joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
xor ebx, ebx
jmp 0x40a9b0
mov ecx, dword [esi + 0x2c]
cmp ebx, ecx
jae 0x40a9cf
mov eax, dword [esi + 0x24]
lea ebx, [ebx]
cmp byte [eax + ebx], 0
je 0x40aa57
inc ebx
cmp ebx, ecx
jb 0x40a9c0
cmp ecx, dword [esi + 0x28]
jne 0x40aa19
mov eax, dword [esi + 0x28]
lea ecx, [eax + eax]
test eax, eax
jne 0x40a9e3
mov ecx, 0x800
cmp dword [esi + 0x30], 0
jne 0x40aa44
mov edi, eax
test eax, eax
jne 0x40a9f4
mov edi, 0x800
cmp edi, ecx
jae 0x40a9fe
add edi, edi
cmp edi, ecx
jb 0x40a9f8
cmp edi, eax
jbe 0x40aa19
mov eax, dword [esi + 0x24]
push edi
push eax
call fcn.0049328d
add esp, 8
test eax, eax
je 0x40aa3d
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [esi + 0x10]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x40aa44
add dword [esi + 0x2c], eax
jmp 0x40a9b0
mov dword [esi + 0x30], 1
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.0040af50
add esp, 4
pop edi
pop ebp
pop ebx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40aa61
mov dword [eax], ebx
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x40aa70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 0x3c]
push 0xa
lea eax, [esp + 0x10]
push eax
add ecx, 0x26
push ecx
call fcn.004928a2
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00494720
push str.__xml_version_1.0__encoding_UTF_8___
lea esi, [eax + 1]
push 0x4a8974
push esi
call fcn.00493c7e
mov edx, dword [ebx + 0x10]
add esp, 0x20
add esi, eax
lea eax, [esp + 0xc]
push 0
sub esi, eax
push esi
mov esi, dword [sym.imp.WSOCK32.dll_send]
mov ecx, eax
push ecx
push edx
call esi
cmp eax, 0xffffffff
je 0x40ab23
cmp dword [ebx + 0x40], 0
lea edi, [ebx + 0x34]
jne 0x40ab23
mov ecx, dword [edi + 8]
inc ecx
call fcn.0040b800
test eax, eax
jne 0x40ab23
mov eax, dword [edi]
add eax, dword [edi + 8]
mov cl, byte [0x4a8978]
mov byte [eax], cl
inc dword [edi + 8]
mov edx, dword [ebx + 0x3c]
mov eax, dword [edi]
mov ecx, dword [ebx + 0x10]
push 0
push edx
push eax
push ecx
call esi
cmp eax, 0xffffffff
je 0x40ab23
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x4bc3d8
call fcn.0040aee0
mov edx, dword [0x4bca60]
mov eax, dword [0x4bb448]
push 0x10014
push edx
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40ab5d
push 0
push 4
mov ecx, 0x4bc460
call fcn.00420790
pop edi
pop esi
mov eax, 0x3e6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40afa0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x40afba
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40afb1
sub eax, ebx
mov ebp, eax
cmp eax, 2
jbe 0x40b036
lea edx, [eax - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edi
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
mov byte [esi + ecx + 2], bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 3], al
add edi, 3
add ecx, 4
sub ebp, 3
dec edx
jne 0x40afd0
test ebp, ebp
je 0x40b0aa
movzx eax, byte [edi]
shl eax, 0x10
cmp ebp, 1
jbe 0x40b04e
movzx edx, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
cmp ebp, 1
jbe 0x40b096
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
mov al, 0x3d
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
pop ebp
mov byte [ecx + esi], 0
mov eax, ecx
pop ebx
ret

Function at 0x40c000
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, ebx
jne 0x40c04f
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x40c074
mov eax, dword [edi + 0x10]
dec eax
mov dword [edi + 0x10], eax
jne 0x40c041
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40c038
push eax
call fcn.00492c28
add esp, 4
push edi
call fcn.00492988
add esp, 4
pop edi
pop ebp
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov eax, esi
pop ebx
ret 4
push esi
xor cl, cl
call fcn.0040c080
mov ebx, dword [esi + 4]
push edi
call fcn.00404e20
mov eax, dword [esi + 4]
mov eax, dword [eax]
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
pop ebp
mov eax, esi
pop ebx
ret 4
Function at 0x4108a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4bb578], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x4108c4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4bb57c], 0
je 0x4108d3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x410ae0
test al, al
jne 0x410916
cmp byte [ebp + 0xc], al
jne 0x410916
push 0x4ba348
push 0
push 0
push 0x410bd0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4bbc78], eax
test eax, eax
je 0x4109a7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4ba348]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x41094c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x410926
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4109b3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x410a1a
cmp dword [esp + 0x2c], 0
je 0x4109c2
mov byte [esp + 0x1f], 1
call fcn.00410f50
test al, al
jne 0x4109c2
cmp byte [ebp + 0xc], al
jne 0x410aae
mov byte [ebp + 8], al
jmp 0x410961
call fcn.00410f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x4109fe
call fcn.00410f50
test al, al
jne 0x410a1a
cmp byte [ebp + 0xc], 0
jne 0x410aa7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4bb578], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x410a52
test byte [esp + 0x1e], 1
jne 0x410a6b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4bbc70], eax
jmp 0x410a6b
mov ecx, dword [0x4bbc78]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x410a32
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x4109c2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410961
mov edx, dword [0x4bbc78]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4bbc78], 0
call fcn.00410f70
jmp 0x4109d2
test byte [esp + 0x1e], 1
je 0x410a6b
mov eax, dword [0x4bbc70]
push eax
call edi
mov dword [0x4bbc70], 0
cmp dword [0x4bb57c], 0
je 0x410a8d
test byte [esp + 0x1e], 2
jne 0x410aa7
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4bbc74], eax
jmp 0x410aa7
test byte [esp + 0x1e], 2
je 0x410aa7
mov ecx, dword [0x4bbc74]
push ecx
call edi
mov dword [0x4bbc74], 0
cmp byte [esp + 0x1f], 0
je 0x410ae0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4b79dc], 0
push 0
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.00484510
add esp, 0x18
mov dword [0x4b79dc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412560
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x804
cmp byte [0x4bcc94], 0
push ebx
push ebp
mov ebp, dword [esp + 0x814]
push esi
push edi
jne 0x4126c9
cmp dword [0x4bbc90], 0
jne 0x412592
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bbc90], eax
mov ebx, 1
add dword [0x4bcc98], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4bcc98]
mov esi, dword [0x4b79f0]
mov ecx, eax
sub ecx, dword [0x4bbc90]
mov dword [0x4bbc94], eax
cmp edx, dword [0x4b79ec]
jbe 0x4125c8
cmp ecx, esi
jb 0x412626
xor ebx, ebx
cmp ecx, esi
jbe 0x4125e5
mov dword [0x4bcc98], 0
mov dword [0x4bbc90], eax
test ebx, ebx
jne 0x4126c9
mov esi, dword [esp + 0x818]
mov cl, byte [esi + 0xf]
push 0
push 0
mov byte [0x4bca5d], cl
inc byte [ebp + 0x16]
mov edx, dword [0x4bc9ec]
push 0
push edx
push ebp
call fcn.0047a540
dec byte [ebp + 0x16]
test eax, eax
jne 0x412696
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.0047f710
add esp, 0xc
call fcn.00411490
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4bcc94], bl
mov dword [0x4b79dc], 0
call fcn.00484510
add esp, 0x18
cmp eax, 7
jne 0x41267f
push 0
push 4
mov ecx, 0x4bc460
call fcn.00420790
mov eax, dword [0x4bbc94]
mov dword [0x4b79dc], ebx
mov byte [0x4bcc94], 0
jmp 0x4125ce
cmp byte [ebp + 0x1b], 0
je 0x4126c9
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x4126c9
movzx eax, word [esi + 4]
mov ecx, dword [0x4bb448]
push 0
push eax
push 0x312
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
Function at 0x417fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov cl, byte [esp + 4]
sub esp, 0x30
cmp dword [0x4bbccc], 2
push ebx
sete bl
push esi
mov esi, eax
test bl, bl
je 0x41800b
lea eax, [esp + 0xc]
test cl, cl
jns 0x417ffa
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0xd]
push 0xa
push eax
movzx eax, cl
push eax
call fcn.004928a2
add esp, 0xc
jmp 0x41802b
push 1
lea ecx, [esp + 0xc]
push ecx
push 1
lea edx, [esp + 0x48]
push edx
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4180ec
test esi, esi
jle 0x4180ec
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jmp 0x418040
cmp dword [0x4bbccc], 0
jne 0x41809d
call ebp
sub eax, dword [0x4bcaa4]
mov ecx, dword [0x4b7a70]
cmp eax, dword [ecx + 0xb8]
jbe 0x41809d
push 0
push 0
push 0
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x418096
push 1
push 0xffffffffffffffff
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
mov dword [0x4b79dc], 1
call ebp
mov dword [0x4bcaa4], eax
test bl, bl
je 0x4180ac
lea edi, [esp + 0x14]
call fcn.00418100
jmp 0x4180bd
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x10]
push eax
call fcn.00416660
add esp, 4
cmp dword [0x4bbccc], 2
jne 0x4180d1
mov ecx, dword [0x4b7a70]
mov eax, dword [ecx + 0x60]
jmp 0x4180da
mov edx, dword [0x4b7a70]
mov eax, dword [edx + 0x5c]
push eax
call fcn.00419f20
add esp, 4
dec esi
jne 0x418040
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x418100
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
cmp dword [0x4bbccc], 0
push esi
je 0x418117
mov al, byte [0x4ba359]
jmp 0x41823e
cmp dword [0x4bb578], 0
je 0x41812a
mov al, byte [0x4bb445]
jmp 0x41823e
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [esp + 0xb], 0
call esi
mov ecx, 0x8000
test cx, ax
je 0x41814b
mov byte [esp + 7], 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x418161
or byte [esp + 7], 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x418177
or byte [esp + 7], 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x41818d
or byte [esp + 7], 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x4181a3
or byte [esp + 7], 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x4181b9
or byte [esp + 7], 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x4181cc
or byte [esp + 7], 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x4181df
or byte [esp + 7], 0x80
cmp dword [0x4bb578], 0
je 0x41823a
push ebx
mov bl, byte [esp + 0xb]
not bl
and bl, byte [0x4bb445]
je 0x418239
mov cl, byte [0x4bb447]
mov al, bl
not al
and byte [0x4bb445], al
and byte [0x4bb446], al
and cl, al
mov al, cl
mov byte [0x4bb447], cl
mov ecx, 0x4bb470
call fcn.0041aad0
mov eax, dword [0x4ba34c]
test eax, eax
je 0x418239
test byte [eax + 8], bl
je 0x418239
mov dword [0x4ba34c], 0
pop ebx
mov al, byte [esp + 7]
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
push 1
and al, 0xc4
push 0
or al, 4
push 0
movzx edx, al
push ecx
push edx
mov esi, 0xffc3d44f
call fcn.0041a2f0
mov al, byte [edi]
add esp, 0x14
mov esi, edi
cmp al, 0x30
jl 0x418297
lea ebx, [ebx]
cmp al, 0x39
jg 0x418297
push 0xffc3d44d
push 0
add al, 0x30
push 0
movzx eax, al
push 0
push eax
push 2
call fcn.00418520
mov al, byte [esi + 1]
inc esi
add esp, 0x18
cmp al, 0x30
jge 0x418270
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
call fcn.00418520
add esp, 0x18
pop esi
add esp, 8
ret
Function at 0x4197b0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x419991
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x419991
mov edx, dword [0x4bbccc]
cmp edx, 2
jne 0x419825
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.00419b70
add esp, 4
call fcn.0041a000
cmp byte [esp + 0x24], 0
je 0x419991
mov dword [esi], connect
mov dword [ebp], connect
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x41987a
cmp edx, 1
jne 0x419860
cmp dword [0x4ba35c], 0x80000000
jne 0x41984e
push 0x4ba35c
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4ba35c]
add dword [esi], eax
mov ecx, dword [0x4ba360]
add dword [ebp], ecx
jmp 0x41989f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x41989f
mov edx, dword [0x4b7a70]
movzx eax, word [edx + 0xd0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x41989f
push eax
mov edi, ebp
mov ebx, esi
call fcn.004809d0
add esp, 4
cmp dword [0x4bbccc], 1
jne 0x4198b8
mov eax, dword [esi]
mov dword [0x4ba35c], eax
mov ecx, dword [ebp]
mov dword [0x4ba360], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x41997b
cmp eax, 0x64
jle 0x419913
mov dword [esp + 0x20], 0x64
jmp 0x419917
test eax, eax
je 0x41997b
cmp dword [0x4bbccc], 1
je 0x41997b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.0045f130
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.004199a0
add esp, 4
call fcn.0041a000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x419dd0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ecx
cmp dword [0x4bbccc], 1
jne 0x419e95
push ebx
xor bl, bl
cmp dword [0x4bb578], 0
mov byte [esp + 4], bl
je 0x419df4
mov bl, 1
mov byte [esp + 4], bl
cmp dword [0x4bb57c], 0
je 0x419e04
or bl, 2
mov byte [esp + 4], bl
test bl, bl
je 0x419e1f
mov al, byte [0x4ba358]
not al
and al, bl
movzx ecx, al
push 1
push ecx
call fcn.004108a0
add esp, 8
mov edx, dword [0x4ba370]
mov eax, dword [0x4ba36c]
push 0x1c
push edx
push eax
call dword [sym.imp.USER32.dll_SendInput]
test bl, bl
je 0x419f15
mov cl, byte [0x4ba358]
and cl, bl
test cl, 1
je 0x419e7c
push 1
call fcn.0041a9a0
mov dl, byte [esp + 0x14]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4bb447]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4bb447], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4ba1f0], eax
mov edx, dword [esp + 4]
pop ebx
add esp, 4
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.004108a0
mov eax, dword [0x4bb43c]
push 0
push eax
push 0x4182c0
push 1
mov dword [0x4ba364], 0
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4bb580], eax
test eax, eax
je 0x419f16
mov byte [0x4bb46a], 1
push 1
push 0x8000012f
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
cmp dword [0x4bb580], 0
mov dword [0x4b79dc], 1
jne 0x419ec4
mov eax, dword [0x4ba370]
mov ecx, dword [0x4ba36c]
cmp dword [eax + ecx*8 - 8], 0
mov byte [0x4bb46a], 0
jne 0x419f16
mov ecx, dword [eax + ecx*8 - 4]
mov edx, dword [esp + 8]
mov dword [edx], ecx
pop ecx
ret
pop ebx
pop ecx
ret

Function at 0x41a0f0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4bbc60]
test eax, eax
je 0x41a1dd
mov ecx, dword [0x4bbc64]
imul ecx, ecx, 0x70
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 5], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov word [eax + 2], dx
push esi
mov byte [eax + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x4bcb04]
mov dword [0x4bbc68], eax
mov dword [esp + 4], ecx
fild dword [esp + 4]
jns 0x41a143
fadd dword [0x4b1668]
fdiv qword [0x4b1660]
mov edx, dword [0x4bbc64]
mov ecx, dword [0x4bbc60]
mov dword [0x4bcb04], eax
imul edx, edx, 0x70
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [edx + ecx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x41a1a2
mov edx, dword [0x4bbc64]
mov eax, dword [0x4bbc60]
imul edx, edx, 0x70
cmp esi, dword [0x4bbc6c]
je 0x41a19b
push 0x64
lea ecx, [edx + eax + 0xc]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41a1b9
mov byte [edx + eax + 0xc], 0
jmp 0x41a1b9
mov ecx, dword [0x4bbc64]
mov edx, dword [0x4bbc60]
imul ecx, ecx, 0x70
mov dword [ecx + edx + 0xc], 0x412f4e
mov eax, dword [0x4bbc64]
inc eax
mov dword [0x4bbc6c], esi
mov dword [0x4bbc64], eax
pop esi
cmp eax, dword [0x4b79e0]
jl 0x41a1dd
mov dword [0x4bbc64], 0
pop ecx
ret
Function at 0x41a1e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
movzx edi, bl
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
movsx esi, al
neg esi
sbb esi, esi
add esi, 2
cmp ebp, 1
je 0x41a20b
cmp ebp, 2
jne 0x41a2e1
cmp esi, ebp
je 0x41a2e1
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
mov ecx, 0x8000
test cx, ax
je 0x41a23c
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 1
call fcn.00418520
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 2
call fcn.00418520
add esp, 0x18
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4bc448]
sete al
mov byte [esp + 0x10], al
test al, al
je 0x41a292
push 1
push 0xffffffffffffffff
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
mov dword [0x4b79dc], 1
cmp bl, 0x14
jne 0x41a2e1
cmp ebp, 2
jne 0x41a2e1
push 0x14
call edi
test al, 1
je 0x41a2e1
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push ebp
call fcn.00418520
add esp, 0x18
cmp byte [esp + 0x10], 0
je 0x41a2e1
push 1
push 0xffffffffffffffff
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
mov dword [0x4b79dc], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41a9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4bb578], 0
je 0x41a9b8
cmp byte [esp + 8], 0
jne 0x41a9b8
mov al, byte [0x4bb445]
pop ecx
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [esp + 0xb], 0
call esi
mov ecx, 0x8000
test cx, ax
je 0x41a9da
mov byte [esp + 7], 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x41a9f0
or byte [esp + 7], 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x41aa06
or byte [esp + 7], 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x41aa1c
or byte [esp + 7], 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x41aa32
or byte [esp + 7], 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x41aa48
or byte [esp + 7], 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x41aa5b
or byte [esp + 7], 0x40
push 0x5c
call esi
mov edx, 0x8000
pop esi
test dx, ax
je 0x41aa6f
or byte [esp + 3], 0x80
cmp dword [0x4bb578], 0
je 0x41aaca
push ebx
mov bl, byte [esp + 7]
not bl
and bl, byte [0x4bb445]
je 0x41aac9
mov cl, byte [0x4bb447]
mov al, bl
not al
and byte [0x4bb445], al
and byte [0x4bb446], al
and cl, al
mov al, cl
mov byte [0x4bb447], cl
mov ecx, 0x4bb470
call fcn.0041aad0
mov eax, dword [0x4ba34c]
test eax, eax
je 0x41aac9
test byte [eax + 8], bl
je 0x41aac9
mov dword [0x4ba34c], 0
pop ebx
mov al, byte [esp + 3]
pop ecx
ret