joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c27d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x461f88
cmp edx, dword [eax]
je 0x43c29f
add eax, 8
inc ecx
cmp eax, str.__t__r_
jl 0x43c290
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x461f88]
jne 0x43c3cd
mov eax, dword [0x4650f8]
cmp eax, 1
je 0x43c3a7
test eax, eax
jne 0x43c2d0
cmp dword [0x461dd4], 1
je 0x43c3a7
cmp edx, 0xfc
je 0x43c3cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43c307
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043fa50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043b880
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43c34a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043b880
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x451cec
push edi
call fcn.00438a90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043fa50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043fa60
lea eax, [ebp - 0xa0]
push 0x449cb4
push eax
call fcn.0043fa60
push dword [esi + 0x461f8c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043fa60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004408db
add esp, 0x2c
pop edi
jmp 0x43c3cd
lea eax, [ebp + 8]
lea esi, [esi + 0x461f8c]
push 0
push eax
push dword [esi]
call fcn.0043b880
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x43fa09
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43fa29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043f38e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x43fa4a
test byte [esp + 8], 2
je 0x43fa4a
mov dword [0x4650a4], 0xd
mov dword [0x4650a8], 5
jmp 0x43fa25
xor eax, eax
ret
Function at 0x404f80
Capabilities:
Set current directory

Disassembly:
push ecx
cmp byte [esp + 8], 0
mov eax, ecx
push ebx
mov ebx, dword [0x4f90f4]
mov ecx, 0x42
push esi
push edi
mov byte [esp + 0xf], dl
mov esi, 0x4fb8c8
je 0x404fc8
inc dword [0x4fb9e8]
add ebx, 0x108
mov edi, ebx
mov dword [0x4f90f4], ebx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4fdb90
mov dword [ebx + 0x2c], eax
call fcn.0042ebc0
jmp 0x404fcf
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], eax
cmp dword [0x4fb9fc], 0
xorps xmm0, xmm0
movlpd qword [0x4fe698], xmm0
je 0x404fff
mov eax, dword [0x4fab58]
mov ecx, 0x4cfc30
test eax, eax
je 0x404ff8
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0xf], 0
jne 0x405084
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x405034
cmp byte [esp + 0x18], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x405034
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4fe6a4], 0
je 0x405046
cmp dword [0x4fe6a0], 0
jne 0x40504a
test cl, cl
je 0x405084
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x405084
cmp dword [0x4fe6a4], 0
jge 0x40506d
pop edi
pop esi
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4fe6a4]
mov dword [ebx + 0xe0], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x406b50
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x18], 0
jne 0x406bd4
call fcn.00406e50
test eax, eax
jne 0x406bd4
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [esi + 0x18], eax
je 0x406b91
cmp dword [esi + 8], eax
je 0x406b7e
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
cmp dword [esi + 0xc], 0
je 0x406baa
push dword [esi + 4]
call edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406bbb
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
push 0x4cfc30
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4fdb90
call fcn.0044e970
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x406c4f
cmp dword [esi + 0x18], eax
je 0x406c0c
cmp dword [esi + 8], eax
je 0x406bf9
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
cmp dword [esi + 0xc], 0
je 0x406c25
push dword [esi + 4]
call edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406c36
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
push 0x4cfc30
push 0x4d0294
mov ecx, 0x4fdb90
call fcn.0044e970
pop edi
pop esi
ret 4
mov eax, dword [esi + 4]
test eax, eax
je 0x406c8a
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x406c78
cmp word [ecx], 0
push eax
sete bl
call edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 4]
test bl, bl
pop ebx
push eax
je 0x406cbe
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x406cb4
cmp dword [esi + 8], 0
je 0x406ca1
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x406cd3
mov dword [esi + 4], 0
jmp 0x406c8a
cmp dword [esi + 0x18], 0
je 0x406cfd
cmp dword [esi + 8], 0
je 0x406cea
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
cmp dword [esi + 0xc], 0
je 0x406d16
push dword [esi + 4]
call edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406d27
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
push 0x4cfc30
push 0x4d02b4
mov ecx, 0x4fdb90
call fcn.0044e970
pop edi
pop esi
ret 4
Function at 0x406d40
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
je 0x406d5a
mov dword [esi], 0
mov ebx, dword [esp + 0x21c]
lea eax, [ebx - 0xc000]
cmp eax, 0x3fff
ja 0x406e30
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0x10]
push str.Link_Source
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x406e22
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0xc]
push str.ObjectLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406e22
lea eax, [esp + 0xc]
push str.OwnerLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406e22
lea eax, [esp + 0xc]
push str.Native
push eax
call edi
add esp, 8
test eax, eax
je 0x406e22
lea eax, [esp + 0xc]
push str.Embed_Source
push eax
call edi
add esp, 8
test eax, eax
je 0x406e22
lea eax, [esp + 0xc]
push str.MSDEVColumnSelect
push eax
call edi
add esp, 8
test eax, eax
je 0x406e18
lea eax, [esp + 0xc]
push str.MSDEVLineSelect
push eax
call edi
add esp, 8
test eax, eax
jne 0x406e37
test esi, esi
je 0x406e22
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 0xc], ax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x406e50
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, ecx
cmp dword [ebp + 0x18], 0
je 0x406e60
mov eax, 1
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4fba00]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
test eax, eax
jne 0x406ece
nop
mov eax, dword [0x4f9100]
cmp eax, 0xffffffff
je 0x406e9f
test eax, eax
je 0x406edf
call esi
mov ecx, dword [0x4f9100]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x406edf
mov edx, 1
mov dword [0x4f90ec], 0
mov ecx, 0x8000012f
call fcn.004018d0
push dword [0x4fba00]
mov dword [0x4f90ec], 1
call edi
test eax, eax
je 0x406e80
pop edi
pop esi
pop ebx
mov dword [ebp + 0x18], 1
mov eax, 1
pop ebp
ret
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
Function at 0x406ff0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x81c
push ebx
push ebp
push esi
push edi
push 0x400
lea eax, [esp + 0x29]
mov dword [esp + 0x1c], edx
mov ebx, ecx
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x30], 0
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [esp + 0x439]
mov byte [esp + 0x438], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebx
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x28
mov eax, dword [esp + 0x83c]
mov edi, eax
push ebx
mov byte [ebp], 0
mov dword [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4071d1
cmp word [ebx + 8], 2
jne 0x4070cf
cmp word [ebx + 0xa], 4
jne 0x4070cf
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4070cf
nop dword [eax]
push dword [eax]
mov edx, dword [esp + 0x834]
push dword [esp + 0x838]
mov ecx, dword [esp + 0x20]
call fcn.00406f70
mov dword [edi], eax
test eax, eax
je 0x4071bd
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x4070a0
push 0x400
push dword [ebx]
push 0x401
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [esp + 0x84c]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x40716c
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4070f7
sub ecx, edx
je case.0x4071e1.11003
mov ebx, dword [esp + 0x14]
mov eax, ebp
mov ecx, ebx
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x407130
test dl, dl
je 0x40712c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x407130
add ecx, 2
add eax, 2
test dl, dl
jne 0x407110
xor eax, eax
jmp 0x407135
sbb eax, eax
or eax, 1
test eax, eax
je case.0x4071e1.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x4071e1.11003
mov eax, ebx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x1c]
mov ebp, eax
jmp 0x407062
mov esi, 0x2afb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
cmp dword [esp + 0x838], esi
je 0x407201
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407180
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x4071aa
push ebp
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [esp + 0x83c]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
cmp dword [eax + 0x14], esi
jne 0x407201
mov esi, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4071e1.11001
jmp dword [eax*4 + 0x407210]
mov esi, 0x2afa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2af9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
Function at 0x4078d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
cmp dword [0x4ffaf0], 0
mov ax, cx
push ebx
push ebp
push esi
push edi
mov word [esp + 0x12], ax
mov dword [esp + 0x14], str.getaddrinfo
mov dword [esp + 0x18], 0x407270
mov dword [esp + 0x1c], str.getnameinfo
mov dword [esp + 0x20], 0x4076e0
mov dword [esp + 0x24], str.freeaddrinfo
mov dword [esp + 0x28], 0x407220
je 0x407930
movzx eax, ax
mov eax, dword [eax*8 + 0x4faf10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
push 0x104
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407a35
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.ws2_32
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x4079ac
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4079f8
push edi
call ebp
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.wship6
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407a35
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x407a32
xor esi, esi
nop word [eax + eax]
push dword [esp + esi*8 + 0x14]
push edi
call ebx
mov dword [esp + esi*8 + 0x18], eax
test eax, eax
je 0x407a32
inc esi
cmp esi, 3
jl 0x407a00
mov eax, dword [esp + 0x18]
mov dword [0x4faf10], eax
mov eax, dword [esp + 0x20]
mov dword [0x4faf18], eax
mov eax, dword [esp + 0x28]
mov dword [0x4faf20], eax
jmp 0x407a35
push edi
call ebp
movzx eax, word [esp + 0x12]
pop edi
pop esi
pop ebp
mov eax, dword [eax*8 + 0x4faf10]
mov dword [0x4ffaf0], 1
pop ebx
add esp, 0x234
ret
Function at 0x40c110
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 4]
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4d10b4
lea esi, [eax + 1]
push esi
call fcn.0040da70
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push 0
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40c1c5
cmp dword [edi + 0x34], 0
jne 0x40c1c5
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x28]
inc eax
push eax
call fcn.0040d140
test eax, eax
jne 0x40c1c5
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 0x28]
mov al, byte [0x4cfc30]
push 0
mov byte [edx + ecx], al
inc dword [edi + 0x30]
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40c1c5
mov dword [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x34], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x4faaf0
call fcn.0040c730
push 0x10014
push dword [0x4fe670]
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push dword [0x4fba00]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40c1fe
push 0
push 4
mov ecx, 0x4fdb90
call fcn.0042f030
pop edi
mov eax, 0x3e6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cef0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
mov dword [esp + 8], ebx
test esi, esi
je 0x40d05f
cmp byte [esp + 0x18], 0
jne 0x40cf38
lea ecx, [esi - 1]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebx + 8]
mov ecx, ebx
shr edx, 1
lea eax, [eax + edx*4]
add eax, 5
push eax
call fcn.0040d140
test eax, eax
je 0x40cf38
pop esi
mov eax, 0x3e6
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40d05e
push ebp
mov ebp, dword [ebx]
xor edx, edx
add ebp, dword [ebx + 8]
mov dword [esp + 0x20], ebp
cmp esi, 0xffffffff
jne 0x40cf69
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40cf60
sub esi, ecx
cmp esi, 2
jbe 0x40cffb
lea ecx, [esi - 3]
mov eax, 0xaaaaaaab
mul ecx
lea ebx, [ebp + 2]
mov ebp, edx
shr ebp, 1
inc ebp
lea edx, [ebp*4]
nop dword [eax + eax]
movzx ecx, byte [edi]
lea ebx, [ebx + 4]
movzx eax, byte [edi + 1]
sub esi, 3
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
add edi, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 6], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 5], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 4], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 3], al
sub ebp, 1
jne 0x40cf90
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x20]
test esi, esi
je 0x40d056
movzx ecx, byte [edi]
shl ecx, 0x10
cmp esi, 1
jbe 0x40d013
movzx eax, byte [edi + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + ebp], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + ebp + 1], al
cmp esi, 1
jbe 0x40d048
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40d04a
mov al, 0x3d
mov byte [edx + ebp + 2], al
mov byte [edx + ebp + 3], 0x3d
add edx, 4
mov byte [edx + ebp], 0
add dword [ebx + 8], edx
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x40d7b0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push 0
push 0
push dword [esp + 0x14]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x40d808
mov edi, dword [esi + 4]
test edi, edi
je 0x40d830
mov eax, dword [edi + 0x10]
add eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x40d7f6
mov eax, dword [edi + 4]
test eax, eax
je 0x40d7eb
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x14
push edi
call fcn.004cc464
add esp, 8
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov byte [esi + 8], 0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.0040dc10
mov ecx, dword [esi + 4]
push edi
call fcn.0040da90
mov eax, dword [esi + 4]
push edi
push dword [eax]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x40e360
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 8
cmp byte [0x4fe688], 0
push ebx
push esi
push edi
je 0x40e409
mov edi, dword fs:[0x24]
cmp dword [0x4fdb70], edi
je 0x40e38e
push dword [0x4fdb74]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, dword [esp + 0x18]
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40e397
sub esi, ecx
sar esi, 1
cmp word [ebx], ax
je 0x40e412
lea eax, [esp + 0xf]
mov ecx, 0x4fdb90
push eax
push 3
lea eax, [esp + 0x18]
push eax
push esi
push ebx
call fcn.004401f0
test eax, eax
jne 0x40e3e4
cmp byte [esp + 0xf], al
mov ecx, 0x4fdb90
setne al
inc eax
push eax
push dword [esp + 0x14]
push esi
push ebx
call fcn.004407c0
test eax, eax
je 0x40e412
push 1
push 0
push 0xffffffffffffffff
push dword [esp + 0x28]
mov ecx, eax
call fcn.004b55f0
cmp dword [0x4fdb70], edi
je 0x40e409
push dword [0x4fdb74]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [0x4fdb70], edi
je 0x40e426
push dword [0x4fdb74]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x414150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
xor al, al
mov bl, cl
cmp dword [0x4fba18], 0
mov ecx, 1
push ebp
movzx eax, al
mov bh, dl
cmovne eax, ecx
mov byte [esp + 0xb], bh
cmp dword [0x4fba14], 0
push esi
push edi
mov dword [esp + 0x14], eax
je 0x41418d
or eax, 2
mov dword [esp + 0x14], eax
cmp bl, al
je 0x41438a
test al, al
jne 0x4141ce
test bh, bh
jne 0x4141ce
push 0x4fc50c
push 0
push 0
push 0x414400
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4fe8b0], eax
test eax, eax
je 0x414286
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx edi, bh
xor esi, esi
xor edi, 1
movzx ebp, bl
nop dword [eax]
push edi
push ebp
push 0x417
push dword [0x4fc50c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x414205
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x4141e0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor bh, bh
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov dh, bl
mov dl, bh
test bl, bl
je 0x414293
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x414271
cmp dword [esp + 0x24], 0
je 0x4142ad
mov bh, 1
call fcn.00414760
test al, al
jne 0x4142ad
cmp byte [esp + 0x13], al
jne 0x41435d
xor bl, bl
lea eax, [esp + 0x18]
push eax
push dword [0x4fe8b0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], 0x103
jne 0x4142ba
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x4142ad
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x414217
call fcn.00414780
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x13], 0
mov bh, dl
mov bl, dh
je 0x414256
call fcn.00414760
test al, al
je 0x414359
jmp 0x414271
cmp byte [esp + 0x13], 0
jne 0x414359
jmp 0x4142d5
push dword [0x4fe8b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fe8b0], 0
call fcn.00414780
mov al, byte [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
and al, 1
cmp dword [0x4fba18], 0
je 0x414300
test al, al
jne 0x41431a
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4fe8a8], eax
jmp 0x41431a
test al, al
je 0x41431a
push dword [0x4fe8a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fe8a8], 0
mov eax, dword [esp + 0x14]
and al, 2
cmp dword [0x4fba14], 0
je 0x41433f
test al, al
jne 0x414359
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4fe8ac], eax
jmp 0x414359
test al, al
je 0x414359
push dword [0x4fe8ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4fe8ac], 0
test bh, bh
je 0x41438a
push 0
push 0
xorps xmm3, xmm3
mov dword [0x4f90ec], 0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.004b75d0
add esp, 8
mov dword [0x4f90ec], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret