joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41996e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x41998c
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x419981
pop esi
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x40481d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40482c
pop dword [ebp - 0x1c]
mov eax, 0x2d45099f
add eax, 0xd2fb3e8d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x4de6354
sub dword [ebp - 0x2c], 0xb68c1e09
mov dword [ebp - 0x28], 0x3248ee6f
sub dword [ebp - 0x28], 0x15a22a
mov dword [ebp - 0x24], 0x63542517
sub dword [ebp - 0x24], 0x1707e0e9
mov dword [ebp - 0x20], 0xca55523d
sub dword [ebp - 0x20], 0xca55523d
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x93808abc
sub eax, 0x933e5a48
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xacad36d2
sub dword [ebp - 0x2c], 0x383acd7c
mov dword [ebp - 0x28], 0x5f7333e0
sub dword [ebp - 0x28], 0x1e06d26b
mov dword [ebp - 0x24], 0x18b2ef97
add dword [ebp - 0x24], 0x4abc7cd5
mov dword [ebp - 0x20], 0xc8ac0b43
add dword [ebp - 0x20], 0x3753f4bd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x393e9
push 0
call eax
mov ecx, 0x2cb37b4d
add ecx, 0xd34cbac5
mov esi, eax
mov edx, 0xb7a435ad
sub edx, 0xb760f1ad
add edx, dword [ebp - 0x1c]
mov ebx, 0x45ab0b4b
xor dword [ebp - 0xc], esi
mov edi, dword [edx]
xor dword [ebp - 0x10], esi
sub edi, ebx
add dword [ebp - 0xc], ecx
mov dword [esi], edi
xor dword [ebp - 0x18], 0xabee6ce6
add esi, 0x957b758e
sub esi, 0x957b758a
add edx, 0xb5102f35
add edx, 0x4aefd0cf
loop 0x404943
add eax, 0xcb1b
xor ebx, ebx
add ebx, eax
add eax, 0xf2eef27d
sub eax, 0xf2eef278
mov ecx, 0xd130dbfa
add ecx, 0x2f0f2406
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4011f0
Capabilities:
Enumerate processes
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x1ac
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push esi
push edi
mov dword [esp + 0x14], 0
xor ebp, ebp
mov dword [esp + 0x18], str.ollydbg.exe
mov dword [esp + 0x1c], str.ProcessHacker.exe
mov dword [esp + 0x20], str.tcpview.exe
mov dword [esp + 0x24], str.autoruns.exe
mov dword [esp + 0x28], str.autorunsc.exe
mov dword [esp + 0x2c], str.filemon.exe
mov dword [esp + 0x30], str.procmon.exe
mov dword [esp + 0x34], str.regmon.exe
mov dword [esp + 0x38], str.procexp.exe
mov dword [esp + 0x3c], str.idaq.exe
mov dword [esp + 0x40], str.idaq64.exe
mov dword [esp + 0x44], str.ImmunityDebugger.exe
mov dword [esp + 0x48], str.Wireshark.exe
mov dword [esp + 0x4c], str.dumpcap.exe
mov dword [esp + 0x50], str.HookExplorer.exe
mov dword [esp + 0x54], str.ImportREC.exe
mov dword [esp + 0x58], str.PETools.exe
mov dword [esp + 0x5c], str.LordPE.exe
mov dword [esp + 0x60], str.SysInspector.exe
mov dword [esp + 0x64], str.proc_analyzer.exe
mov dword [esp + 0x68], str.sysAnalyzer.exe
mov dword [esp + 0x6c], str.sniff_hit.exe
mov dword [esp + 0x70], str.windbg.exe
mov dword [esp + 0x74], str.joeboxcontrol.exe
mov dword [esp + 0x78], str.joeboxserver.exe
mov dword [esp + 0x7c], str.ida.exe
mov dword [esp + 0x80], str.cheatengine_x86_64.exe
mov dword [esp + 0x84], str.x32dbg.exe
mov dword [esp + 0x88], str.x64dbg.exe
mov dword [esp + 0x8c], str.HxD.exe
jmp 0x401310
mov edi, dword [esp + ebp*4 + 0x18]
lea eax, [esp + 0x90]
push 0x128
push 0
push eax
call fcn.0048fd00
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4013ad
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4013aa
lea eax, [esp + 0xb4]
push edi
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x4013c6
lea eax, [esp + 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x4013aa
lea eax, [esp + 0xb4]
push edi
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x4013c6
lea eax, [esp + 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401382
push esi
call ebx
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, 0x1e
jl 0x401310
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1ac
ret
push esi
call ebx
mov eax, dword [esp + 0x98]
test eax, eax
je 0x4013ad
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4013f4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
push 1
call dword [sym.imp.USER32.dll_BlockInput]
mov eax, 1
mov dword [esp + 0x14], eax
jmp 0x4013b1
Function at 0x4016b0
Capabilities:
Check for trap flag exception

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a74e0
push 0x496378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
pushfd
or word [esp], 0x100
popfd
nop
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401730
Capabilities:
Check os version

Disassembly:
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jne 0x40175b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
xor eax, eax
cmp dword [esp], eax
setne al
pop ecx
ret
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x44]
mov dword [esp], eax
xor eax, eax
cmp dword [esp], eax
setne al
pop ecx
ret

Function at 0x401780
Capabilities:
Check for hardware breakpoints

Disassembly:
push esi
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, 0x2cc
mov ecx, esi
jmp 0x4017a0
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x4017a0
push esi
mov dword [esi], 0x10010
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4017c6
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 4], 0
jne 0x4017e2
cmp dword [esi + 8], 0
jne 0x4017e2
cmp dword [esi + 0xc], 0
jne 0x4017e2
cmp dword [esi + 0x10], 0
jne 0x4017e2
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x4017f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a74f0
push 0x496378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x44], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x40], xmm0
movdqu xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4018d1
mov byte [esi], 0xc3
lea eax, [ebp - 0x1c]
push eax
push 0x140
push dword [ebp - 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4018d1
mov dword [ebp - 4], 0
call esi
mov dword [ebp - 4], 0xffffffff
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc0
push 0x44
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [esp + 0xc], xmm0
call fcn.0048fd00
push 0x60
lea eax, [esp + 0x70]
push 0
push eax
call fcn.0048fd00
add esp, 0x18
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x10002
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push 0xffffffffffffffff
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov esp, ebp
pop ebp
ret
Function at 0x404a60
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4ac1d8]
test al, al
je 0x404a88
inc dword [0x4af098]
add ebx, 0xe8
mov dword [0x4ac1d8], ebx
mov ecx, 0x3a
push esi
mov esi, 0x4aee98
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x404aad
push 0
mov ecx, 0x4b09a0
call fcn.004170e0
cmp dword [0x4af0a8], 0
xorps xmm0, xmm0
movlpd qword [0x4b0fb8], xmm0
je 0x404acc
push 0x4aef88
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 7], 0
jne 0x404b60
cmp byte [ebx + 0xce], 0
jne 0x404b08
xor eax, eax
cmp byte [esp + 0x10], 0x65
sete al
mov byte [ebx + 0xce], al
test al, al
je 0x404b08
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4b0fc4], 0
je 0x404b1a
cmp dword [0x4b0fc0], 0
jne 0x404b23
cmp byte [ebx + 0xce], 0
je 0x404b60
cmp byte [ebx + 0xce], 0
mov byte [ebx + 0xcc], 0
jne 0x404b60
cmp dword [0x4b0fc4], 0
jge 0x404b49
mov dword [ebx + 0xc0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xbc], eax
mov eax, dword [0x4b0fc4]
mov dword [ebx + 0xc0], eax
pop ebx
pop ecx
ret
Function at 0x405a20
Capabilities:
Write clipboard data

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405a44
call fcn.00405d70
test eax, eax
jne 0x405a44
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00405b70
pop esi
pop ecx
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405a8b
cmp dword [esi + 0x18], eax
je 0x405a7a
cmp dword [esi + 8], eax
je 0x405a67
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x49e214
mov ecx, esi
call fcn.00405b70
pop esi
pop ecx
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x405ad9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405b0e
cmp dword [esp + 0x10], 0xd
jne 0x405aad
cmp word [ecx], 0
jmp 0x405ab0
cmp byte [ecx], 0
push eax
sete byte [esp + 0xf]
call edi
cmp byte [esp + 0xb], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
je 0x405b0e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x405b03
cmp dword [esi + 8], 0
je 0x405af0
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
push dword [esi + 4]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405b28
mov dword [esi + 4], 0
jmp 0x405ad9
cmp dword [esi + 0x18], 0
je 0x405b52
cmp dword [esi + 8], 0
je 0x405b3f
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x49e224
mov ecx, esi
call fcn.00405b70
pop edi
pop esi
pop ecx
ret 4

Function at 0x405c60
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
push esi
mov esi, dword [esp + 0x114]
push edi
test esi, esi
je 0x405c79
mov dword [esi], 0
mov edi, dword [esp + 0x114]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x405d59
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.0048616d
add esp, 0xc
test eax, eax
je 0x405d4c
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x405d4c
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x405d4c
lea eax, [esp + 8]
push str.Native
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x405d4c
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x405d4c
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.004855c8
add esp, 8
test eax, eax
je 0x405d42
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.004855c8
add esp, 8
test eax, eax
jne 0x405d5e
test esi, esi
je 0x405d4c
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 8
mov byte [esp + 8], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x108
ret 8
Function at 0x405d70
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 0x18], 0
jne 0x405df5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [0x4af0ac]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x405dee
mov edi, edi
mov eax, dword [0x4ac1e0]
cmp eax, 0xffffffff
je 0x405dbf
test eax, eax
je 0x405e02
call esi
mov ecx, dword [0x4ac1e0]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x405e02
mov edx, 1
mov dword [0x4ac1d0], 0
mov ecx, 0x8000012f
call fcn.004027d0
push dword [0x4af0ac]
mov dword [0x4ac1d0], 1
call edi
test eax, eax
je 0x405da0
mov dword [ebx + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4b11d6], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov bl, dl
push esi
push edi
mov byte [esp + 0x13], bl
mov edi, ecx
je 0x408cc5
mov al, byte [0x4b11d4]
cmp al, 0xa0
je 0x408c87
cmp al, 0x10
jne 0x408cc5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4b11dc]
cmp eax, 0x16
jae 0x408cc5
test ebp, 0x100
je 0x408ca4
xor al, al
jmp 0x408cab
mov cl, bl
call fcn.00408f80
cmp byte [0x4b11d5], 0
jne 0x408d14
xor eax, eax
cmp byte [eax + 0x4b11e0], 0
jne 0x408d29
inc eax
cmp eax, 0x16
jl 0x408cb6
mov dh, byte [esp + 0x1c]
mov dl, byte [0x4af9b3]
mov al, byte [0x4af9d0]
mov byte [0x4b11da], al
mov al, byte [0x4afa60]
movzx esi, bl
mov byte [0x4b11db], al
mov eax, dword [0x4afae0]
mov byte [0x4b11d7], dl
lea ecx, [esi + esi*4]
mov bl, byte [eax + ecx*4 + 8]
test bl, bl
je case.default.0x408e4a
cmp dword [edi + 0x10], 0xffc3d44f
setne bh
test byte [edi + 8], 0x10
je 0x408d5f
xor cl, cl
jmp 0x408d72
mov dh, byte [esp + 0x1c]
test dh, dh
je 0x408d36
test al, al
je 0x408cc9
mov byte [0x4b11bb], 1
jmp 0x408d3a
mov dh, byte [esp + 0x1c]
mov byte [0x4b11bb], 1
jmp 0x408d3a
test al, al
je 0x408cc9
mov al, byte [0x4b11da]
mov dl, byte [0x4b11d7]
mov byte [0x4af9d0], al
mov al, byte [0x4b11db]
mov byte [0x4af9b3], dl
mov byte [0x4afa60], al
jmp 0x408ccf
mov cl, byte [esp + 0x13]
mov dl, dh
call fcn.00408ef0
mov dl, byte [0x4af9b3]
mov cl, al
cmp byte [esp + 0x1c], 0
je 0x408e15
cmp byte [esp + 0x20], 0
jne 0x408d98
mov al, bl
not al
and byte [0x4afac1], al
test bh, bh
je 0x408d98
and byte [0x4afac0], al
test cl, cl
je case.default.0x408e4a
not bl
mov byte [esi + 0x4af9c0], 0
and dl, bl
add esi, 0xffffff60
mov byte [0x4af9b3], dl
cmp esi, 5
ja case.default.0x408e4a
jmp dword [esi*4 + 0x408ebc]
mov al, byte [0x4afa61]
mov byte [0x4af9d0], al
jmp case.default.0x408e4a
mov al, byte [0x4afa60]
mov byte [0x4af9d0], al
jmp case.default.0x408e4a
mov al, byte [0x4afa63]
mov byte [0x4af9d1], al
jmp case.default.0x408e4a
mov al, byte [0x4afa62]
mov byte [0x4af9d1], al
jmp case.default.0x408e4a
mov al, byte [0x4afa65]
mov byte [0x4af9d2], al
jmp case.default.0x408e4a
mov al, byte [0x4afa64]
mov byte [0x4af9d2], al
jmp case.default.0x408e4a
cmp byte [esp + 0x20], 0
jne 0x408e2c
or byte [0x4afac1], bl
test bh, bh
je 0x408e2c
or byte [0x4afac0], bl
test cl, cl
je case.default.0x408e4a
mov byte [esi + 0x4af9c0], 0x80
or dl, bl
add esi, 0xffffff60
mov byte [0x4af9b3], dl
cmp esi, 5
ja case.default.0x408e4a
jmp dword [esi*4 + 0x408ed4]
mov byte [0x4af9d0], 0x80
jmp case.default.0x408e4a
mov byte [0x4af9d1], 0x80
jmp case.default.0x408e4a
mov byte [0x4af9d2], 0x80
test byte [edi + 8], 0x10
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x1c]
pop edi
pop esi
mov word [0x4b11d8], bp
pop ebp
mov byte [0x4b11d4], cl
mov byte [0x4b11d5], al
pop ebx
je 0x408ea2
xor al, al
mov byte [0x4b11d6], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b11dc], eax
pop ecx
ret
mov dl, al
call fcn.00408ef0
mov byte [0x4b11d6], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b11dc], eax
pop ecx
ret
Function at 0x408ef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp cl, 0xa0
je 0x408efa
cmp cl, 0x10
jne 0x408f5e
test dl, dl
jne 0x408f5e
cmp byte [0x4b11bb], dl
je 0x408f29
xor eax, eax
jmp 0x408f10
cmp byte [eax + 0x4b11e0], 0
jne 0x408f29
inc eax
cmp eax, 0x16
jl 0x408f10
mov byte [0x4b11bb], 0
xor al, al
ret
cmp byte [0x4b11d5], 0
je 0x408f5e
test dword [0x4b11d8], 0x100
jne 0x408f5e
mov cl, byte [0x4b11d4]
call fcn.00408f80
test al, al
je 0x408f5e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4b11dc]
cmp eax, 0x16
jb 0x408f26
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b117c], eax
mov dword [0x4b1178], eax
mov al, 1
ret
Function at 0x409f70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x30
push ebx
mov al, dl
mov byte [esp + 0xe], cl
xor dl, dl
mov byte [esp + 0xd], al
cmp dword [0x4af0c8], 0
movzx ebx, dl
mov edx, 1
push ebp
cmovne ebx, edx
cmp dword [0x4af0c4], 0
push esi
push edi
mov dword [esp + 0x1c], ebx
je 0x409faf
or ebx, 2
mov dword [esp + 0x1c], ebx
cmp cl, bl
je 0x40a1c7
test bl, bl
jne 0x409ff8
test al, al
jne 0x409ff8
push 0x4afad8
push 0
push 0
push 0x40a290
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4afaf0], eax
test eax, eax
je 0x40a099
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, byte [esp + 0x19]
mov cl, byte [esp + 0x1a]
mov ebp, dword [sym.imp.USER32.dll_PostThreadMessageA]
xor ebx, ebx
xor esi, esi
movzx edi, cl
test al, al
sete bl
lea ebx, [ebx]
push ebx
push edi
push 0x417
push dword [0x4afad8]
call ebp
test eax, eax
jne 0x40a031
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x40a010
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor al, al
mov byte [esp + 0x1b], al
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov cl, byte [esp + 0x1a]
mov al, byte [esp + 0x19]
test cl, cl
je 0x40a0a6
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x34]
push eax
call ebp
test eax, eax
je 0x40a0db
cmp dword [esp + 0x2c], 0
je 0x40a0b3
mov byte [esp + 0x1b], 1
call fcn.0040a640
test al, al
jne 0x40a0b3
mov al, byte [esp + 0x19]
test al, al
jne 0x40a192
xor cl, cl
mov byte [esp + 0x1a], cl
jmp 0x40a053
call fcn.0040a660
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
je 0x40a0c0
call fcn.0040a640
test al, al
jne 0x40a0db
cmp byte [esp + 0x19], 0
jne 0x40a18a
jmp 0x40a10e
lea eax, [esp + 0x20]
push eax
push dword [0x4afaf0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x40a0f3
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x40a0b3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a04b
push dword [0x4afaf0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4afaf0], 0
call fcn.0040a660
cmp dword [0x4af0c8], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x40a134
test bl, 1
jne 0x40a14f
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4afaf8], eax
jmp 0x40a14f
test bl, 1
je 0x40a14f
push dword [0x4afaf8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4afaf8], 0
cmp dword [0x4af0c4], 0
je 0x40a16f
test bl, 2
jne 0x40a18a
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4afaf4], eax
jmp 0x40a18a
test bl, 2
je 0x40a18a
push dword [0x4afaf4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4afaf4], 0
mov al, byte [esp + 0x1b]
test al, al
je 0x40a1c7
sub esp, 8
mov dword [0x4ac1d0], 0
xorps xmm0, xmm0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
movsd qword [esp], xmm0
push 0
push 0
call fcn.00477510
add esp, 0x10
mov dword [0x4ac1d0], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret