joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a7b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0
push edi
mov edi, dword [ebp + 8]
je 0x40a7ce
push str.stderr
push edi
call fcn.0040a640
cmp dword [esi + 0x3c], 2
je 0x40a7db
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40a8b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
xor ebx, ebx
jmp 0x40a8c0
mov ecx, dword [esi + 0x20]
cmp ebx, ecx
jae 0x40a8df
mov eax, dword [esi + 0x18]
lea ebx, [ebx]
cmp byte [eax + ebx], 0
je 0x40a968
inc ebx
cmp ebx, ecx
jb 0x40a8d0
cmp ecx, dword [esi + 0x1c]
jne 0x40a92a
mov eax, dword [esi + 0x1c]
lea ecx, [eax + eax]
test eax, eax
jne 0x40a8f3
mov ecx, 0x800
cmp dword [esi + 0x24], 0
jne 0x40a955
mov edi, eax
test eax, eax
jne 0x40a904
mov edi, 0x800
cmp edi, ecx
jae 0x40a90e
add edi, edi
cmp edi, ecx
jb 0x40a908
cmp edi, eax
jbe 0x40a92a
mov eax, dword [esi + 0x18]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
je 0x40a94e
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push 0
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [esi + 0x10]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x40a955
add dword [esi + 0x20], eax
jmp 0x40a8c0
mov dword [esi + 0x24], 1
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.0040aea0
add esp, 4
pop edi
pop ebp
pop ebx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40a972
mov dword [eax], ebx
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x40a980
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 0x30]
push 0xa
lea eax, [esp + 0x10]
push eax
add ecx, 0x26
push ecx
call dword [sym.imp.MSVCR100.dll__itoa]
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.MSVCR100.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
lea esi, [eax + 1]
push 0x4bcec4
push esi
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edx, dword [ebx + 0x10]
add esp, 0x20
add esi, eax
lea eax, [esp + 0xc]
push 0
sub esi, eax
push esi
mov esi, dword [sym.imp.WSOCK32.dll_send]
mov ecx, eax
push ecx
push edx
call esi
cmp eax, 0xffffffff
je 0x40aa36
cmp dword [ebx + 0x34], 0
lea edi, [ebx + 0x28]
jne 0x40aa36
mov ecx, dword [edi + 8]
inc ecx
call fcn.0040b750
test eax, eax
jne 0x40aa36
mov eax, dword [edi]
add eax, dword [edi + 8]
mov cl, byte [0x4bd2c4]
mov byte [eax], cl
inc dword [edi + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [edi]
mov ecx, dword [ebx + 0x10]
push 0
push edx
push eax
push ecx
call esi
cmp eax, 0xffffffff
je 0x40aa36
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x4e9880
call fcn.0040ae30
mov edx, dword [0x4eacac]
mov eax, dword [0x4e7ef0]
push 0x10014
push edx
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40aa6f
push 0
push eax
mov ecx, 0x4ea1d0
call fcn.0042b150
pop edi
pop esi
mov eax, 0x3e6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aef0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x40af0a
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40af01
sub eax, ebx
mov ebp, eax
cmp eax, 2
jbe 0x40af86
lea edx, [eax - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edi
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
mov byte [esi + ecx + 2], bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 3], al
add edi, 3
add ecx, 4
sub ebp, 3
dec edx
jne 0x40af20
test ebp, ebp
je 0x40affa
movzx eax, byte [edi]
shl eax, 0x10
cmp ebp, 1
jbe 0x40af9e
movzx edx, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
cmp ebp, 1
jbe 0x40afe6
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
mov al, 0x3d
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
pop ebp
mov byte [ecx + esi], 0
mov eax, ecx
pop ebx
ret

Function at 0x40bf50
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, ebx
jne 0x40bfa1
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x40bfc6
mov eax, dword [edi + 0x10]
dec eax
mov dword [edi + 0x10], eax
jne 0x40bf93
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40bf89
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
pop edi
pop ebp
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov eax, esi
pop ebx
ret 4
push esi
xor cl, cl
call fcn.0040c0c0
mov ebx, dword [esi + 4]
push edi
call fcn.0040c2b0
mov eax, dword [esi + 4]
mov eax, dword [eax]
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
pop ebp
mov eax, esi
pop ebx
ret 4
Function at 0x40c9a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp byte [0x4eacc4], 0
jne 0x40c9ac
xor eax, eax
ret
push edi
mov edi, dword fs:[0x24]
cmp dword [0x4ea158], edi
je 0x40c9c8
mov eax, dword [0x4ea15c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 8]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c9d2
sub eax, esi
push 3
sar eax, 1
push eax
push edx
mov ecx, 0x4ea1d0
call fcn.0043d150
pop esi
test eax, eax
jne 0x40ca0e
cmp dword [0x4ea158], edi
je 0x40ca09
mov ecx, dword [0x4ea15c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esp + 0xc]
push 1
push 0
push 0xffffffffffffffff
push edx
push eax
call fcn.004a2810
cmp dword [0x4ea158], edi
je 0x40ca33
mov eax, dword [0x4ea15c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
ret
Function at 0x411200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4e6d8e], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x4112ae
mov al, byte [0x4e6d96]
cmp al, 0xa0
je 0x411226
cmp al, 0x10
jne 0x4112ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e6d90]
cmp eax, 0x16
jae 0x4112ae
test ebp, 0x100
jne case.0x411253.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x411253.13
movzx eax, byte [eax + 0x411464]
jmp dword [eax*4 + 0x41145c]
mov al, 1
jmp 0x411260
xor al, al
cmp byte [0x4e6d8f], 0
jne 0x411274
call fcn.00411580
test al, al
jne 0x41127f
jmp 0x4112ae
cmp byte [esp + 0x1c], 0
je 0x411288
test al, al
je 0x4112ae
mov byte [0x4e6d97], 1
jmp 0x41128c
test al, al
je 0x4112ae
mov cl, byte [0x4e6d77]
mov dl, byte [0x4e6d76]
mov al, byte [0x4e6d75]
mov byte [0x4e7eeb], cl
mov byte [0x4e7f20], dl
mov byte [0x4e7fb0], al
movzx ecx, byte [0x4e7eeb]
mov dl, byte [0x4e7f20]
mov al, byte [0x4e7fb0]
mov byte [0x4e6d77], cl
mov cl, byte [esp + 0x14]
movzx esi, cl
mov byte [0x4e6d76], dl
mov byte [0x4e6d75], al
mov eax, dword [0x4e895c]
lea edx, [esi + esi*4]
mov bl, byte [eax + edx*4 + 8]
test bl, bl
je case.default.0x411424
cmp dword [edi + 0x10], 0xffc3d44f
setne al
test byte [edi + 8], 0x10
mov byte [esp + 0xf], al
je 0x411304
xor cl, cl
jmp 0x411319
mov edx, dword [esp + 0x1c]
push edx
mov al, cl
call fcn.004114c0
mov cl, al
mov al, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], cl
je 0x4113f0
cmp byte [esp + 0x20], 0
jne 0x411343
mov cl, bl
not cl
and byte [0x4e7ee7], cl
test al, al
je 0x411343
and byte [0x4e7eea], cl
cmp byte [esp + 0x18], 0
je case.default.0x411424
not bl
and byte [0x4e7eeb], bl
lea eax, [esi - 0xa0]
mov byte [esi + 0x4e7f10], 0
cmp eax, 5
ja case.default.0x411424
jmp dword [eax*4 + 0x411488]
mov al, byte [0x4e7fb1]
mov byte [0x4e7f20], al
jmp case.default.0x411424
mov cl, byte [0x4e7fb0]
mov byte [0x4e7f20], cl
jmp case.default.0x411424
mov dl, byte [0x4e7fb3]
mov byte [0x4e7f21], dl
jmp case.default.0x411424
mov al, byte [0x4e7fb2]
mov byte [0x4e7f21], al
jmp case.default.0x411424
mov cl, byte [0x4e7fb5]
mov byte [0x4e7f22], cl
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4e6d94], bp
pop ebp
mov byte [0x4e6d96], al
mov byte [0x4e6d8f], cl
pop ebx
je 0x411441
xor al, al
mov byte [0x4e6d8e], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e6d90], eax
pop ecx
ret
mov dl, byte [0x4e7fb4]
mov byte [0x4e7f22], dl
jmp case.default.0x411424
cmp byte [esp + 0x20], 0
jne 0x411407
or byte [0x4e7ee7], bl
test al, al
je 0x411407
or byte [0x4e7eea], bl
test cl, cl
je case.default.0x411424
or byte [0x4e7eeb], bl
lea eax, [esi - 0xa0]
mov cl, 0x80
mov byte [esi + 0x4e7f10], cl
cmp eax, 5
ja case.default.0x411424
jmp dword [eax*4 + 0x4114a0]
mov byte [0x4e7f20], cl
jmp case.default.0x411424
mov byte [0x4e7f21], cl
jmp case.default.0x411424
push ecx
call fcn.004114c0
add esp, 4
mov byte [0x4e6d8e], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e6d90], eax
pop ecx
ret
Function at 0x4114c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x4114cf
cmp al, 0x10
jne case.0x411526.13
cmp byte [esp + 8], 0
jne case.0x411526.13
cmp byte [0x4e6d97], 0
je 0x4114fb
xor eax, eax
cmp byte [eax + 0x4e6d78], 0
jne 0x4114fb
inc eax
cmp eax, 0x16
jl 0x4114e1
mov byte [0x4e6d97], 0
xor al, al
pop esi
ret
cmp byte [0x4e6d8f], 0
je case.0x411526.13
test dword [0x4e6d94], 0x100
jne case.0x411526.13
movzx eax, byte [0x4e6d96]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x411526.13
movzx eax, byte [eax + 0x411554]
jmp dword [eax*4 + 0x41154c]
call esi
sub eax, dword [0x4e6d90]
cmp eax, 0x16
jb 0x4114f7
call esi
mov dword [0x4eae9c], eax
mov dword [0x4eae98], eax
mov al, 1
pop esi
ret
Function at 0x412620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4e8020], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x412644
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4e8024], 0
je 0x412653
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x412860
test al, al
jne 0x412696
cmp byte [ebp + 0xc], al
jne 0x412696
push 0x4e6d70
push 0
push 0
push 0x412930
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e894c], eax
test eax, eax
je 0x412727
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4e6d70]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x4126cc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x4126a6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x412733
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x41279a
cmp dword [esp + 0x2c], 0
je 0x412742
mov byte [esp + 0x1f], 1
call fcn.00412ca0
test al, al
jne 0x412742
cmp byte [ebp + 0xc], al
jne 0x41282e
mov byte [ebp + 8], al
jmp 0x4126e1
call fcn.00412cc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x41277e
call fcn.00412ca0
test al, al
jne 0x41279a
cmp byte [ebp + 0xc], 0
jne 0x412827
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4e8020], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x4127d2
test byte [esp + 0x1e], 1
jne 0x4127eb
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4e8944], eax
jmp 0x4127eb
mov ecx, dword [0x4e894c]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x4127b2
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x412742
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4126e1
mov edx, dword [0x4e894c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4e894c], 0
call fcn.00412cc0
jmp 0x412752
test byte [esp + 0x1e], 1
je 0x4127eb
mov eax, dword [0x4e8944]
push eax
call edi
mov dword [0x4e8944], 0
cmp dword [0x4e8024], 0
je 0x41280d
test byte [esp + 0x1e], 2
jne 0x412827
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4e8948], eax
jmp 0x412827
test byte [esp + 0x1e], 2
je 0x412827
mov ecx, dword [0x4e8948]
push ecx
call edi
mov dword [0x4e8948], 0
cmp byte [esp + 0x1f], 0
je 0x412860
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
mov dword [0x4e4a2c], 0
call fcn.004a4470
add esp, 0x18
mov dword [0x4e4a2c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413c80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.00412620
mov eax, dword [0x4e8028]
add esp, 8
test eax, eax
je 0x413ca7
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov edx, dword [0x4e5d74]
push ebx
xor ecx, ecx
xor ebx, ebx
cmp cx, word [edx]
jae 0x413d34
mov edx, dword [0x4e9830]
push ebp
mov ebp, dword [sym.imp.USER32.dll_UnregisterHotKey]
push esi
push edi
mov edi, dword [0x4e9834]
lea esp, [esp]
mov eax, dword [0x4e896c]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x413d23
cmp byte [esi + 0x18], 0
je 0x413d04
movzx ecx, word [esi + 4]
mov edx, dword [0x4e7ef0]
push ecx
push edx
call ebp
mov edi, dword [0x4e9834]
mov edx, dword [0x4e9830]
test eax, eax
sete al
mov byte [esi + 0x18], al
cmp esi, edi
jne 0x413d23
test edi, edi
je 0x413d23
mov eax, dword [edx + 4]
mov ecx, eax
sub ecx, edi
add dword [edx + 8], ecx
sub eax, ecx
xor edi, edi
mov dword [edx + 4], eax
mov dword [0x4e9834], edi
mov ecx, dword [0x4e5d74]
movzx eax, word [ecx]
inc ebx
cmp ebx, eax
jl 0x413cd0
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_exit]
pop ebx

Function at 0x4142a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.004b9d80
cmp byte [0x4eaee8], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
jne 0x41440d
cmp dword [0x4e8964], 0
jne 0x4142d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e8964], eax
mov ebx, 1
add dword [0x4eaeec], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4eaeec]
mov esi, dword [0x4e4a40]
mov ecx, eax
sub ecx, dword [0x4e8964]
mov dword [0x4e8968], eax
cmp edx, dword [0x4e4a3c]
jbe 0x41430c
cmp ecx, esi
jb 0x41436a
xor ebx, ebx
cmp ecx, esi
jbe 0x414329
mov dword [0x4eaeec], 0
mov dword [0x4e8964], eax
test ebx, ebx
jne 0x41440d
mov esi, dword [esp + 0x1018]
mov cl, byte [esi + 0xf]
push 0
push 0
mov byte [0x4eacaa], cl
inc byte [ebp + 0x16]
mov edx, dword [0x4eac38]
push 0
push edx
push ebp
call fcn.00491070
dec byte [ebp + 0x16]
test eax, eax
jne 0x4143da
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.0049e5c0
add esp, 0xc
call fcn.0040c5c0
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
mov eax, edi
push 4
push eax
mov byte [0x4eaee8], bl
mov dword [0x4e4a2c], 0
call fcn.004a4470
add esp, 0x18
cmp eax, 7
jne 0x4143c3
push 0
push 1
mov ecx, 0x4ea1d0
call fcn.0042b150
mov eax, dword [0x4e8968]
mov dword [0x4e4a2c], ebx
mov byte [0x4eaee8], 0
jmp 0x414312
cmp byte [ebp + 0x1b], 0
je 0x41440d
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x41440d
movzx eax, word [esi + 4]
mov ecx, dword [0x4e7ef0]
push 0
push eax
push 0x312
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
Function at 0x4176c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x38
cmp dword [0x4e899c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
je 0x4176de
mov bl, byte [0x4e6da7]
jmp 0x4177d0
cmp dword [0x4e8020], 0
je 0x4176f2
mov bl, byte [0x4e7ee7]
jmp 0x4177d0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x41770d
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x417721
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x417735
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x417749
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x41775d
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x417771
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x417782
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x417793
or bl, 0x80
cmp dword [0x4e8020], 0
je 0x4177d0
mov al, bl
not al
and al, byte [0x4e7ee7]
je 0x4177d0
mov cl, byte [0x4e7eeb]
not al
and byte [0x4e7ee7], al
and byte [0x4e7eea], al
and cl, al
mov al, cl
mov byte [0x4e7eeb], cl
mov ecx, 0x4e7f10
call fcn.0041baf0
mov eax, dword [esp + 0x4c]
push 1
push 0
push 0
push ebx
push eax
mov esi, 0xffc3d44f
call fcn.0041b350
add esp, 0x14
cmp dword [0x4e899c], 1
jne 0x41783e
mov ecx, dword [0x4e4b24]
movzx edx, byte [ecx + 0xf6]
mov eax, 0xffc3d44d
sub eax, edx
push eax
push 4
push ebp
push 0
push 0
call fcn.0041a940
mov ecx, dword [0x4e4b24]
movzx edx, byte [ecx + 0xf6]
mov eax, 0xffc3d44d
sub eax, edx
push eax
push 6
push ebp
push 0
push 0
call fcn.0041a940
add esp, 0x28
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
mov eax, dword [0x4e4b24]
xor ecx, ecx
mov word [esp + 0x10], cx
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], 1
mov word [esp + 0x12], bp
mov dword [esp + 0x14], 4
movzx edx, byte [eax + 0xf6]
mov esi, 0xffc3d44d
sub esi, edx
xor edx, edx
mov dword [esp + 0x34], ecx
mov word [esp + 0x2c], dx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
mov word [esp + 0x2e], bp
mov dword [esp + 0x30], 6
movzx eax, byte [eax + 0xf6]
push 0x1c
lea edx, [esp + 0x10]
mov ecx, 0xffc3d44d
push edx
sub ecx, eax
push 2
mov dword [esp + 0x44], ecx
call dword [sym.imp.USER32.dll_SendInput]
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x418f40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
cmp dword [0x4e899c], 2
push ebx
sete bl
push esi
mov esi, ecx
test bl, bl
je 0x418f80
movzx eax, ax
lea ecx, [esp + 0x28]
test eax, 0xffffff80
je 0x418f71
mov ecx, 0x30
mov word [esp + 0x28], cx
lea ecx, [esp + 0x2a]
push 0xa
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__itow]
add esp, 0xc
jmp 0x418f87
movzx edx, ax
mov dword [esp + 8], edx
test esi, esi
jle 0x419043
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
cmp dword [0x4e899c], 0
jne 0x418ff4
call ebp
sub eax, dword [0x4eace4]
mov ecx, dword [0x4e4b24]
cmp eax, dword [ecx + 0xd8]
jbe 0x418ff4
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418fed
push 1
push 0xffffffffffffffff
mov dword [0x4e4a2c], 0
call fcn.00401510
add esp, 8
mov dword [0x4e4a2c], 1
call ebp
mov dword [0x4eace4], eax
test bl, bl
je 0x419003
lea edi, [esp + 0x30]
call fcn.00419050
jmp 0x419015
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004176c0
add esp, 8
cmp dword [0x4e899c], 2
jne 0x419029
mov edx, dword [0x4e4b24]
mov eax, dword [edx + 0x60]
jmp 0x419031
mov eax, dword [0x4e4b24]
mov eax, dword [eax + 0x5c]
push eax
call fcn.0041af10
add esp, 4
dec esi
jne 0x418f97
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret

Function at 0x419050
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4e899c], 0
push esi
je 0x419065
mov al, byte [0x4e6da7]
jmp 0x41915a
cmp dword [0x4e8020], 0
je 0x419078
mov al, byte [0x4e7ee7]
jmp 0x41915a
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x419094
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x4190a8
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x4190bc
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x4190d0
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x4190e4
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x4190f8
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x419109
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x41911a
or bl, 0x80
cmp dword [0x4e8020], 0
je 0x419157
mov al, bl
not al
and al, byte [0x4e7ee7]
je 0x419157
mov cl, byte [0x4e7eeb]
not al
and byte [0x4e7ee7], al
and byte [0x4e7eea], al
and cl, al
mov al, cl
mov byte [0x4e7eeb], cl
mov ecx, 0x4e7f10
call fcn.0041baf0
mov al, bl
pop ebx
mov byte [esp + 4], al
mov ecx, dword [esp + 4]
push 1
and al, 0xc4
push 0
or al, 4
push 0
movzx edx, al
push ecx
push edx
mov esi, 0xffc3d44f
call fcn.0041b350
movzx eax, word [edi]
add esp, 0x14
mov esi, edi
cmp eax, 0x30
jb 0x4191b7
cmp ax, 0x39
ja 0x4191b7
mov al, byte [esi]
push 0xffc3d44d
push 0
add al, 0x30
push 0
movzx ecx, al
push 0
push ecx
push 2
call fcn.00419440
movzx eax, word [esi + 2]
add esi, 2
add esp, 0x18
cmp eax, 0x30
jae 0x419188
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
call fcn.00419440
add esp, 0x18
pop esi
pop ecx
ret