joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ad9
Capabilities:
Hide graphical window

Disassembly:
add byte [edi - 1], dl
adc eax, sym.imp.USER32.dll_SetForegroundWindow
push 0xa
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ec
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x51c], 0
jmp 0x403b20
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x41ff1c]
mov eax, dword [ebp - 0x518]
push edx
push 0
push 0x143
push eax
call esi
mov eax, dword [ebp - 0x51c]
add eax, 4
mov dword [ebp - 0x51c], eax
cmp eax, 0x14
jb 0x403b20
push 0
push 0
push 0x41376c
push 0x413270
call fcn.00405344
mov ecx, dword [ebp - 0x518]
add esp, 0xc
push eax
push 0x14e
push ecx
call esi
push 0
push str.ExitOnMouse
push 0x413270
call 0x405367
add esp, 0xc
push eax
push 0x40c
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
push str.UseFSAA
push 0x413270
call 0x405388
add esp, 0xc
push eax
push 0x41b
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0x20
mov byte [ebp - 0x51d], 0
call dword [0x4214f0]
mov dword [0x4214dc], eax
test eax, eax
jne 0x403bd7
mov byte [ebp - 0x51d], 1
push 0x41b
push edi
call ebx
cmp byte [ebp - 0x51d], 0
mov dword [ebp - 0x518], eax
jne 0x403c5a
mov eax, dword [0x4214dc]
mov edx, dword [eax]
push 0
push 2
push 0
push 0x50
push 1
push 0
push eax
mov eax, dword [edx + 0x2c]

Function at 0x404bfc
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov ecx, dword [ebp + 8]
add esp, 0xc
test eax, eax
setne al
mov byte [0x41ff40], al
mov dword [esi + 0xb0c], ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCommandLineA
push eax
mov ecx, esi
call fcn.00406bb0
mov ecx, esi
mov dword [esi + 0xb10], eax
call fcn.004064cd
mov eax, dword [esi + 0xb10]
or eax, dword [eax]
add byte [ebx + 0x537401f8], al
cmp eax, 3
je 0x404c8b
cmp eax, 2
je 0x404c8b
test eax, eax
jne 0x404c84
call fcn.0040667b
test al, al
jne 0x404c84
mov ecx, esi
call 0x408342
test al, al
jne 0x404c84
mov byte [esi + 0xb1a], 1
pop esi
pop ebp
ret 4

Function at 0x404c11
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ebp + 8]
add esp, 0xc
test eax, eax
setne al
mov byte [0x41ff40], al
mov dword [esi + 0xb0c], ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCommandLineA
push eax
mov ecx, esi
call fcn.00406bb0
mov ecx, esi
mov dword [esi + 0xb10], eax
call fcn.004064cd
mov eax, dword [esi + 0xb10]
or eax, dword [eax]
add byte [ebx + 0x537401f8], al
cmp eax, 3
je 0x404c8b
cmp eax, 2
je 0x404c8b
test eax, eax
jne 0x404c84
call fcn.0040667b
test al, al
jne 0x404c84
mov ecx, esi
call 0x408342
test al, al
jne 0x404c84
mov byte [esi + 0xb1a], 1
pop esi
pop ebp
ret 4
Function at 0x404c30
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ebp + 8]
add esp, 0xc
test eax, eax
setne al
mov byte [0x41ff40], al
mov dword [esi + 0xb0c], ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCommandLineA
push eax
mov ecx, esi
call fcn.00406bb0
mov ecx, esi
mov dword [esi + 0xb10], eax
call fcn.004064cd
mov eax, dword [esi + 0xb10]
or eax, dword [eax]
add byte [ebx + 0x537401f8], al
cmp eax, 3
je 0x404c8b
cmp eax, 2
je 0x404c8b
test eax, eax
jne 0x404c84
call fcn.0040667b
test al, al
jne 0x404c84
mov ecx, esi
call 0x408342
test al, al
jne 0x404c84
mov byte [esi + 0xb1a], 1
pop esi
pop ebp
ret 4

Function at 0x404c4f
Capabilities:
Terminate process

Disassembly:
push 0x24
push str.Solar_System___Earth_3D_Screensaver_Error
push str.Solar_System___Earth_3D_Screensaver_requires_DirectX_9.0_or_later._Download_latest_version_of_DirectX_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x404c75
push 0x4138c0
call fcn.004066d2
add esp, 4
push 0
invalid
invalid
invalid
invalid

Function at 0x405e96
Capabilities:
Accept command line arguments

Disassembly:
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.004112ae
test eax, eax
jne 0x405e89
push 0x1c
call fcn.0040b063
pop ecx
call 0x40e7cf
test eax, eax
jne 0x405e9a
push 0x10
call fcn.0040b074
push ecx
add byte [eax], al
pop ecx
call fcn.00411284
mov dword [ebp - 4], esi
call fcn.00411047
test eax, eax
jns 0x405eb3
push 0x1b
call fcn.004108b5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x423418], eax
call fcn.00410fcc
mov dword [0x42161c], eax
call fcn.00410f1b
test eax, eax
jns 0x405ed9
push 8
call fcn.004108db
pop ecx
call fcn.00410cb6
test eax, eax
jns 0x405eea
push 9
call fcn.004108ec
pop ecx
push 1
call fcn.004106d3
pop ecx
cmp eax, esi
je 0x405efd
push eax
call 0x4108ff
pop ecx
call fcn.00410c7b
test byte [ebp - 0x3c], 1
je 0x405f0e
movzx ecx, word [ebp - 0x38]
jmp 0x405f11
push 0xa
pop ecx
push ecx
push eax
push esi
push 0x400000
call fcn.004070be
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x405f2c
push eax
call fcn.004108e5
call fcn.00410916
jmp 0x405f61
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call 0x411405
ret

Function at 0x406c86
Capabilities:
Terminate process

Disassembly:
inc edx
add byte [ecx + 0x42171c3d], cl
add byte [esi - 0x74], ah
adc eax, 0x421748
mov word [0x42173c], cs
mov word [0x421718], ds
mov word [0x421714], es
mov word [0x421710], fs
inc edx
add byte [esi - 0x74], ah
sub eax, 0x42170c

Function at 0x406cce
Capabilities:
Terminate process

Disassembly:
add byte [ebp + 0x44a30845], cl
pop ss
inc edx
add byte [ebx - 0x31f7b], cl
inc edi
add eax, 0x421680
add dword [eax], eax
add dword [eax], eax
push 1
call fcn.00412ab8
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x40b7bc
Capabilities:
Write file on windows

Disassembly:
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x40b7c0
inc eax
cmp eax, 0x1f4
add byte [eax], al
add byte [eax], al
jb 0x40b7a8
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
invalid
call dword [eax - 0x78]
pop ebp
sti

Function at 0x40d1ed
Capabilities:
Write file on windows

Disassembly:
add byte [ecx - 0x3d], bl
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1ae4
call fcn.00412392
mov eax, dword [0x41ff88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
inc ebp
or al, 0x56
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x1acc], eax
mov dword [ebp - 0x1ac8], edi
mov dword [ebp - 0x1ad0], edi
cmp dword [ebp + 0x10], edi
jne 0x40d214
xor eax, eax
jmp 0x419ed6
cmp eax, edi
jne 0x40d237
call 0x413947
mov dword [eax], edi
call 0x41393b
mov dword [eax], 0x16
call 0x4138f4
or eax, 0xffffffff
jmp 0x419ef9
mov eax, esi
sar eax, 5
mov edi, esi
push ebx
lea ebx, [eax*4 + 0x423300]

Function at 0x40d246
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebx]
and edi, 0x1f
shl edi, 6
mov cl, byte [eax + edi + 0x24]
add cl, cl
sar cl, 1
invalid
Function at 0x40d760
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [ebp - 0x1ad4]
and dword [ebp - 0x1ac0], 0
sub ecx, dword [ebp - 0x1acc]
push 2
lea eax, [ebp - 0x6b8]
pop esi
cmp ecx, dword [ebp + 0x10]
jae 0x40d766
mov edx, dword [ebp - 0x1ad4]
movzx edx, word [edx]
add dword [ebp - 0x1ad4], esi
add ecx, esi
cmp edx, 0xa
jne 0x40d74f
push 0xd
pop ebx
mov word [eax], bx
add eax, esi
add dword [ebp - 0x1ac0], esi
add dword [ebp - 0x1ac0], esi
mov word [eax], dx
add eax, esi
cmp dword [ebp - 0x1ac0], 0x6a8
test al, 6
add byte [eax], al
test al, 6
add byte [eax], al
jb 0x40d726
xor esi, esi
push esi
push esi
push 0xd55
lea ecx, [ebp - 0x1410]
push ecx
invalid
lea ecx, [eax - 7]
invalid

Function at 0x40d767
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [ebp - 0x1ad4]
and dword [ebp - 0x1ac0], 0
sub ecx, dword [ebp - 0x1acc]
push 2
lea eax, [ebp - 0x6b8]
pop esi
cmp ecx, dword [ebp + 0x10]
jae 0x40d766
mov edx, dword [ebp - 0x1ad4]
movzx edx, word [edx]
add dword [ebp - 0x1ad4], esi
add ecx, esi
cmp edx, 0xa
jne 0x40d74f
push 0xd
pop ebx
mov word [eax], bx
add eax, esi
add dword [ebp - 0x1ac0], esi
add dword [ebp - 0x1ac0], esi
mov word [eax], dx
add eax, esi
cmp dword [ebp - 0x1ac0], 0x6a8
test al, 6
add byte [eax], al
test al, 6
add byte [eax], al
jb 0x40d726
xor esi, esi
push esi
push esi
push 0xd55
lea ecx, [ebp - 0x1410]
push ecx
invalid
lea ecx, [eax - 7]
invalid

Function at 0x411260
Capabilities:
Read file on windows

Disassembly:
rol dword [edx], 0xf
test ebp, edi
add al, 0
add byte [ecx], bh
pop ebp
or al, 0x74
xor eax, 0x2430448a
add al, al
sar al, 1
mov byte [ebp - 2], al
movsx eax, al
dec eax
push 4
pop ecx
je 0x41129a
dec eax
jne 0x411292
mov eax, edx
not eax
test al, 1
jne 0x4112bb
mov eax, edx
shr eax, 1
mov dword [ebp + 0x10], ecx
cmp eax, ecx
jb 0x4112c9
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
call 0x41d040
mov ebx, eax
pop ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x4112f9
call 0x4179f7
mov dword [eax], 0xc
call 0x417a15
mov dword [eax], 8
push 1
push 0
push 0
push dword [ebp + 8]
call 0x41d76b
mov ecx, dword [edi]
mov dword [esi + ecx + 0x28], eax
add esp, 0x10
mov dword [esi + ecx + 0x2c], edx

Function at 0x411284
Capabilities:
Read file on windows

Disassembly:
mov eax, edx
not eax
test al, 1
je 0x4112a2
and edx, 0xfffffffe
mov dword [ebp + 0x10], edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
jmp 0x411314
call 0x4179d1
mov dword [eax], ebx
call 0x4179c5
mov ecx, dword [edi]
add ecx, esi
test byte [ecx + 4], 0x48
mov eax, ebx
je 0x41139a
mov cl, byte [ecx + 5]
cmp cl, 0xa
je 0x41139a
cmp dword [ebp + 0x10], 0
je 0x41139a
dec dword [ebp + 0x10]
cmp byte [ebp - 2], 0
mov byte [ebx], cl
mov ecx, dword [edi]
lea eax, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [esi + ecx + 5], 0xa
je 0x41139a
invalid

Function at 0x41134b
Capabilities:
Read file on windows

Disassembly:
jp 0x8066219d
stc
or dh, byte [ebp + eax*2 - 0x7d]
jge 0x411368
add byte [edi + edi - 0x78], dh
or byte [ebx + 0x4dff400f], cl
adc byte [eax - 0x38fe0183], al
inc ebp
hlt
Function at 0x403a20
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4aa1d8]
test al, al
je 0x403a48
inc dword [0x4ad0cc]
add ebx, 0xe8
mov dword [0x4aa1d8], ebx
mov ecx, 0x3a
push esi
mov esi, 0x4acec8
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x403a6d
push 0
mov ecx, 0x4ae9b0
call fcn.00415f60
cmp dword [0x4ad0dc], 0
xorps xmm0, xmm0
movlpd qword [0x4aefc8], xmm0
je 0x403a8c
push 0x4acfc0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 7], 0
jne 0x403b20
cmp byte [ebx + 0xce], 0
jne 0x403ac8
xor eax, eax
cmp byte [esp + 0x10], 0x65
sete al
mov byte [ebx + 0xce], al
test al, al
je 0x403ac8
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4aefd4], 0
je 0x403ada
cmp dword [0x4aefd0], 0
jne 0x403ae3
cmp byte [ebx + 0xce], 0
je 0x403b20
cmp byte [ebx + 0xce], 0
mov byte [ebx + 0xcc], 0
jne 0x403b20
cmp dword [0x4aefd4], 0
jge 0x403b09
mov dword [ebx + 0xc0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xbc], eax
mov eax, dword [0x4aefd4]
mov dword [ebx + 0xc0], eax
pop ebx
pop ecx
ret
Function at 0x4048a0
Capabilities:
Write clipboard data

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x4048c4
call fcn.00404bf0
test eax, eax
jne 0x4048c4
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.004049f0
pop esi
pop ecx
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40490b
cmp dword [esi + 0x18], eax
je 0x4048fa
cmp dword [esi + 8], eax
je 0x4048e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x49be3c
mov ecx, esi
call fcn.004049f0
pop esi
pop ecx
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x404959
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40498e
cmp dword [esp + 0x10], 0xd
jne 0x40492d
cmp word [ecx], 0
jmp 0x404930
cmp byte [ecx], 0
push eax
sete byte [esp + 0xf]
call edi
cmp byte [esp + 0xb], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
je 0x40498e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x404983
cmp dword [esi + 8], 0
je 0x404970
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
push dword [esi + 4]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4049a8
mov dword [esi + 4], 0
jmp 0x404959
cmp dword [esi + 0x18], 0
je 0x4049d2
cmp dword [esi + 8], 0
je 0x4049bf
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x49be4c
mov ecx, esi
call fcn.004049f0
pop edi
pop esi
pop ecx
ret 4

Function at 0x404ae0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
push esi
mov esi, dword [esp + 0x114]
push edi
test esi, esi
je 0x404af9
mov dword [esi], 0
mov edi, dword [esp + 0x114]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x404bd9
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.00484c8d
add esp, 0xc
test eax, eax
je 0x404bcc
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.00484212
add esp, 8
test eax, eax
je 0x404bcc
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.00484212
add esp, 8
test eax, eax
je 0x404bcc
lea eax, [esp + 8]
push str.Native
push eax
call fcn.00484212
add esp, 8
test eax, eax
je 0x404bcc
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.00484212
add esp, 8
test eax, eax
je 0x404bcc
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.00484212
add esp, 8
test eax, eax
je 0x404bc2
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.00484212
add esp, 8
test eax, eax
jne 0x404bde
test esi, esi
je 0x404bcc
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 8
mov byte [esp + 8], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x108
ret 8
Function at 0x404bf0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 0x18], 0
jne 0x404c75
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [0x4ad0e0]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x404c6e
mov edi, edi
mov eax, dword [0x4aa1e0]
cmp eax, 0xffffffff
je 0x404c3f
test eax, eax
je 0x404c82
call esi
mov ecx, dword [0x4aa1e0]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x404c82
mov edx, 1
mov dword [0x4aa1d0], 0
mov ecx, 0x8000012f
call fcn.00401790
push dword [0x4ad0e0]
mov dword [0x4aa1d0], 1
call edi
test eax, eax
je 0x404c20
mov dword [ebx + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4af1e6], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov bl, dl
push esi
push edi
mov byte [esp + 0x13], bl
mov edi, ecx
je 0x407b45
mov al, byte [0x4af1e4]
cmp al, 0xa0
je 0x407b07
cmp al, 0x10
jne 0x407b45
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4af1ec]
cmp eax, 0x16
jae 0x407b45
test ebp, 0x100
je 0x407b24
xor al, al
jmp 0x407b2b
mov cl, bl
call fcn.00407e00
cmp byte [0x4af1e5], 0
jne 0x407b94
xor eax, eax
cmp byte [eax + 0x4af1f0], 0
jne 0x407ba9
inc eax
cmp eax, 0x16
jl 0x407b36
mov dh, byte [esp + 0x1c]
mov dl, byte [0x4ad9e7]
mov al, byte [0x4ada08]
mov byte [0x4af1ea], al
mov al, byte [0x4ada98]
movzx esi, bl
mov byte [0x4af1eb], al
mov eax, dword [0x4adb14]
mov byte [0x4af1e7], dl
lea ecx, [esi + esi*4]
mov bl, byte [eax + ecx*4 + 8]
test bl, bl
je case.default.0x407cca
cmp dword [edi + 0x10], 0xffc3d44f
setne bh
test byte [edi + 8], 0x10
je 0x407bdf
xor cl, cl
jmp 0x407bf2
mov dh, byte [esp + 0x1c]
test dh, dh
je 0x407bb6
test al, al
je 0x407b49
mov byte [0x4af1cb], 1
jmp 0x407bba
mov dh, byte [esp + 0x1c]
mov byte [0x4af1cb], 1
jmp 0x407bba
test al, al
je 0x407b49
mov al, byte [0x4af1ea]
mov dl, byte [0x4af1e7]
mov byte [0x4ada08], al
mov al, byte [0x4af1eb]
mov byte [0x4ad9e7], dl
mov byte [0x4ada98], al
jmp 0x407b4f
mov cl, byte [esp + 0x13]
mov dl, dh
call fcn.00407d70
mov dl, byte [0x4ad9e7]
mov cl, al
cmp byte [esp + 0x1c], 0
je 0x407c95
cmp byte [esp + 0x20], 0
jne 0x407c18
mov al, bl
not al
and byte [0x4ad9f5], al
test bh, bh
je 0x407c18
and byte [0x4ad9f4], al
test cl, cl
je case.default.0x407cca
not bl
mov byte [esi + 0x4ad9f8], 0
and dl, bl
add esi, 0xffffff60
mov byte [0x4ad9e7], dl
cmp esi, 5
ja case.default.0x407cca
jmp dword [esi*4 + 0x407d3c]
mov al, byte [0x4ada99]
mov byte [0x4ada08], al
jmp case.default.0x407cca
mov al, byte [0x4ada98]
mov byte [0x4ada08], al
jmp case.default.0x407cca
mov al, byte [0x4ada9b]
mov byte [0x4ada09], al
jmp case.default.0x407cca
mov al, byte [0x4ada9a]
mov byte [0x4ada09], al
jmp case.default.0x407cca
mov al, byte [0x4ada9d]
mov byte [0x4ada0a], al
jmp case.default.0x407cca
mov al, byte [0x4ada9c]
mov byte [0x4ada0a], al
jmp case.default.0x407cca
cmp byte [esp + 0x20], 0
jne 0x407cac
or byte [0x4ad9f5], bl
test bh, bh
je 0x407cac
or byte [0x4ad9f4], bl
test cl, cl
je case.default.0x407cca
mov byte [esi + 0x4ad9f8], 0x80
or dl, bl
add esi, 0xffffff60
mov byte [0x4ad9e7], dl
cmp esi, 5
ja case.default.0x407cca
jmp dword [esi*4 + 0x407d54]
mov byte [0x4ada08], 0x80
jmp case.default.0x407cca
mov byte [0x4ada09], 0x80
jmp case.default.0x407cca
mov byte [0x4ada0a], 0x80
test byte [edi + 8], 0x10
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x1c]
pop edi
pop esi
mov word [0x4af1e8], bp
pop ebp
mov byte [0x4af1e4], cl
mov byte [0x4af1e5], al
pop ebx
je 0x407d22
xor al, al
mov byte [0x4af1e6], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4af1ec], eax
pop ecx
ret
mov dl, al
call fcn.00407d70
mov byte [0x4af1e6], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4af1ec], eax
pop ecx
ret
Function at 0x407d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp cl, 0xa0
je 0x407d7a
cmp cl, 0x10
jne 0x407dde
test dl, dl
jne 0x407dde
cmp byte [0x4af1cb], dl
je 0x407da9
xor eax, eax
jmp 0x407d90
cmp byte [eax + 0x4af1f0], 0
jne 0x407da9
inc eax
cmp eax, 0x16
jl 0x407d90
mov byte [0x4af1cb], 0
xor al, al
ret
cmp byte [0x4af1e5], 0
je 0x407dde
test dword [0x4af1e8], 0x100
jne 0x407dde
mov cl, byte [0x4af1e4]
call fcn.00407e00
test al, al
je 0x407dde
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4af1ec]
cmp eax, 0x16
jb 0x407da6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4af18c], eax
mov dword [0x4af188], eax
mov al, 1
ret
Function at 0x408df0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x30
push ebx
mov al, dl
mov byte [esp + 0xe], cl
xor dl, dl
mov byte [esp + 0xd], al
cmp dword [0x4ad0fc], 0
movzx ebx, dl
mov edx, 1
push ebp
cmovne ebx, edx
cmp dword [0x4ad0f8], 0
push esi
push edi
mov dword [esp + 0x1c], ebx
je 0x408e2f
or ebx, 2
mov dword [esp + 0x1c], ebx
cmp cl, bl
je 0x409047
test bl, bl
jne 0x408e78
test al, al
jne 0x408e78
push 0x4adb0c
push 0
push 0
push 0x409110
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4adb24], eax
test eax, eax
je 0x408f19
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, byte [esp + 0x19]
mov cl, byte [esp + 0x1a]
mov ebp, dword [sym.imp.USER32.dll_PostThreadMessageA]
xor ebx, ebx
xor esi, esi
movzx edi, cl
test al, al
sete bl
lea ebx, [ebx]
push ebx
push edi
push 0x417
push dword [0x4adb0c]
call ebp
test eax, eax
jne 0x408eb1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408e90
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor al, al
mov byte [esp + 0x1b], al
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov cl, byte [esp + 0x1a]
mov al, byte [esp + 0x19]
test cl, cl
je 0x408f26
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x34]
push eax
call ebp
test eax, eax
je 0x408f5b
cmp dword [esp + 0x2c], 0
je 0x408f33
mov byte [esp + 0x1b], 1
call fcn.004094c0
test al, al
jne 0x408f33
mov al, byte [esp + 0x19]
test al, al
jne 0x409012
xor cl, cl
mov byte [esp + 0x1a], cl
jmp 0x408ed3
call fcn.004094e0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
je 0x408f40
call fcn.004094c0
test al, al
jne 0x408f5b
cmp byte [esp + 0x19], 0
jne 0x40900a
jmp 0x408f8e
lea eax, [esp + 0x20]
push eax
push dword [0x4adb24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408f73
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x408f33
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408ecb
push dword [0x4adb24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4adb24], 0
call fcn.004094e0
cmp dword [0x4ad0fc], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x408fb4
test bl, 1
jne 0x408fcf
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4adb2c], eax
jmp 0x408fcf
test bl, 1
je 0x408fcf
push dword [0x4adb2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4adb2c], 0
cmp dword [0x4ad0f8], 0
je 0x408fef
test bl, 2
jne 0x40900a
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4adb28], eax
jmp 0x40900a
test bl, 2
je 0x40900a
push dword [0x4adb28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4adb28], 0
mov al, byte [esp + 0x1b]
test al, al
je 0x409047
sub esp, 8
mov dword [0x4aa1d0], 0
xorps xmm0, xmm0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
movsd qword [esp], xmm0
push 0
push 0
call fcn.00476030
add esp, 0x10
mov dword [0x4aa1d0], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret