joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
cmp dword [0x4ba060], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x405bf0
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x405ed0
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.00405ba0
je 0x40615f
movzx eax, word [esp + 0x244]
mov eax, dword [eax*8 + 0x4b7410]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x406257
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.00494a88
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.00494c6e
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4061d6
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x406222
push esi
call ebp
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.00494a88
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.00494c6e
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x406257
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x406222
push esi
call ebp
jmp 0x406257
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x40621d
inc edi
cmp edi, 3
jl 0x406224
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x4b7410], edx
mov dword [0x4b7418], eax
mov dword [fcn.00405ba0], ecx
movzx edx, word [esp + 0x244]
mov eax, dword [edx*8 + 0x4b7410]
pop edi
pop esi
pop ebp
mov dword [0x4ba060], 1
pop ebx
add esp, 0x230
ret 4
Function at 0x40a940
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
xor ebx, ebx
jmp 0x40a950
mov ecx, dword [esi + 0x2c]
cmp ebx, ecx
jae 0x40a96f
mov eax, dword [esi + 0x24]
lea ebx, [ebx]
cmp byte [eax + ebx], 0
je 0x40a9f7
inc ebx
cmp ebx, ecx
jb 0x40a960
cmp ecx, dword [esi + 0x28]
jne 0x40a9b9
mov eax, dword [esi + 0x28]
lea ecx, [eax + eax]
test eax, eax
jne 0x40a983
mov ecx, 0x800
cmp dword [esi + 0x30], 0
jne 0x40a9e4
mov edi, eax
test eax, eax
jne 0x40a994
mov edi, 0x800
cmp edi, ecx
jae 0x40a99e
add edi, edi
cmp edi, ecx
jb 0x40a998
cmp edi, eax
jbe 0x40a9b9
mov eax, dword [esi + 0x24]
push edi
push eax
call fcn.004939cd
add esp, 8
test eax, eax
je 0x40a9dd
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [esi + 0x10]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x40a9e4
add dword [esi + 0x2c], eax
jmp 0x40a950
mov dword [esi + 0x30], 1
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.0040ae90
add esp, 4
pop edi
pop ebp
pop ebx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40aa01
mov dword [eax], ebx
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x40aa10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 0x3c]
push 0xa
lea eax, [esp + 0x10]
push eax
add ecx, 0x26
push ecx
call fcn.00492fe2
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00494bb0
push str.__xml_version_1.0__encoding_UTF_8___
lea esi, [eax + 1]
push 0x4a896c
push esi
call fcn.00494113
mov edx, dword [ebx + 0x10]
add esp, 0x20
add esi, eax
lea eax, [esp + 0xc]
push 0
sub esi, eax
push esi
mov esi, dword [sym.imp.WSOCK32.dll_send]
mov ecx, eax
push ecx
push edx
call esi
cmp eax, 0xffffffff
je 0x40aac3
cmp dword [ebx + 0x40], 0
lea edi, [ebx + 0x34]
jne 0x40aac3
mov ecx, dword [edi + 8]
inc ecx
call fcn.0040b740
test eax, eax
jne 0x40aac3
mov eax, dword [edi]
add eax, dword [edi + 8]
mov cl, byte [0x4ae400]
mov byte [eax], cl
inc dword [edi + 8]
mov edx, dword [ebx + 0x3c]
mov eax, dword [edi]
mov ecx, dword [ebx + 0x10]
push 0
push edx
push eax
push ecx
call esi
cmp eax, 0xffffffff
je 0x40aac3
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x4bc440
call fcn.0040ae20
mov edx, dword [0x4bcac8]
mov eax, dword [0x4bb4ac]
push 0x10014
push edx
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40aafd
push 0
push 4
mov ecx, 0x4bc4c8
call fcn.00420870
pop edi
pop esi
mov eax, 0x3e6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aee0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x40aefa
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40aef1
sub eax, ebx
mov ebp, eax
cmp eax, 2
jbe 0x40af76
lea edx, [eax - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edi
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
mov byte [esi + ecx + 2], bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 3], al
add edi, 3
add ecx, 4
sub ebp, 3
dec edx
jne 0x40af10
test ebp, ebp
je 0x40afea
movzx eax, byte [edi]
shl eax, 0x10
cmp ebp, 1
jbe 0x40af8e
movzx edx, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
cmp ebp, 1
jbe 0x40afd6
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
mov al, 0x3d
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
pop ebp
mov byte [ecx + esi], 0
mov eax, ecx
pop ebx
ret

Function at 0x40bf40
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, ebx
jne 0x40bf8f
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x40bfb4
mov eax, dword [edi + 0x10]
dec eax
mov dword [edi + 0x10], eax
jne 0x40bf81
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40bf78
push eax
call fcn.00493368
add esp, 4
push edi
call fcn.004930c8
add esp, 4
pop edi
pop ebp
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov eax, esi
pop ebx
ret 4
push esi
xor cl, cl
call fcn.0040bfc0
mov ebx, dword [esi + 4]
push edi
call fcn.00404dc0
mov eax, dword [esi + 4]
mov eax, dword [eax]
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
pop ebp
mov eax, esi
pop ebx
ret 4
Function at 0x410830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4bb5dc], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x410854
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4bb5e0], 0
je 0x410863
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x410a70
test al, al
jne 0x4108a6
cmp byte [ebp + 0xc], al
jne 0x4108a6
push 0x4ba3ac
push 0
push 0
push 0x410b60
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4bbcdc], eax
test eax, eax
je 0x410937
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4ba3ac]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4108dc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x4108b6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x410943
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x4109aa
cmp dword [esp + 0x2c], 0
je 0x410952
mov byte [esp + 0x1f], 1
call fcn.00410ef0
test al, al
jne 0x410952
cmp byte [ebp + 0xc], al
jne 0x410a3e
mov byte [ebp + 8], al
jmp 0x4108f1
call fcn.00410f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x41098e
call fcn.00410ef0
test al, al
jne 0x4109aa
cmp byte [ebp + 0xc], 0
jne 0x410a37
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4bb5dc], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x4109e2
test byte [esp + 0x1e], 1
jne 0x4109fb
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4bbcd4], eax
jmp 0x4109fb
mov ecx, dword [0x4bbcdc]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x4109c2
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x410952
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4108f1
mov edx, dword [0x4bbcdc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4bbcdc], 0
call fcn.00410f10
jmp 0x410962
test byte [esp + 0x1e], 1
je 0x4109fb
mov eax, dword [0x4bbcd4]
push eax
call edi
mov dword [0x4bbcd4], 0
cmp dword [0x4bb5e0], 0
je 0x410a1d
test byte [esp + 0x1e], 2
jne 0x410a37
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4bbcd8], eax
jmp 0x410a37
test byte [esp + 0x1e], 2
je 0x410a37
mov ecx, dword [0x4bbcd8]
push ecx
call edi
mov dword [0x4bbcd8], 0
cmp byte [esp + 0x1f], 0
je 0x410a70
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4b79dc], 0
push 0
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.00484c50
add esp, 0x18
mov dword [0x4b79dc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4124b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x804
cmp byte [0x4bccfc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x814]
push esi
push edi
jne 0x412619
cmp dword [0x4bbcf8], 0
jne 0x4124e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bbcf8], eax
mov ebx, 1
add dword [0x4bcd00], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4bcd00]
mov esi, dword [0x4b79f0]
mov ecx, eax
sub ecx, dword [0x4bbcf8]
mov dword [0x4bbcfc], eax
cmp edx, dword [0x4b79ec]
jbe 0x412518
cmp ecx, esi
jb 0x412576
xor ebx, ebx
cmp ecx, esi
jbe 0x412535
mov dword [0x4bcd00], 0
mov dword [0x4bbcf8], eax
test ebx, ebx
jne 0x412619
mov esi, dword [esp + 0x818]
mov cl, byte [esi + 0xf]
push 0
push 0
mov byte [0x4bcac5], cl
inc byte [ebp + 0x16]
mov edx, dword [0x4bca54]
push 0
push edx
push ebp
call fcn.0047ac80
dec byte [ebp + 0x16]
test eax, eax
jne 0x4125e6
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.0047fe70
add esp, 0xc
call fcn.00411430
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4bccfc], bl
mov dword [0x4b79dc], 0
call fcn.00484c50
add esp, 0x18
cmp eax, 7
jne 0x4125cf
push 0
push 4
mov ecx, 0x4bc4c8
call fcn.00420870
mov eax, dword [0x4bbcfc]
mov dword [0x4b79dc], ebx
mov byte [0x4bccfc], 0
jmp 0x41251e
cmp byte [ebp + 0x1b], 0
je 0x412619
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x412619
movzx eax, word [esi + 4]
mov ecx, dword [0x4bb4ac]
push 0
push eax
push 0x312
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
Function at 0x417f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov cl, byte [esp + 4]
sub esp, 0x30
cmp dword [0x4bbd80], 2
push ebx
sete bl
push esi
mov esi, eax
test bl, bl
je 0x417f6b
lea eax, [esp + 0xc]
test cl, cl
jns 0x417f5a
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0xd]
push 0xa
push eax
movzx eax, cl
push eax
call fcn.00492fe2
add esp, 0xc
jmp 0x417f8b
push 1
lea ecx, [esp + 0xc]
push ecx
push 1
lea edx, [esp + 0x48]
push edx
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x41804c
test esi, esi
jle 0x41804c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jmp 0x417fa0
cmp dword [0x4bbd80], 0
jne 0x417ffd
call ebp
sub eax, dword [0x4bcb0c]
mov ecx, dword [0x4b7a70]
cmp eax, dword [ecx + 0xb8]
jbe 0x417ffd
push 0
push 0
push 0
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x417ff6
push 1
push 0xffffffffffffffff
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
mov dword [0x4b79dc], 1
call ebp
mov dword [0x4bcb0c], eax
test bl, bl
je 0x41800c
lea edi, [esp + 0x14]
call fcn.00418060
jmp 0x41801d
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x10]
push eax
call fcn.00416510
add esp, 4
cmp dword [0x4bbd80], 2
jne 0x418031
mov ecx, dword [0x4b7a70]
mov eax, dword [ecx + 0x60]
jmp 0x41803a
mov edx, dword [0x4b7a70]
mov eax, dword [edx + 0x5c]
push eax
call fcn.00419eb0
add esp, 4
dec esi
jne 0x417fa0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x418060
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
cmp dword [0x4bbd80], 0
push esi
je 0x418077
mov al, byte [0x4ba3bd]
jmp 0x4181c3
cmp dword [0x4bb5dc], 0
je 0x41808a
mov al, byte [0x4bb4a9]
jmp 0x4181c3
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [esp + 0xb], 0
call esi
mov ecx, 0x8000
test cx, ax
je 0x4180ab
mov byte [esp + 7], 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x4180c1
or byte [esp + 7], 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x4180d7
or byte [esp + 7], 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x4180ed
or byte [esp + 7], 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x418103
or byte [esp + 7], 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x418119
or byte [esp + 7], 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x41812c
or byte [esp + 7], 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x41813f
or byte [esp + 7], 0x80
cmp dword [0x4bb5dc], 0
je 0x4181bf
push ebx
mov bl, byte [esp + 0xb]
not bl
and bl, byte [0x4bb4a9]
cmp byte [0x4bb4ce], 0
je 0x418178
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ba390]
cmp eax, 0x14
jae 0x418178
mov al, byte [0x4bb4ce]
not al
and bl, al
test bl, bl
je 0x4181be
mov cl, byte [0x4bb4ab]
mov al, bl
not al
and byte [0x4bb4a9], al
and byte [0x4bb4aa], al
and cl, al
mov al, cl
mov byte [0x4bb4ab], cl
mov ecx, 0x4bb4d0
call fcn.0041aa90
mov eax, dword [0x4ba3b0]
test eax, eax
je 0x4181be
test byte [eax + 8], bl
je 0x4181be
mov dword [0x4ba3b0], 0
pop ebx
mov al, byte [esp + 7]
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
push 1
and al, 0xc4
push 0
or al, 4
push 0
movzx edx, al
push ecx
push edx
mov esi, 0xffc3d44f
call fcn.0041a280
mov al, byte [edi]
add esp, 0x14
mov esi, edi
cmp al, 0x30
jl 0x418217
nop
cmp al, 0x39
jg 0x418217
push 0xffc3d44d
push 0
add al, 0x30
push 0
movzx eax, al
push 0
push eax
push 2
call fcn.004184a0
mov al, byte [esi + 1]
inc esi
add esp, 0x18
cmp al, 0x30
jge 0x4181f0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
call fcn.004184a0
add esp, 0x18
pop esi
add esp, 8
ret
Function at 0x419730
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x419911
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x419911
mov edx, dword [0x4bbd80]
cmp edx, 2
jne 0x4197a5
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.00419af0
add esp, 4
call fcn.00419f90
cmp byte [esp + 0x24], 0
je 0x419911
mov dword [esi], connect
mov dword [ebp], connect
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x4197fa
cmp edx, 1
jne 0x4197e0
cmp dword [0x4ba3c0], 0x80000000
jne 0x4197ce
push 0x4ba3c0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4ba3c0]
add dword [esi], eax
mov ecx, dword [0x4ba3c4]
add dword [ebp], ecx
jmp 0x41981f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x41981f
mov edx, dword [0x4b7a70]
movzx eax, word [edx + 0xd0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x41981f
push eax
mov edi, ebp
mov ebx, esi
call fcn.00481130
add esp, 4
cmp dword [0x4bbd80], 1
jne 0x419838
mov eax, dword [esi]
mov dword [0x4ba3c0], eax
mov ecx, dword [ebp]
mov dword [0x4ba3c4], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x4198fb
cmp eax, 0x64
jle 0x419893
mov dword [esp + 0x20], 0x64
jmp 0x419897
test eax, eax
je 0x4198fb
cmp dword [0x4bbd80], 1
je 0x4198fb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.0045f200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.00419920
add esp, 4
call fcn.00419f90
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x419d50
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ecx
cmp dword [0x4bbd80], 1
jne 0x419e1f
push ebx
xor bl, bl
cmp dword [0x4bb5dc], 0
mov byte [esp + 4], bl
je 0x419d74
mov bl, 1
mov byte [esp + 4], bl
cmp dword [0x4bb5e0], 0
je 0x419d84
or bl, 2
mov byte [esp + 4], bl
test bl, bl
je 0x419d9f
mov al, byte [0x4ba3bc]
not al
and al, bl
movzx ecx, al
push 1
push ecx
call fcn.00410830
add esp, 8
mov edx, dword [0x4ba3d4]
mov eax, dword [0x4ba3d0]
push 0x1c
push edx
push eax
call dword [sym.imp.USER32.dll_SendInput]
test bl, bl
je 0x419ea1
mov cl, byte [0x4ba3bc]
and cl, bl
test cl, 1
je 0x419e06
push 1
call fcn.0041a930
mov dl, byte [esp + 0x14]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4bb4ab]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4bb4ab], bl
mov byte [0x4bb4aa], al
mov byte [0x4bb4a9], al
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4ba250], eax
mov edx, dword [esp + 4]
pop ebx
add esp, 4
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.00410830
mov eax, dword [0x4bb4a0]
push 0
push eax
push 0x418240
push 1
mov dword [0x4ba3c8], 0
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4bb5e4], eax
test eax, eax
je 0x419ea2
mov byte [0x4bb4cf], 1
mov edi, edi
push 1
push 0x8000012f
mov dword [0x4b79dc], 0
call fcn.004014b0
add esp, 8
cmp dword [0x4bb5e4], 0
mov dword [0x4b79dc], 1
jne 0x419e50
mov eax, dword [0x4ba3d4]
mov ecx, dword [0x4ba3d0]
cmp dword [eax + ecx*8 - 8], 0
mov byte [0x4bb4cf], 0
jne 0x419ea2
mov ecx, dword [eax + ecx*8 - 4]
mov edx, dword [esp + 8]
mov dword [edx], ecx
pop ecx
ret
pop ebx
pop ecx
ret

Function at 0x41a080
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4bbcc4]
test eax, eax
je 0x41a16d
mov ecx, dword [0x4bbcc8]
imul ecx, ecx, 0x70
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 5], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov word [eax + 2], dx
push esi
mov byte [eax + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x4bcb6c]
mov dword [0x4bbccc], eax
mov dword [esp + 4], ecx
fild dword [esp + 4]
jns 0x41a0d3
fadd dword [0x4b16b0]
fdiv qword [0x4b16a8]
mov edx, dword [0x4bbcc8]
mov ecx, dword [0x4bbcc4]
mov dword [0x4bcb6c], eax
imul edx, edx, 0x70
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [edx + ecx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x41a132
mov edx, dword [0x4bbcc8]
mov eax, dword [0x4bbcc4]
imul edx, edx, 0x70
cmp esi, dword [0x4bbcd0]
je 0x41a12b
push 0x64
lea ecx, [edx + eax + 0xc]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41a149
mov byte [edx + eax + 0xc], 0
jmp 0x41a149
mov ecx, dword [0x4bbcc8]
mov edx, dword [0x4bbcc4]
imul ecx, ecx, 0x70
mov dword [ecx + edx + 0xc], 0x412f4e
mov eax, dword [0x4bbcc8]
inc eax
mov dword [0x4bbcd0], esi
mov dword [0x4bbcc8], eax
pop esi
cmp eax, dword [0x4b79e0]
jl 0x41a16d
mov dword [0x4bbcc8], 0
pop ecx
ret