joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e90
Capabilities:
Set current directory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x5ec]
xor ebx, ebx
mov byte [edi + 0x174], 1
mov word [edi + 0x604], 0
cmp eax, ebx
je 0x41609e
cmp byte [eax], bl
je 0x41609e
cmp dword [0x4ac1f0], ebx
jne 0x415ed7
call fcn.0046f850
mov dword [0x4ac1f0], eax
cmp eax, ebx
je 0x415f23
mov ecx, dword [0x4ac1f4]
cmp dword [ecx + 8], 0x14
jae 0x415ef5
call fcn.0046f850
mov ecx, dword [0x4ac1f4]
mov dword [ecx + 0xc], eax
cmp eax, ebx
je 0x415f23
mov eax, dword [ecx + 4]
add dword [ecx + 8], 0xffffffec
lea edx, [eax + 0x14]
mov dword [0x4ac1f8], eax
mov dword [ecx + 4], edx
cmp eax, ebx
je 0x415f23
mov dword [eax], vtable.Label.0
mov dword [eax + 4], 0x498811
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
jmp 0x415f25
xor eax, eax
mov dword [edi + 0x374], eax
cmp eax, ebx
je 0x41609e
mov ecx, 0x49ae94
cmp byte [0x4aa353], bl
jne 0x415f46
mov ecx, dword [edi + 0x5ec]
push edi
call fcn.004161f0
cmp eax, 1
jne 0x41609e
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bf70
test eax, eax
je 0x41609e
mov eax, dword [edi]
push edi
call fcn.004214f0
test eax, eax
je 0x41609e
mov eax, dword [edi]
mov esi, edi
call fcn.004215b0
cmp dword [edi + 8], ebx
je 0x415f9b
mov ecx, dword [edi]
mov eax, dword [edi + 0xc]
mov dword [eax + 0x14], ecx
mov edx, dword [edi]
mov eax, dword [edi + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [edi + 8]
mov dword [edi], ecx
cmp dword [edi + 0x1c], ebx
jle 0x415fce
mov edx, dword [edi + 0x18]
mov ebp, dword [edx + ebx*4]
cmp byte [ebp + 0x3d], 0
jne 0x415fc6
mov eax, dword [ebp + 0x1c]
push ebp
lea esi, [ebp + 0x28]
push edi
call fcn.0042de40
mov eax, dword [ebp + 0x20]
push ebp
lea esi, [ebp + 0x30]
push edi
call fcn.0042de40
inc ebx
cmp ebx, dword [edi + 0x1c]
jl 0x415fa0
xor ebx, ebx
cmp dword [edi + 0x160], ebx
je 0x415ff7
call fcn.0041f060
test eax, eax
je 0x41609e
mov eax, dword [edi + 0x160]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 0x160], ebx
mov eax, dword [0x4aab34]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [edi + 0x170]
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bf70
test eax, eax
je 0x41609e
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bf70
test eax, eax
je 0x41609e
mov ecx, dword [edi + 0x374]
mov edx, dword [edi + 4]
push ebx
push ebx
mov dword [ecx + 8], edx
mov eax, dword [edi]
push ebx
push eax
mov ecx, edi
call fcn.00421610
test eax, eax
je 0x41609e
mov ecx, dword [edi]
push ecx
push edi
call fcn.00421930
test eax, eax
je 0x41609e
push 3
push ebx
push str.ErrorLevel
mov ecx, edi
call fcn.00420b20
mov dword [0x4aaa2c], eax
cmp eax, ebx
je 0x41609e
push 1
push ebx
push 0xffffffffffffffff
push 0x49889c
push eax
call fcn.00475030
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x10]
call fcn.00412560
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
Function at 0x41bda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x4a6367]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov dword [esp + 0x1e], 0x7b3f2e
mov edi, ebp
test ebp, ebp
je 0x41be0a
mov dl, byte [ebp]
test dl, dl
je 0x41be0a
lea ecx, [ecx]
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x41be5e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41bdf6
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x41bdf0
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41be10
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x41be30
mov al, byte [edi]
cmp al, 0x20
je 0x41be2b
cmp al, 9
jne 0x41be30
dec edi
cmp edi, ebp
ja 0x41be21
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x41be65
cmp byte [esp + 0x30], 0
je 0x41be53
mov ecx, dword [esp + 0x28]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0042d760
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x41be30
dec edi
jmp 0x41be1d
push esi
push ebp
push ebx
call fcn.004880f0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x42a610
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4aa39c]
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x4a6890]
jl 0x42a639
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov esi, dword [0x4aaa2c]
cmp byte [esi + 0x17], 0
jne 0x42a648
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42a655
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42a66e
test byte [esi + 0x15], 4
je 0x42a669
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
jmp 0x42a67e
cmp al, 2
jne 0x42a679
call fcn.00401000
jmp 0x42a67e
mov eax, 0x4abb36
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004880f0
mov eax, dword [0x4a6920]
inc dword [0x4aa39c]
add eax, 0xf0
mov edi, eax
mov byte [esp + 0xa3], 0
mov ecx, 0x3c
mov esi, 0x4a8ed8
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor ebx, ebx
mov dword [0x4a6920], eax
push ebx
mov eax, 0x4ac290
mov dword [esi + 0x2c], ebx
call fcn.00415760
mov dword [0x4ac898], ebx
mov dword [0x4ac89c], ebx
cmp dword [0x4aa3cc], ebx
je 0x42a6ea
push 0x4aaa30
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, 0xffffffff
cmp byte [esi + 0xce], bl
jne 0x42a704
mov byte [esi + 0xce], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x4ac8a4], ebx
je 0x42a71a
cmp dword [0x4ac8a0], ebx
jne 0x42a722
cmp byte [esi + 0xce], bl
je 0x42a754
mov byte [esi + 0xcc], bl
cmp byte [esi + 0xce], bl
jne 0x42a754
cmp dword [0x4ac8a4], ebx
jge 0x42a740
mov dword [esi + 0xc0], eax
jmp 0x42a754
call edi
mov dword [esi + 0xbc], eax
mov edx, dword [0x4ac8a4]
mov dword [esi + 0xc0], edx
mov eax, dword [0x4ac818]
mov ebx, dword [0x4ac81c]
mov ecx, dword [0x4ac870]
mov edx, dword [0x4ac874]
mov ebp, eax
mov dword [0x4ac81c], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [0x4ac874], ecx
mov dword [0x4ac818], eax
call edi
mov esi, dword [esp + 0xa0]
mov ecx, dword [0x4a6920]
mov dword [0x4ac8ac], eax
mov dword [0x4ac8a8], eax
mov dword [0x4ac870], eax
mov dword [0x4ac600], esi
cmp byte [ecx + 0xd9], 0
je 0x42a7ee
mov edx, dword [0x4ac1d0]
mov dword [edx*4 + 0x4abb90], esi
call edi
mov ecx, dword [0x4ac1d0]
mov dword [ecx*4 + 0x4a9b38], eax
inc ecx
mov dword [0x4ac1d0], ecx
cmp ecx, 0x190
jl 0x42a7ee
mov dword [0x4ac1d0], 0
push 0
push 0xffffffffffffffff
push 0
push esi
call fcn.00458cc0
mov esi, eax
cmp esi, 1
jne 0x42a810
mov eax, dword [esp + 0xa0]
push eax
call fcn.00428d50
mov esi, eax
mov ecx, dword [0x4a6920]
mov edx, dword [ecx + 0xa4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0x4aa3bc], edx
lea edx, [esp + 0x18]
push edx
mov dword [0x4ac818], ebp
mov dword [0x4ac870], eax
mov dword [0x4ac81c], ebx
mov dword [0x4ac874], ecx
call fcn.00403650
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x42dbb0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.00491920
cmp dword [esp + 0x2008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x2018]
mov ebx, ecx
je 0x42dccf
test ebx, ebx
jne 0x42dbe8
mov eax, dword [esp + 0x200c]
mov ebx, dword [eax + 0x370]
test ebx, ebx
je 0x42dbf2
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42dbff
mov ecx, dword [eax + 0x16c]
movzx eax, word [eax + 0x170]
mov edx, dword [esp + 0x2014]
mov ecx, dword [ecx*4 + 0x4aa1c8]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.00472310
add esp, 0x10
cmp byte [ebp], 0
lea edi, [esp + eax + 0x10]
je 0x42dc4c
push ebp
lea esi, [esp + 0x2014]
push str._____Specifically:__s_n
sub esi, edi
call fcn.00472310
add esp, 8
mov esi, dword [esp + 0x2018]
cmp esi, 3
jne 0x42dc7b
call fcn.00485817
add eax, 0x20
push eax
lea edx, [esp + 0x14]
push edx
call fcn.004877bf
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 2
jne 0x42dccd
test ebx, ebx
jne 0x42dca0
mov ecx, dword [esp + 0x2014]
mov ebx, dword [ecx + 0x370]
test ebx, ebx
je 0x42dcbf
mov ecx, dword [esp + 0x201c]
push ebp
push 1
push ecx
mov ecx, ebx
call fcn.0042d4b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
mov edx, dword [esp + 0x201c]
push ebp
push edx
call fcn.0042d760
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
Function at 0x42dfe0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x42e00f
push 0x64
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42e017
mov byte [esp + 0xa0], 0
push 0x7f
lea edx, [esp + 0x25]
push ebp
push edx
mov byte [esp + 0x2c], 0
call fcn.0048e620
mov esi, dword [0x4ac854]
add esp, 0xc
cmp esi, ebp
je 0x42e07f
cmp byte [esi + 0x11], 0
je 0x42e078
mov eax, dword [esi]
push eax
call fcn.0046d9e0
add esp, 4
sub eax, ebp
je 0x42e05c
dec eax
je 0x42e055
mov eax, str.Object
jmp 0x42e061
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
jmp 0x42e061
mov edx, dword [esi]
mov eax, dword [edx + 4]
push eax
push 0x49ca28
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.00472350
add esp, 8
mov esi, dword [esi + 0x14]
cmp esi, ebp
jne 0x42e036
cmp byte [esp + 0x20], 0
je 0x42e0cd
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e090
sub eax, edx
cmp eax, 0x7b
jbe 0x42e0be
mov esi, 0x7f
sub esi, eax
push esi
lea ebx, [esp + eax + 0x24]
push 0x49a9f8
push ebx
call fcn.004880f0
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x42e0cd
cmp byte [esp + eax + 0x1f], 0x20
lea eax, [esp + eax + 0x20]
jne 0x42e0cd
mov byte [eax - 1], 0
mov eax, dword [0x4a8de0]
cmp byte [eax + 0xd8], 0
je 0x42e0ec
cmp byte [0x4ac895], 0
mov dword [esp + 0x14], 1
je 0x42e0f0
mov dword [esp + 0x14], ebp
mov eax, dword [0x4aa39c]
mov dword [esp + 0x10], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42e1fc
mov dword [esp + 0x10], 0x498811
mov dword [esp + 0x18], ebp
cmp dword [0x4aa364], ebp
mov ebp, 0x499a20
je 0x42e124
mov ebp, 0x499a1c
cmp dword [0x4aa360], 0
mov esi, 0x499a20
je 0x42e137
mov esi, 0x499a1c
push 1
call fcn.00411480
mov bl, al
add esp, 4
lea eax, [esp + 0x108]
call fcn.00411840
mov ecx, dword [0x4aa398]
mov edx, dword [0x4aa39c]
push eax
mov eax, dword [0x4aa3a0]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [0x4ac85c]
push edx
mov edx, dword [0x4ac860]
lea eax, [esp + 0x38]
push eax
push ecx
push edx
push ebp
push esi
lea eax, [esp + 0xcc]
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.00472310
mov esi, dword [esp + 0x50]
add edi, eax
mov ecx, esi
sub ecx, edi
add esp, 0x34
add ecx, 0xfffe
push ecx
push edi
call fcn.00409130
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42e1c0
sub eax, ecx
add edi, eax
cmp dword [0x4aab3c], 0
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42e1de
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, edi
push eax
add esi, 0xfffe
call fcn.00472310
add esp, 4
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
dec eax
mov dword [esp + 0x18], eax
jmp 0x42e112
Function at 0x434180
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.00441920
mov edi, eax
test edi, edi
je 0x4341ae
mov esi, dword [esp + 0x1c]
push edi
call fcn.00476a40
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4341f9
mov ecx, dword [0x4a6920]
cmp byte [ecx + 0xe8], 0
jne 0x4341dc
mov edx, dword [0x4aaa2c]
push 1
push 0
push 0xffffffffffffffff
push 0x499f00
push edx
call fcn.00475030
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x498811
push 0
push 0x499f00
call fcn.0042d1f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x434231
cmp ebp, dword [0x4ac238]
je 0x434231
mov esi, edi
call fcn.00476f00
test al, al
jne 0x434231
mov eax, dword [0x4ac238]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x43426f
mov edx, dword [0x4aaa2c]
push 1
push 0
push 0xffffffffffffffff
push 0x49889c
push edx
call fcn.00475030
mov eax, dword [0x4a6920]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x43426f
push 1
push eax
call fcn.00401350
add esp, 8
test bl, bl
je 0x434283
mov ecx, dword [0x4ac238]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4350b0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0042f440
mov ebx, eax
test ebx, ebx
jne 0x4350e3
mov ecx, dword [ebp + 8]
push esi
push eax
push str.Parameter_1_invalid.
call fcn.0042d4b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x4350ef
jmp dword [eax*4 + 0x4352e8]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x435109
push eax
call fcn.004527d0
add esp, 4
jmp 0x43510f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4aaa2c]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.004527d0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x435187
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x435187
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4aaa2c]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4aaa2c]
push 1
push 0
push 0xffffffffffffffff
push 0x49889c
push ecx
call fcn.00475030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx edx, byte [edi]
push edx
call fcn.00487995
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x4351c2.67
movzx eax, byte [eax + 0x435318]
jmp dword [eax*4 + 0x4352fc]
mov esi, 0x40
jmp 0x4351f1
mov esi, 0x4000
jmp 0x4351f1
mov esi, 0x20
jmp 0x4351f1
mov esi, 0x8000
jmp 0x4351f1
mov esi, 0x80
jmp 0x4351f1
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x435204
push eax
call fcn.004527d0
add esp, 4
jmp 0x43520a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x435187
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x435187
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x43515b
mov edx, dword [0x4aaa2c]
push 1
push 0
push 0xffffffffffffffff
push 0x49889c
push edx
call fcn.00475030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [edi], 0
je 0x435283
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.00412b70
fmul qword [0x4a0a68]
call fcn.00493b10
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x435290
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
push eax
call fcn.004527d0
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x4352ad
test esi, esi
jne 0x43516a
jmp 0x4352b1
test esi, esi
je case.0x4351c2.67
cmp byte [esp + 0x13], 0
jne 0x4352cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x43516a
push 1
push 0x64
call fcn.00401350
add esp, 8
jmp 0x435290
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435b40
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4aa178]
push eax
mov eax, dword [esp + 0x18]
call fcn.00441920
mov ebp, eax
test ebp, ebp
je 0x435b66
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x435b6b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.00475030
cmp eax, 1
je 0x435b89
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x435c92
cmp byte [edi + 0x17], 0
jne 0x435b9c
mov esi, dword [edi + 0xc]
jmp 0x435b9e
mov esi, edi
test byte [esi + 0x15], 8
je 0x435bab
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435bc4
test byte [esi + 0x15], 4
je 0x435bbf
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
jmp 0x435bd4
cmp al, 2
jne 0x435bcf
call fcn.00401000
jmp 0x435bd4
mov eax, 0x4abb36
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x435bea
mov esi, dword [edi + 0xc]
jmp 0x435bec
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435c04
test byte [esi + 0x15], 8
je 0x435bff
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435c09
mov eax, 0x4acaa0
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x435c16
mov esi, dword [edi + 0xc]
jmp 0x435c18
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435c30
test byte [esi + 0x15], 8
je 0x435c2b
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435c35
mov eax, 0x4acaa0
cmp dword [eax], 0
jne 0x435d08
cmp byte [edi + 0x17], 0
jne 0x435c49
mov esi, dword [edi + 0xc]
jmp 0x435c4b
mov esi, edi
test byte [esi + 0x15], 8
je 0x435c58
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435c77
test byte [esi + 0x15], 4
je 0x435c6c
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x435d08
cmp al, 2
jne 0x435c88
call fcn.00401000
mov byte [eax], 0
jmp 0x435d08
mov eax, 0x4abb36
mov byte [eax], 0
jmp 0x435d08
cmp byte [edi + 0x17], 0
jne 0x435c9d
mov esi, dword [edi + 0xc]
jmp 0x435c9f
mov esi, edi
test byte [esi + 0x15], 8
je 0x435cac
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435cc5
test byte [esi + 0x15], 4
je 0x435cc0
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
jmp 0x435cd5
cmp al, 2
jne 0x435cd0
call fcn.00401000
jmp 0x435cd5
mov eax, 0x4abb36
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435ce3
mov esi, dword [edi + 0xc]
jmp 0x435ce5
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435cfd
test byte [esi + 0x15], 8
je 0x435cf8
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435d02
mov eax, 0x4acaa0
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435d11
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x435d36
cmp dword [0x4ac8fc], 0
je 0x435d36
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4ac8f0
jmp fcn.004043b0
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x436b60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.00491920
push ebp
mov ebp, dword [0x4aa178]
push esi
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 0x7fff
jb 0x436c8a
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push ebp
call fcn.00475030
test eax, eax
jne 0x436bb0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
cmp byte [ebp + 0x17], 0
jne 0x436bbb
mov esi, dword [ebp + 0xc]
jmp 0x436bbd
mov esi, ebp
test byte [esi + 0x15], 8
je 0x436bca
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436be3
test byte [esi + 0x15], 4
je 0x436bde
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
jmp 0x436bf3
cmp al, 2
jne 0x436bee
call fcn.00401000
jmp 0x436bf3
mov eax, 0x4abb36
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x436c45
cmp byte [ebp + 0x17], al
jne 0x436c0a
mov esi, dword [ebp + 0xc]
jmp 0x436c0c
mov esi, ebp
test byte [esi + 0x15], 8
je 0x436c19
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436c32
test byte [esi + 0x15], 4
je 0x436c2d
mov eax, esi
call fcn.0042dce0
mov eax, dword [esi + 8]
jmp 0x436c42
cmp al, 2
jne 0x436c3d
call fcn.00401000
jmp 0x436c42
mov eax, 0x4abb36
mov byte [eax], 0
cmp byte [ebp + 0x17], 0
jne 0x436c50
mov eax, dword [ebp + 0xc]
jmp 0x436c52
mov eax, ebp
cmp byte [eax + 0x17], 2
jne 0x436c77
cmp dword [0x4ac8fc], 0
je 0x436c77
push 1
mov ecx, 0x4ac8f0
call fcn.004043b0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
and byte [eax + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x436c97
mov eax, 0x498811
push 1
push 0
push edi
push eax
push ebp
call fcn.00475030
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
Function at 0x439450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
je 0x439488
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x439503
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push str.InstallDir
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x439480
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x439480
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], bl
jne 0x4394e7
cmp eax, ebx
je 0x439503
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], bl
jne 0x4394e1
dec eax
jne 0x4394d8
mov dword [esp + 0x10], eax
jmp 0x4394ff
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x4394fb
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x439503
mov byte [esp + eax + 0x18], bl
cmp eax, ebx
jne 0x439511
cmp edi, ebx
jne 0x439511
mov edi, 0x100
jmp 0x439464
mov esi, dword [esp + 0x120]
cmp esi, ebx
je 0x43952e
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x439524
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret