joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d60
Capabilities:
Create process on windows
Delete file
Read file on windows

Disassembly:
sub esp, 0x408
push ebp
push esi
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00403d40
mov eax, dword [0x424744]
mov dword [0x435460], 0
test eax, eax
je 0x403e85
mov edi, dword [esp + 0x418]
lea eax, [esp + 0x114]
push edi
push str._s.t
push eax
call fcn.004179d0
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x114]
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x403dff
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x403e07
push edi
push str.GameSystem_Open_error__s_
jmp 0x403e5e
mov dword [esp + 0x10], 1
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0xc]
push 0
push eax
push 0x10
push 0x433240
push esi
call ebp
test eax, eax
je 0x403e58
push esi
push 0x433240
call fcn.00403600
add esp, 8
test eax, eax
jne 0x403e58
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x1023c
push 0x435474
push esi
call ebp
test eax, eax
jne 0x403ed1
push edi
push str.GameSystem_Read_error__s_
lea edx, [esp + 0x1c]
push edx
call fcn.004179d0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.00414880
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0x408
ret
mov edi, dword [esp + 0x418]
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403e07
push 5
push str.KGT2nd_EDITOR.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
or eax, esi
pop edi
pop esi
pop ebp
add esp, 0x408
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [0x433250]
mov dword [0x435464], 1
test al, al
jne 0x403f02
lea ecx, [esp + 0x214]
push 0x41e958
push ecx
call fcn.004179d0
add esp, 8
jmp 0x403f1c
push 0x433250
lea edx, [esp + 0x218]
push 0x41e970
push edx
call fcn.004179d0
add esp, 0xc
mov eax, dword [0x424744]
test eax, eax
je 0x403f42
lea eax, [esp + 0x214]
lea ecx, [esp + 0x214]
push eax
push str._s__
push ecx
call fcn.004179d0
add esp, 0xc
mov eax, dword [0x4246f8]
lea edx, [esp + 0x214]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
lea ecx, [esp + 0x18]
push 0x41e988
push ecx
call fcn.004179d0
lea edx, [esp + 0x20]
push 0xdfffff
push edx
call fcn.00415190
mov eax, dword [esp + 0x24]
add esp, 0x14
test eax, eax
je 0x403f8e
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x408
ret
Function at 0x40c130
Capabilities:
Accept command line arguments
Inspect section memory permissions
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, dword [0x4cfa00]
mov ecx, dword [eax]
jmp dword [ecx*4 + 0x41ed58]
Function at 0x4153b0
Capabilities:
Get disk information

Disassembly:
push ecx
mov cl, byte [esp + 8]
mov eax, dword [0x41f70c]
lea edx, [esp]
add cl, 0x41
mov dword [esp], eax
push edx
mov byte [esp + 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
pop ecx
ret

Function at 0x415640
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp]
push 0x41f798
push ecx
lea edx, [esp + 8]
push 0x41f7b4
push edx
call fcn.004179d0
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x108
ret

Function at 0x415690
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x424738]
sub esp, 0x128
test eax, eax
push esi
je 0x4156bc
mov eax, dword [0x42473c]
mov esi, dword [sym.imp.WINMM.dll_mciSendCommandA]
push 0
push 0x100
push 0x807
push eax
call esi
jmp 0x415736
lea ecx, [esp + 0x24]
push 0x105
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x24]
push 0x41f798
push edx
lea eax, [esp + 0x2c]
push 0x41f7bc
push eax
call fcn.004179d0
mov ecx, dword [0x4246f8]
mov esi, dword [sym.imp.WINMM.dll_mciSendCommandA]
add esp, 0x10
lea eax, [esp + 4]
lea edx, [esp + 0x24]
mov dword [esp + 4], ecx
push eax
push 0x2200
push 0x803
push 0
mov dword [esp + 0x1c], str.sequencer
mov dword [esp + 0x20], edx
call esi
test eax, eax
je 0x41572c
mov eax, 1
pop esi
add esp, 0x128
ret
mov ecx, dword [esp + 8]
mov dword [0x42473c], ecx
mov ecx, dword [0x42473c]
mov edx, dword [0x4246f8]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
push eax
push 1
push 0x806
push ecx
call esi
test eax, eax
je 0x415789
mov edx, dword [0x42473c]
push 0
push 0
push 0x808
push edx
call esi
mov eax, dword [0x42473c]
push 0
push 0
push 0x804
push eax
call esi
mov eax, 1
pop esi
add esp, 0x128
ret
mov dword [0x424738], 1
xor eax, eax
pop esi
add esp, 0x128
ret

Function at 0x4157a0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
xor eax, eax
push edi
mov al, byte [esi + 0x28]
shr eax, 4
and eax, 1
mov dword [0x424740], eax
call fcn.00415640
call fcn.00415600
lea ecx, [esp + 0x14]
push 0x105
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x14]
push 0x41f798
push edx
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.004179d0
mov edi, dword [esi]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x28]
push 0x40000000
push ecx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call fcn.00415690
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x418fa5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41fbd8
cmp edx, dword [eax]
je 0x418fc7
add eax, 8
inc ecx
cmp eax, 0x41fc68
jl 0x418fb8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41fbd8]
jne 0x4190f5
mov eax, dword [0x42480c]
cmp eax, 1
je 0x4190cf
test eax, eax
jne 0x418ff8
cmp dword [0x41fb24], 1
je 0x4190cf
cmp edx, 0xfc
je 0x4190f5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41902f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00419aa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00419470
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x419072
lea eax, [ebp - 0x1a4]
push eax
call fcn.00419470
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41c794
push edi
call fcn.0041a820
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00419aa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00419ab0
lea eax, [ebp - 0xa0]
push 0x41c774
push eax
call fcn.00419ab0
push dword [esi + 0x41fbdc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00419ab0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041a78e
add esp, 0x2c
pop edi
jmp 0x4190f5
lea eax, [ebp + 8]
lea esi, [esi + 0x41fbdc]
push 0
push eax
push dword [esi]
call fcn.00419470
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404570
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404593
call fcn.00404840
test eax, eax
jne 0x404593
push str.Cant_open_clipboard_for_writing.
call fcn.00404670
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4045cc
cmp dword [esi + 0x18], ebx
je 0x4045be
cmp dword [esi + 8], ebx
je 0x4045b3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c04
call fcn.00404670
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404605
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40462c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40462c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404622
cmp dword [esi + 8], ebx
je 0x404617
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404641
mov dword [esi + 4], ebx
jmp 0x404605
cmp dword [esi + 0x18], ebx
je 0x40465e
cmp dword [esi + 8], ebx
je 0x404653
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c24
call fcn.00404670
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404740
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404750
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40481f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.004902b7
add esp, 0xc
test eax, eax
je 0x404816
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.0048fa69
add esp, 8
test eax, eax
je 0x404816
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.0048fa69
add esp, 8
test eax, eax
je 0x404816
lea edx, [esp]
push str.Native
push edx
call fcn.0048fa69
add esp, 8
test eax, eax
je 0x404816
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.0048fa69
add esp, 8
test eax, eax
je 0x404816
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.0048fa69
add esp, 8
test eax, eax
je 0x40480c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.0048fa69
add esp, 8
test eax, eax
jne 0x404825
test esi, esi
je 0x404816
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x408ca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4ca694], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x408cc4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4ca698], 0
je 0x408cd3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408ee0
test al, al
jne 0x408d16
cmp byte [ebp + 0xc], al
jne 0x408d16
push 0x4c9470
push 0
push 0
push 0x408fd0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4cad90], eax
test eax, eax
je 0x408da7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c9470]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x408d4c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408d26
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x408db3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x408e1a
cmp dword [esp + 0x2c], 0
je 0x408dc2
mov byte [esp + 0x1f], 1
call fcn.004092f0
test al, al
jne 0x408dc2
cmp byte [ebp + 0xc], al
jne 0x408eae
mov byte [ebp + 8], al
jmp 0x408d61
call fcn.00409310
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x408dfe
call fcn.004092f0
test al, al
jne 0x408e1a
cmp byte [ebp + 0xc], 0
jne 0x408ea7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4ca694], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408e52
test byte [esp + 0x1e], 1
jne 0x408e6b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4cad88], eax
jmp 0x408e6b
mov ecx, dword [0x4cad90]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408e32
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x408dc2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408d61
mov edx, dword [0x4cad90]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4cad90], 0
call fcn.00409310
jmp 0x408dd2
test byte [esp + 0x1e], 1
je 0x408e6b
mov eax, dword [0x4cad88]
push eax
call edi
mov dword [0x4cad88], 0
cmp dword [0x4ca698], 0
je 0x408e8d
test byte [esp + 0x1e], 2
jne 0x408ea7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4cad8c], eax
jmp 0x408ea7
test byte [esp + 0x1e], 2
je 0x408ea7
mov ecx, dword [0x4cad8c]
push ecx
call edi
mov dword [0x4cad8c], 0
cmp byte [esp + 0x1f], 0
je 0x408ee0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4c694c], 0
push 0
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.0047af00
add esp, 0x18
mov dword [0x4c694c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a970
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.0049b260
cmp byte [0x4cc200], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
jne 0x40aae2
cmp dword [0x4cadac], 0
jne 0x40a9a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cadac], eax
mov ebx, 1
add dword [0x4cc204], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4cc204]
mov esi, dword [0x4c6960]
mov ecx, eax
sub ecx, dword [0x4cadac]
mov dword [0x4cadb0], eax
cmp edx, dword [0x4c695c]
jbe 0x40a9dc
cmp ecx, esi
jb 0x40aa40
xor ebx, ebx
cmp ecx, esi
jbe 0x40a9f9
mov dword [0x4cc204], 0
mov dword [0x4cadac], eax
test ebx, ebx
jne 0x40aae2
mov esi, dword [esp + 0x1018]
mov cl, byte [esi + 0xf]
push 0
mov byte [0x4cbfe6], cl
mov ecx, dword [ebp]
inc byte [ebp + 0x16]
push 0
push 0x4a38d8
push ecx
xor eax, eax
xor edx, edx
call fcn.0046e480
dec byte [ebp + 0x16]
add esp, 0x10
test eax, eax
jne 0x40aab0
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.00476310
add esp, 0xc
call fcn.00409910
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4cc200], bl
mov dword [0x4c694c], 0
call fcn.0047af00
add esp, 0x18
cmp eax, 7
jne 0x40aa99
push 0
push 5
push 0x4cb520
call fcn.00417940
mov eax, dword [0x4cadb0]
mov dword [0x4c694c], ebx
mov byte [0x4cc200], 0
jmp 0x40a9e2
cmp byte [ebp + 0x1b], 0
je 0x40aae2
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40aae2
movzx edx, word [esi + 4]
mov eax, dword [0x4ca564]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
Function at 0x410610
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
cmp dword [0x4cade4], 2
push ebx
push ebp
push esi
sete bl
push edi
mov esi, ecx
test bl, bl
je 0x410655
movzx eax, ax
lea ecx, [esp + 0x30]
test eax, 0xffffff80
je 0x410643
mov ecx, 0x30
mov word [esp + 0x30], cx
lea ecx, [esp + 0x32]
push 0xa
push ecx
push eax
call fcn.0048f7e5
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x410658
movzx edi, ax
test esi, esi
jle 0x410709
mov ebp, esi
cmp dword [0x4cade4], 0
jne 0x4106c5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4cc01c]
mov edx, dword [0x4c6a44]
cmp eax, dword [edx + 0xd8]
jbe 0x4106c5
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4106be
push 1
push 0xffffffffffffffff
mov dword [0x4c694c], 0
call fcn.004013d0
add esp, 8
mov dword [0x4c694c], 1
call esi
mov dword [0x4cc01c], eax
test bl, bl
je 0x4106d4
lea eax, [esp + 0x30]
call fcn.00410720
jmp 0x4106e1
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0040ecb0
add esp, 4
cmp dword [0x4cade4], 2
jne 0x4106f5
mov edx, dword [0x4c6a44]
mov esi, dword [edx + 0x60]
jmp 0x4106fd
mov eax, dword [0x4c6a44]
mov esi, dword [eax + 0x5c]
call fcn.00412690
dec ebp
jne 0x410662
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x411f20
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x412101
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x412101
mov edx, dword [0x4cade4]
cmp edx, 2
jne 0x411f95
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.004122e0
add esp, 4
call fcn.00412760
cmp byte [esp + 0x24], 0
je 0x412101
mov dword [esi], SysReAllocString
mov dword [ebp], SysStringLen
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x411fea
cmp edx, 1
jne 0x411fd0
cmp dword [0x4c9484], 0x80000000
jne 0x411fbe
push 0x4c9484
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c9484]
add dword [esi], eax
mov ecx, dword [0x4c9488]
add dword [ebp], ecx
jmp 0x41200f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x41200f
mov edx, dword [0x4c6a44]
movzx eax, word [edx + 0xf0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x41200f
push eax
mov edi, ebp
mov ebx, esi
call fcn.00477710
add esp, 4
cmp dword [0x4cade4], 1
jne 0x412028
mov eax, dword [esi]
mov dword [0x4c9484], eax
mov ecx, dword [ebp]
mov dword [0x4c9488], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x4120eb
cmp eax, 0x64
jle 0x412083
mov dword [esp + 0x20], 0x64
jmp 0x412087
test eax, eax
je 0x4120eb
cmp dword [0x4cade4], 1
je 0x4120eb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.00455e40
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.00412110
add esp, 4
call fcn.00412760
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x412540
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 8
cmp dword [0x4cade4], 1
push ebx
jne 0x412607
xor bl, bl
cmp dword [0x4ca694], 0
mov byte [esp + 8], bl
je 0x412566
mov bl, 1
mov byte [esp + 8], bl
cmp dword [0x4ca698], 0
je 0x412576
or bl, 2
mov byte [esp + 8], bl
test bl, bl
je 0x412591
mov al, byte [0x4c9482]
not al
and al, bl
movzx ecx, al
push 1
push ecx
call fcn.00408ca0
add esp, 8
mov edx, dword [0x4c9498]
mov eax, dword [0x4c9494]
push 0x1c
push edx
push eax
call dword [0x4cc1dc]
test bl, bl
je 0x412685
mov cl, byte [0x4c9482]
and cl, bl
test cl, 1
je 0x4125ee
push 1
call fcn.00413130
mov dl, byte [esp + 0x18]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4ca563]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4ca563], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4c92c0], eax
mov edx, dword [esp + 8]
pop ebx
add esp, 8
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.00408ca0
mov eax, dword [0x4ca55c]
push 0
push eax
push 0x4108e0
push 1
mov dword [0x4c948c], 0
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4ca69c], eax
test eax, eax
je 0x412685
mov byte [0x4ca585], 1
push 1
push 0x8000012f
mov dword [0x4c694c], 0
call fcn.004013d0
add esp, 8
cmp dword [0x4ca69c], 0
mov dword [0x4c694c], 1
jne 0x412636
mov eax, dword [0x4c9498]
mov ecx, dword [0x4c9494]
cmp dword [eax + ecx*8 - 8], 0
mov byte [0x4ca585], 0
jne 0x412685
mov ecx, dword [eax + ecx*8 - 4]
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
pop ebx
add esp, 8
ret

Function at 0x412850
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4cad78]
test eax, eax
je 0x412968
mov ecx, dword [0x4cad7c]
imul ecx, ecx, 0xd4
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 6], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov ecx, 0x69
mov word [eax + 2], dx
push esi
mov word [eax + 4], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4cc1cc]
mov dword [0x4cad80], eax
mov dword [esp + 4], edx
fild dword [esp + 4]
jns 0x4128ab
fadd dword [0x4c0d20]
fdiv qword [0x4c0d18]
mov ecx, dword [0x4cad7c]
mov edx, dword [0x4cad78]
mov dword [0x4cc1cc], eax
imul ecx, ecx, 0xd4
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [ecx + edx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x412918
mov eax, dword [0x4cad7c]
imul eax, eax, 0xd4
cmp esi, dword [0x4cad84]
je 0x412909
mov ecx, dword [0x4cad78]
push 0x64
lea edx, [eax + ecx + 0xc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412944
mov edx, dword [0x4cad78]
xor ecx, ecx
mov word [eax + edx + 0xc], cx
jmp 0x412944
mov ecx, dword [0x4cad7c]
mov edx, dword [0x4cad78]
imul ecx, ecx, 0xd4
mov eax, 0x4a5914
lea edx, [ecx + edx + 0xc]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x412935
mov eax, dword [0x4cad7c]
inc eax
mov dword [0x4cad84], esi
mov dword [0x4cad7c], eax
pop esi
cmp eax, dword [0x4c6950]
jl 0x412968
mov dword [0x4cad7c], 0
pop ecx
ret