joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406690
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x81c
push ebx
push ebp
push esi
push edi
push 0x401
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], edx
mov ebx, ecx
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x28], ebx
call sub.VCRUNTIME140.dll_memset
push 0x401
lea eax, [esp + 0x438]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebx
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x28
mov eax, dword [esp + 0x83c]
mov edi, eax
push ebx
mov byte [ebp], 0
mov dword [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x406872
cmp word [ebx + 8], 2
jne 0x40675f
cmp word [ebx + 0xa], 4
jne 0x40675f
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x40675f
push dword [eax]
mov edx, dword [esp + 0x834]
push dword [esp + 0x838]
mov ecx, dword [esp + 0x20]
call fcn.00406610
mov dword [edi], eax
test eax, eax
je 0x4067f7
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x406730
push 0x400
push dword [ebx]
push 0x401
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [esp + 0x84c]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x40680b
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406790
sub ecx, edx
je case.0x406882.11003
mov ebx, dword [esp + 0x14]
mov eax, ebp
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4067c7
test dl, dl
je 0x4067c3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4067c7
add ecx, 2
add eax, 2
test dl, dl
jne 0x4067a7
xor eax, eax
jmp 0x4067cc
sbb eax, eax
or eax, 1
test eax, eax
je case.0x406882.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x406882.11003
mov eax, ebx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x1c]
mov ebp, eax
jmp 0x4066f5
mov esi, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
cmp dword [esp + 0x838], esi
je 0x4068b6
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406820
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x40684a
push ebp
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [esp + 0x83c]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
pop edi
cmp dword [eax + 0x14], esi
cmove esi, ecx
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x406882.11001
jmp dword [eax*4 + 0x4068c8]
mov esi, 0x2afa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2afb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2af9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
Function at 0x406ec0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
cmp dword [0x4e8cc8], 0
mov ax, cx
push ebx
push ebp
push esi
push edi
mov word [esp + 0x12], ax
mov dword [esp + 0x14], str.getaddrinfo
mov dword [esp + 0x18], 0x406930
mov dword [esp + 0x1c], str.getnameinfo
mov dword [esp + 0x20], 0x406cd0
mov dword [esp + 0x24], str.freeaddrinfo
mov dword [esp + 0x28], fcn.004068e0
je 0x406f20
movzx eax, ax
mov eax, dword [eax*8 + 0x4e202c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
push 0x104
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407025
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.ws2_32
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x406f9c
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x406fe8
push edi
call ebp
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.wship6
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407025
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x407022
xor esi, esi
nop word [eax + eax]
push dword [esp + esi*8 + 0x14]
push edi
call ebx
mov dword [esp + esi*8 + 0x18], eax
test eax, eax
je 0x407022
inc esi
cmp esi, 3
jl 0x406ff0
mov eax, dword [esp + 0x18]
mov dword [0x4e202c], eax
mov eax, dword [esp + 0x20]
mov dword [0x4e2034], eax
mov eax, dword [esp + 0x28]
mov dword [fcn.004068e0], eax
jmp 0x407025
push edi
call ebp
movzx eax, word [esp + 0x12]
pop edi
pop esi
pop ebp
mov eax, dword [eax*8 + 0x4e202c]
mov dword [0x4e8cc8], 1
pop ebx
add esp, 0x234
ret

Function at 0x407240
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x38], 2
jne 0x40724d
xor eax, eax
pop esi
ret
call fcn.004071b0
test eax, eax
jne 0x40724b
mov ecx, esi
pop esi
jmp fcn.00407260
Function at 0x40b070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4e3b24]
test eax, eax
je 0x40b096
push str.stderr
push dword [ebp + 8]
mov ecx, 0x4e3ae8
call fcn.0040af50
mov eax, dword [0x4e3b24]
cmp eax, 2
je 0x40b0a4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 4

Function at 0x40b170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 4]
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4b9fa4
lea esi, [eax + 1]
push esi
call fcn.004062c0
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push 0
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b224
cmp dword [edi + 0x34], 0
jne 0x40b224
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x28]
inc eax
push eax
call fcn.0040bed0
test eax, eax
jne 0x40b224
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x28]
mov al, byte [0x4b8c14]
push 0
mov byte [ecx], al
inc dword [edi + 0x30]
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b224
mov dword [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x34], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x4e3ae8
call fcn.0040b760
push 0x10014
push dword [0x4e7834]
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push dword [0x4e4b98]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40b25c
push 0
push eax
mov ecx, 0x4e6d58
call fcn.0042ae40
pop edi
mov eax, 0x3e6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bc90
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
mov dword [esp + 8], ebp
test esi, esi
je 0x40bdf5
cmp byte [esp + 0x18], 0
jne 0x40bcd8
lea ecx, [esi - 1]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebp + 8]
mov ecx, ebp
shr edx, 1
lea eax, [eax + edx*4]
add eax, 5
push eax
call fcn.0040bed0
test eax, eax
je 0x40bcd8
pop esi
mov eax, 0x3e6
pop ebp
pop ecx
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x40bdf4
mov edx, dword [ebp + 8]
add edx, dword [ebp]
push edi
xor edi, edi
mov dword [esp + 0x20], edx
cmp esi, 0xffffffff
jne 0x40bd09
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40bd00
sub esi, ecx
cmp esi, 2
jbe 0x40bd91
mov ebp, dword [esp + 0x20]
lea ecx, [esi - 3]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
movzx ecx, byte [ebx]
sub esi, 3
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add ebx, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 3], al
add edi, 4
sub edx, 1
jne 0x40bd23
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
test esi, esi
je 0x40bdec
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 1
jbe 0x40bda9
movzx eax, byte [ebx + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + edx + 1], al
cmp esi, 1
jbe 0x40bdde
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40bde0
mov al, 0x3d
mov byte [edi + edx + 2], al
mov byte [edi + edx + 3], 0x3d
add edi, 4
mov byte [edi + edx], 0
add dword [ebp + 8], edi
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
Function at 0x40c540
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push 0
push 0
push dword [esp + 0x14]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x40c598
mov edi, dword [esi + 4]
test edi, edi
je 0x40c5c0
mov eax, dword [edi + 0x10]
add eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x40c586
mov eax, dword [edi + 4]
test eax, eax
je 0x40c57b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x14
push edi
call fcn.004b5fff
add esp, 8
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov byte [esi + 8], 0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.0040c7f0
mov ecx, dword [esi + 4]
push edi
call fcn.0040c730
mov eax, dword [esi + 4]
push edi
push dword [eax]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x40cf70
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp byte [0x4e784c], 0
push esi
je 0x40d003
mov esi, dword fs:[0x24]
cmp dword [0x4e6ce0], esi
je 0x40cf99
push dword [0x4e6ce4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 8]
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cfa3
sub ecx, edi
sar ecx, 1
push 3
push ecx
push edx
mov ecx, 0x4e6d58
call fcn.0043afc0
pop edi
test eax, eax
jne 0x40cfde
cmp dword [0x4e6ce0], esi
je 0x40cfd9
push dword [0x4e6ce4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or eax, 0xffffffff
pop esi
ret
push 1
push 0
push 0xffffffffffffffff
push dword [esp + 0x18]
mov ecx, eax
call fcn.004a0110
cmp dword [0x4e6ce0], esi
je 0x40d003
push dword [0x4e6ce4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret
Function at 0x411420
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4e7a7e], 0
push ebx
mov bh, dl
mov edx, ecx
push esi
mov dword [esp + 8], edx
je 0x4114bb
mov al, byte [0x4e7a7c]
cmp al, 0xa0
je 0x411445
cmp al, 0x10
jne 0x4114bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e7a84]
cmp eax, 0x16
jae 0x4114b7
mov edx, dword [esp + 0x10]
mov cl, bh
call fcn.00411700
cmp byte [0x4e7a7d], 0
jne 0x411481
xor eax, eax
nop dword [eax]
cmp byte [eax + 0x4e7a88], 0
jne 0x41148c
inc eax
cmp eax, 0x16
jl 0x411470
jmp 0x4114b7
cmp byte [esp + 0x14], 0
je 0x411495
test al, al
je 0x4114b7
mov byte [0x4e7a63], 1
jmp 0x411499
test al, al
je 0x4114b7
mov al, byte [0x4e7a7f]
mov byte [0x4e4c3f], al
mov al, byte [0x4e7a82]
mov byte [0x4e5578], al
mov al, byte [0x4e7a83]
mov byte [0x4e5608], al
mov edx, dword [esp + 8]
mov al, byte [0x4e4c3f]
mov byte [0x4e7a7f], al
mov al, byte [0x4e5578]
mov byte [0x4e7a82], al
mov al, byte [0x4e5608]
movzx esi, bh
mov byte [0x4e7a83], al
mov eax, dword [0x4e7a74]
lea ecx, [esi + esi*4]
mov bl, byte [eax + ecx*4 + 8]
test bl, bl
je 0x411606
mov ecx, dword [esp + 8]
push edi
mov edi, dword [edx + 0x10]
mov dl, bh
push dword [esp + 0x18]
mov ecx, dword [ecx + 8]
call fcn.00411680
add esp, 4
cmp byte [esp + 0x18], 0
je 0x4115ae
cmp byte [esp + 0x1c], 0
jne 0x411533
mov cl, bl
not cl
and byte [0x4e4c43], cl
cmp edi, 0xffc3d44f
je 0x411533
and byte [0x4e4c42], cl
test al, al
je case.default.0x4115e5
not bl
mov byte [esi + 0x4e5568], 0
and byte [0x4e4c3f], bl
add esi, 0xffffff60
cmp esi, 5
ja case.default.0x4115e5
jmp dword [esi*4 + 0x411648]
mov al, byte [0x4e5609]
mov byte [0x4e5578], al
jmp case.default.0x4115e5
mov al, byte [0x4e5608]
mov byte [0x4e5578], al
jmp case.default.0x4115e5
mov al, byte [0x4e560b]
mov byte [0x4e5579], al
jmp case.default.0x4115e5
mov al, byte [0x4e560a]
mov byte [0x4e5579], al
jmp case.default.0x4115e5
mov al, byte [0x4e560d]
mov byte [0x4e557a], al
jmp case.default.0x4115e5
mov al, byte [0x4e560c]
mov byte [0x4e557a], al
jmp case.default.0x4115e5
cmp byte [esp + 0x1c], 0
jne 0x4115c9
or byte [0x4e4c43], bl
cmp edi, 0xffc3d44f
je 0x4115c9
or byte [0x4e4c42], bl
test al, al
je case.default.0x4115e5
or byte [0x4e4c3f], bl
mov byte [esi + 0x4e5568], 0x80
add esi, 0xffffff60
cmp esi, 5
ja case.default.0x4115e5
jmp dword [esi*4 + 0x411660]
mov byte [0x4e5578], 0x80
jmp case.default.0x4115e5
mov byte [0x4e5579], 0x80
jmp case.default.0x4115e5
mov byte [0x4e557a], 0x80
pop edi
mov eax, dword [esp + 0x10]
mov dl, bh
mov word [0x4e7a80], ax
mov eax, dword [esp + 0x14]
mov byte [0x4e7a7d], al
push eax
mov eax, dword [esp + 0xc]
mov byte [0x4e7a7c], bh
mov ecx, dword [eax + 8]
call fcn.00411680
add esp, 4
mov byte [0x4e7a7e], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
mov dword [0x4e7a84], eax
pop ebx
pop ecx
ret
Function at 0x411680
Capabilities:
Check for time delay via gettickcount

Disassembly:
test cl, 0x10
jne 0x4116b7
cmp dl, 0xa0
je 0x41168f
cmp dl, 0x10
jne 0x4116ea
cmp byte [esp + 4], 0
jne 0x4116ea
cmp byte [0x4e7a63], 0
je 0x4116ba
xor eax, eax
cmp byte [eax + 0x4e7a88], 0
jne 0x4116ba
inc eax
cmp eax, 0x16
jl 0x4116a1
mov byte [0x4e7a63], 0
xor al, al
ret
cmp byte [0x4e7a7d], 0
je 0x4116ea
mov dx, word [0x4e7a80]
mov cl, byte [0x4e7a7c]
call fcn.00411700
test al, al
je 0x4116ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e7a84]
cmp eax, 0x16
jb 0x4116b7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e7a24], eax
mov dword [0x4e7a20], eax
mov al, 1
ret
Function at 0x4126b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
mov al, dl
mov byte [esp + 0xa], cl
xor dl, dl
mov byte [esp + 9], al
cmp dword [0x4e4bb4], 0
movzx ebx, dl
mov edx, 1
push ebp
push esi
cmovne ebx, edx
cmp dword [0x4e4bb0], 0
push edi
je 0x4126e7
or bl, 2
cmp cl, bl
je 0x4128f1
test bl, bl
jne 0x412730
test al, al
jne 0x412730
push 0x4e5688
push 0
push 0
push 0x412960
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e7a5c], eax
test eax, eax
je 0x4127c9
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, byte [esp + 0x15]
mov cl, byte [esp + 0x16]
movzx edi, al
xor esi, esi
xor edi, 1
movzx ebp, cl
nop dword [eax + eax]
push edi
push ebp
push 0x417
push dword [0x4e5688]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x412765
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x412740
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor al, al
mov byte [esp + 0x17], al
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov cl, byte [esp + 0x16]
mov al, byte [esp + 0x15]
test cl, cl
je 0x4127d6
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x41280b
cmp dword [esp + 0x24], 0
je 0x4127e3
mov byte [esp + 0x17], 1
call fcn.00412d00
test al, al
jne 0x4127e3
mov al, byte [esp + 0x15]
test al, al
jne 0x4128c4
xor cl, cl
mov byte [esp + 0x16], cl
jmp 0x412783
call fcn.00412d20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
je 0x4127f0
call fcn.00412d00
test al, al
jne 0x41280b
cmp byte [esp + 0x15], 0
jne 0x4128bd
jmp 0x41283e
lea eax, [esp + 0x18]
push eax
push dword [0x4e7a5c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], 0x103
jne 0x412823
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x4127e3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41277b
push dword [0x4e7a5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4e7a5c], 0
call fcn.00412d20
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov al, bl
and al, 1
cmp dword [0x4e4bb4], 0
je 0x412867
test al, al
jne 0x412881
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4e7a54], eax
jmp 0x412881
test al, al
je 0x412881
push dword [0x4e7a54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4e7a54], 0
and bl, 2
cmp dword [0x4e4bb0], 0
je 0x4128a3
test bl, bl
jne 0x4128bd
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4e7a58], eax
jmp 0x4128bd
test bl, bl
je 0x4128bd
push dword [0x4e7a58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4e7a58], 0
cmp byte [esp + 0x17], 0
je 0x4128f1
push 0
push 0
xorps xmm3, xmm3
mov dword [0x4e2114], 0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.004a1c80
add esp, 8
mov dword [0x4e2114], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d50
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, ecx
push eax
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor dl, dl
xor cl, cl
call fcn.004126b0
mov eax, dword [0x4e4b7c]
test eax, eax
je 0x413d77
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push edi
xor eax, eax
xor edi, edi
cmp ax, word [0x4e56e4]
jae 0x413e02
mov edx, dword [0x4e6450]
push ebx
mov ebx, dword [0x4e6454]
push ebp
mov ebp, dword [sym.imp.USER32.dll_UnregisterHotKey]
push esi
nop word [eax + eax]
mov esi, dword [0x4e56d4]
mov esi, dword [esi + edi*4]
test esi, esi
je 0x413df3
cmp byte [esi + 0x18], 0
je 0x413dd4
movzx eax, word [esi + 4]
push eax
push dword [0x4e4b98]
call ebp
mov edx, dword [0x4e6450]
test eax, eax
mov ebx, dword [0x4e6454]
sete al
mov byte [esi + 0x18], al
cmp esi, edx
jne 0x413df3
test edx, edx
je 0x413df3
mov eax, dword [ebx + 4]
mov ecx, eax
sub ecx, edx
add dword [ebx + 8], ecx
sub eax, ecx
xor edx, edx
mov dword [ebx + 4], eax
mov dword [0x4e6450], edx
movzx eax, word [0x4e56e4]
inc edi
cmp edi, eax
jl 0x413da0
pop esi
pop ebp
pop ebx
push dword [esp + 4]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
int3
Function at 0x418430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov al, byte [ebp + 0xc]
or byte [ebp + 8], al
push ebx
mov bl, cl
mov dword [esp + 8], edx
mov al, bl
sub al, 1
push esi
push edi
cmp al, 5
ja 0x418455
cmp bl, 3
jne 0x41845d
mov al, bl
add al, 0x66
cmp al, 5
ja 0x418461
mov bh, 1
jmp 0x418463
xor bh, bh
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
test esi, esi
jle 0x41858a
cmp dword [0x4e7b18], 0
jne 0x4184d7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e211c]
sub eax, dword [0x4e786c]
cmp eax, dword [ecx + 0xd8]
jbe 0x4184dd
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4184cc
mov edx, 1
mov dword [0x4e2114], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e2114], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e786c], eax
mov ecx, dword [0x4e211c]
cmp byte [ebp + 0x18], 0
jne 0x418531
mov al, byte [ecx + 0xf6]
test al, al
je 0x4184f9
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x4184fe
mov esi, 0xffc3d44f
cmp dword [0x4e7b18], 0
je 0x41850e
mov al, byte [0x4e7aa7]
jmp 0x418515
xor cl, cl
call fcn.0041af60
mov cl, byte [ebp + 8]
mov dl, al
push esi
push 1
push 0
push edi
call fcn.0041a910
mov ecx, dword [0x4e211c]
add esp, 0x10
mov esi, dword [ebp + 0x10]
test bh, bh
je 0x41855b
test edi, edi
jne 0x41855b
push dword [ebp + 0x28]
movzx eax, byte [ecx + 0xef]
mov cl, bl
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
push eax
push 1
push dword [ebp + 0x24]
call fcn.00419880
add esp, 0x14
jmp 0x41857e
movzx eax, byte [ecx + 0xf6]
mov dl, bl
mov ecx, 0xffc3d44d
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push edi
push dword [esp + 0x1c]
call fcn.004189d0
add esp, 0x10
sub esi, 1
mov dword [ebp + 0x10], esi
jne 0x418471
cmp byte [ebp + 0x18], 0
jne 0x4185cb
cmp dword [0x4e7b18], 0
je 0x4185a0
mov al, byte [0x4e7aa7]
jmp 0x4185a7
xor cl, cl
call fcn.0041af60
mov cl, al
xor cl, byte [ebp + 0xc]
and cl, al
and cl, 0xcc
je 0x4185cb
push 0xffc3d44d
push 0
not cl
mov dl, al
push 1
push edi
and cl, al
call fcn.0041a910
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4185e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
mov eax, dword [0x4e7b18]
cmp eax, 2
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
sete byte [esp + 0xf]
jne 0x41862c
movzx edx, bx
mov ecx, edx
and ecx, 0xffffff80
je 0x41860d
mov eax, 0x30
mov word [esp + 0x2c], ax
test ecx, ecx
lea eax, [esp + 0x2c]
lea edi, [esp + 0x2e]
push 0xa
cmovne eax, edi
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov eax, dword [0x4e7b18]
add esp, 0xc
test esi, esi
jle 0x4186de
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x418696
call edi
mov ecx, dword [0x4e211c]
sub eax, dword [0x4e786c]
cmp eax, dword [ecx + 0xd8]
jbe 0x418696
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call ebp
test eax, eax
je 0x41868f
mov edx, 1
mov dword [0x4e2114], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e2114], 1
call edi
mov dword [0x4e786c], eax
cmp byte [esp + 0x13], 0
je 0x4186a8
lea ecx, [esp + 0x30]
call fcn.004186f0
jmp 0x4186b3
mov dl, byte [esp + 0x54]
mov ecx, ebx
call fcn.00417270
cmp dword [0x4e7b18], 2
mov eax, dword [0x4e211c]
jne 0x4186c6
mov ecx, dword [eax + 0x60]
jmp 0x4186c9
mov ecx, dword [eax + 0x5c]
call fcn.0041a5d0
sub esi, 1
je 0x4186dd
mov eax, dword [0x4e7b18]
jmp 0x418641
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret