joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x49f3bc]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x41b64b
mov dl, byte [ebp]
test dl, dl
je 0x41b64b
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x41b69e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41b637
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x41b631
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b650
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x41b670
mov al, byte [edi]
cmp al, 0x20
je 0x41b66b
cmp al, 9
jne 0x41b670
dec edi
cmp edi, ebp
ja 0x41b661
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x41b6a5
cmp byte [esp + 0x30], 0
je 0x41b693
mov ecx, dword [esp + 0x28]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0042cfa0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x41b670
dec edi
jmp 0x41b65d
push esi
push ebp
push ebx
call fcn.00481870
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x429f90
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4a2d9c]
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x49f3a0]
jl 0x429fb9
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov esi, dword [0x4a3434]
cmp byte [esi + 0x17], 0
jne 0x429fc8
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x429fd5
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x429fee
test byte [esi + 0x15], 4
je 0x429fe9
mov eax, esi
call fcn.0042d510
mov eax, dword [esi + 8]
jmp 0x429ffe
cmp al, 2
jne 0x429ff9
call fcn.00401000
jmp 0x429ffe
mov eax, 0x4a453d
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00481870
mov eax, dword [0x49f430]
inc dword [0x4a2d9c]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xa3], 0
mov ecx, 0x3a
mov esi, 0x4a18f0
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x49f430], eax
push edi
mov eax, 0x4a4ca0
mov dword [esi + 0x2c], edi
call fcn.00414fe0
mov dword [0x4a5280], edi
mov dword [0x4a5284], edi
cmp dword [0x4a2dc8], edi
je 0x42a06a
push 0x4a3438
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, 0xffffffff
cmp byte [esi + 0xc6], 0
jne 0x42a085
mov byte [esi + 0xc6], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
cmp dword [0x4a528c], edi
je 0x42a095
cmp dword [0x4a5288], edi
jne 0x42a09e
cmp byte [esi + 0xc6], 0
je 0x42a0d6
cmp byte [esi + 0xc6], 0
mov byte [esi + 0xc4], 0
jne 0x42a0d6
cmp dword [0x4a528c], edi
jge 0x42a0be
mov dword [esi + 0xb8], eax
jmp 0x42a0d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb4], eax
mov edx, dword [0x4a528c]
mov dword [esi + 0xb8], edx
mov eax, dword [0x4a5218]
mov ebp, dword [0x4a521c]
mov ecx, dword [0x4a5250]
mov edx, dword [0x4a5254]
mov edi, eax
mov dword [0x4a521c], eax
mov eax, dword [esp + 0xa4]
mov ebx, ecx
mov dword [esp + 0x14], edx
mov dword [0x4a5254], ecx
mov dword [0x4a5218], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xa0]
push 0
push 0xffffffffffffffff
push 0
push ecx
mov dword [0x4a5294], eax
mov dword [0x4a5290], eax
mov dword [0x4a5250], eax
call fcn.004554c0
mov esi, eax
cmp esi, 1
jne 0x42a14a
mov edx, dword [esp + 0xa0]
push edx
call fcn.004286d0
mov esi, eax
mov eax, dword [0x49f430]
mov ecx, dword [eax + 0xa0]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov dword [0x4a2db8], ecx
mov dword [0x4a5218], edi
mov dword [0x4a5250], ebx
mov dword [0x4a521c], ebp
mov dword [0x4a5254], edx
call fcn.00403160
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x42d3e0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.0048af20
cmp dword [esp + 0x2008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x2018]
mov ebx, ecx
je 0x42d4ff
test ebx, ebx
jne 0x42d418
mov eax, dword [esp + 0x200c]
mov ebx, dword [eax + 0x364]
test ebx, ebx
je 0x42d422
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42d42f
mov ecx, dword [eax + 0x160]
movzx eax, word [eax + 0x164]
mov edx, dword [esp + 0x2014]
mov ecx, dword [ecx*4 + 0x4a2c20]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.0046c360
add esp, 0x10
cmp byte [ebp], 0
lea edi, [esp + eax + 0x10]
je 0x42d47c
push ebp
lea esi, [esp + 0x2014]
push str._____Specifically:__s_n
sub esi, edi
call fcn.0046c360
add esp, 8
mov esi, dword [esp + 0x2018]
cmp esi, 3
jne 0x42d4ab
call fcn.0047f0e2
add eax, 0x20
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00480f3d
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 2
jne 0x42d4fd
test ebx, ebx
jne 0x42d4d0
mov ecx, dword [esp + 0x2014]
mov ebx, dword [ecx + 0x364]
test ebx, ebx
je 0x42d4ef
mov ecx, dword [esp + 0x201c]
push ebp
push 1
push ecx
mov ecx, ebx
call fcn.0042cd00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
mov edx, dword [esp + 0x201c]
push ebp
push edx
call fcn.0042cfa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
Function at 0x42d810
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x42d83f
push 0x64
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42d847
mov byte [esp + 0xa0], 0
push 0x7f
lea edx, [esp + 0x25]
push ebp
push edx
mov byte [esp + 0x2c], 0
call fcn.00487c20
mov esi, dword [0x4a5234]
add esp, 0xc
cmp esi, ebp
je 0x42d88e
cmp byte [esi + 0x11], 0
je 0x42d887
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push 0x496804
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.0046c3a0
add esp, 8
mov esi, dword [esi + 0x14]
cmp esi, ebp
jne 0x42d866
cmp byte [esp + 0x20], 0
je 0x42d8dd
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d8a0
sub eax, edx
cmp eax, 0x7b
jbe 0x42d8ce
mov esi, 0x7f
sub esi, eax
push esi
lea ebx, [esp + eax + 0x24]
push 0x4942a4
push ebx
call fcn.00481870
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x42d8dd
cmp byte [esp + eax + 0x1f], 0x20
lea eax, [esp + eax + 0x20]
jne 0x42d8dd
mov byte [eax - 1], 0
mov edx, dword [0x4a1800]
cmp byte [edx + 0xd0], 0
je 0x42d8fd
cmp byte [0x4a5275], 0
mov dword [esp + 0x14], 1
je 0x42d901
mov dword [esp + 0x14], ebp
mov eax, dword [0x4a2d9c]
mov dword [esp + 0x10], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42da0c
mov dword [esp + 0x10], 0x4927e9
mov dword [esp + 0x18], ebp
cmp dword [0x4a2d64], ebp
mov ebp, 0x493a30
je 0x42d935
mov ebp, 0x493a2c
cmp dword [0x4a2d60], 0
mov esi, 0x493a30
je 0x42d948
mov esi, 0x493a2c
push 1
call fcn.00410da0
mov bl, al
add esp, 4
lea eax, [esp + 0x108]
call fcn.00411130
mov ecx, dword [0x4a2d9c]
mov edx, dword [0x4a2da0]
sub edx, dword [esp + 0x14]
push eax
mov eax, dword [0x4a2d98]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [0x4a523c]
push ecx
mov ecx, dword [0x4a5240]
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push ebp
push esi
lea edx, [esp + 0xcc]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.0046c360
mov esi, dword [esp + 0x50]
add edi, eax
mov eax, esi
sub eax, edi
add esp, 0x34
add eax, 0xfffe
push eax
push edi
call fcn.00408c20
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42d9d0
sub eax, ecx
add edi, eax
cmp dword [0x4a3544], 0
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42d9ee
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, edi
push eax
add esi, 0xfffe
call fcn.0046c360
add esp, 4
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
dec eax
mov dword [esp + 0x18], eax
jmp 0x42d923
Function at 0x433000
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
mov ebx, dword [0x4a2bd0]
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.0046ede0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
call fcn.0043ff20
mov esi, eax
test esi, esi
je 0x4330e5
push 0
push esi
mov byte [esp + 0x17], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x43307c
cmp edi, dword [0x4a4c44]
je 0x43307c
call fcn.00470bf0
test al, al
jne 0x43307c
mov ecx, dword [0x4a4c44]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [esp + 0xf], 0
mov dword [esp + 0x1c], eax
je 0x4330a1
mov edx, dword [0x4a4c44]
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4330e5
lea ecx, [esp + 0x20]
push 0xfc
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x4330e5
lea eax, [esp + 0x10]
push eax
push 0x433180
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [esp + 0x14], 0
jne 0x43312e
mov ecx, dword [0x49f430]
cmp byte [ecx + 0xe0], 0
jne 0x433111
mov edx, dword [0x4a3434]
push edx
or eax, 0xffffffff
mov ecx, 0x493f08
call fcn.004011f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x4927e9
push 0
push 0x493f08
call fcn.0042c9e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esp + 0x18]
push eax
push 0x492830
mov eax, 0x101
lea ecx, [esp + 0x28]
call fcn.0046c3a0
mov ecx, dword [0x4a3434]
add esp, 8
push 1
push 0
push 0xffffffffffffffff
push 0x492860
call fcn.0046ede0
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebx
call fcn.0046ede0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x433200
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
push esi
push edi
push eax
mov eax, dword [ebp + 0x14]
call fcn.0043ff20
mov edi, eax
test edi, edi
je 0x433232
mov esi, dword [ebp + 0xc]
push edi
call fcn.00470700
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x43327b
mov ecx, dword [0x49f430]
cmp byte [ecx + 0xe0], 0
jne 0x43325e
mov edx, dword [0x4a3434]
push edx
or eax, 0xffffffff
mov ecx, 0x493f08
call fcn.004011f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push 0x4927e9
push 0
push 0x493f08
call fcn.0042c9e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
mov byte [esp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test ebx, ebx
je 0x4332b8
cmp ebx, dword [0x4a4c44]
je 0x4332b8
mov esi, edi
call fcn.00470bf0
test al, al
jne 0x4332b8
mov eax, dword [0x4a4c44]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x4332f6
mov ecx, dword [0x4a3434]
push 1
push 0
push 0xffffffffffffffff
push 0x492860
call fcn.0046ede0
mov edx, dword [0x49f430]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x4332f6
push 1
push eax
call fcn.004012a0
add esp, 8
cmp byte [esp + 0x13], 0
je 0x43330c
mov eax, dword [0x4a4c44]
push 0
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434120
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0042e940
mov ebx, eax
test ebx, ebx
jne 0x434153
mov ecx, dword [ebp + 8]
push esi
push eax
push str.Parameter_1_invalid.
call fcn.0042cd00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x43415f
jmp dword [eax*4 + 0x43433c]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x434179
push eax
call fcn.0044f8e0
add esp, 4
jmp 0x43417f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4a3434]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044f8e0
mov ebx, eax
add esp, 4
test ebx, ebx
je case.0x434231.67
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je case.0x434231.67
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4a3434]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4a3434]
push 1
push 0
push 0xffffffffffffffff
push 0x492860
call fcn.0046ede0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx ecx, byte [edi]
push ecx
call fcn.00481113
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x434231.67
movzx edx, byte [eax + 0x43436c]
jmp dword [edx*4 + 0x434350]
mov esi, 0x40
jmp 0x434260
mov esi, 0x4000
jmp 0x434260
mov esi, 0x20
jmp 0x434260
mov esi, 0x8000
jmp 0x434260
mov esi, 0x80
jmp 0x434260
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x434273
push eax
call fcn.0044f8e0
add esp, 4
jmp 0x434279
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je case.0x434231.67
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je case.0x434231.67
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x4341cb
cmp byte [edi], 0
je 0x4342d2
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.00412320
fmul qword [0x49a2b0]
call fcn.0048d110
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x4342e0
mov byte [esp + 0x13], 1
xor edi, edi
lea esp, [esp]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044f8e0
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x4342fd
test esi, esi
jne 0x4341da
jmp 0x434305
test esi, esi
je case.0x434231.67
cmp byte [esp + 0x13], 0
jne 0x434323
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4341da
push 1
push 0x64
call fcn.004012a0
add esp, 8
jmp 0x4342e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434ba0
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a2bd0]
push eax
mov eax, dword [esp + 0x18]
call fcn.0043ff20
mov ebp, eax
test ebp, ebp
je 0x434bc6
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x434bcb
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
mov ecx, edi
call fcn.0046ede0
cmp eax, 1
je 0x434bea
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x434cf3
cmp byte [edi + 0x17], 0
jne 0x434bfd
mov esi, dword [edi + 0xc]
jmp 0x434bff
mov esi, edi
test byte [esi + 0x15], 8
je 0x434c0c
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434c25
test byte [esi + 0x15], 4
je 0x434c20
mov eax, esi
call fcn.0042d510
mov eax, dword [esi + 8]
jmp 0x434c35
cmp al, 2
jne 0x434c30
call fcn.00401000
jmp 0x434c35
mov eax, 0x4a453d
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x434c4b
mov esi, dword [edi + 0xc]
jmp 0x434c4d
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x434c65
test byte [esi + 0x15], 8
je 0x434c60
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x434c6a
mov eax, 0x4a54d0
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x434c77
mov esi, dword [edi + 0xc]
jmp 0x434c79
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x434c91
test byte [esi + 0x15], 8
je 0x434c8c
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x434c96
mov eax, 0x4a54d0
cmp dword [eax], 0
jne 0x434d69
cmp byte [edi + 0x17], 0
jne 0x434caa
mov esi, dword [edi + 0xc]
jmp 0x434cac
mov esi, edi
test byte [esi + 0x15], 8
je 0x434cb9
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434cd8
test byte [esi + 0x15], 4
je 0x434ccd
mov eax, esi
call fcn.0042d510
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x434d69
cmp al, 2
jne 0x434ce9
call fcn.00401000
mov byte [eax], 0
jmp 0x434d69
mov eax, 0x4a453d
mov byte [eax], 0
jmp 0x434d69
cmp byte [edi + 0x17], 0
jne 0x434cfe
mov esi, dword [edi + 0xc]
jmp 0x434d00
mov esi, edi
test byte [esi + 0x15], 8
je 0x434d0d
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x434d26
test byte [esi + 0x15], 4
je 0x434d21
mov eax, esi
call fcn.0042d510
mov eax, dword [esi + 8]
jmp 0x434d36
cmp al, 2
jne 0x434d31
call fcn.00401000
jmp 0x434d36
mov eax, 0x4a453d
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x434d44
mov esi, dword [edi + 0xc]
jmp 0x434d46
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x434d5e
test byte [esi + 0x15], 8
je 0x434d59
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x434d63
mov eax, 0x4a54d0
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x434d72
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x434d97
cmp dword [0x4a4c90], 0
je 0x434d97
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4a4c84
jmp fcn.00403e90
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x438470
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4384ff
mov eax, dword [esp + 0xc]
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push str.InstallDir
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop edi
jne 0x4384ff
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4384ff
dec eax
cmp byte [esp + eax + 0x10], bl
jne 0x4384f1
cmp eax, ebx
je 0x438505
lea ecx, [esp + 0x10]
cmp byte [ecx + eax - 1], bl
jne 0x438505
dec eax
jne 0x4384e6
jmp 0x438505
inc eax
cmp eax, 0x104
jae 0x4384ff
mov byte [esp + eax + 0x10], bl
jmp 0x438505
mov byte [esp + 0x10], bl
xor eax, eax
cmp esi, ebx
je 0x43851b
lea ecx, [esp + 0x10]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x438511
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x43b7a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x4a2bd0]
push ebx
push edi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [esi]
test cl, cl
je 0x43b890
cmp byte [esi + 1], 0
jne 0x43b80f
mov byte [esp + 0x10], cl
cmp cl, 0xa
jne 0x43b7df
mov al, 0xd
jmp 0x43b881
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
jne 0x43b803
cmp cl, 0xff
jne 0x43b803
xor al, al
jmp 0x43b881
and al, 0x38
neg al
sbb al, al
not al
and al, cl
jmp 0x43b881
movzx edi, cl
test edi, 0xffffff80
jne 0x43b82c
push 2
push edi
call fcn.0047ff4e
add esp, 8
test eax, eax
je 0x43b82c
and edi, 0xffffffdf
mov eax, edi
cmp al, 0x56
jne 0x43b850
mov al, byte [esi + 1]
call fcn.00408e70
cmp al, 0x4b
jne 0x43b850
push 0x10
lea eax, [esi + 2]
push 0
push eax
call fcn.00480394
add esp, 0xc
jmp 0x43b881
xor edi, edi
mov eax, dword [edi*8 + 0x4a01a8]
push esi
push eax
call fcn.0047ea31
add esp, 8
test eax, eax
je 0x43b8c1
inc edi
cmp edi, 0x6d
jl 0x43b852
mov eax, esi
call fcn.00411470
movzx ecx, ax
test cx, cx
je 0x43b890
call fcn.00411bd0
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
jne 0x43b908
push 0
lea ebx, [esp + 0x14]
mov eax, esi
call fcn.0044ac10
mov edi, eax
add esp, 4
test edi, edi
jne 0x43b8ce
mov ecx, dword [esp + 0x14]
push 1
push eax
push 0xffffffffffffffff
push 0x4927e9
call fcn.0046ede0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov cl, byte [edi*8 + 0x4a01ac]
mov byte [esp + 0xf], cl
jmp 0x43b885
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
call fcn.0044aeb0
fstp st(0)
mov edi, dword [esp + 0x1c]
add esp, 8
lea eax, [esp + 0x18]
call fcn.0046e810
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
movzx ebx, byte [ecx]
test ebx, 0xffffff80
jne 0x43b928
push 2
push ebx
call fcn.0047ff4e
add esp, 8
test eax, eax
je 0x43b928
and bl, 0xdf
cmp bl, 0x50
je 0x43b93b
xor eax, eax
cmp bl, 0x54
setne al
dec eax
and eax, 2
jmp 0x43b940
mov eax, 1
mov bl, byte [esp + 0xf]
push eax
call fcn.0044ae00
add esp, 4
test al, al
mov eax, 0x497810
jne 0x43b95b
mov eax, 0x497814
mov ecx, dword [esp + 0x14]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0046ede0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43b980
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x4a2bd0]
sub esp, 0x130
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
push 0
mov esi, eax
call fcn.0046ede0
test esi, esi
je 0x43bafb
cmp byte [esi], 0
je 0x43bafb
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00481870
lea eax, [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x134], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b9d6
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
je 0x43b9ff
lea ecx, [eax + 1]
cmp ecx, 0x105
jae 0x43bafb
mov byte [esp + eax + 0x30], 0x5c
mov byte [esp + eax + 0x31], 0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4a5ed0], 1
jne 0x43ba35
or dword [0x4a5ed0], 1
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a5ecc], eax
jmp 0x43ba3a
mov eax, dword [0x4a5ecc]
test eax, eax
je 0x43ba88
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43bafb
cmp byte [ebp + 0xc], 0
je 0x43ba75
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43baca
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43baca
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43bafb
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x14]
jne 0x43bab9
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x4a3434]
push 1
push 0
push 0xffffffffffffffff
push 0x492860
call fcn.0046ede0
mov eax, dword [0x4a2bd0]
push 0x18
push edi
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x49f430]
cmp byte [ecx + 0xe0], 0
jne 0x43bb26
mov edx, dword [0x4a3434]
push edx
or eax, 0xffffffff
mov ecx, 0x493f08
call fcn.004011f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x4927e9
push 0
push 0x493f08
call fcn.0042c9e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8