joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410b00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor ecx, ecx
mov eax, dword [ecx*8 + 0x466f28]
test eax, eax
je 0x410b1c
cmp eax, ebx
je 0x410b39
inc ecx
cmp ecx, 0xa
jl 0x410b07
cmp ecx, 0xa
jl 0x410b24
push 9
pop ecx
mov eax, dword [esp + 0xc]
test eax, eax
push esi
lea esi, [ecx*8 + 0x466f28]
je 0x410b58
mov dword [esi + 4], eax
jmp 0x410b8e
mov edx, dword [esp + 0xc]
test edx, edx
je 0x410b4f
lea eax, [ecx*8 + 0x466f2c]
cmp dword [eax], 0
jne 0x410b4f
mov dword [eax], edx
mov eax, dword [ecx*8 + 0x466f2c]
pop ebx
ret
and dword [esi + 4], 0
push edi
push 0x20
pop edi
push ebx
push edi
call dword [sym.imp.USER32.dll_VkKeyScanExA]
cmp ax, 0xffff
je 0x410b78
and ax, 0x600
cmp ax, 0x600
je 0x410b83
inc edi
cmp edi, 0x100
jl 0x410b60
jmp 0x410b8a
mov dword [esi + 4], 3
mov eax, dword [esi + 4]
pop edi
mov dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x411034
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov ebx, 0x80000000
cmp ecx, ebx
je 0x41119c
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, ebx
je 0x41119b
mov edx, dword [0x466f78]
cmp edx, 2
jne 0x411098
push eax
mov al, byte [ebp + 0x18]
neg al
push ecx
push 0
sbb eax, eax
and eax, ebx
or eax, 1
push eax
call fcn.0040f751
add esp, 0x10
call fcn.0040fc56
cmp byte [ebp + 0x18], 0
je 0x41119b
mov dword [esi], ebx
mov dword [edi], ebx
jmp 0x41119b
mov eax, dword [ebp + 0x10]
or word [eax], 0x8001
cmp byte [ebp + 0x18], 0
je 0x4110e2
cmp edx, 1
jne 0x4110ce
cmp dword [0x466ef8], ebx
jne 0x4110be
push 0x466ef8
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x466ef8]
add dword [esi], eax
mov eax, dword [0x466efc]
add dword [edi], eax
jmp 0x4110f4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
add dword [esi], eax
mov eax, dword [ebp - 8]
jmp 0x4110ca
test byte [0x4651f4], 2
jne 0x4110f4
push edi
push esi
call fcn.00439036
pop ecx
pop ecx
cmp dword [0x466f78], 1
jne 0x41110b
mov eax, dword [esi]
mov dword [0x466ef8], eax
mov eax, dword [edi]
mov dword [0x466efc], eax
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 8], eax
mov eax, dword [esi]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
inc eax
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
inc eax
test ebx, ebx
mov dword [edi], eax
jl 0x411184
cmp ebx, 0x64
jle 0x411146
push 0x64
pop ebx
test ebx, ebx
je 0x411184
cmp dword [0x466f78], 1
je 0x411184
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
push ebx
push dword [edi]
push dword [esi]
inc eax
push eax
mov eax, dword [ebp - 0xc]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
inc eax
push eax
call fcn.0042ac36
add esp, 0x14
jmp 0x41119b
push eax
push dword [esi]
push 0
push 0x8001
call fcn.00410ff0
add esp, 0x10
call fcn.0040fc56
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41166b
Capabilities:
Log keystrokes

Disassembly:
push esi
movzx esi, byte [esp + 8]
mov ecx, esi
mov eax, 0x90
cmp ecx, eax
jg 0x4116f1
je 0x4116e7
sub ecx, 0x5b
cmp ecx, 0x14
ja case.0x41168a.93
jmp dword [ecx*4 + 0x411797]
mov eax, 0x15b
jmp 0x411783
mov eax, 0x15c
jmp 0x411783
push 0x52
jmp 0x411727
push 0x4f
jmp 0x411727
push 0x50
jmp 0x411727
push 0x51
jmp 0x411727
push 0x4b
jmp 0x411727
push 0x4c
jmp 0x411727
push 0x4d
jmp 0x411727
push 0x47
jmp 0x411727
push 0x48
jmp 0x411727
push 0x49
jmp 0x411727
push 0x53
jmp 0x411727
mov eax, 0x135
jmp 0x411783
push 0x37
jmp 0x411727
push 0x4a
jmp 0x411727
push 0x4e
jmp 0x411727
mov eax, 0x145
jmp 0x411783
sub ecx, 0xa0
je 0x411725
dec ecx
je 0x41171e
dec ecx
je 0x41171a
dec ecx
je 0x411713
dec ecx
je 0x41170f
dec ecx
jne case.0x41168a.93
mov eax, 0x138
jmp 0x411783
push 0x38
jmp 0x411727
mov eax, 0x11d
jmp 0x411783
push 0x1d
jmp 0x411727
mov eax, 0x136
jmp 0x411783
push 0x2a
pop eax
jmp 0x411783
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ax, ax
jne 0x41173a
pop esi
ret
cmp esi, 0x2e
jg 0x41176f
cmp esi, 0x2d
jge 0x41175f
cmp esi, 3
je 0x41177e
cmp esi, 0xd
je 0x41175f
cmp esi, 0x20
jle 0x411783
cmp esi, 0x28
jle 0x41175f
cmp esi, 0x2c
je 0x41177e
jmp 0x411783
cmp byte [esp + 0xc], 0
movzx eax, ax
je 0x411795
or ax, 0x100
pop esi
ret
sub esi, 0x5d
je 0x41177e
sub esi, 0x12
je 0x41177e
sub esi, 0x21
jne 0x411783
or eax, 0x100
mov cl, byte [esp + 0xc]
neg cl
movzx eax, ax
sbb ecx, ecx
not ecx
and ecx, eax
mov ax, cx
pop esi
ret
Function at 0x41183f
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp dword [0x466f78], ebp
push esi
push edi
je 0x411857
mov al, byte [0x466f00]
jmp 0x4119c3
cmp dword [0x465338], ebp
je 0x411869
mov al, byte [0x465224]
jmp 0x4119c3
push ebx
xor bl, bl
cmp byte [0x466341], bl
jne 0x411907
cmp byte [0x466342], bl
jne 0x411907
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x41189e
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x4118ad
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x4118bc
or bl, 1
push 0xa3
call edi
test si, ax
je 0x4118cb
or bl, 2
push 0xa4
call edi
test si, ax
je 0x4118da
or bl, 4
push 0xa5
call edi
test si, ax
je 0x4118e9
or bl, 8
push 0x5b
call edi
test si, ax
je 0x4118f5
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x411982
or bl, 0x80
jmp 0x411982
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x41192a
push 0x10
call ebp
test si, ax
je 0x41192c
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x41193e
push 0x11
call ebp
test si, ax
je 0x411941
or bl, 1
push 0x12
call edi
test si, ax
jne 0x411953
push 0x12
call ebp
test si, ax
je 0x411956
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x411968
push 0x5b
call ebp
test si, ax
je 0x41196b
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x41197d
push 0x5c
call ebp
test si, ax
je 0x411980
or bl, 0x80
xor ebp, ebp
cmp dword [0x465338], ebp
je 0x4119be
mov al, bl
not al
and al, byte [0x465224]
je 0x4119be
not al
and byte [0x465226], al
and byte [0x465224], al
and byte [0x465225], al
xor eax, eax
mov al, byte [0x465226]
push eax
push 0x465228
call fcn.0040f8d6
pop ecx
pop ecx
xor eax, eax
mov al, bl
pop ebx
push 0xffc3d44f
push 1
push ebp
mov byte [esp + 0x18], al
push ebp
push dword [esp + 0x1c]
and eax, 0xffffffc4
or eax, 4
push eax
call fcn.0040fefa
mov eax, dword [esp + 0x2c]
mov esi, eax
movsx eax, byte [eax]
add esp, 0x18
mov edi, 0xffc3d44d
jmp 0x411a0b
cmp al, 0x39
jg 0x411a0f
push edi
push ebp
add al, 0x30
push ebp
push ebp
push eax
push 2
call fcn.00410525
add esp, 0x18
inc esi
mov al, byte [esi]
cmp al, 0x30
jge 0x4119f3
push edi
push ebp
push ebp
push ebp
push 0x12
push 1
call fcn.00410525
add esp, 0x18
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x412c22
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push edi
lea eax, [ebp - 0x10]
jge 0x412c3b
mov byte [ebp - 0x10], 0x30
lea eax, [ebp - 0xf]
push 0xa
push eax
movzx eax, byte [ebp + 8]
push eax
call fcn.0040184f
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp edi, ebx
jle 0x412cca
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x466f78], ebx
jne 0x412ca2
call esi
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x412ca2
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x412c9b
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
call esi
mov dword [0x466154], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041183f
cmp dword [0x466f78], 2
mov eax, dword [0x465198]
pop ecx
je 0x412cbf
mov eax, dword [0x465194]
push eax
call fcn.0040fc03
dec edi
pop ecx
jne 0x412c59
pop esi
pop edi
pop ebx
leave
ret

Function at 0x413216
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
movzx eax, byte [esp + 8]
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push eax
call edi
mov ebp, dword [esp + 0x14]
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
cmp ebp, 1
mov dword [esp + 8], eax
je 0x413245
cmp ebp, 2
jne 0x413312
cmp eax, ebp
je 0x413312
push ebx
xor ebx, ebx
cmp byte [esp + 0x14], 0x90
push esi
mov esi, 0xffc3d44d
jne 0x413282
cmp byte [0x466341], bl
je 0x41326f
call fcn.00413316
jmp 0x41330c
push esi
push ebx
push ebx
push ebx
push 0x90
push 1
call fcn.00410525
add esp, 0x18
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x28]
push 2
call fcn.00410525
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x465c44]
sete byte [esp + 0x1c]
cmp byte [esp + 0x1c], bl
je 0x4132cb
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
cmp byte [esp + 0x18], 0x14
jne 0x41330c
cmp ebp, 2
jne 0x41330c
push 0x14
call edi
test al, 1
je 0x41330c
push esi
push ebx
push ebx
push ebx
push 0x10
push ebp
call fcn.00410525
add esp, 0x18
cmp byte [esp + 0x1c], bl
je 0x41330c
push 1
push 0xffffffffffffffff
mov byte [0x463069], bl
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
mov eax, dword [esp + 0x10]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x41333f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x465c34]
test eax, eax
je 0x41344d
mov ecx, dword [0x465c38]
mov dl, byte [ebp + 8]
imul ecx, ecx, 0x70
mov byte [ecx + eax + 5], dl
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
mov dl, byte [ebp + 0xc]
mov byte [eax + ecx], dl
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
mov dx, word [ebp + 0x10]
mov word [eax + ecx + 2], dx
mov eax, dword [0x465c38]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
push esi
mov byte [eax + ecx + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x465c3c], eax
sub eax, dword [0x466358]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x4133c0
fadd dword [0x459a84]
mov eax, dword [0x465c38]
fmul dword [0x459a80]
mov ecx, dword [0x465c34]
imul eax, eax, 0x70
fstp dword [eax + ecx + 8]
mov eax, dword [0x465c3c]
mov dword [0x466358], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x465c34]
mov esi, eax
mov eax, dword [0x465c38]
imul eax, eax, 0x70
test esi, esi
je 0x41341b
cmp esi, dword [0x465c40]
je 0x413414
push 0x64
lea eax, [eax + ecx + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41342c
mov byte [eax + ecx + 0xc], 0
jmp 0x41342c
lea eax, [eax + ecx + 0xc]
push 0x459a7c
push eax
call fcn.00455a20
pop ecx
pop ecx
inc dword [0x465c38]
mov eax, dword [0x465c38]
cmp eax, dword [0x46306c]
mov dword [0x465c40], esi
pop esi
jl 0x41344d
and dword [0x465c38], 0
leave
ret

Function at 0x41349c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4641d8]
jne 0x4134a9
call fcn.0044e551
mov eax, dword [0x466f90]
mov ecx, dword [eax]
add dword [0x466f90], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x4134e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4641d8]
jne 0x4134ed
call fcn.0044e551
mov eax, dword [0x466f90]
mov ecx, dword [eax]
add dword [0x466f90], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x413522
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4641d8]
jne 0x413530
call fcn.0044e551
mov eax, dword [0x466f90]
mov eax, dword [eax]
add dword [0x466f90], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x413576
fadd qword [0x45a078]
fmul qword [0x45a070]
pop ecx
ret
Function at 0x41357e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
inc esi
mov dword [0x466f98], eax
push edi
mov edx, esi
mov eax, 0x466f98
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x467954
jl 0x413593
pop edi
mov dword [0x4641d8], esi
mov dword [0x467958], esi
pop esi
ret

Function at 0x415268
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.00443312
mov eax, dword [0x465340]
test eax, eax
pop ecx
pop ecx
je 0x41528d
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x4641d0]
push esi
xor esi, esi
cmp word [eax], si
jbe 0x4152b9
mov ecx, dword [esi*4 + 0x4663d0]
test ecx, ecx
je 0x4152ac
push 1
call fcn.0040d7ee
mov eax, dword [0x4641d0]
movzx eax, word [eax]
inc esi
cmp esi, eax
jl 0x41529a
push dword [esp + 8]
call fcn.0043d4a6
pop esi

Function at 0x4152c3
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x468], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4152ea
cmp byte [eax], bl
mov byte [ebp + 0xb], 1
je 0x4152ed
mov byte [ebp + 0xb], bl
cmp eax, ebx
je 0x415336
cmp byte [eax], bl
je 0x415336
push eax
push str.Critical_Error:__s_n_nThe_program_will_exit.
lea eax, [ebp - 0x54c]
push 0x400
push eax
call fcn.00409c5f
add esp, 0x10
push 0x10000
push dword [0x46611c]
lea eax, [ebp - 0x54c]
push eax
push dword [0x465208]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
mov ecx, esi
call fcn.0041545a
cmp dword [esi + 0x464], ebx
je 0x415346
cmp byte [0x4686a8], bl
je 0x415350
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
mov ecx, dword [0x465b20]
push 0x80
call fcn.00401d39
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00438c79
push 0xc8
lea eax, [ebp - 0x14c]
push 0x465138
push eax
call fcn.00455650
push ebx
push 1
push 1
push ebx
call fcn.0040b4ee
add esp, 0x28
cmp dword [0x46537c], ebx
je 0x4153a4
push 0x465b28
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov al, byte [0x463069]
mov byte [ebp + 0xf], al
mov al, byte [0x465351]
push ebx
mov ecx, 0x465c88
mov byte [0x463069], bl
mov byte [ebp - 1], al
call fcn.0040b419
mov ecx, dword [esi + 0x464]
mov byte [0x4686a8], 1
call fcn.0040595f
test eax, eax
jne 0x4153e5
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
cmp byte [ebp + 0xb], bl
mov byte [0x4686a8], bl
je 0x4153fa
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0041545a
push ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040b337
mov al, byte [ebp + 0xf]
add esp, 0xc
cmp byte [ebp - 1], bl
mov byte [0x463069], al
je 0x415451
cmp byte [0x465351], bl
jne 0x415451
mov eax, dword [0x46614c]
cmp eax, 0xa
jge 0x415433
push 0xa
pop eax
push 0x40aea3
push eax
push 0xa
push dword [0x465208]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x465351], al
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0xc
Function at 0x415efa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 0x2af8
jae 0x415f76
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx*4 + 0x465928]
test ecx, ecx
je 0x415f76
cmp eax, dword [ecx + 0xc]
jae 0x415f76
cmp dword [ebp + 0x10], 0
mov ecx, dword [ecx + 0x14]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + 8]
je 0x415f55
test ecx, ecx
je 0x415f46
push dword [ecx + 0x10]
push dword [ebp + 0x10]
call fcn.00455a20
push eax
call fcn.00455c50
add esp, 0xc
pop ebp
ret
push 0x40
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop ebp
ret
test ecx, ecx
je 0x415f64
push dword [ecx + 0x10]
call fcn.00455c50
pop ecx
pop ebp
ret
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, 0x3f
jbe 0x415f82
push 0x3f
pop eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x415f80
mov byte [eax], 0
xor eax, eax
pop ebp
ret
Function at 0x4179f4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x465b20]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
cmp dword [ebp + 8], ebx
je 0x417a32
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417a36
mov eax, edi
jmp 0x417ab4
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x417a75
cmp byte [esi], bl
je 0x417a75
push str.ahk_default
push esi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
jne 0x417a58
mov esi, 0x4585d8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x417a9f
mov eax, edi
jmp 0x417ab3
push dword [ebp - 4]
call fcn.00417d60
pop ecx
push dword [ebp - 4]
mov byte [ebp + 0x13], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x13], bl
je 0x417a71
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jmp 0x417a6f
mov ecx, dword [0x465b20]
push edi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x417d60
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x417e05
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417e0d
push dword [ebp - 0xc]
call fcn.00417d60
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x417e0d
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x417e0d
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x417d9a
mov al, 1
jmp 0x417e0f
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ec15
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test bl, bl
jne 0x41ec22
xor al, al
pop ebx
ret
mov eax, dword [esp + 0xc]
dec eax
je 0x41ec80
dec eax
je 0x41ec71
cmp byte [0x466341], 0
jne 0x41ec4d
cmp byte [0x466342], 0
jne 0x41ec4d
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x41ecd2
push esi
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x41ec6b
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x41ec6b
xor eax, eax
jmp 0x41ec6e
xor eax, eax
inc eax
pop esi
pop ebx
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebx
and eax, 1
ret
push ebx
call fcn.00444490
test al, al
pop ecx
je 0x41eca2
cmp dword [0x46533c], 0
movzx eax, bl
je 0x41eccb
mov al, byte [eax + 0x465228]
shr al, 7
pop ebx
ret
xor eax, eax
cmp dword [0x465338], eax
je 0x41ecc8
push eax
push eax
push ebx
call fcn.00410a27
add esp, 0xc
test al, al
je 0x41ecc3
push 1
call fcn.0040fd86
pop ecx
movzx eax, bl
jmp 0x41ec97
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
Function at 0x4218a4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043a541
mov esi, eax
test esi, esi
je 0x421993
push dword [ebp + 8]
push esi
call fcn.0043a622
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x421993
push ebx
push edi
push 0
push esi
mov byte [ebp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
test ebx, ebx
je 0x421932
cmp ebx, dword [0x465c44]
je 0x421932
push esi
call fcn.0043b520
test al, al
pop ecx
jne 0x421932
push 1
push ebx
push dword [0x465c44]
call edi
test eax, eax
setne byte [ebp + 0x1b]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x421980
mov ecx, dword [0x465b20]
push 1
push 0
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, dword [0x465190]
cmp eax, 0xffffffff
jle 0x421980
cmp eax, 0x19
jge 0x421976
cmp byte [0x466341], 0
je 0x421976
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421980
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
cmp byte [ebp + 0x1b], 0
je 0x421991
push 0
push ebx
push dword [0x465c44]
call edi
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x14
Function at 0x42199b
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043a541
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x421a83
push edi
push ebx
push eax
mov byte [ebp + 0x17], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
cmp edi, ebx
je 0x421a2c
cmp edi, dword [0x465c44]
je 0x421a2c
push dword [ebp + 0x10]
call fcn.0043b520
test al, al
pop ecx
jne 0x421a2c
push 1
push edi
push dword [0x465c44]
call esi
test eax, eax
setne byte [ebp + 0x17]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0x17], bl
mov dword [ebp - 4], eax
je 0x421a44
push ebx
push edi
push dword [0x465c44]
call esi
cmp dword [ebp - 4], ebx
pop edi
je 0x421a83
lea eax, [ebp - 0x410]
push 0x3fb
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x421a83
lea eax, [ebp - 0x10]
push eax
push 0x43a889
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov byte [ebp - 0xc], bl
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0xc], bl
jne 0x421a88
xor eax, eax
inc eax
jmp 0x421ad0
push dword [ebp - 8]
lea eax, [ebp - 0x410]
push 0x45874c
push 0x400
push eax
call fcn.00409cfa
mov ecx, dword [0x465b20]
add esp, 0x10
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov ecx, dword [0x467ff0]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push eax
call fcn.00401592
pop esi
pop ebx
leave
ret 0x10