joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407650
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
cmp dword [0x4feb70], 0
mov ax, cx
push ebx
push ebp
push esi
push edi
mov word [esp + 0x16], ax
mov dword [esp + 0x18], str.getaddrinfo
mov dword [esp + 0x1c], 0x406ff0
mov dword [esp + 0x20], str.getnameinfo
mov dword [esp + 0x24], 0x407460
mov dword [esp + 0x28], str.freeaddrinfo
mov dword [esp + 0x2c], 0x406fa0
je 0x4076b0
movzx eax, ax
mov eax, dword [eax*8 + 0x4f9f90]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
push 0x104
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4077b8
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x34]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x30]
push str.ws2_32
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x40772c
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x407778
push edi
call ebp
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x34]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x30]
push str.wship6
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4077b8
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x4077b5
xor esi, esi
lea eax, [esp + 0x18]
nop
push dword [eax + esi*8]
push edi
call ebx
mov dword [esp + esi*8 + 0x1c], eax
test eax, eax
je 0x4077b5
inc esi
lea eax, [esp + 0x18]
cmp esi, 3
jl 0x407780
mov eax, dword [esp + 0x1c]
mov dword [0x4f9f90], eax
mov eax, dword [esp + 0x24]
mov dword [0x4f9f98], eax
mov eax, dword [esp + 0x2c]
mov dword [0x4f9fa0], eax
jmp 0x4077b8
push edi
call ebp
movzx eax, word [esp + 0x16]
pop edi
pop esi
pop ebp
mov eax, dword [eax*8 + 0x4f9f90]
mov dword [0x4feb70], 1
pop ebx
add esp, 0x23c
ret
Function at 0x40bc80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 4]
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4d00b4
lea esi, [eax + 1]
push esi
call fcn.0040d5f0
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push 0
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40bd35
cmp dword [edi + 0x34], 0
jne 0x40bd35
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x28]
inc eax
push eax
call fcn.0040ccb0
test eax, eax
jne 0x40bd35
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 0x28]
mov al, byte [0x4cec30]
push 0
mov byte [edx + ecx], al
inc dword [edi + 0x30]
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40bd35
mov dword [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x34], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x4f9b70
call fcn.0040c2a0
push 0x10014
push dword [0x4fd6f0]
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push dword [0x4faa80]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40bd6e
push 0
push 4
mov ecx, 0x4fcc10
call fcn.0042eac0
pop edi
mov eax, 0x3e6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ca60
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, ecx
mov dword [esp + 0xc], ebp
test esi, esi
je 0x40cbd6
cmp byte [esp + 0x1c], 0
lea ebx, [ebp + 8]
jne 0x40caac
lea ecx, [esi - 1]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebx]
mov ecx, ebp
shr edx, 1
lea eax, [eax + edx*4]
add eax, 5
push eax
call fcn.0040ccb0
test eax, eax
je 0x40caac
pop esi
pop ebp
mov eax, 0x3e6
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40cbd5
mov ecx, dword [ebp]
xor edx, edx
add ecx, dword [ebx]
mov dword [esp + 0x20], ecx
cmp esi, 0xffffffff
jne 0x40cadc
mov esi, edi
lea ebx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x40cad0
sub esi, ebx
lea ebx, [ebp + 8]
cmp esi, 2
jbe 0x40cb6e
lea ebx, [ecx + 2]
mov eax, 0xaaaaaaab
lea ecx, [esi - 3]
mul ecx
mov ebp, edx
shr ebp, 1
inc ebp
lea edx, [ebp*4]
nop
movzx ecx, byte [edi]
lea ebx, [ebx + 4]
movzx eax, byte [edi + 1]
sub esi, 3
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
add edi, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 6], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 5], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 4], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 3], al
sub ebp, 1
jne 0x40cb00
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add ebx, 8
test esi, esi
je 0x40cbcf
movzx ecx, byte [edi]
shl ecx, 0x10
cmp esi, 1
jbe 0x40cb86
movzx eax, byte [edi + 1]
shl eax, 8
or ecx, eax
mov edi, dword [esp + 0x20]
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + edi], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + edi + 1], al
cmp esi, 1
jbe 0x40cbbf
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40cbc1
mov al, 0x3d
mov ecx, edi
mov byte [edx + ecx + 2], al
mov byte [edx + ecx + 3], 0x3d
add edx, 4
mov byte [edx + ecx], 0
add dword [ebx], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x40d320
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push 0
push 0
push dword [esp + 0x14]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x40d378
mov edi, dword [esi + 4]
test edi, edi
je 0x40d3a0
mov eax, dword [edi + 0x10]
add eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x40d366
mov eax, dword [edi + 4]
test eax, eax
je 0x40d35b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x14
push edi
call fcn.004cb6c4
add esp, 8
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov byte [esi + 8], 0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.0040d7b0
mov ecx, dword [esi + 4]
push edi
call fcn.0040d610
mov eax, dword [esi + 4]
push edi
push dword [eax]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x40def0
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 8
cmp byte [0x4fd708], 0
push ebx
push esi
push edi
je 0x40df99
mov edi, dword fs:[0x24]
cmp dword [0x4fcbf0], edi
je 0x40df1e
push dword [0x4fcbf4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, dword [esp + 0x18]
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40df27
sub esi, ecx
sar esi, 1
cmp word [ebx], ax
je 0x40dfa2
lea eax, [esp + 0xf]
mov ecx, 0x4fcc10
push eax
push 3
lea eax, [esp + 0x18]
push eax
push esi
push ebx
call fcn.0043f980
test eax, eax
jne 0x40df74
cmp byte [esp + 0xf], al
mov ecx, 0x4fcc10
setne al
inc eax
push eax
push dword [esp + 0x14]
push esi
push ebx
call fcn.0043ffc0
test eax, eax
je 0x40dfa2
push 1
push 0
push 0xffffffffffffffff
push dword [esp + 0x28]
mov ecx, eax
call fcn.004b4bf0
cmp dword [0x4fcbf0], edi
je 0x40df99
push dword [0x4fcbf4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [0x4fcbf0], edi
je 0x40dfb6
push dword [0x4fcbf4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x413cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
xor al, al
mov bl, cl
cmp dword [0x4faa98], 0
mov ecx, 1
push ebp
movzx eax, al
mov bh, dl
cmovne eax, ecx
mov byte [esp + 0xb], bh
cmp dword [0x4faa94], 0
push esi
push edi
mov dword [esp + 0x14], eax
je 0x413ced
or eax, 2
mov dword [esp + 0x14], eax
cmp bl, al
je 0x413eea
test al, al
jne 0x413d2e
test bh, bh
jne 0x413d2e
push 0x4fb58c
push 0
push 0
push 0x413f60
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4fd930], eax
test eax, eax
je 0x413de6
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx edi, bh
xor esi, esi
xor edi, 1
movzx ebp, bl
nop dword [eax]
push edi
push ebp
push 0x417
push dword [0x4fb58c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x413d65
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x413d40
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor bh, bh
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov dh, bl
mov dl, bh
test bl, bl
je 0x413df3
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x413dd1
cmp dword [esp + 0x24], 0
je 0x413e0d
mov bh, 1
call fcn.004142c0
test al, al
jne 0x413e0d
cmp byte [esp + 0x13], al
jne 0x413ebd
xor bl, bl
lea eax, [esp + 0x18]
push eax
push dword [0x4fd930]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], 0x103
jne 0x413e1a
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x413e0d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413d77
call fcn.004142e0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x13], 0
mov bh, dl
mov bl, dh
je 0x413db6
call fcn.004142c0
test al, al
je 0x413eb9
jmp 0x413dd1
cmp byte [esp + 0x13], 0
jne 0x413eb9
jmp 0x413e35
push dword [0x4fd930]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fd930], 0
call fcn.004142e0
mov al, byte [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
and al, 1
cmp dword [0x4faa98], 0
je 0x413e60
test al, al
jne 0x413e7a
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4fd928], eax
jmp 0x413e7a
test al, al
je 0x413e7a
push dword [0x4fd928]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fd928], 0
mov eax, dword [esp + 0x14]
and al, 2
cmp dword [0x4faa94], 0
je 0x413e9f
test al, al
jne 0x413eb9
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4fd92c], eax
jmp 0x413eb9
test al, al
je 0x413eb9
push dword [0x4fd92c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fd92c], 0
test bh, bh
je 0x413eea
push 0
push 0
xorps xmm3, xmm3
mov dword [0x4f816c], 0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.004b6bc0
add esp, 8
mov dword [0x4f816c], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415690
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1000
call fcn.004cc6a0
cmp byte [0x4feb84], 0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
jne 0x41588e
cmp dword [0x4fb5f4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4156c3
call ebx
mov dword [0x4fb5f4], eax
inc dword [0x4feb80]
call ebx
mov esi, dword [0x4feb80]
mov ecx, eax
sub ecx, dword [0x4fb5f4]
mov edx, dword [0x4f93d8]
mov dword [0x4fb5f0], eax
cmp esi, dword [0x4f93dc]
jbe 0x4156f7
cmp ecx, edx
jae 0x4156f7
mov edi, 1
jmp 0x4156f9
xor edi, edi
test edi, edi
je 0x4157ae
push ecx
push esi
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea eax, [esp + 0x1c]
push 0x800
push eax
call fcn.004b0610
mov dx, word [0x4fb5ec]
xor eax, eax
add esp, 0x14
xor ecx, ecx
cmp ax, dx
jae 0x41575a
nop word [eax + eax]
mov eax, dword [0x4fb5dc]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x415752
nop
mov byte [eax + 0x1b], 0
mov eax, dword [eax + 8]
test eax, eax
jne 0x415740
mov dx, word [0x4fb5ec]
inc ecx
movzx eax, dx
cmp ecx, eax
jl 0x415730
push 0
push 0
xorps xmm3, xmm3
mov byte [0x4feb84], 1
mov edx, 4
mov dword [0x4f816c], 0
lea ecx, [esp + 0x18]
call fcn.004b6bc0
add esp, 8
cmp eax, 7
jne 0x415796
push 0
push 4
mov ecx, 0x4fcc10
call fcn.0042eac0
mov eax, dword [0x4fb5f0]
mov dword [0x4f816c], 1
mov byte [0x4feb84], 0
jmp 0x4157b2
cmp ecx, edx
jbe 0x4157c9
mov dword [0x4feb80], 0
mov dword [0x4fb5f4], eax
test edi, edi
jne 0x41588e
mov esi, dword [esp + 0x1014]
movzx eax, byte [ebp + 0xf]
mov byte [0x4fd6ee], al
inc byte [esi + 0x16]
mov ecx, dword [0x4f9b74]
mov edi, dword [0x4fd67c]
cmp ecx, dword [0x4f9b78]
jne 0x4157fb
call fcn.00406c70
mov ecx, dword [0x4f9b74]
cmp ecx, dword [0x4f9b70]
jb 0x415810
mov eax, dword [0x4fd25c]
mov dword [ecx], eax
mov ecx, dword [0x4f9b74]
add ecx, 0xc
push 0
push 0
mov dword [0x4f9b74], ecx
push 0
mov dword [ecx], 0
mov dword [ecx + 4], edi
mov dword [ecx + 8], 0
mov ecx, dword [esi]
mov edx, ecx
push 0
push str.call
call fcn.0049c630
sub dword [0x4f9b74], 0xc
add esp, 0x14
dec byte [esi + 0x16]
test eax, eax
jne 0x415860
mov byte [esi + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret 4
cmp byte [esi + 0x1b], 0
je 0x41588e
mov byte [esi + 0x1b], 0
call ebx
sub eax, dword [esi + 0xc]
cmp eax, 0x3e8
ja 0x41588e
movzx eax, word [ebp + 4]
push 0
push eax
push 0x312
push dword [0x4faa80]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret 4
Function at 0x41b740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov bl, byte [ebp + 0xc]
mov bh, cl
or byte [ebp + 8], bl
mov al, bh
dec al
mov dword [esp + 8], edx
push esi
push edi
cmp al, 5
ja 0x41b765
cmp bh, 3
jne 0x41b76d
mov al, bh
add al, 0x66
cmp al, 5
ja 0x41b774
mov byte [esp + 0xf], 1
jmp 0x41b779
mov byte [esp + 0xf], 0
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
test esi, esi
jle 0x41b8ac
mov bl, byte [esp + 0xf]
nop dword [eax + eax]
cmp dword [0x4fd9bc], 0
jne 0x41b7f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4f8174]
sub eax, dword [0x4fd72c]
cmp eax, dword [ecx + 0xd8]
jbe 0x41b7fc
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41b7eb
mov edx, 1
mov dword [0x4f816c], 0
or ecx, 0xffffffff
call fcn.004018d0
mov dword [0x4f816c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4fd72c], eax
mov ecx, dword [0x4f8174]
cmp byte [ebp + 0x18], 0
jne 0x41b850
mov al, byte [ecx + 0xf6]
test al, al
je 0x41b818
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x41b81d
mov esi, 0xffc3d44f
cmp dword [0x4fd9bc], 0
je 0x41b82d
mov al, byte [0x4fd78c]
jmp 0x41b834
xor cl, cl
call fcn.0041e650
mov cl, byte [ebp + 8]
mov dl, al
push esi
push 1
push 0
push edi
call fcn.0041df20
mov ecx, dword [0x4f8174]
add esp, 0x10
mov esi, dword [ebp + 0x10]
test bl, bl
je 0x41b87a
test edi, edi
jne 0x41b87a
push dword [ebp + 0x28]
movzx eax, byte [ecx + 0xef]
mov cl, bh
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
push eax
push 1
push dword [ebp + 0x24]
call fcn.0041cce0
add esp, 0x14
jmp 0x41b89d
movzx eax, byte [ecx + 0xf6]
mov dl, bh
mov ecx, 0xffc3d44d
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0041bd60
add esp, 0x10
sub esi, 1
mov dword [ebp + 0x10], esi
jne 0x41b790
mov bl, byte [ebp + 0xc]
cmp byte [ebp + 0x18], 0
jne 0x41b8e8
cmp dword [0x4fd9bc], 0
je 0x41b8c2
mov al, byte [0x4fd78c]
jmp 0x41b8c9
xor cl, cl
call fcn.0041e650
not bl
and bl, al
and bl, 0xcc
je 0x41b8e8
push 0xffc3d44d
push 0
push 1
push edi
mov dl, bl
xor cl, cl
call fcn.0041df20
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b8f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x44
mov eax, dword [0x4fd9bc]
cmp eax, 2
push ebx
push esi
push edi
mov esi, edx
sete byte [esp + 0xf]
jne 0x41b940
movzx edx, cx
mov ecx, edx
and ecx, 0xffffff80
je 0x41b91b
mov eax, 0x30
mov word [esp + 0x30], ax
test ecx, ecx
lea eax, [esp + 0x30]
lea edi, [esp + 0x32]
push 0xa
cmovne eax, edi
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov ebx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [0x4fd9bc]
jmp 0x41b943
movzx ebx, cx
test esi, esi
jle 0x41b9f5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x41b9ad
call edi
mov ecx, dword [0x4f8174]
sub eax, dword [0x4fd72c]
cmp eax, dword [ecx + 0xd8]
jbe 0x41b9ad
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call ebp
test eax, eax
je 0x41b9a6
mov edx, 1
mov dword [0x4f816c], 0
or ecx, 0xffffffff
call fcn.004018d0
mov dword [0x4f816c], 1
call edi
mov dword [0x4fd72c], eax
cmp byte [esp + 0x13], 0
je 0x41b9bf
lea ecx, [esp + 0x34]
call fcn.0041ba00
jmp 0x41b9ca
mov dl, byte [esp + 0x58]
mov ecx, ebx
call fcn.0041a150
cmp dword [0x4fd9bc], 2
mov eax, dword [0x4f8174]
jne 0x41b9dd
mov ecx, dword [eax + 0x60]
jmp 0x41b9e0
mov ecx, dword [eax + 0x5c]
call fcn.0041dae0
sub esi, 1
je 0x41b9f4
mov eax, dword [0x4fd9bc]
jmp 0x41b958
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x41d8d0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0xc
mov eax, dword fs:[0x24]
cmp dword [0x4fd9bc], 1
push ebp
push esi
mov byte [esp + 0xb], dl
mov esi, ecx
mov dword [esp + 0x10], eax
jne 0x41da48
xor al, al
mov ebp, 1
cmp dword [0x4faa98], 0
push ebx
movzx ebx, al
cmovne ebx, ebp
cmp dword [0x4faa94], 0
mov dword [esp + 0x10], ebx
je 0x41d91b
or ebx, 2
mov dword [esp + 0x10], ebx
test bl, bl
je 0x41d930
mov cl, byte [0x4fd78d]
mov dl, 1
not cl
and cl, bl
call fcn.00413cb0
mov eax, dword [0x4fd9a8]
xor edx, edx
mov ecx, dword [0x4fb5f8]
push edi
xor edi, edi
test eax, eax
je 0x41d9e7
xor esi, esi
xor ebx, ebx
nop dword [eax]
cmp dword [esi + ecx], ebp
jne 0x41d9c5
cmp word [esi + ecx + 4], 0
jne 0x41d9c5
cmp word [esi + ecx + 6], 0
jne 0x41d9c5
push 0x1c
lea eax, [ebx + ecx]
push eax
mov eax, edi
sub eax, edx
push eax
call dword [sym.imp.USER32.dll_SendInput]
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4fb5f8]
mov dword [0x4f816c], 0
cmp dword [0x4fcbf0], eax
je 0x41d9a3
mov eax, dword [esi + ecx + 0x10]
test eax, eax
js 0x41d9a3
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d9ae
mov ecx, dword [esi + ecx + 0x10]
mov edx, ebp
call fcn.004018d0
mov eax, dword [0x4fd9a8]
lea edx, [edi + 1]
mov ecx, dword [0x4fb5f8]
lea ebx, [esi + 0x1c]
mov dword [0x4f816c], ebp
inc edi
add esi, 0x1c
cmp edi, eax
jb 0x41d950
mov ebx, dword [esp + 0x14]
test edx, edx
je 0x41d9e7
lea eax, [edx*8]
sub eax, edx
push 0x1c
lea eax, [ecx + eax*4]
push eax
push edx
jmp 0x41d9eb
push 0x1c
push ecx
push eax
call dword [sym.imp.USER32.dll_SendInput]
pop edi
test bl, bl
je 0x41dacb
mov al, byte [0x4fd78d]
and al, bl
test al, 1
je 0x41da39
mov cl, 1
call fcn.0041e650
mov bl, al
xor bl, byte [esp + 0xf]
mov dl, bl
and bl, al
and dl, byte [esp + 0xf]
not dl
and dl, byte [0x4fab2f]
or dl, bl
mov byte [0x4fab2f], dl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [esp + 0x10]
mov dword [0x4fac4c], eax
mov cl, bl
mov dl, 1
pop ebx
pop esi
pop ebp
add esp, 0xc
jmp fcn.00413cb0
push 0
push 0
mov dword [0x4fd9b0], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x41ba90
push 1
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4faa60], eax
test eax, eax
je 0x41dacc
mov byte [0x4fab2a], 1
mov ebp, 1
nop
mov edx, ebp
mov dword [0x4f816c], 0
mov ecx, 0x8000012f
call fcn.004018d0
cmp dword [0x4faa60], 0
mov dword [0x4f816c], ebp
jne 0x41da80
mov eax, dword [0x4f9be0]
mov byte [0x4fab2a], 0
mov ecx, dword [eax]
mov eax, dword [0x4fd9a8]
cmp dword [ecx + eax*8 - 8], 0
jne 0x41dacc
mov eax, dword [ecx + eax*8 - 4]
mov dword [esi], eax
pop esi
pop ebp
add esp, 0xc
ret
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x41dcf0
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [0x4faa90]
test edi, edi
je 0x41de01
mov ax, word [esp + 8]
push esi
imul esi, dword [0x4fab04], 0xd4
mov byte [esi + edi + 6], cl
mov byte [esi + edi], dl
mov word [esi + edi + 2], ax
mov eax, 0x69
mov word [esi + edi + 4], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [0x4faa90]
mov ecx, edx
mov dword [0x4fab00], edx
sub ecx, dword [0x4fd8f8]
mov dword [0x4fd8f8], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4f20e0]
imul ecx, dword [0x4fab04], 0xd4
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4f1fc4]
movss dword [ecx + eax + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4faa90]
test esi, esi
je 0x41ddc5
cmp esi, dword [0x4faafc]
je 0x41ddb0
imul edx, dword [0x4fab04], 0xd4
push 0x64
add edx, 0xc
add eax, edx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [0x4fab04]
jmp 0x41dde1
mov edx, dword [0x4fab04]
imul ecx, edx, 0xd4
xor edi, edi
mov word [ecx + eax + 0xc], di
jmp 0x41dde1
mov edx, dword [0x4fab04]
imul ecx, edx, 0xd4
mov dword [ecx + eax + 0xc], 0x2f004e
mov dword [ecx + eax + 0x10], 0x41
inc edx
mov dword [0x4faafc], esi
mov dword [0x4fab04], edx
pop esi
cmp edx, dword [0x4f8178]
jl 0x41de01
mov dword [0x4fab04], 0
pop edi
ret

Function at 0x41de10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov bl, cl
push edi
movzx ebp, bl
mov edi, edx
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp edi, 1
je 0x41de3a
cmp edi, 2
jne 0x41df0c
cmp esi, edi
je 0x41df0c
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41de68
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.0041bd60
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 2
call fcn.0041bd60
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4fcbf0]
sete bh
jne 0x41debd
mov edx, 1
mov dword [0x4f816c], 0
or ecx, 0xffffffff
call fcn.004018d0
mov dword [0x4f816c], 1
cmp bl, 0x14
jne 0x41df0c
cmp edi, 2
jne 0x41df0c
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x41df0c
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, edi
call fcn.0041bd60
add esp, 0x10
test bh, bh
je 0x41df0c
lea edx, [edi - 1]
mov dword [0x4f816c], 0
or ecx, 0xffffffff
call fcn.004018d0
mov dword [0x4f816c], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret