joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ed30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44edcf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00456f07
lea ecx, [0x44ede0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004557b0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004558c0
jmp fcn.0044ed30
Function at 0x456bb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x57eb40]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45539b
je 0x4553ea
cmp ebx, 0x20
jbe 0x4553f0
cmp ebx, 0x40
jbe 0x45542e
jmp 0x4554bf
test ebx, ebx
je 0x4553e0
add eax, 0x10
test ax, 0xff0
je 0x4553cc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4bea00]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4beb00]
jmp 0x4553b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4553b8
pxor xmm1, xmmword [0x57eb50]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x57eb50]
pxor xmm2, xmmword [0x57eb60]
pxor xmm3, xmmword [0x57eb70]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x57eb50]
pxor xmm2, xmmword [0x57eb60]
pxor xmm3, xmmword [0x57eb70]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45551e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x57e8d1], 0
je 0x456bca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x455360
jmp fcn.00407cd0

Function at 0x457930
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00456b30
call fcn.00455730
ret
Function at 0x4783b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [0x583820], eax
je 0x4783f6
mov dword [esp], 0x583824
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
add esp, 0x1c
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x4791b0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000004
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x4792cd
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 0xc], eax
call fcn.004787f0
test eax, eax
setne al
test al, al
je 0x47929b
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
jmp 0x4792b1
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
nop
leave
ret
Function at 0x479980
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x583868
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x583860]
sub esp, 4
test ebx, ebx
je 0x4799cb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4799c4
test esi, esi
je 0x4799c4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4799a0
mov dword [esp], 0x583868
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x479bb0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x479c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x479cd8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x479c3e
cmp eax, 4
jne 0x479c60
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x479c4e
cmp edx, 4
je 0x479c4e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00479bb0
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x66526ae4
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x101d642d
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x40893a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
mov ecx, 0x77262d63
dec ecx
call fcn.00408957
add ecx, ecx
xor dword [edx], ebx
inc edx
dec edi
cmp edx, eax
jne fcn.0040893a
ret

Function at 0x409660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
jmp 0x40967a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409670
mov eax, 1
add ebx, ebx
jne 0x409693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409688
jne 0x4096a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409688
xor ecx, ecx
sub eax, 3
jb 0x4096b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40972a
mov ebp, eax
add ebx, ebx
jne 0x4096c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4096d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4096f4
inc ecx
add ebx, ebx
jne 0x4096e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4096d5
jne 0x4096f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4096d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409705
jmp 0x409676
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409714
add edi, ecx
jmp 0x409676
pop esi
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x40977c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbb24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbb90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409731
mov ecx, edi
jns 0x409760
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbb98]
or eax, eax
je 0x409776
mov dword [ebx], eax
add ebx, 4
jmp 0x40974e
call dword [esi + 0xbb94]
mov ebp, dword [esi + 0xbb9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4097b0
sub esp, 0xffffff80
jmp 0x4017e0
Function at 0x2a12bc0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0x2a12c57
test ebp, ebp
je 0x2a12c57
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x2a12be0
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.02a1374f
mov esi, eax
add esp, 4
test esi, esi
je 0x2a12c52
push edi
push 0
push esi
call fcn.02a16370
push esi
push ebp
mov eax, ebx
call fcn.02a120d0
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0x2a12c2b
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0x2a12c23
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [0x2a1f018]
push esi
mov bl, 1
call fcn.02a1574e
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x40c650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c668
mov eax, 1
add ebx, ebx
jne 0x40c68b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c680
jne 0x40c69c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c680
xor ecx, ecx
sub eax, 3
jb 0x40c6b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c722
mov ebp, eax
add ebx, ebx
jne 0x40c6bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6ec
inc ecx
add ebx, ebx
jne 0x40c6d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6cd
jne 0x40c6e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c70c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6fd
jmp 0x40c66e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c70c
add edi, ecx
jmp 0x40c66e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c774
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c729
mov ecx, edi
jns 0x40c758
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c76e
mov dword [ebx], eax
add ebx, 4
jmp 0x40c746
call dword [esi + 0xc064]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c7a8
sub esp, 0xffffff80
jmp 0x40a6fc
Function at 0x403840
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403854
inc dword [0x4ca660]
add dword [0x4c6a44], 0x108
mov edx, dword [0x4c6a44]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c9130
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403883
push 0
mov eax, 0x4cb490
call fcn.00417e10
cmp dword [0x4ca694], 0
mov dword [0x4cbf80], 0
mov dword [0x4cbf84], 0
je 0x4038bb
mov eax, dword [0x4c7b78]
test eax, eax
je 0x4038af
mov eax, dword [eax]
test eax, eax
jne 0x4038b4
mov eax, 0x4a3910
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40393f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x4038ea
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x4038ea
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cbf8c], 0
je 0x4038fc
cmp dword [0x4cbf88], 0
jne 0x403905
cmp byte [esi + 0xee], 0
je 0x40393f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40393f
cmp dword [0x4cbf8c], 0
jge 0x403927
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cbf8c]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x4047e0
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404803
call fcn.00404ab0
test eax, eax
jne 0x404803
push str.Cant_open_clipboard_for_writing.
call fcn.004048e0
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40483c
cmp dword [esi + 0x18], ebx
je 0x40482e
cmp dword [esi + 8], ebx
je 0x404823
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3ce4
call fcn.004048e0
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404875
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40489c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40489c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404892
cmp dword [esi + 8], ebx
je 0x404887
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4048b1
mov dword [esi + 4], ebx
jmp 0x404875
cmp dword [esi + 0x18], ebx
je 0x4048ce
cmp dword [esi + 8], ebx
je 0x4048c3
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3d04
call fcn.004048e0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4049b0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x4049c0
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x404a8f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.0049065d
add esp, 0xc
test eax, eax
je 0x404a86
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00490459
add esp, 8
test eax, eax
je 0x404a86
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00490459
add esp, 8
test eax, eax
je 0x404a86
lea edx, [esp]
push str.Native
push edx
call fcn.00490459
add esp, 8
test eax, eax
je 0x404a86
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00490459
add esp, 8
test eax, eax
je 0x404a86
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.00490459
add esp, 8
test eax, eax
je 0x404a7c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.00490459
add esp, 8
test eax, eax
jne 0x404a95
test esi, esi
je 0x404a86
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x404ab0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x404b3a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x4ca4ec]
push eax
call ebx
test eax, eax
jne 0x404b2f
mov eax, dword [0x4c6948]
cmp eax, 0xffffffff
je 0x404aff
test eax, eax
je 0x404b46
call esi
mov ecx, dword [0x4c6948]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x404b46
push 1
push 0x8000012f
mov dword [0x4c694c], 0
call fcn.00401430
mov edx, dword [0x4ca4ec]
add esp, 8
push edx
mov dword [0x4c694c], 1
call ebx
test eax, eax
je 0x404ae0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4093a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4ca61c], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x4093c4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4ca620], 0
je 0x4093d3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x4095e0
test al, al
jne 0x409416
cmp byte [ebp + 0xc], al
jne 0x409416
push 0x4c93f0
push 0
push 0
push 0x4096d0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4cad1c], eax
test eax, eax
je 0x4094a7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c93f0]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40944c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x409426
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4094b3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x40951a
cmp dword [esp + 0x2c], 0
je 0x4094c2
mov byte [esp + 0x1f], 1
call fcn.00409a50
test al, al
jne 0x4094c2
cmp byte [ebp + 0xc], al
jne 0x4095ae
mov byte [ebp + 8], al
jmp 0x409461
call fcn.00409a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x4094fe
call fcn.00409a50
test al, al
jne 0x40951a
cmp byte [ebp + 0xc], 0
jne 0x4095a7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4ca61c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x409552
test byte [esp + 0x1e], 1
jne 0x40956b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4cad14], eax
jmp 0x40956b
mov ecx, dword [0x4cad1c]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x409532
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x4094c2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409461
mov edx, dword [0x4cad1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4cad1c], 0
call fcn.00409a70
jmp 0x4094d2
test byte [esp + 0x1e], 1
je 0x40956b
mov eax, dword [0x4cad14]
push eax
call edi
mov dword [0x4cad14], 0
cmp dword [0x4ca620], 0
je 0x40958d
test byte [esp + 0x1e], 2
jne 0x4095a7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4cad18], eax
jmp 0x4095a7
test byte [esp + 0x1e], 2
je 0x4095a7
mov ecx, dword [0x4cad18]
push ecx
call edi
mov dword [0x4cad18], 0
cmp byte [esp + 0x1f], 0
je 0x4095e0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4c694c], 0
push 0
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.0047b800
add esp, 0x18
mov dword [0x4c694c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret