joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406727
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x40c150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll__vsnprintf_s]
add esp, 0x14
test eax, eax
jns 0x406766
mov byte [ebp - 0x425], 0
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.004066a8
push 0x40a298
lea eax, [ebp - 0x24]
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcat_s]
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40678a
sub eax, edx
cmp eax, 6
jbe 0x4067b3
lea eax, [esi + eax - 6]
push str.__08x_
push eax
call dword [sym.imp.MSVCR100.dll__mbscmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067b3
xor edi, edi
inc edi
jmp 0x4067b5
xor edi, edi
lea eax, [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4067bb
sub eax, edx
mov esi, eax
mov eax, str.Error:
test edi, edi
jne 0x4067d4
mov eax, 0x40a1ae
lea ecx, [ebp - 0x824]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x424]
push eax
call dword [sym.imp.MSVCR100.dll__snprintf_s]
add esp, 0x20
test eax, eax
jns 0x406815
mov dword [ebp - 0x29], 0x2e2e2e
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push eax
call sub.MSVCR100.dll_memcpy
lea edi, [ebp - 0x424]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406830
lea eax, [ebp - 0x424]
mov esi, 0x40a2c4
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00406ab9
leave
ret

Function at 0x406ab9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c150]
jne 0x406ac3
repz ret
jmp fcn.00407026
Function at 0x406fac
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40abd0
call fcn.00406fc0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x40c5f4], ebx
jne 0x406d47
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x40c5f0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x406d81
cmp eax, esi
jne 0x406d74
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406d84
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406d5b
xor esi, esi
inc esi
mov eax, dword [0x40c5ec]
cmp eax, esi
jne 0x406d97
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x406dd2
mov eax, dword [0x40c5ec]
test eax, eax
jne 0x406dcc
mov dword [0x40c5ec], esi
push 0x40821c
push 0x408210
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x406dd2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406eec
mov dword [0x40c274], esi
mov eax, dword [0x40c5ec]
cmp eax, esi
jne 0x406df6
push 0x40820c
push 0x4081f4
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40c5ec], 2
cmp dword [ebp - 0x24], ebx
jne 0x406e03
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40c5f8], ebx
je 0x406e24
push 0x40c5f8
call fcn.00407280
pop ecx
test eax, eax
je 0x406e24
push ebx
push 2
push ebx
call dword [0x40c5f8]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e7d
cmp al, bl
je 0x406e3d
cmp dword [ebp - 0x1c], ebx
jne 0x406e7d
mov al, byte [esi]
cmp al, bl
je 0x406e4d
cmp al, 0x20
ja 0x406e4d
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406e3d
test byte [ebp - 0x40], 1
je 0x406e59
movzx eax, word [ebp - 0x3c]
jmp 0x406e5c
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x40c270], eax
cmp dword [0x40c264], ebx
jne 0x406ed2
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x406e8c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x406e9f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406e2b
cmp dword [0x40c274], ebx
jne 0x406ee0
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c270]
call fcn.00407005
ret
call 0x49b000
jmp 0x406d19
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret

Function at 0x408946
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.00408972
sub ecx, 0x1c96acb4
and edx, ecx
xor dword [ebx], edi
add edx, ecx
add ebx, 1
or edx, ecx
mov edx, 0xf40e0048
cmp ebx, eax
jne fcn.00408946
mov edx, ecx
ret
Function at 0x404010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x14]
call fcn.0040372c
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00403777
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040372c
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00403777
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040372c
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00403767
enter 0xf9b, 0x38
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], pe_nt_image_headers32
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.00403777
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040372c
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.00403767
popfd
xor bl, byte [edx - 0x635a7fac]
stc
invalid
Function at 0x4026e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0x17]
xor ebx, ebx
sub eax, ebx
push edi
je 0x4027f1
dec eax
je 0x402746
dec eax
je 0x402721
dec eax
je 0x40270f
push dword [esi + 0x18]
push dword [ebp + 8]
call dword [esi + 0x10]
jmp 0x40278e
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4027a9
mov byte [eax], bl
jmp 0x4027a9
mov esi, dword [ebp + 8]
push esi
mov ecx, 0x4681d8
call fcn.0044384e
cmp eax, 0xffffffff
jne 0x402736
xor eax, eax
cmp esi, ebx
je 0x4027fc
mov byte [eax + esi], bl
jmp 0x4027fc
mov ecx, esi
call fcn.00401dcc
cmp dword [0x4673b0], ebx
jne 0x4027ad
cmp dword [esi + 0xc], ebx
jne 0x4027ad
cmp dword [0x46b468], esi
mov edi, dword [ebp + 8]
jne 0x402769
cmp edi, ebx
jne 0x402799
push ebx
lea eax, [ebp - 1]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
je 0x402795
cmp edi, ebx
mov dword [0x46b468], ebx
je 0x402792
push edi
push dword [esi + 0x18]
call fcn.004395a4
pop ecx
pop ecx
jmp 0x4027fc
dec eax
jmp 0x4027fc
cmp edi, ebx
je 0x4027a3
mov byte [edi], bl
mov dword [0x46b468], ebx
jmp 0x4027a9
mov dword [0x46b468], esi
xor eax, eax
jmp 0x4027fc
mov edi, dword [ebp + 8]
cmp edi, ebx
mov eax, dword [esi + 0xc]
je 0x4027fc
cmp eax, ebx
jne 0x4027bf
mov byte [edi], bl
jmp 0x4027a9
mov ecx, dword [esi + 8]
cmp edi, ecx
je 0x4027fc
cmp eax, 0x186a0
jb 0x4027e7
push eax
push ecx
push edi
call fcn.004576b0
mov eax, dword [esi + 0xc]
add esp, 0xc
mov byte [edi + eax], bl
mov eax, dword [esi + 0xc]
jmp 0x4027fc
mov byte [edi], al
inc edi
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x4027e3
mov byte [edi], bl
jmp 0x4027de
push dword [ebp + 8]
mov ecx, dword [esi + 0xc]
call fcn.004026e4
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40dc06
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push esi
mov eax, 0xd0
je 0x40dc23
inc dword [0x4673b8]
add dword [0x465108], eax
push eax
push 0x467038
push dword [0x465108]
call fcn.004576b0
mov esi, dword [0x465108]
mov eax, dword [ebp + 8]
add esp, 0xc
cmp byte [ebp + 0x10], bl
mov dword [esi + 0x2c], eax
je 0x40dc53
push ebx
mov ecx, 0x467ce0
call fcn.0040d84f
cmp dword [0x4673d8], ebx
mov dword [0x468198], ebx
mov dword [0x46819c], ebx
je 0x40dc72
push 0x467b80
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [ebp + 0xc], bl
jne 0x40dce8
or ecx, 0xffffffff
cmp byte [esi + 0xc6], bl
jne 0x40dc9b
cmp byte [ebp + 0x14], 0x64
sete al
cmp al, bl
mov byte [esi + 0xc6], al
je 0x40dc9b
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4681a4], ebx
je 0x40dcab
cmp dword [0x4681a0], ebx
jne 0x40dcb3
cmp byte [esi + 0xc6], bl
je 0x40dce8
cmp byte [esi + 0xc6], bl
mov byte [esi + 0xc4], bl
jne 0x40dce8
cmp dword [0x4681a4], ebx
jge 0x40dcd1
mov dword [esi + 0xb8], ecx
jmp 0x40dce8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb4], eax
mov eax, dword [0x4681a4]
mov dword [esi + 0xb8], eax
pop esi
pop ebx
pop ebp
ret
Function at 0x410d5f
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
push edi
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
lea eax, [esi + 0x14]
jne 0x410d84
lea eax, [ebp + 0x17]
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
jne 0x410dc6
push 0x45bc18
push edi
call fcn.00439b0d
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x410dc6
push 0x45a85c
push ebx
call fcn.00401ea8
pop ecx
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x410dc6
test esi, esi
je 0x410dc3
mov byte [esi + 0x18], 1
mov byte [ebx], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
push edi
call fcn.00415b93
mov bl, al
add esp, 0x14
test bl, bl
mov byte [ebp + 0x14], bl
je 0x410ed4
cmp byte [ebp + 0x10], 0
je 0x410e86
cmp bl, 0x9c
jb 0x410ea3
cmp bl, 0x9f
ja 0x410ea3
cmp byte [ebp + 0x18], 0
je 0x410e2a
push 1
push 0
push 0xffffffffffffffff
push 0x45bc14
mov ecx, dword [0x467b78]
call fcn.0040184e
jmp 0x410f44
push edi
push str.__s__is_not_allowed_as_a_prefix_key.
mov esi, 0x200
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040a6d3
add esp, 0x10
cmp byte [0x46818c], 0
lea eax, [ebp - 0x210]
je 0x410e68
push str.__The_current_thread_will_exit.
push esi
push eax
call fcn.0040a76e
add esp, 0xc
jmp 0x410f2e
push 0
fldz
push ecx
push ecx
fstp qword [esp]
push 0
push 0x10000
push eax
call fcn.0043c205
add esp, 0x18
jmp 0x410f44
test esi, esi
je 0x410ea3
push 2
push 0x45bbc8
push edi
call fcn.00442545
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [esi + 0x19], al
push dword [ebp + 0x14]
call fcn.00445190
test byte [ebp - 1], 0x30
pop ecx
mov byte [ebp - 2], al
je 0x410f60
cmp bl, 0x41
jb 0x410f60
cmp bl, 0x5a
ja 0x410f60
and byte [ebp - 1], 0xcf
jmp 0x410f60
push edi
call fcn.0041593b
test ax, ax
pop ecx
jne 0x410f6f
push 1
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00422c60
add esp, 0xc
test ax, ax
mov dword [ebp - 0xc], eax
jne 0x410f48
cmp byte [ebp + 0x18], al
je 0x410f10
push 1
push 0
push 0xffffffffffffffff
push 0x45bbc4
jmp 0x410e1a
test esi, esi
je 0x410f44
push edi
push str.__s__is_not_a_valid_key_name.__The_current_thread_will_exit.
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.0040a6d3
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x45a5d8
mov ecx, 0x467ce0
push eax
call fcn.0044c37d
xor eax, eax
jmp 0x410faa
mov eax, dword [ebp - 8]
inc dword [0x4693dc]
mov byte [eax], 4
mov eax, dword [ebp - 0x10]
mov bl, al
mov byte [eax + 0x4693cc], 1
cmp byte [ebp - 2], 0
je 0x410f6c
mov eax, dword [ebp - 8]
mov byte [eax], 2
mov eax, dword [ebp - 0xc]
cmp byte [ebp + 0x10], 0
je 0x410f82
test esi, esi
je 0x410fa7
mov byte [esi + 0x13], bl
mov word [esi + 0xa], ax
jmp 0x410fa7
test esi, esi
je 0x410fa7
mov word [esi + 8], ax
xor eax, eax
mov al, byte [ebp - 1]
mov byte [esi + 0x12], bl
and eax, 0xffffffd5
push eax
call fcn.004121a1
or dword [esi + 0xc], eax
mov al, byte [ebp - 1]
and al, 0x2a
or byte [esi + 0x10], al
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411b37
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
cmp byte [0x4693f4], bl
mov dword [ebp - 8], ecx
jne 0x411c9b
cmp dword [0x46841c], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x411b68
call edi
mov dword [0x46841c], eax
inc dword [0x4693f0]
push esi
call edi
mov ecx, dword [0x4693f0]
mov esi, dword [0x465084]
mov edx, eax
sub edx, dword [0x46841c]
cmp ecx, dword [0x465080]
mov dword [0x468420], eax
jbe 0x411c08
cmp edx, esi
jae 0x411c08
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
xor esi, esi
lea eax, [ebp - 0x80c]
push 0x800
inc esi
push eax
mov dword [ebp - 0xc], esi
call fcn.0040a6d3
add esp, 0x14
call fcn.0041192c
fldz
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
lea eax, [ebp - 0x80c]
push 4
push eax
mov byte [0x4693f4], 1
mov dword [0x46506c], ebx
call fcn.0043c205
add esp, 0x18
cmp eax, 7
jne 0x411bf5
push ebx
push ebx
push esi
mov ecx, 0x467ce0
call fcn.00417d99
mov eax, dword [0x468420]
mov dword [0x46506c], esi
mov byte [0x4693f4], bl
jmp 0x411c0f
cmp edx, esi
mov dword [ebp - 0xc], ebx
jbe 0x411c1f
cmp dword [ebp - 0xc], ebx
mov dword [0x4693f0], ebx
mov dword [0x46841c], eax
jne 0x411c99
mov ecx, dword [ebp - 8]
mov al, byte [ecx + 0x11]
mov byte [0x468171], al
cmp byte [ecx + 0x1a], bl
je 0x411c67
cmp byte [ecx + 0x1b], bl
je 0x411c67
mov byte [ebp - 1], 1
call fcn.004113c1
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
inc byte [esi + 0x19]
call fcn.004065a4
dec byte [esi + 0x19]
cmp byte [ebp - 1], bl
mov dword [ebp + 8], eax
je 0x411c5d
mov ecx, dword [ebp - 8]
call fcn.004118c0
cmp dword [ebp + 8], ebx
jne 0x411c6c
mov byte [esi + 0x1d], bl
jmp 0x411c99
mov byte [ebp - 1], bl
jmp 0x411c3d
cmp byte [esi + 0x1d], bl
je 0x411c99
mov byte [esi + 0x1d], bl
call edi
sub eax, dword [esi + 4]
cmp eax, 0x3e8
ja 0x411c99
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push ebx
push eax
push 0x312
push dword [0x467254]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x4120fe
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x412108
mov al, 0xd
ret
push ebx
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ebx, eax
shr ebx, 8
cmp bl, 0xff
jne 0x412129
cmp al, 0xff
jne 0x412129
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x41217c
mov dl, bl
and dl, 6
cmp dl, 6
jne 0x412149
cmp byte [0x4683a2], 0
je 0x412149
or byte [ecx], 8
jmp 0x41216b
test bl, 2
je 0x41215a
mov dl, byte [ecx]
test dl, 3
jne 0x41215a
or dl, 1
mov byte [ecx], dl
test bl, 4
je 0x41216b
mov dl, byte [ecx]
test dl, 0xc
jne 0x41216b
or dl, 4
mov byte [ecx], dl
test bl, 1
je 0x41217c
mov dl, byte [ecx]
test dl, 0x30
jne 0x41217c
or dl, 0x10
mov byte [ecx], dl
pop ebx
ret
Function at 0x412490
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 3
jge 0x4124a4
mov eax, dword [ebp + 0x10]
jmp 0x412555
push ebx
mov bl, byte [ebp + 8]
test bl, bl
push esi
mov esi, dword [ebp + 0x10]
mov byte [esi], 0
jne 0x4124ca
cmp word [ebp + 0xc], 0
je 0x412551
push dword [ebp + 0xc]
call fcn.00413dd9
mov bl, al
jmp 0x4124df
cmp word [ebp + 0xc], 0
jne 0x4124e7
push 0
push dword [ebp + 8]
call fcn.00413e9c
pop ecx
mov dword [ebp + 0xc], eax
cmp word [ebp + 0xc], 0
pop ecx
je 0x412505
cmp bl, 0x9c
jb 0x4124f1
cmp bl, 0x9f
jbe 0x412505
movzx eax, word [ebp + 0xc]
push edi
push esi
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x412551
mov eax, dword [0x4661f8]
xor ecx, ecx
test eax, eax
jle 0x41252c
cmp byte [ecx*8 + 0x465e2c], bl
je 0x41251e
inc ecx
cmp ecx, eax
jl 0x412510
cmp ecx, eax
jge 0x41252c
push edi
push dword [ecx*8 + 0x465e28]
jmp 0x412548
movzx eax, bl
push eax
call fcn.0043cc8b
test eax, eax
pop ecx
je 0x412542
mov byte [esi], bl
mov byte [esi + 1], 0
jmp 0x412551
push edi
push str.not_found
push esi
call fcn.00439851
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x412558
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x467388], 0
je 0x41256e
cmp byte [esp + 4], 0
jne 0x41256e
mov al, byte [0x467270]
ret
push ebx
xor bl, bl
cmp byte [0x468399], bl
push esi
push edi
jne 0x41260e
cmp byte [0x46839a], bl
jne 0x41260e
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x4125a5
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x4125b4
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x4125c3
or bl, 1
push 0xa3
call edi
test si, ax
je 0x4125d2
or bl, 2
push 0xa4
call edi
test si, ax
je 0x4125e1
or bl, 4
push 0xa5
call edi
test si, ax
je 0x4125f0
or bl, 8
push 0x5b
call edi
test si, ax
je 0x4125fc
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x412689
or bl, 0x80
jmp 0x412689
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x412632
push 0x10
call ebp
test si, ax
je 0x412634
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x412646
push 0x11
call ebp
test si, ax
je 0x412649
or bl, 1
push 0x12
call edi
test si, ax
jne 0x41265b
push 0x12
call ebp
test si, ax
je 0x41265e
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x412670
push 0x5b
call ebp
test si, ax
je 0x412673
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x412685
push 0x5c
call ebp
test si, ax
je 0x412688
or bl, 0x80
pop ebp
cmp dword [0x467388], 0
je 0x4126c6
mov al, bl
not al
and al, byte [0x467270]
je 0x4126c6
not al
and byte [0x467272], al
and byte [0x467270], al
and byte [0x467271], al
xor eax, eax
mov al, byte [0x467272]
push eax
push 0x467278
call fcn.00412040
pop ecx
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
ret