joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ac90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.0042e340
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x46adf8
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x46ad0c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x46ad71
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x46ad30
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x46ad9d
mov eax, dword [esi + 4]
push 1
push 0x47ce55
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x47ce56
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x46ad76
push dword [esp + 0x28]
call fcn.0042e340
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x46adc8
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x483004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x46aed0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x46aef6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x46af26
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.0042e340
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x46af7d
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x46af8c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x46af9d
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5d7f56d9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x31143719
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x9571b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00957140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00957140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00957140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00957140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x957bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x957c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x96987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x957c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x957c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x404810
Capabilities:
Set current directory

Disassembly:
push ecx
cmp byte [esp + 8], 0
mov eax, ecx
push ebx
mov ebx, dword [0x4e7024]
mov ecx, 0x42
push esi
push edi
mov byte [esp + 0xf], dl
mov esi, 0x4e96c0
je 0x404858
inc dword [0x4e97dc]
add ebx, 0x108
mov edi, ebx
mov dword [0x4e7024], ebx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4eb958
mov dword [ebx + 0x2c], eax
call fcn.00423e50
jmp 0x40485f
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], eax
cmp dword [0x4e97f0], 0
xorps xmm0, xmm0
movlpd qword [0x4ec458], xmm0
je 0x40488f
mov eax, dword [0x4e8a04]
mov ecx, 0x4bfba0
test eax, eax
je 0x404888
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0xf], 0
jne 0x404914
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x4048c4
cmp byte [esp + 0x18], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x4048c4
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4ec464], 0
je 0x4048d6
cmp dword [0x4ec460], 0
jne 0x4048da
test cl, cl
je 0x404914
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x404914
cmp dword [0x4ec464], 0
jge 0x4048fd
pop edi
pop esi
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4ec464]
mov dword [ebx + 0xe0], eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x405c70
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405c92
call fcn.00405f40
test eax, eax
jne 0x405c92
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00405da0
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405cd8
cmp dword [esi + 0x18], eax
je 0x405cc8
cmp dword [esi + 8], eax
je 0x405cb5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4c011c
mov ecx, esi
call fcn.00405da0
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x405d1a
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x405d0b
cmp word [ecx], 0
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x405d4e
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x405d44
cmp dword [esi + 8], 0
je 0x405d31
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405d63
mov dword [esi + 4], 0
jmp 0x405d1a
cmp dword [esi + 0x18], 0
je 0x405d8d
cmp dword [esi + 8], 0
je 0x405d7a
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4c013c
mov ecx, esi
call fcn.00405da0
pop edi
pop esi
ret 4
Function at 0x405e30
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
je 0x405e4a
mov dword [esi], 0
mov ebx, dword [esp + 0x21c]
lea eax, [ebx - 0xc000]
cmp eax, 0x3fff
ja 0x405f20
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0x10]
push str.Link_Source
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x405f12
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0xc]
push str.ObjectLink
push eax
call edi
add esp, 8
test eax, eax
je 0x405f12
lea eax, [esp + 0xc]
push str.OwnerLink
push eax
call edi
add esp, 8
test eax, eax
je 0x405f12
lea eax, [esp + 0xc]
push str.Native
push eax
call edi
add esp, 8
test eax, eax
je 0x405f12
lea eax, [esp + 0xc]
push str.Embed_Source
push eax
call edi
add esp, 8
test eax, eax
je 0x405f12
lea eax, [esp + 0xc]
push str.MSDEVColumnSelect
push eax
call edi
add esp, 8
test eax, eax
je 0x405f08
lea eax, [esp + 0xc]
push str.MSDEVLineSelect
push eax
call edi
add esp, 8
test eax, eax
jne 0x405f27
test esi, esi
je 0x405f12
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 0xc], ax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x405f40
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 0x18], 0
jne 0x405fc5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [0x4e97f4]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x405fbe
nop
mov eax, dword [0x4e7030]
cmp eax, 0xffffffff
je 0x405f8f
test eax, eax
je 0x405fd2
call esi
mov ecx, dword [0x4e7030]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x405fd2
mov edx, 1
mov dword [0x4e701c], 0
mov ecx, 0x8000012f
call fcn.00401700
push dword [0x4e97f4]
mov dword [0x4e701c], 1
call edi
test eax, eax
je 0x405f70
mov dword [ebx + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4064c0
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 8
cmp byte [0x4ec450], 0
push ebx
push esi
push edi
je 0x406569
mov edi, dword fs:[0x24]
cmp dword [0x4eb0cc], edi
je 0x4064ee
push dword [0x4eb940]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, dword [esp + 0x18]
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4064f7
sub esi, ecx
sar esi, 1
cmp word [ebx], ax
je 0x406572
lea eax, [esp + 0xf]
mov ecx, 0x4eb958
push eax
push 3
lea eax, [esp + 0x18]
push eax
push esi
push ebx
call fcn.004307c0
test eax, eax
jne 0x406544
cmp byte [esp + 0xf], al
mov ecx, 0x4eb958
setne al
inc eax
push eax
push dword [esp + 0x14]
push esi
push ebx
call fcn.00430d20
test eax, eax
je 0x406572
push 1
push 0
push 0xffffffffffffffff
push dword [esp + 0x28]
mov ecx, eax
call fcn.004a6070
cmp dword [0x4eb0cc], edi
je 0x406569
push dword [0x4eb940]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [0x4eb0cc], edi
je 0x406586
push dword [0x4eb940]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x40b7c0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
xor al, al
mov bl, cl
cmp dword [0x4e9814], 0
mov ecx, 1
push ebp
movzx eax, al
mov bh, dl
cmovne eax, ecx
mov byte [esp + 0xb], bh
cmp dword [0x4e9810], 0
push esi
push edi
mov dword [esp + 0x14], eax
je 0x40b7fd
or eax, 2
mov dword [esp + 0x14], eax
cmp bl, al
je 0x40b9fa
test al, al
jne 0x40b83e
test bh, bh
jne 0x40b83e
push 0x4ea308
push 0
push 0
push 0x40ba70
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4ec66c], eax
test eax, eax
je 0x40b8f6
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx edi, bh
xor esi, esi
xor edi, 1
movzx ebp, bl
nop dword [eax]
push edi
push ebp
push 0x417
push dword [0x4ea308]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40b875
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x40b850
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor bh, bh
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov dh, bl
mov dl, bh
test bl, bl
je 0x40b903
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x40b8e1
cmp dword [esp + 0x24], 0
je 0x40b91d
mov bh, 1
call fcn.0040bdd0
test al, al
jne 0x40b91d
cmp byte [esp + 0x13], al
jne 0x40b9cd
xor bl, bl
lea eax, [esp + 0x18]
push eax
push dword [0x4ec66c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], 0x103
jne 0x40b92a
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x40b91d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b887
call fcn.0040bdf0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x13], 0
mov bh, dl
mov bl, dh
je 0x40b8c6
call fcn.0040bdd0
test al, al
je 0x40b9c9
jmp 0x40b8e1
cmp byte [esp + 0x13], 0
jne 0x40b9c9
jmp 0x40b945
push dword [0x4ec66c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ec66c], 0
call fcn.0040bdf0
mov al, byte [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
and al, 1
cmp dword [0x4e9814], 0
je 0x40b970
test al, al
jne 0x40b98a
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4ec664], eax
jmp 0x40b98a
test al, al
je 0x40b98a
push dword [0x4ec664]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ec664], 0
mov eax, dword [esp + 0x14]
and al, 2
cmp dword [0x4e9810], 0
je 0x40b9af
test al, al
jne 0x40b9c9
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4ec668], eax
jmp 0x40b9c9
test al, al
je 0x40b9c9
push dword [0x4ec668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ec668], 0
test bh, bh
je 0x40b9fa
push 0
push 0
xorps xmm3, xmm3
mov dword [0x4e701c], 0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.004a7f40
add esp, 8
mov dword [0x4e701c], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d060
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.004bdab0
cmp byte [0x4ed8c0], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x40d209
cmp dword [0x4ea348], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x40d092
call edi
mov dword [0x4ea348], eax
inc dword [0x4ed8bc]
call edi
mov esi, dword [0x4ed8bc]
mov ecx, eax
sub ecx, dword [0x4ea348]
mov edx, dword [0x4e8280]
mov dword [0x4ea344], eax
cmp esi, dword [0x4e8284]
jbe 0x40d187
cmp ecx, edx
jae 0x40d189
push ecx
push esi
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea eax, [esp + 0x1c]
push 0x800
push eax
call fcn.004a1b10
mov dx, word [0x4ea340]
xor eax, eax
add esp, 0x14
xor ecx, ecx
cmp ax, dx
jae 0x40d11a
mov eax, dword [0x4ea330]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x40d112
nop
mov byte [eax + 0x1b], 0
mov eax, dword [eax + 8]
test eax, eax
jne 0x40d100
mov dx, word [0x4ea340]
inc ecx
movzx eax, dx
cmp ecx, eax
jl 0x40d0f0
push 0
push 0
xorps xmm3, xmm3
mov byte [0x4ed8c0], 1
mov edx, 4
mov dword [0x4e701c], 0
lea ecx, [esp + 0x18]
call fcn.004a7f40
add esp, 8
cmp eax, 7
jne 0x40d156
push 0
push 4
mov ecx, 0x4eb958
call fcn.00424170
mov eax, dword [0x4ea344]
mov dword [0x4e701c], 1
mov byte [0x4ed8c0], 0
mov dword [0x4ed8bc], 0
mov dword [0x4ea348], eax
pop edi
pop esi
pop ebx
add esp, 0x1004
ret 4
cmp ecx, edx
jbe 0x40d19a
mov dword [0x4ed8bc], 0
mov dword [0x4ea348], eax
mov esi, dword [esp + 0x1014]
mov al, byte [ebx + 0xf]
push 0
push 0
mov byte [0x4ec436], al
inc byte [esi + 0x16]
mov ecx, dword [esi]
mov edx, ecx
push 0
push 0
push 0x4bfc18
call fcn.0048def0
dec byte [esi + 0x16]
add esp, 0x14
test eax, eax
jne 0x40d1db
mov byte [esi + 0x1b], al
pop edi
pop esi
pop ebx
add esp, 0x1004
ret 4
cmp byte [esi + 0x1b], 0
je 0x40d209
mov byte [esi + 0x1b], 0
call edi
sub eax, dword [esi + 0xc]
cmp eax, 0x3e8
ja 0x40d209
movzx eax, word [ebx + 4]
push 0
push eax
push 0x312
push dword [0x4e97f4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
add esp, 0x1004
ret 4
Function at 0x412ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov bl, byte [ebp + 0xc]
mov bh, cl
or byte [ebp + 8], bl
mov al, bh
dec al
mov dword [esp + 8], edx
push esi
push edi
cmp al, 5
ja 0x412ad5
cmp bh, 3
jne 0x412add
mov al, bh
add al, 0x66
cmp al, 5
ja 0x412ae4
mov byte [esp + 0xf], 1
jmp 0x412ae9
mov byte [esp + 0xf], 0
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
test esi, esi
jle 0x412c1c
mov bl, byte [esp + 0xf]
nop dword [eax + eax]
cmp dword [0x4ec700], 0
jne 0x412b66
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e7024]
sub eax, dword [0x4ec46c]
cmp eax, dword [ecx + 0xd8]
jbe 0x412b6c
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x412b5b
mov edx, 1
mov dword [0x4e701c], 0
or ecx, 0xffffffff
call fcn.00401700
mov dword [0x4e701c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ec46c], eax
mov ecx, dword [0x4e7024]
cmp byte [ebp + 0x18], 0
jne 0x412bc0
mov al, byte [ecx + 0xf6]
test al, al
je 0x412b88
movzx eax, al
mov esi, 0xffc3d44d
sub esi, eax
jmp 0x412b8d
mov esi, 0xffc3d44f
cmp dword [0x4ec700], 0
je 0x412b9d
mov al, byte [0x4ec6f4]
jmp 0x412ba4
xor cl, cl
call fcn.00415950
mov cl, byte [ebp + 8]
mov dl, al
push esi
push 1
push 0
push edi
call fcn.00415220
mov ecx, dword [0x4e7024]
add esp, 0x10
mov esi, dword [ebp + 0x10]
test bl, bl
je 0x412bea
test edi, edi
jne 0x412bea
push dword [ebp + 0x28]
movzx eax, byte [ecx + 0xef]
mov cl, bh
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
push eax
push 1
push dword [ebp + 0x24]
call fcn.00414000
add esp, 0x14
jmp 0x412c0d
movzx eax, byte [ecx + 0xf6]
mov dl, bh
mov ecx, 0xffc3d44d
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push edi
push dword [esp + 0x1c]
call fcn.004130d0
add esp, 0x10
sub esi, 1
mov dword [ebp + 0x10], esi
jne 0x412b00
mov bl, byte [ebp + 0xc]
cmp byte [ebp + 0x18], 0
jne 0x412c58
cmp dword [0x4ec700], 0
je 0x412c32
mov al, byte [0x4ec6f4]
jmp 0x412c39
xor cl, cl
call fcn.00415950
not bl
and bl, al
and bl, 0xcc
je 0x412c58
push 0xffc3d44d
push 0
push 1
push edi
mov dl, bl
xor cl, cl
call fcn.00415220
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412c60
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
mov eax, dword [0x4ec700]
cmp eax, 2
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
sete byte [esp + 0xf]
jne 0x412cac
movzx edx, bx
mov ecx, edx
and ecx, 0xffffff80
je 0x412c8d
mov eax, 0x30
mov word [esp + 0x2c], ax
test ecx, ecx
lea eax, [esp + 0x2c]
lea edi, [esp + 0x2e]
push 0xa
cmovne eax, edi
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov eax, dword [0x4ec700]
add esp, 0xc
test esi, esi
jle 0x412d5e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x412d16
call edi
mov ecx, dword [0x4e7024]
sub eax, dword [0x4ec46c]
cmp eax, dword [ecx + 0xd8]
jbe 0x412d16
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call ebp
test eax, eax
je 0x412d0f
mov edx, 1
mov dword [0x4e701c], 0
or ecx, 0xffffffff
call fcn.00401700
mov dword [0x4e701c], 1
call edi
mov dword [0x4ec46c], eax
cmp byte [esp + 0x13], 0
je 0x412d28
lea ecx, [esp + 0x30]
call fcn.00412d70
jmp 0x412d33
mov dl, byte [esp + 0x54]
mov ecx, ebx
call fcn.00411590
cmp dword [0x4ec700], 2
mov eax, dword [0x4e7024]
jne 0x412d46
mov ecx, dword [eax + 0x60]
jmp 0x412d49
mov ecx, dword [eax + 0x5c]
call fcn.00414e00
sub esi, 1
je 0x412d5d
mov eax, dword [0x4ec700]
jmp 0x412cc1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret