joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, dword [0x4296d0]
mov eax, ecx
mov ebp, esp
or eax, 0xc350ee1b
push esi
mov esi, 0x10df
push ebx
mov ebx, str.The_notification_function_for_a_callout_returned_an_error.
movsx edx, byte [ebx]
inc ebx
test dl, dl
je 0x41326e
add esi, edx
cmp esi, 0x21bb
jbe 0x41325c
mov edx, eax
mov ebx, str.TimeZoneKeyName
xor edx, 0xa402455d
mov dword [0x4295dc], edx
mov dl, byte [ebx]
test dl, dl
je 0x4132a0
sub edx, 0x30
cmp dl, 9
jbe 0x41329d
or ecx, 0xf7d2eeff
mov dword [0x4295dc], ecx
jmp 0x4132a0
inc ebx
jmp 0x413281
imul edx, dword [0x4295dc], 0xb59fe12e
sub eax, 0x2ad80c8e
mov dword [0x429404], eax
mov dword [0x4296d0], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, str.The_notification_function_for_a_callout_returned_an_error.
mov ecx, 0x2228
movsx eax, byte [edx]
inc edx
test al, al
je 0x4132dc
add ecx, eax
cmp ecx, 0x234b
jbe 0x4132ca
mov eax, dword [0x429404]
pop ebx
pop esi
pop ebp
and eax, 0x44b8175d
sub eax, 0x7d722a74
imul edx, eax, 0x64bbecd5
imul eax, eax, 0xcca1dd8b
mov dword [0x4295dc], edx
mov dword [0x429404], eax
ret

Function at 0x4135e8
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [str.NR_tK2d]
push ebp
imul edx, eax, 0xee49ddd6
mov ebp, esp
push esi
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [str.Gm_], edx
imul edx, eax, 0x4009eb3c
mov dword [0x42949c], edx
mov edx, dword [ebp + 8]
cmp byte [edx], 0
je 0x413626
imul eax, eax, 0xa52b3d34
mov dword [str.NR_tK2d], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [str.NR_tK2d]
mov eax, dword [str.Gm_]
mov ecx, edx
or eax, 0x56e6b7f1
or ecx, 0x183856ab
cmp word [ebx], 0
mov dword [0x4293b4], eax
mov dword [str.Gm_], ecx
je 0x41365e
mov eax, dword [0x42949c]
add eax, 0x65a668d5
mov dword [0x4293b4], eax
mov esi, ebx
mov ax, word [esi]
sub eax, 0x30
cmp ax, 9
ja 0x413671
add esi, 2
jmp 0x413660
mov esi, 0x4298a0
mov al, byte [esi]
test al, al
je 0x413694
sub eax, 0x30
cmp al, 9
jbe 0x413691
sub ecx, 0x736d2896
mov dword [str.Gm_], ecx
jmp 0x413694
inc esi
jmp 0x413676
xor dword [str.Gm_], 0x294db573
mov ax, word [ebx]
sub eax, 0x30
cmp ax, 9
ja 0x4136af
add ebx, 2
jmp 0x41369e
mov eax, dword [0x4293b4]
mov ebx, 0x148c
mov ecx, eax
sub eax, 0x3b0fa7f3
mov dword [0x42949c], eax
and eax, 0x3bb27aa
or ecx, 0x67aecbc7
mov dword [str.NR_tK2d], eax
mov dword [0x429344], ecx
mov ecx, str.The_redirector_is_in_use_and_cannot_be_unloaded.
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x41371a
add ebx, eax
cmp ebx, 0x1a0a
jbe 0x4136e0
and edx, 0x1014a602
or edx, 0x10100602
mov dword [str.NR_tK2d], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
xor eax, 0xb8c555fe
mov dword [0x4293b4], eax
mov eax, dword [0x4293b4]
pop ebx
pop esi
pop ebp
xor eax, 0x6de12e81
mov dword [0x42949c], eax
mov eax, dword [0x429344]
or eax, 0xb642b594
mov dword [0x4293b4], eax
ret
Function at 0x413854
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4294ac]
mov edx, eax
and eax, 0xc66fbf50
or edx, 0x7b0db2a5
add eax, 0x62497f30
mov dword [0x4297b8], edx
mov dword [0x42946c], eax
cmp byte [ecx + str.ftypmif1], 0
je 0x41389a
inc ecx
cmp ecx, 0xfeb
jne 0x41387e
xor eax, 0xdfbcdfc8
mov dword [0x4294ac], eax
sub edx, 0x727dfcd5
mov dword [0x429380], edx
call dword [sym.imp.USER32.dll_GetMessageTime]
add eax, 0x6b374bdd
mov dword [0x429380], eax
mov eax, dword [0x4297b8]
and eax, 0x9b60bd7f
xor eax, 0x16e36cca
mov dword [0x42946c], eax
mov eax, dword [0x4294ac]
sub eax, 0x1fc8ca09
mov dword [0x4294ac], eax
imul eax, eax, 0xc28bf8fa
mov dword [0x4297b8], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429380]
or eax, 0xc389db87
mov dword [0x4297b8], eax
mov eax, dword [0x42946c]
or eax, 0x155c4b4a
mov dword [0x42946c], eax
imul eax, eax, 0x5f847f7a
mov dword [0x4294ac], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x42946c]
mov ecx, dword [0x429380]
mov edx, eax
and eax, 0x6fcb7820
or edx, 0x35e57d69
or eax, 0x25c17820
mov dword [0x4297b8], edx
lea edx, [ecx + 0x5c0b7ffd]
mov dword [0x4294ac], edx
mov dword [0x42946c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp], 0x13ba
call dword [sym.imp.USER32.dll_OpenIcon]
mov ecx, dword [0x42946c]
push eax
mov eax, dword [0x429380]
mov edx, eax
or edx, 0xdea47f8b
mov dword [0x4297b8], edx
xor edx, edx
cmp byte [edx + str.AslpFileMappingGetFileKind_failed__S___x_], 0
je 0x41399a
inc edx
cmp edx, 0xa68
jne 0x41397c
add ecx, 0x50e88bdb
mov dword [0x4297b8], ecx
imul eax, eax, 0x8cc6783d
mov dword [0x4294ac], eax
mov eax, dword [0x4297b8]
xor eax, 0x516080be
mov dword [0x42946c], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [0x4297b8]
sub eax, 0x32f15df2
mov dword [0x4294ac], eax
leave
ret

Function at 0x413ae4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x1013
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edx, ebx
movsx eax, byte [edx]
inc edx
test al, al
je 0x413b0c
add ecx, eax
cmp ecx, 0x1ece
jbe 0x413afa
mov eax, ebx
movzx edi, byte [eax]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x413b1c
inc eax
jmp 0x413b0e
mov edi, dword [sym.imp.USER32.dll_GetShellWindow]
call edi
mov dword [esp], 0x429e20
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x429e20
mov ecx, 0x1b23
push eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x413b4e
add ecx, eax
cmp ecx, 0x19bb
jbe 0x413b3c
mov al, byte [esi]
sub eax, 0x30
cmp al, 9
ja 0x413b5a
inc esi
jmp 0x413b4e
call edi
mov al, byte [ebx]
test al, al
je 0x413b79
sub eax, 0x30
cmp al, 9
jbe 0x413b76
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
inc ebx
jmp 0x413b5c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413b84
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x413b9a
inc edx
jmp 0x413b8e
mov edx, ebx
mov ecx, 0x17a
movzx eax, byte [edx]
inc edx
test al, al
je 0x413bb3
add ecx, eax
cmp ecx, 0x1d18
jbe 0x413ba1
mov edx, ebx
mov ecx, 0x1fc8
movzx eax, byte [edx]
inc edx
test al, al
je 0x413bcc
add ecx, eax
cmp ecx, 0x14c1
jbe 0x413bba
mov edx, ebx
mov ecx, 0x106e
movzx eax, byte [edx]
inc edx
test al, al
je 0x413be5
add ecx, eax
cmp ecx, 0x158b
jbe 0x413bd3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edx, 0x246b
movzx eax, byte [ebx]
inc ebx
test al, al
je 0x413c08
add edx, eax
cmp edx, 0x25f8
jbe 0x413bf6
pop eax
pop ebx
pop ebp
ret

Function at 0x413cc8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, str.SXS:__s___BaseDllMapResourceIdA_failed
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov al, byte [ecx]
test al, al
je 0x413cf8
sub eax, 0x30
cmp al, 9
jbe 0x413cf5
or dword [0x429340], 0xf7f9cc27
jmp 0x413cf8
inc ecx
jmp 0x413cdc
imul eax, dword [0x429340], 0x3c208166
mov dword [0x42947c], eax
mov ax, word [edx]
test ax, ax
je 0x413d2e
sub eax, 0x30
cmp ax, 9
jbe 0x413d29
mov eax, dword [0x42955c]
add eax, 0x68005bc8
mov dword [0x42947c], eax
jmp 0x413d2e
add edx, 2
jmp 0x413d07
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [0x42955c]
mov eax, dword [0x429340]
mov esi, ebx
mov edi, 0x1f55
and edx, 0x5acf7f54
or eax, 0xd0e02631
or edx, 0x8831644
sub eax, 0x10f07277
sub edx, 0x5a0f86ac
movzx ecx, byte [esi]
inc esi
test cl, cl
je 0x413d74
add edi, ecx
cmp edi, 0x1237
jbe 0x413d62
imul edx, edx, 0x203f8dd7
imul ecx, eax, 0xc6f21baf
mov dword [0x42947c], edx
imul edx, eax, 0xab5190ca
mov dword [0x42955c], ecx
mov ecx, 0x5b0
mov dword [0x429340], edx
add dword [ebp + 0xc], 2
mov esi, dword [ebp + 0xc]
movzx edx, word [esi - 2]
test dx, dx
je 0x413dc2
add ecx, edx
cmp ecx, 0x83
jbe 0x413d9d
imul eax, eax, 0x3caa2606
mov dword [0x429340], eax
mov eax, dword [0x429340]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push ecx
mov edx, dword [0x42955c]
mov ecx, 0x9b2
movzx eax, byte [ebx]
inc ebx
test al, al
je 0x413dfa
add ecx, eax
cmp ecx, 0xee2
jbe 0x413ddc
mov eax, edx
xor eax, 0x2b05dd26
mov dword [0x42947c], eax
mov eax, dword [0x42947c]
xor edx, 0xc298fddd
mov dword [0x429340], edx
xor eax, 0xd9880e8
mov dword [0x42955c], eax
or eax, 0x580d9ced
mov dword [0x42947c], eax
mov dword [esp], str.PreferredUILanguages
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub eax, 0x7cc565a9
push edx
mov dword [0x42955c], eax
mov eax, dword [0x429340]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413f60
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edx, ebx
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x413f82
add edx, 2
jmp 0x413f71
lea eax, [esi - 0x1bad1f08]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov dword [0x429694], eax
mov dword [esp], 0x1161
call edi
mov eax, esi
and eax, 0x5ccecfbc
push edx
mov edx, ebx
mov dword [0x429694], eax
mov ax, word [edx]
test ax, ax
je 0x413fd0
sub eax, 0x30
cmp ax, 9
jbe 0x413fcb
mov eax, dword [ebp + 0xc]
xor eax, 0x53a7bc9b
mov dword [0x429694], eax
jmp 0x413fd0
add edx, 2
jmp 0x413fab
mov dword [esp], 0x23af
call edi
mov edx, ebx
mov ecx, 0xe3d
push eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x413ff6
add ecx, eax
cmp ecx, 0x24c5
jbe 0x413fe1
mov eax, dword [ebp + 0xc]
xor eax, 0x7aa86385
mov dword [0x429694], eax
xor eax, eax
cmp word [ebx + eax*2], 0
je 0x414020
inc eax
cmp eax, 0x24f0
jne 0x414005
xor esi, 0x68dbfd6e
mov dword [0x429694], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, 0x15d9
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x414040
add edx, eax
cmp edx, 0xe85
jbe 0x41402b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x414390
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 8]
cmp byte [eax + str.SdbpGetPathAppPatchPreRS3], 0
je 0x4143ba
inc eax
cmp eax, 0x220b
jne 0x41439a
mov eax, dword [0x4297a0]
sub eax, 0x68afdce7
mov dword [0x4297ac], eax
mov eax, dword [0x4297ac]
mov edx, ebx
mov ecx, 0x1532
add eax, 0x610809ee
mov dword [0x429778], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x4143f4
add ecx, eax
cmp ecx, 0x1ee
jbe 0x4143d0
mov eax, dword [0x429774]
add eax, 0x40e00272
mov dword [0x429778], eax
mov eax, dword [0x429778]
mov edx, eax
xor edx, 0xb57d2c9b
mov dword [0x4297ac], edx
lea edx, [eax + 0x1412e45f]
xor eax, 0x1c9d6e81
mov dword [0x429774], edx
mov dword [0x4297a0], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x4297a0]
mov ecx, 0x138a
xor eax, 0x97740bf
lea edx, [eax + 0x3ade2541]
mov dword [0x4297a0], eax
mov dword [0x429774], edx
movzx edx, word [ebx]
add ebx, 2
test dx, dx
je 0x414462
add ecx, edx
cmp ecx, 0x14e5
jbe 0x414443
add eax, 0x9fa3cf5
mov dword [0x4297a0], eax
mov eax, dword [0x4297a0]
or eax, 0x88624db0
mov dword [0x429778], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xf026153e
mov dword [0x429778], eax
pop eax
pop ebx
pop ebp
ret
Function at 0x414b84
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], 0x2367
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
push eax
mov eax, dword [0x429790]
mov si, word [ecx]
lea edx, [esi - 0x30]
cmp dx, 9
ja 0x414bb5
add ecx, 2
jmp 0x414ba4
xor eax, 0x2ff889ef
mov esi, ebx
imul edx, eax, 0x9c78a3c0
imul ecx, eax, 0x162eca2f
mov dword [0x429790], edx
mov dword [0x4297fc], ecx
mov dx, word [esi]
test dx, dx
je 0x414bf8
sub edx, 0x30
cmp dx, 9
jbe 0x414bf3
sub ecx, 0x71c36448
mov dword [0x4297fc], ecx
jmp 0x414bf8
add esi, 2
jmp 0x414bd4
sub eax, 0x1dd693a2
mov dword [0x429494], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, ebx
mov ax, word [edx]
test ax, ax
je 0x414c31
sub eax, 0x30
cmp ax, 9
jbe 0x414c2c
mov eax, dword [0x429790]
sub eax, 0x2f87cf8a
mov dword [0x4297fc], eax
jmp 0x414c31
add edx, 2
jmp 0x414c0a
mov edx, dword [0x4297fc]
mov ecx, ebx
mov esi, 0xbab
imul eax, edx, 0x5bc706b5
mov dword [0x429494], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x414c6a
add esi, eax
cmp esi, 0x1f7b
jbe 0x414c49
add edx, 0x6490fc3e
mov dword [0x429494], edx
mov eax, dword [0x429494]
mov esi, dword [0x429790]
mov ecx, ebx
mov edx, eax
and edx, 0xa0f9466c
mov dword [0x4297fc], edx
mov dx, word [ecx]
test dx, dx
je 0x414ca9
sub edx, 0x30
cmp dx, 9
jbe 0x414ca4
xor esi, 0xeb6356c1
mov dword [0x4297fc], esi
jmp 0x414ca9
add ecx, 2
jmp 0x414c85
or eax, 0xba9d667e
sub eax, 0x19d54d2c
cmp word [ebx], 0
mov dword [0x429494], eax
je 0x414cc8
and eax, 0x98e269cf
mov dword [0x4297fc], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x414db0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x429884]
imul edx, dword [0x429664], 0xd2fa0942
and eax, 0xd54fafa4
or eax, 0x14430aa0
mov dword [0x429884], edx
add eax, 0x26b4e4b7
mov edx, eax
mov dword [0x429664], eax
and eax, 0x90e3b970
or edx, 0x66e4a0b0
mov dword [0x429658], eax
mov dword [0x429568], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, 0x42a8e8
imul eax, dword [0x429658], 0x549594dc
sub eax, 0x27f84497
mov dword [0x429664], eax
mov al, byte [edx]
test al, al
je 0x414e38
sub eax, 0x30
cmp al, 9
jbe 0x414e35
mov eax, dword [0x429568]
and eax, 0xf311756b
mov dword [0x429664], eax
jmp 0x414e38
inc edx
jmp 0x414e17
mov eax, dword [0x429664]
mov ebx, 0x4ab
xor eax, 0xabd9f271
mov dword [0x429884], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov ecx, dword [0x429884]
mov edx, str.Fast_Cache_data_expired.
sub eax, 0x70c99435
mov dword [0x429664], eax
xor ecx, 0x6f7e72ae
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x414e91
add ebx, eax
cmp ebx, 0x11d1
jbe 0x414e6d
mov eax, dword [0x429568]
or eax, 0x44398206
mov dword [0x429664], eax
mov edx, dword [0x429568]
mov eax, dword [0x429664]
imul ecx, ecx, 0xfbd6a990
or edx, 0x2887387e
xor eax, 0x20f9032d
mov dword [0x429568], edx
mov dword [0x429658], eax
mov dword [0x429664], ecx
xor ecx, ecx
cmp word [ecx + str.Fast_Cache_data_expired.], 0
je 0x414ee1
add ecx, 2
cmp ecx, 0x142
jne 0x414ec0
add edx, 0x6d2d6b66
mov dword [0x429664], edx
and eax, 0x675324b6
mov dword [esp], str.AslStringAnsiToUnicode_failed___x_
sub dword [0x429664], 0x5560e64a
mov dword [0x429884], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp - 4]
push eax
mov eax, dword [0x429658]
mov edx, eax
and edx, 0xc04fba5f
mov dword [0x429664], edx
leave
ret

Function at 0x415414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x20
mov dword [ebp - 0x14], 0x3d
mov dword [ebp - 0x10], 0x36
mov dword [ebp - 0xc], 0xffffff8d
mov dword [esp + 8], str.ServerSessionId
mov dword [esp + 4], str.Format_ID
mov dword [esp], str.The_stub_received_bad_data.
call fcn.0040e864
add dword [0x429808], 0x17c5fe02
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor dword [0x429808], 0x3ee94a45
mov dword [esp], str.TPM_1.2:_Authentication_failed.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
sub eax, 0x28067d2b
or eax, 0x7ed22ef0
mov dword [0x429808], eax
call fcn.004129a4
sub ebx, dword [ebp + esi*4 - 0x14]
inc esi
cmp esi, 3
jne 0x415435
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040d6cc
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x64e480
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x584015
lea edi, [esi - 0x183015]
mov dword [edi + 0x246bf4], 0xe679e79e
push edi
or ebp, 0xffffffff
jmp 0x64e4aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x64e4b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64e4a0
mov eax, 1
add ebx, ebx
jne 0x64e4c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x64e4d4
jne 0x64e4f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64e4f3
dec eax
add ebx, ebx
jne 0x64e4e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x64e4b8
add ebx, ebx
jne 0x64e4ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x64e545
xor ecx, ecx
sub eax, 3
jb 0x64e50b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x64e57a
sar eax, 1
mov ebp, eax
jmp 0x64e516
add ebx, ebx
jne 0x64e516
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64e4e4
inc ecx
add ebx, ebx
jne 0x64e524
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64e4e4
add ebx, ebx
jne 0x64e531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x64e526
jne 0x64e542
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x64e526
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x64e564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x64e556
jmp 0x64e4a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x64e564
add edi, ecx
jmp 0x64e4a6
pop esi
mov edi, esi
mov ecx, 0x9160
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x64e582
cmp byte [edi], 0x24
jne 0x64e582
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x64e587
lea edi, [esi + 0x24c000]
mov eax, dword [edi]
or eax, eax
je 0x64e5f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24e000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24e08c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x64e5b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24e090]
or eax, eax
je 0x64e5f0
mov dword [ebx], eax
add ebx, 4
jmp 0x64e5d1
call dword [esi + 0x24e0a0]
mov ebp, dword [esi + 0x24e094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x24e651]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x64e642
sub esp, 0xffffff80
jmp 0x4014d0
Function at 0x40135a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov ebx, ecx
mov esi, dword [edi]
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x170], eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, dword [edi + 0x174]
je 0x442842
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jge 0x442853
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
mov ecx, 0x8000
and ax, cx
push 0
mov word [ebp + 0xa], ax
pop eax
push dword [ebx + 0x1c]
setne al
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [ebp - 0xc]
mov cx, ax
mov eax, 0x8000
and cx, ax
push 0
pop eax
setne al
mov word [ebp - 2], cx
mov dword [ebp - 8], eax
cmp esi, dword [edi + 0x17c]
jne 0x442864
cmp dword [ebp + 0xc], 0
je 0x401411
mov dword [edi + 0x17c], esi
cmp eax, dword [edi + 0x180]
jne 0x4428d7
cmp dword [ebp + 0xc], 0
je 0x401429
mov dword [edi + 0x180], eax
pop edi
pop esi
pop ebx
leave
ret 8
cmp eax, dword [edi + 0x178]
je 0x4013b9
jmp 0x4013a3
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.00493451
jmp 0x4013b9
cmp dword [ebp + 0xc], 1
jl 0x401405
cmp byte [edi + 0x1a8], 0
je 0x401405
cmp word [ebp + 0xa], 0
mov ecx, ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
je 0x44288f
push 0xfffffffffffffff9
jmp 0x4428bf
push 0xfffffffffffffff8
call fcn.00493451
cmp byte [edi + 0x184], 0
je 0x4428c4
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
test eax, 0x1000000
je 0x4428bd
push 0xfffffffffffffffa
jmp 0x4428bf
push 0xfffffffffffffff4
call fcn.00493451
mov eax, dword [ebp - 8]
mov cx, word [ebp - 2]
mov byte [edi + 0x184], 0
jmp 0x401405
cmp dword [ebp + 0xc], 1
jl 0x40141d
push dword [ebp - 0x10]
test cx, cx
mov ecx, ebx
push dword [ebp - 0x14]
push edi
je 0x4428f3
push 0xfffffffffffffff7
jmp 0x4428f5
push 0xfffffffffffffff6
call fcn.00493451
mov eax, dword [ebp - 8]
jmp 0x40141d
Function at 0x402723
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2002c
call fcn.004422a0
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0040ae03
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
push 0x7fff
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x13]
push eax
push dword [ebp + 8]
call fcn.0040174a
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x442eec
xor edi, edi
mov esi, 0x4d33b0
inc edi
cmp dword [0x4d23f0], edi
je 0x442f04
lea eax, [esp + 0x11]
push eax
push ecx
push 0x4d23f0
push 0x4d2408
mov ecx, esi
call fcn.004031c8
test al, al
je 0x442f23
mov al, byte [0x4d33b0]
mov byte [0x4d23f4], al
mov al, byte [0x4d33b1]
mov byte [esp + 0x12], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1003c]
push eax
push 0x7fff
push dword [0x4d2408]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [esp + 0x14]
mov ecx, 0x4d23e0
call fcn.00407467
mov bl, byte [esp + 0x11]
push dword [0x4d23f0]
push 0x4d2408
call fcn.004019a9
test eax, eax
jne 0x442f2e
cmp byte [esp + 0x12], 1
je 0x442f4b
call fcn.0040286b
call fcn.0040294b
cmp byte [0x4d23f4], 0
mov ebx, 0x4d29b0
jne 0x40282c
mov ecx, ebx
call fcn.00403989
push edi
mov ecx, 0x4d2420
call fcn.0040dd00
cmp byte [0x4d23f4], 0
jne 0x402847
mov ecx, ebx
call fcn.00402f14
mov ecx, esi
call fcn.004048dc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x28]
call fcn.0040ac28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x10
push str.AutoIt
push str.It_is_a_violation_of_the_AutoIt_EULA_to_attempt_to_reverse_engineer_this_program.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402859
push 0xffffffffffffffff
push dword [0x4d23f8]
mov ecx, esi
push edi
call fcn.004038a0
mov al, byte [0x4d2354]
mov byte [0x4d33b2], al
jmp 0x4027ea
mov dword [0x4d234c], edi
jmp 0x40284e
mov ecx, esi
call fcn.004048dc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4d234c], edi
jmp 0x402859
call fcn.00461d45
test al, al
jne 0x40280d
cmp byte [esp + 0x13], al
jne 0x40280d
lea ecx, [esp + 0x28]
call fcn.00403dd1
push 0x4c3204
lea ecx, [esp + 0x1c]
call fcn.0040a1d4
lea ecx, [esp + 0x18]
test bl, bl
je 0x442fa8
mov edi, 0x4c69d4
push edi
call fcn.004059dc
push 0x4d2408
lea ecx, [esp + 0x1c]
call fcn.00406aa4
push edi
lea ecx, [esp + 0x1c]
call fcn.004059dc
push 1
jmp 0x442fb1
push dword [ebp + 8]
call fcn.004059dc
push edi
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x34]
push 0x4c69d8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x18]
call fcn.0040ac28
jmp 0x402847