joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415530
Capabilities:
Set current directory

Disassembly:
sub esp, 0x48c
push ebx
push ebp
mov ebp, dword [esp + 0x498]
xor ebx, ebx
push esi
push edi
mov dword [ebp + 0x590], ecx
cmp eax, ebx
je 0x415556
mov byte [esp + 0x17], 1
cmp byte [eax], bl
je 0x41555a
mov byte [esp + 0x17], bl
cmp eax, ebx
je 0x4155c3
cmp byte [eax], bl
je 0x4155c3
push eax
push str.Critical_Error:__s_n_nThe_program_will_exit.
mov esi, 0x400
lea edi, [esp + 0xa0]
call fcn.0046c770
mov edx, dword [0x4a51fc]
mov ecx, dword [0x4a2bf0]
add esp, 8
push 0x10000
push edx
mov eax, edi
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x4a2bf0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4155bc
mov eax, dword [0x4a2bf0]
push eax
mov byte [0x4a2bec], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call fcn.004097d0
cmp dword [ebp + 0x58c], ebx
je 0x4156f5
cmp byte [0x4a5496], bl
jne 0x4156f5
mov esi, dword [0x4a33f4]
cmp byte [esi + 0x17], bl
jne 0x4155e9
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x4155f6
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x41560f
test byte [esi + 0x15], 4
je 0x41560a
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 8]
jmp 0x41561f
cmp al, 2
jne 0x41561a
call fcn.00401000
jmp 0x41561f
mov eax, 0x4a44fd
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00481f40
mov eax, dword [0x49f440]
inc dword [0x4a2d5c]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xa3], bl
mov ecx, 0x3a
mov esi, 0x4a18b0
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x49f440], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x4a4c40
call fcn.004151c0
mov dword [0x4a5220], ebx
mov dword [0x4a5224], ebx
cmp dword [0x4a2d88], ebx
je 0x415686
push 0x4a33f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [0x49f3a4]
mov ecx, dword [ebp + 0x58c]
mov dword [0x49f3a4], ebx
mov byte [0x4a5496], 1
call fcn.00401210
test eax, eax
jne 0x4156b6
mov edx, dword [esp + 0x4a4]
push edx
push ebp
call fcn.00415720
mov byte [0x4a5496], bl
cmp byte [esp + 0x17], bl
je 0x4156d0
mov eax, dword [esp + 0x4a4]
push eax
push ebp
call fcn.00415720
lea ecx, [esp + 0x18]
push ecx
call fcn.004031c0
add esp, 4
pop edi
mov dword [0x49f3a4], esi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x48c
ret 8
mov eax, dword [esp + 0x4a4]
mov edx, dword [0x49f440]
push eax
push ebp
mov dword [0x49f3a4], ebx
mov byte [edx + 0xd4], bl
call fcn.00415720
int3
Function at 0x41b5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x49f367]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x41b63b
mov dl, byte [ebp]
test dl, dl
je 0x41b63b
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x41b68e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41b627
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x41b621
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b640
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x41b660
mov al, byte [edi]
cmp al, 0x20
je 0x41b65b
cmp al, 9
jne 0x41b660
dec edi
cmp edi, ebp
ja 0x41b651
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x41b695
cmp byte [esp + 0x30], 0
je 0x41b683
mov ecx, dword [esp + 0x28]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0042cf80
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x41b660
dec edi
jmp 0x41b64d
push esi
push ebp
push ebx
call fcn.00481f40
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x42a010
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4a2d5c]
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x49f3b0]
jl 0x42a039
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov esi, dword [0x4a33f4]
cmp byte [esi + 0x17], 0
jne 0x42a048
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42a055
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42a06e
test byte [esi + 0x15], 4
je 0x42a069
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 8]
jmp 0x42a07e
cmp al, 2
jne 0x42a079
call fcn.00401000
jmp 0x42a07e
mov eax, 0x4a44fd
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00481f40
mov eax, dword [0x49f440]
inc dword [0x4a2d5c]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xa3], 0
mov ecx, 0x3a
mov esi, 0x4a18b0
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x49f440], eax
push edi
mov eax, 0x4a4c40
mov dword [esi + 0x2c], edi
call fcn.004151c0
mov dword [0x4a5220], edi
mov dword [0x4a5224], edi
cmp dword [0x4a2d88], edi
je 0x42a0ea
push 0x4a33f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, 0xffffffff
cmp byte [esi + 0xca], 0
jne 0x42a105
mov byte [esi + 0xca], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
cmp dword [0x4a522c], edi
je 0x42a115
cmp dword [0x4a5228], edi
jne 0x42a11e
cmp byte [esi + 0xca], 0
je 0x42a156
cmp byte [esi + 0xca], 0
mov byte [esi + 0xc8], 0
jne 0x42a156
cmp dword [0x4a522c], edi
jge 0x42a13e
mov dword [esi + 0xbc], eax
jmp 0x42a156
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb8], eax
mov edx, dword [0x4a522c]
mov dword [esi + 0xbc], edx
mov eax, dword [0x4a51b8]
mov ebp, dword [0x4a51bc]
mov ecx, dword [0x4a51f0]
mov edx, dword [0x4a51f4]
mov edi, eax
mov dword [0x4a51bc], eax
mov eax, dword [esp + 0xa4]
mov ebx, ecx
mov dword [esp + 0x14], edx
mov dword [0x4a51f4], ecx
mov dword [0x4a51b8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xa0]
push 0
push 0xffffffffffffffff
push 0
push ecx
mov dword [0x4a5234], eax
mov dword [0x4a5230], eax
mov dword [0x4a51f0], eax
call fcn.004551e0
mov esi, eax
cmp esi, 1
jne 0x42a1ca
mov edx, dword [esp + 0xa0]
push edx
call fcn.00428750
mov esi, eax
mov eax, dword [0x49f440]
mov ecx, dword [eax + 0xa0]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov dword [0x4a2d78], ecx
mov dword [0x4a51b8], edi
mov dword [0x4a51f0], ebx
mov dword [0x4a51bc], ebp
mov dword [0x4a51f4], edx
call fcn.004031c0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x42d3c0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.0048b740
cmp dword [esp + 0x2008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x2018]
mov ebx, ecx
je 0x42d4df
test ebx, ebx
jne 0x42d3f8
mov eax, dword [esp + 0x200c]
mov ebx, dword [eax + 0x364]
test ebx, ebx
je 0x42d402
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42d40f
mov ecx, dword [eax + 0x160]
movzx eax, word [eax + 0x164]
mov edx, dword [esp + 0x2014]
mov ecx, dword [ecx*4 + 0x4a2be0]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.0046c770
add esp, 0x10
cmp byte [ebp], 0
lea edi, [esp + eax + 0x10]
je 0x42d45c
push ebp
lea esi, [esp + 0x2014]
push str._____Specifically:__s_n
sub esi, edi
call fcn.0046c770
add esp, 8
mov esi, dword [esp + 0x2018]
cmp esi, 3
jne 0x42d48b
call fcn.0047f7b2
add eax, 0x20
push eax
lea edx, [esp + 0x14]
push edx
call fcn.0048160d
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 2
jne 0x42d4dd
test ebx, ebx
jne 0x42d4b0
mov ecx, dword [esp + 0x2014]
mov ebx, dword [ecx + 0x364]
test ebx, ebx
je 0x42d4cf
mov ecx, dword [esp + 0x201c]
push ebp
push 1
push ecx
mov ecx, ebx
call fcn.0042ccd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
mov edx, dword [esp + 0x201c]
push ebp
push edx
call fcn.0042cf80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
Function at 0x42d7f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x42d81f
push 0x64
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42d827
mov byte [esp + 0xa0], 0
push 0x7f
lea edx, [esp + 0x25]
push ebp
push edx
mov byte [esp + 0x2c], 0
call fcn.00488440
mov esi, dword [0x4a51d4]
add esp, 0xc
cmp esi, ebp
je 0x42d86e
cmp byte [esi + 0x11], 0
je 0x42d867
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push 0x496808
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.0046c7b0
add esp, 8
mov esi, dword [esi + 0x14]
cmp esi, ebp
jne 0x42d846
cmp byte [esp + 0x20], 0
je 0x42d8bd
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d880
sub eax, edx
cmp eax, 0x7b
jbe 0x42d8ae
mov esi, 0x7f
sub esi, eax
push esi
lea ebx, [esp + eax + 0x24]
push 0x49425c
push ebx
call fcn.00481f40
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x42d8bd
cmp byte [esp + eax + 0x1f], 0x20
lea eax, [esp + eax + 0x20]
jne 0x42d8bd
mov byte [eax - 1], 0
mov edx, dword [0x4a17c0]
cmp byte [edx + 0xd4], 0
je 0x42d8dd
cmp byte [0x4a5215], 0
mov dword [esp + 0x14], 1
je 0x42d8e1
mov dword [esp + 0x14], ebp
mov eax, dword [0x4a2d5c]
mov dword [esp + 0x10], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42d9ec
mov dword [esp + 0x10], 0x49281e
mov dword [esp + 0x18], ebp
cmp dword [0x4a2d24], ebp
mov ebp, 0x4939e8
je 0x42d915
mov ebp, 0x4939e4
cmp dword [0x4a2d20], 0
mov esi, 0x4939e8
je 0x42d928
mov esi, 0x4939e4
push 1
call fcn.00410f60
mov bl, al
add esp, 4
lea eax, [esp + 0x108]
call fcn.004112f0
mov ecx, dword [0x4a2d5c]
mov edx, dword [0x4a2d60]
sub edx, dword [esp + 0x14]
push eax
mov eax, dword [0x4a2d58]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [0x4a51dc]
push ecx
mov ecx, dword [0x4a51e0]
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push ebp
push esi
lea edx, [esp + 0xcc]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.0046c770
mov esi, dword [esp + 0x50]
add edi, eax
mov eax, esi
sub eax, edi
add esp, 0x34
add eax, 0xfffe
push eax
push edi
call fcn.00408c90
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42d9b0
sub eax, ecx
add edi, eax
cmp dword [0x4a3504], 0
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42d9ce
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, edi
push eax
add esi, 0xfffe
call fcn.0046c770
add esp, 4
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
dec eax
mov dword [esp + 0x18], eax
jmp 0x42d903
Function at 0x432d00
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4a2b90]
push esi
push edi
mov ecx, ebp
call fcn.00412530
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x13c]
call fcn.0043fbf0
mov esi, eax
test esi, esi
je 0x432de0
push 0
push esi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x432d7a
cmp edi, dword [0x4a4c00]
je 0x432d7a
call fcn.00471070
test al, al
jne 0x432d7a
mov ecx, dword [0x4a4c00]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x1c], eax
test bl, bl
je 0x432d9c
mov edx, dword [0x4a4c00]
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x432de0
lea ecx, [esp + 0x20]
push 0xfc
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x432de0
lea eax, [esp + 0x10]
push eax
push 0x432e90
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [esp + 0x14], 0
jne 0x432e38
mov ecx, dword [0x49f440]
cmp byte [ecx + 0xe4], 0
jne 0x432e13
mov edx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x493ec0
push edx
call fcn.0046f1f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov ecx, dword [esp + 0x12c]
push 0x49281e
push 0
push 0x493ec0
call fcn.0042ca10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov eax, dword [esp + 0x18]
push eax
push 0x492838
mov eax, 0x101
lea ecx, [esp + 0x28]
call fcn.0046c7b0
mov ecx, dword [0x4a33f4]
add esp, 8
push 1
push 0
push 0xffffffffffffffff
push 0x492868
push ecx
call fcn.0046f1f0
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push edx
push ebp
call fcn.0046f1f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
Function at 0x432f10
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.0043fbf0
mov edi, eax
test edi, edi
je 0x432f3e
mov esi, dword [esp + 0x1c]
push edi
call fcn.00470b80
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x432f89
mov ecx, dword [0x49f440]
cmp byte [ecx + 0xe4], 0
jne 0x432f6c
mov edx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x493ec0
push edx
call fcn.0046f1f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x49281e
push 0
push 0x493ec0
call fcn.0042ca10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x432fc1
cmp ebp, dword [0x4a4c00]
je 0x432fc1
mov esi, edi
call fcn.00471070
test al, al
jne 0x432fc1
mov eax, dword [0x4a4c00]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x432fff
mov edx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x492868
push edx
call fcn.0046f1f0
mov eax, dword [0x49f440]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x432fff
push 1
push eax
call fcn.00401280
add esp, 8
test bl, bl
je 0x433013
mov ecx, dword [0x4a4c00]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x433e40
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0042e950
mov ebx, eax
test ebx, ebx
jne 0x433e73
mov ecx, dword [ebp + 8]
push esi
push eax
push str.Parameter_1_invalid.
call fcn.0042ccd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x433e7f
jmp dword [eax*4 + 0x434078]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x433e99
push eax
call fcn.0044f580
add esp, 4
jmp 0x433e9f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4a33f4]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044f580
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x433f17
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x433f17
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4a33f4]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x492868
push ecx
call fcn.0046f1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx edx, byte [edi]
push edx
call fcn.004817e3
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x433f52.67
movzx eax, byte [eax + 0x4340a8]
jmp dword [eax*4 + 0x43408c]
mov esi, 0x40
jmp 0x433f81
mov esi, 0x4000
jmp 0x433f81
mov esi, 0x20
jmp 0x433f81
mov esi, 0x8000
jmp 0x433f81
mov esi, 0x80
jmp 0x433f81
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x433f94
push eax
call fcn.0044f580
add esp, 4
jmp 0x433f9a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x433f17
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x433f17
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x433eeb
mov edx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x492868
push edx
call fcn.0046f1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [edi], 0
je 0x434013
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.004124f0
fmul qword [0x49a478]
call fcn.0048d930
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x434020
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044f580
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x43403d
test esi, esi
jne 0x433efa
jmp 0x434041
test esi, esi
je case.0x433f52.67
cmp byte [esp + 0x13], 0
jne 0x43405f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x433efa
push 1
push 0x64
call fcn.00401280
add esp, 8
jmp 0x434020
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434910
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a2b90]
push eax
mov eax, dword [esp + 0x18]
call fcn.0043fbf0
mov ebp, eax
test ebp, ebp
je 0x434936
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x43493b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.0046f1f0
cmp eax, 1
je 0x434959
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x434a62
cmp byte [edi + 0x17], 0
jne 0x43496c
mov esi, dword [edi + 0xc]
jmp 0x43496e
mov esi, edi
test byte [esi + 0x15], 8
je 0x43497b
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434994
test byte [esi + 0x15], 4
je 0x43498f
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 8]
jmp 0x4349a4
cmp al, 2
jne 0x43499f
call fcn.00401000
jmp 0x4349a4
mov eax, 0x4a44fd
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x4349ba
mov esi, dword [edi + 0xc]
jmp 0x4349bc
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x4349d4
test byte [esi + 0x15], 8
je 0x4349cf
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x4349d9
mov eax, 0x4a5490
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x4349e6
mov esi, dword [edi + 0xc]
jmp 0x4349e8
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x434a00
test byte [esi + 0x15], 8
je 0x4349fb
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x434a05
mov eax, 0x4a5490
cmp dword [eax], 0
jne 0x434ad8
cmp byte [edi + 0x17], 0
jne 0x434a19
mov esi, dword [edi + 0xc]
jmp 0x434a1b
mov esi, edi
test byte [esi + 0x15], 8
je 0x434a28
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434a47
test byte [esi + 0x15], 4
je 0x434a3c
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x434ad8
cmp al, 2
jne 0x434a58
call fcn.00401000
mov byte [eax], 0
jmp 0x434ad8
mov eax, 0x4a44fd
mov byte [eax], 0
jmp 0x434ad8
cmp byte [edi + 0x17], 0
jne 0x434a6d
mov esi, dword [edi + 0xc]
jmp 0x434a6f
mov esi, edi
test byte [esi + 0x15], 8
je 0x434a7c
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434a95
test byte [esi + 0x15], 4
je 0x434a90
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 8]
jmp 0x434aa5
cmp al, 2
jne 0x434aa0
call fcn.00401000
jmp 0x434aa5
mov eax, 0x4a44fd
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x434ab3
mov esi, dword [edi + 0xc]
jmp 0x434ab5
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x434acd
test byte [esi + 0x15], 8
je 0x434ac8
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x434ad2
mov eax, 0x4a5490
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x434ae1
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x434b06
cmp dword [0x4a5284], 0
je 0x434b06
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4a5278
jmp fcn.00403f00
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x435930
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.0048b740
push 0x7fff
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [esp]
test eax, eax
jne 0x435957
mov ecx, 0x49281e
mov edx, dword [0x4a2b90]
push 1
push 0
push eax
push ecx
push edx
call fcn.0046f1f0
add esp, 0x8000
ret
Function at 0x438140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
je 0x438178
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x4381f3
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push str.InstallDir
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x438170
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x438170
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], bl
jne 0x4381d7
cmp eax, ebx
je 0x4381f3
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], bl
jne 0x4381d1
dec eax
jne 0x4381c8
mov dword [esp + 0x10], eax
jmp 0x4381ef
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x4381eb
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x4381f3
mov byte [esp + eax + 0x18], bl
cmp eax, ebx
jne 0x438201
cmp edi, ebx
jne 0x438201
mov edi, 0x100
jmp 0x438154
mov esi, dword [esp + 0x120]
cmp esi, ebx
je 0x43821e
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x438214
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret