn.00478220
add esp, 0x18
mov dword [0x4c28b4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a6f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100c
call fcn.00498540
cmp byte [0x4c92fc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
push esi
push edi
jne 0x40a865
cmp dword [0x4c6ef4], 0
jne 0x40a726
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c6ef4], eax
mov ebx, 1
add dword [0x4c9300], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4c9300]
mov esi, dword [0x4c28c8]
mov ecx, eax
sub ecx, dword [0x4c6ef4]
mov dword [0x4c6ef8], eax
cmp edx, dword [0x4c28c4]
jbe 0x40a75c
cmp ecx, esi
jb 0x40a7c0
xor edx, edx
cmp ecx, esi
jbe 0x40a779
mov dword [0x4c9300], 0
mov dword [0x4c6ef4], eax
test edx, edx
jne 0x40a865
mov esi, dword [esp + 0x1020]
mov cl, byte [esi + 0x11]
push 0
mov byte [0x4c90f2], cl
mov ecx, dword [ebp]
add byte [ebp + 0x1f], bl
push 0
push 0x4a0890
push ecx
xor eax, eax
xor edx, edx
call fcn.0046c000
dec byte [ebp + 0x1f]
add esp, 0x10
test eax, eax
jne 0x40a834
mov byte [ebp + 0x24], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x24]
call fcn.004738d0
add esp, 0xc
call fcn.00409800
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
mov eax, edi
push 4
push eax
mov byte [0x4c92fc], bl
mov dword [0x4c28b4], 0
call fcn.00478220
add esp, 0x18
cmp eax, 7
jne 0x40a81b
push 0
push 0x4c8640
xor eax, eax
mov edx, ebx
call fcn.004160c0
mov eax, dword [0x4c6ef8]
mov dword [0x4c28b4], ebx
mov byte [0x4c92fc], 0
mov edx, ebx
jmp 0x40a762
cmp byte [ebp + 0x24], 0
je 0x40a865
mov byte [ebp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 4]
cmp eax, 0x3e8
ja 0x40a865
movzx edx, word [esi]
mov eax, dword [0x4c64b8]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8