joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d20
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 8
cmp dword [0x4eba58], 1
push esi
mov byte [esp + 7], dl
mov esi, ecx
jne 0x417df0
xor al, al
cmp dword [0x4ea0ec], 0
push ebx
movzx ebx, al
mov eax, 1
cmovne ebx, eax
cmp dword [0x4ea0e8], 0
mov dword [esp + 0xc], ebx
je 0x417d60
or ebx, 2
mov dword [esp + 0xc], ebx
test bl, bl
je 0x417dd6
mov cl, byte [0x4eba4d]
mov dl, al
not cl
and cl, bl
call fcn.0040eeb0
push 0x1c
push dword [0x4ea248]
push dword [0x4eba40]
call dword [sym.imp.USER32.dll_SendInput]
mov al, byte [0x4eba4d]
and al, bl
test al, 1
je 0x417dc8
mov cl, 1
call fcn.00418a00
mov bl, al
xor bl, byte [esp + 0xb]
mov dl, bl
and bl, al
and dl, byte [esp + 0xb]
not dl
and dl, byte [0x4ea0f6]
or dl, bl
mov byte [0x4ea0f6], dl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [esp + 0xc]
mov dword [0x4e9fa4], eax
mov cl, bl
mov dl, 1
pop ebx
pop esi
add esp, 8
jmp fcn.0040eeb0
push 0x1c
push dword [0x4ea248]
push dword [0x4eba40]
call dword [sym.imp.USER32.dll_SendInput]
pop ebx
pop esi
add esp, 8
ret
push 0
push dword [0x4e9edc]
mov dword [0x4eba48], 0
push 0x416180
push 1
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4e9e98], eax
test eax, eax
je 0x417deb
mov byte [0x4ea0e3], 1
nop
mov edx, 1
mov dword [0x4e5998], 0
mov ecx, 0x8000012f
call fcn.004015c0
cmp dword [0x4e9e98], 0
mov dword [0x4e5998], 1
jne 0x417e20
mov eax, dword [0x4e8b48]
mov byte [0x4ea0e3], 0
mov ecx, dword [eax]
mov eax, dword [0x4eba40]
cmp dword [ecx + eax*8 - 8], 0
jne 0x417deb
mov eax, dword [ecx + eax*8 - 4]
mov dword [esi], eax
pop esi
add esp, 8
ret

Function at 0x418050
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [0x4e9ebc]
test edi, edi
je 0x41815a
mov ax, word [esp + 8]
push esi
imul esi, dword [0x4e9ee8], 0xd4
mov byte [esi + edi + 6], cl
mov byte [esi + edi], dl
mov word [esi + edi + 2], ax
mov eax, 0x69
mov word [esi + edi + 4], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [0x4e9ebc]
mov ecx, edx
mov dword [0x4e9ee4], edx
sub ecx, dword [0x4eb9a0]
mov dword [0x4eb9a0], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4dfbe0]
imul ecx, dword [0x4e9ee8], 0xd4
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4dfb3c]
movss dword [ecx + eax + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4e9ebc]
test esi, esi
je 0x418125
cmp esi, dword [0x4e9ee0]
je 0x418110
imul edx, dword [0x4e9ee8], 0xd4
push 0x64
add edx, 0xc
add eax, edx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [0x4e9ee8]
jmp 0x418141
mov edx, dword [0x4e9ee8]
imul ecx, edx, 0xd4
xor edi, edi
mov word [ecx + eax + 0xc], di
jmp 0x418141
mov edx, dword [0x4e9ee8]
imul ecx, edx, 0xd4
mov dword [ecx + eax + 0xc], 0x2f004e
mov dword [ecx + eax + 0x10], 0x41
inc edx
mov dword [0x4e9ee0], esi
xor eax, eax
cmp edx, dword [0x4e59a4]
pop esi
cmovge edx, eax
mov dword [0x4e9ee8], edx
pop edi
ret
Function at 0x4181f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov bl, cl
push edi
movzx ebp, bl
mov edi, edx
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp edi, 1
je 0x41821a
cmp edi, 2
jne 0x4182ee
cmp esi, edi
je 0x4182ee
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x41824a
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.004163d0
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 2
call fcn.004163d0
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4eb0dc]
sete bh
jne 0x41829f
mov edx, 1
mov dword [0x4e5998], 0
or ecx, 0xffffffff
call fcn.004015c0
mov dword [0x4e5998], 1
cmp bl, 0x14
jne 0x4182ee
cmp edi, 2
jne 0x4182ee
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4182ee
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, edi
call fcn.004163d0
add esp, 0x10
test bh, bh
je 0x4182ee
lea edx, [edi - 1]
mov dword [0x4e5998], 0
or ecx, 0xffffffff
call fcn.004015c0
mov dword [0x4e5998], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x418a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4ea0ec], 0
je 0x418a15
test cl, cl
jne 0x418a15
mov al, byte [0x4ea1f8]
pop ecx
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0xa0
call esi
mov bx, ax
shr bx, 0xb
push 0xa1
and bl, 0x10
call esi
mov cl, bl
or cl, 0x20
bt ax, 0xf
movzx edx, cl
movzx ecx, bl
cmovae edx, ecx
push 0xa2
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 1
bt ax, 0xf
movzx ebx, cl
movzx ecx, dl
push 0xa3
cmovae ebx, ecx
call esi
mov cl, bl
or cl, 2
bt ax, 0xf
movzx edx, cl
movzx ecx, bl
cmovae edx, ecx
push 0xa4
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 4
bt ax, 0xf
movzx ebx, cl
movzx ecx, dl
push 0xa5
cmovae ebx, ecx
call esi
mov cl, bl
or cl, 8
bt ax, 0xf
movzx edx, cl
movzx ecx, bl
cmovae edx, ecx
push 0x5b
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 0x40
bt ax, 0xf
movzx ebx, cl
movzx ecx, dl
push 0x5c
cmovae ebx, ecx
call esi
mov cl, bl
or cl, 0x80
bt ax, 0xf
movzx edx, cl
movzx ecx, bl
cmovae edx, ecx
cmp dword [0x4ea0ec], 0
mov dword [esp + 0xc], edx
je 0x418b5b
mov cl, byte [0x4ea1f8]
mov bl, dl
not bl
and bl, cl
je 0x418b5b
mov dl, byte [0x4ea0f6]
mov al, bl
not al
and byte [0x4ea0f7], al
and cl, al
and dl, al
mov byte [0x4ea1f8], cl
mov ecx, 0x4ea0f8
mov byte [0x4ea0f6], dl
call fcn.00418b70
mov ecx, dword [0x4ea208]
mov edx, dword [esp + 0xc]
test ecx, ecx
je 0x418b5b
test byte [ecx + 8], bl
mov eax, 0
cmovne ecx, eax
mov dword [0x4ea208], ecx
pop edi
pop esi
mov al, dl
pop ebx
pop ecx
ret
Function at 0x418f60
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x288
xor eax, eax
push ebp
mov ebp, ecx
nop dword [eax + eax]
mov edx, dword [eax*8 + 0x4eb9e8]
test edx, edx
je 0x418f89
cmp edx, ebp
je 0x419003
inc eax
cmp eax, 0xa
jl 0x418f70
cmp eax, 0xa
mov ecx, 9
push ebx
cmovl ecx, eax
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov dword [esp + 8], eax
test eax, eax
je 0x419073
push esi
push edi
mov ecx, 0x19
lea edi, [esp + 0x18]
mov esi, str.SYSTEMCurrentControlSetControlKeyboard_Layouts_
lea eax, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x419012
push ebx
push ecx
lea eax, [esp + 0x98]
push eax
push str.Layout_File
lea edx, [esp + 0x28]
call fcn.00483990
add esp, 0x10
test eax, eax
je 0x419012
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
jmp 0x419014
mov eax, dword [eax*8 + 0x4eb9ec]
pop ebp
add esp, 0x288
ret
xor esi, esi
mov eax, dword [esp + 0x10]
cmp ebp, eax
je 0x419025
push 0
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
test esi, esi
je 0x419071
push str.KbdLayerDescriptor
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41906a
call eax
mov ebx, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41905f
cmp dword [esp + 0x10], 0
je 0x41905f
mov ebx, dword [ebx + 0x50]
jmp 0x419062
mov ebx, dword [ebx + 0x28]
not ebx
and ebx, 1
add ebx, 3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, dword [esp + 0xc]
mov dword [eax*8 + 0x4eb9ec], ebx
mov dword [eax*8 + 0x4eb9e8], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0x288
ret
Function at 0x419090
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push ebx
push esi
mov al, cl
mov ebx, edx
push edi
mov byte [esp + 0xd], al
xor edi, edi
cmp byte [edi*8 + 0x4e5a24], al
je 0x41920f
inc edi
cmp edi, 0x6b
jl 0x4190a3
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov al, byte [esp + 0xd]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x4191a1
push ebp
push 0x100
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0049daf0
add esp, 0xc
lea eax, [esp + 0x14]
xor ebp, ebp
push esi
push ebp
push 2
push eax
lea eax, [esp + 0x34]
push eax
push ebp
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 2
jne 0x419108
movzx ebp, word [esp + 0x14]
movzx edi, byte [esp + 0x11]
lea eax, [esp + 0x14]
push esi
push 0
push 2
push eax
lea eax, [esp + 0x34]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [esp + 0x20], eax
test eax, eax
jns 0x419146
push esi
push 0
push 2
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test bp, bp
je 0x41918e
push 1
push esi
lea edx, [esp + 0x1a]
mov ecx, ebp
call fcn.00419480
add esp, 8
mov byte [esp + 0x13], al
test al, al
je 0x41918e
mov dl, byte [esp + 0x12]
lea ecx, [esp + 0x24]
call fcn.00418b70
push esi
push 0
push 2
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
movzx eax, byte [esp + 0x27]
push 0
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp dword [esp + 0x20], 0
pop ebp
je 0x41919d
movzx eax, word [esp + 0x10]
jmp 0x4191b1
xor eax, eax
jmp 0x4191b1
push esi
movzx edi, al
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
movzx eax, ax
mov word [ebx], ax
test ax, ax
je 0x4191cb
xor eax, eax
pop edi
mov word [ebx + 2], ax
mov eax, ebx
pop esi
pop ebx
add esp, 0x114
ret
cmp byte [esp + 0x128], 0
je 0x4191fe
cmp byte [esp + 0xd], 0
je 0x4191fe
push edi
push str.vk_02X
push dword [esp + 0x12c]
push ebx
call fcn.00482070
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x114
ret
xor eax, eax
pop edi
mov word [ebx], ax
mov eax, ebx
pop esi
pop ebx
add esp, 0x114
ret
mov esi, dword [esp + 0x124]
dec esi
push esi
push dword [edi*8 + 0x4e5a20]
push ebx
call fcn.004ab924
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2], ax
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x114
ret
Function at 0x419330
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
movzx eax, word [edi]
mov esi, eax
test ax, ax
je 0x41946b
cmp word [edi + 2], 0
jne 0x41935e
push 1
push dword [esp + 0x1c]
mov ecx, eax
call fcn.00419480
add esp, 8
pop edi
pop esi
pop ecx
ret
test eax, 0xffffff80
je 0x419369
xor eax, eax
jmp 0x419372
push eax
call fcn.004a5790
add esp, 4
mov ecx, esi
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, esi
cmove edx, ecx
cmp dx, 0x56
jne 0x4193e6
movzx eax, word [edi + 2]
mov esi, eax
test eax, 0xffffff80
je 0x41939b
xor eax, eax
jmp 0x4193a4
push eax
call fcn.004a5790
add esp, 4
mov ecx, esi
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, esi
cmove edx, ecx
cmp dx, 0x4b
jne 0x4193e6
push ebx
push 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 4]
push eax
call fcn.004a1697
mov ecx, dword [esp + 0x18]
add esp, 0xc
xor ebx, ebx
movzx edx, al
cmp word [ecx], bx
cmove ebx, edx
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
ret
xor esi, esi
nop dword [eax + eax]
push edi
push dword [esi*8 + 0x4e5a20]
call fcn.0049f76e
add esp, 8
test eax, eax
je 0x419460
inc esi
cmp esi, 0x6b
jl 0x4193f0
cmp byte [esp + 0x10], 0
jne 0x41946b
xor edx, edx
mov ecx, edi
call fcn.00419240
movzx edx, ax
test dx, dx
je 0x41946b
mov ecx, edx
mov eax, edx
sub ecx, 0x45
je 0x41945a
sub ecx, 0xf1
je 0x419438
sub ecx, 0xf
jne 0x41943b
movzx eax, dl
test eax, 0x100
je 0x41944a
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
pop edi
pop esi
pop ecx
ret
pop edi
mov al, 0x13
pop esi
pop ecx
ret
mov al, byte [esi*8 + 0x4e5a24]
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret

Function at 0x419480
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, ecx
push edi
mov edi, edx
cmp bx, 0xa
jne 0x419493
pop edi
mov al, 0xd
pop ebx
pop ecx
ret
push ebp
push dword [esp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov edx, eax
mov dword [esp + 0xc], eax
shr edx, 8
cmp dl, 0xff
jne 0x4194ff
cmp al, 0xff
jne 0x4194ff
cmp byte [esp + 0x18], 0
je 0x419508
movzx ebp, bx
test ebp, 0xffffff80
jne 0x419508
push ebp
call fcn.004a5670
add esp, 4
test eax, eax
je 0x419508
push esi
push ebp
call fcn.004a5790
push ebp
mov esi, eax
call fcn.004a5820
add esp, 8
mov cl, bl
test eax, eax
movzx eax, bl
setne dl
and cl, 0xdf
test esi, esi
movzx ecx, cl
pop esi
cmove ecx, eax
mov bl, cl
jmp 0x419503
mov ebx, dword [esp + 0xc]
test dl, 0x38
je 0x41950f
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret
test edi, edi
je 0x41954f
mov al, dl
and al, 6
cmp al, 6
jne 0x419520
or byte [edi], 8
jmp 0x41953e
test dl, 2
je 0x41952f
mov al, byte [edi]
test al, 3
jne 0x41952f
or al, 1
mov byte [edi], al
test dl, 4
je 0x41953e
mov al, byte [edi]
test al, 0xc
jne 0x41953e
or al, 4
mov byte [edi], al
test dl, 1
je 0x41954f
mov cl, byte [edi]
test cl, 0x30
jne 0x41954f
or cl, 0x10
mov byte [edi], cl
pop ebp
pop edi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x419880
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor eax, eax
mov byte [esp + 0xb], cl
mov ebx, edx
push edi
mov edi, dword [esp + 0x18]
mov word [edi], ax
test cl, cl
jne 0x4198ec
test bx, bx
je 0x41998e
movzx ecx, bx
movzx eax, bx
sub ecx, 0x45
je 0x4198e4
sub ecx, 0xf1
je 0x4198be
sub ecx, 0xf
jne 0x4198c1
movzx eax, bl
test eax, 0x100
je 0x4198d0
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov cl, al
mov byte [esp + 0xf], cl
jmp 0x419922
mov cl, 0x13
mov byte [esp + 0xf], cl
jmp 0x419922
test bx, bx
jne 0x419922
cmp cl, 0xd
je 0x419909
mov dl, 1
call fcn.004199a0
mov cl, byte [esp + 0xf]
movzx ebx, ax
test bx, bx
jne 0x419922
xor dl, dl
call fcn.004199a0
mov cl, byte [esp + 0xf]
movzx eax, ax
mov byte [esp + 0xf], cl
mov ebx, eax
test ax, ax
je 0x41996d
cmp cl, 0x9c
jb 0x41992c
cmp cl, 0x9f
jbe 0x41996d
xor eax, eax
nop
cmp word [eax*8 + 0x4e59bc], bx
je 0x419947
inc eax
cmp eax, 0xd
jl 0x419930
xor eax, eax
mov word [edi], ax
jmp 0x419967
push esi
lea esi, [ebp - 1]
push esi
push dword [eax*8 + 0x4e59b8]
push edi
call fcn.004ab924
mov cl, byte [esp + 0x1f]
add esp, 0xc
xor eax, eax
mov word [edi + esi*2], ax
pop esi
cmp word [edi], 0
jne 0x41998e
push 0
push ebp
mov edx, edi
call fcn.00419090
mov ecx, dword [esp + 0x28]
add esp, 8
cmp word [eax], 0
cmovne ecx, edi
pop edi
pop ebp
mov eax, ecx
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4199a0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
movzx esi, cl
mov bl, dl
mov eax, esi
sub eax, 0x13
je 0x419a46
sub eax, 0x19
je 0x419a34
sub eax, 0x64
je 0x419a22
push 4
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
test cx, cx
jne 0x4199d2
pop esi
xor eax, eax
pop ebx
ret
test ecx, 0xe000
je 0x4199e3
movzx ecx, cl
or ecx, 0x100
add esi, 0xfffffff3
cmp esi, 0x94
ja case.0x4199f5.14
movzx eax, byte [esi + 0x419a64]
jmp dword [eax*4 + 0x419a58]
movzx eax, cx
mov ecx, eax
or ecx, 0x100
test bl, bl
pop esi
cmovne eax, ecx
pop ebx
ret
or ecx, 0x100
xor eax, eax
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x145
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
xor eax, eax
mov ecx, 0x137
test bl, bl
movzx ecx, cx
pop esi
cmove eax, ecx
pop ebx
ret
mov ecx, 0x45
xor eax, eax
movzx ecx, cx
test bl, bl
pop esi
cmove eax, ecx
pop ebx
ret
Function at 0x41ba50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4e599c]
push ebx
push esi
push edi
lea eax, [eax + eax*4]
add eax, 0xa
shl eax, 5
push eax
call fcn.0049f88a
add esp, 4
mov dword [0x4e9e88], eax
test eax, eax
jne 0x41ba77
pop edi
pop esi
pop ebx
ret
mov esi, dword [0x4e59a0]
mov edi, eax
inc dword [0x4e9e9c]
mov ecx, 0x28
push 0x404650
push 0x4ef6d80
push 0xe
push dword [0x4e9eac]
rep movsd dword es:[edi], dword [esi]
mov dword [0x4e59a0], eax
mov dword [eax + 0x58], 0
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4eb110], 0
jne 0x41bac3
mov ebx, 1
jmp 0x41bb7c
mov eax, dword [0x4e59a0]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [eax + 0x53], 0
call esi
mov ecx, dword [0x4e59a0]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x44], 0x64
mov byte [0x4eb7dd], 1
call esi
mov ecx, dword [0x4eb07c]
mov dword [0x4eb7f4], eax
cmp ecx, dword [0x4eb080]
jne 0x41bb0b
call fcn.00405d4d
mov ecx, dword [0x4eb07c]
cmp ecx, dword [0x4eb078]
jb 0x41bb20
mov eax, dword [0x4eb750]
mov dword [ecx], eax
mov ecx, dword [0x4eb07c]
add ecx, 0xc
mov dword [0x4eb07c], ecx
push 0
push 0
mov dword [ecx], 0
mov dword [ecx + 4], str.Auto_execute
mov dword [ecx + 8], 0
mov ecx, dword [0x4eb110]
push 1
call fcn.0042a030
mov ecx, dword [0x4eb07c]
mov ebx, eax
sub ecx, 0xc
mov dword [0x4eb07c], ecx
cmp ecx, dword [0x4eb078]
jb 0x41bb75
mov ecx, dword [ecx]
mov dword [0x4eb08c], ecx
mov dword [0x4eb750], ecx
mov byte [0x4eb7dd], 0
mov esi, dword [0x4e59a0]
dec dword [0x4e9e9c]
mov edi, dword [esi + 0x30]
test edi, edi
je 0x41bbc7
cmp dword [edi + 8], 5
jne 0x41bb9d
mov eax, dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x41bbad
push eax
call fcn.0049f86f
add esp, 4
push 0x20
push dword [esi + 0x30]
call fcn.0049be24
mov dword [esi + 0x30], 0
add esp, 8
mov esi, dword [0x4e59a0]
mov ecx, 0x4eb110
mov dword [esi + 0x3c], closesocket
call fcn.0041bc00
mov esi, 1
test al, al
jne 0x41bbf8
test ebx, ebx
mov edx, 6
push 0
cmove edx, esi
mov ecx, 0x4eb110
push edx
call fcn.0041be90
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x424e60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x10008
call fcn.004b8900
push esi
push edi
push dword [esp + 0x1001c]
lea eax, [esp + 0xc]
push dword [esp + 0x1001c]
push 0x4d9c24
push 0x8001
push eax
call fcn.00482070
add esp, 0x14
mov edi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424ee6
test al, 0x10
je 0x424ee6
lea ecx, [edi*2 + 0x204]
call fcn.0047f3f0
mov ecx, eax
test ecx, ecx
je 0x424efe
mov esi, dword [esp + 0x10014]
lea eax, [edi*2 + 2]
push eax
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esi], ecx
call fcn.0049ef90
add esp, 0xc
mov dword [esi + 4], edi
pop edi
pop esi
add esp, 0x10008
ret 0xc
mov eax, dword [esp + 0x10014]
pop edi
pop esi
mov dword [eax], 0x4d1e48
add esp, 0x10008
ret 0xc
call fcn.00430e20
int3
Function at 0x424f10
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
cmp dword [0x4ebacc], 0
mov eax, dword [esp + 0x218]
push ebx
push ebp
push esi
mov byte [eax], 0
mov ebx, ecx
mov eax, dword [esp + 0x228]
push edi
mov dword [esp + 0x18], ebx
mov byte [eax], 0
jne 0x424f9e
push str.Lib_
push dword [ebx + 0x6b0]
push 0x4ebacc
call fcn.00424e60
lea eax, [esp + 0x14]
push eax
push 0
push 0x4000
push 0x4bb840
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor esi, esi
test eax, eax
push str.AutoHotkeyLib_
cmovns esi, dword [esp + 0x18]
push esi
push 0x4ebad4
call fcn.00424e60
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Lib_
push dword [ebx + 0x6c0]
push 0x4ebadc
call fcn.00424e60
mov ebx, dword [esp + 0x224]
mov ebp, dword [esp + 0x220]
test ebx, ebx
jne 0x424fc4
mov ebx, ebp
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x424fb5
sub ebx, ecx
sar ebx, 1
cmp ebx, 0xfd
ja 0x4250d9
mov edx, ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
nop
xor esi, esi
mov ecx, dword [esi*8 + 0x4ebacc]
cmp word [ecx], 0
je 0x42503b
mov eax, dword [esi*8 + 0x4ebad0]
lea edi, [ebx + ebx]
push edi
push edx
lea eax, [ecx + eax*2]
push eax
call fcn.0049ef90
movq xmm0, qword [str..ahk]
add esp, 0xc
movq qword [edi + eax], xmm0
lea ecx, [edi + eax]
mov ax, word [0x4d8254]
mov word [ecx + 8], ax
push dword [esi*8 + 0x4ebacc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425037
test al, 0x10
je 0x425096
mov edx, dword [esp + 0x10]
inc esi
cmp esi, 3
jl 0x424fe2
push 0x5f
push ebp
call fcn.0049d2e2
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4250d9
sub ebx, ebp
sar ebx, 1
cmp ebx, 0xfe
jae 0x4250d9
lea esi, [ebx + ebx]
push esi
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x1c], eax
call fcn.0049ef90
xor eax, eax
add esp, 0xc
mov word [esp + esi + 0x1c], ax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 2
jge 0x4250d9
mov edx, dword [esp + 0x10]
jmp 0x424fe0
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x18]
push 0
push 0
mov byte [eax], 1
mov eax, dword [0x4e59a0]
mov edi, dword [eax + 0x18]
mov dword [eax + 0x18], 0
push dword [esi*8 + 0x4ebacc]
call fcn.0041cab0
test eax, eax
jne 0x4250d1
mov eax, dword [esp + 0x228]
mov byte [eax], 1
mov eax, dword [0x4e59a0]
mov dword [eax + 0x18], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 0x10
Function at 0x431880
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4004
call fcn.004b8900
push ebx
mov ebx, dword [esp + 0x400c]
push ebp
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x431983
mov esi, dword [esp + 0x4024]
test esi, esi
jne 0x4318c3
mov esi, dword [edi + 0x640]
test esi, esi
jne 0x4318c3
mov ecx, dword [edi + 0x278]
movzx eax, word [edi + 0x27c]
jmp 0x4318cb
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
push dword [esp + 0x401c]
movzx eax, ax
push eax
mov eax, dword [0x4ea250]
push dword [eax + ecx*4]
lea eax, [esp + 0x1c]
push str._s___d__:___Warning:__s_n
push 0x2000
push eax
call fcn.00482070
mov ebp, dword [esp + 0x4038]
mov edx, eax
add esp, 0x18
add edx, edx
cmp word [ebp], 0
je 0x431928
mov ecx, edx
mov eax, 0x2000
push ebp
sar ecx, 1
sub eax, ecx
push str._____Specifically:__s_n
push eax
lea eax, [esp + 0x1c]
add eax, edx
push eax
call fcn.00482070
add esp, 0x10
lea eax, [esp + 0x10]
cmp ebx, 3
jne 0x43194d
push 0x4d846c
push 0
push eax
mov ecx, edi
call fcn.00430120
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4004
ret 0x10
push eax
mov ecx, 0x4eb078
call fcn.00409455
test al, al
jne 0x431967
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebx, 2
jne 0x431983
push 0
push esi
push 1
push ebp
push dword [esp + 0x402c]
mov ecx, 0x4eb110
call fcn.004303b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4004
ret 0x10