joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c6f0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x45c75a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x45c72a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45c776
push ecx
push esi
call fcn.0045d960
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x45c7d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x45c7ee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x45c7e3
pop esi
ret

Function at 0x45c840
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x45c8d2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x45c8c4
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x45c8bc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x45c885
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x403740
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403754
inc dword [0x4ca6d4]
add dword [0x4c6a44], 0x108
mov edx, dword [0x4c6a44]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c91b0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403783
push 0
mov eax, 0x4cb520
call fcn.00417590
cmp dword [0x4ca708], 0
mov dword [0x4cc008], 0
mov dword [0x4cc00c], 0
je 0x4037bb
mov eax, dword [0x4c7b78]
test eax, eax
je 0x4037af
mov eax, dword [eax]
test eax, eax
jne 0x4037b4
mov eax, 0x4a3920
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40383f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x4037ea
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x4037ea
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cc014], 0
je 0x4037fc
cmp dword [0x4cc010], 0
jne 0x403805
cmp byte [esi + 0xee], 0
je 0x40383f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40383f
cmp dword [0x4cc014], 0
jge 0x403827
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cc014]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x404590
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x4045b3
call fcn.00404860
test eax, eax
jne 0x4045b3
push str.Cant_open_clipboard_for_writing.
call fcn.00404690
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4045ec
cmp dword [esi + 0x18], ebx
je 0x4045de
cmp dword [esi + 8], ebx
je 0x4045d3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c44
call fcn.00404690
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404625
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40464c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40464c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404642
cmp dword [esi + 8], ebx
je 0x404637
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404661
mov dword [esi + 4], ebx
jmp 0x404625
cmp dword [esi + 0x18], ebx
je 0x40467e
cmp dword [esi + 8], ebx
je 0x404673
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c64
call fcn.00404690
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404760
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404770
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40483f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.0048ffb7
add esp, 0xc
test eax, eax
je 0x404836
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea edx, [esp]
push str.Native
push edx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x40482c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.0048f769
add esp, 8
test eax, eax
jne 0x404845
test esi, esi
je 0x404836
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x404860
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x4048ea
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x4ca564]
push eax
call ebx
test eax, eax
jne 0x4048df
mov eax, dword [0x4c6948]
cmp eax, 0xffffffff
je 0x4048af
test eax, eax
je 0x4048f6
call esi
mov ecx, dword [0x4c6948]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4048f6
push 1
push 0x8000012f
mov dword [0x4c694c], 0
call fcn.004013d0
mov edx, dword [0x4ca564]
add esp, 8
push edx
mov dword [0x4c694c], 1
call ebx
test eax, eax
je 0x404890
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4ca694], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x408d94
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4ca698], 0
je 0x408da3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408fb0
test al, al
jne 0x408de6
cmp byte [ebp + 0xc], al
jne 0x408de6
push 0x4c9470
push 0
push 0
push 0x4090a0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4cad90], eax
test eax, eax
je 0x408e77
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c9470]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x408e1c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408df6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x408e83
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x408eea
cmp dword [esp + 0x2c], 0
je 0x408e92
mov byte [esp + 0x1f], 1
call fcn.004093c0
test al, al
jne 0x408e92
cmp byte [ebp + 0xc], al
jne 0x408f7e
mov byte [ebp + 8], al
jmp 0x408e31
call fcn.004093e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x408ece
call fcn.004093c0
test al, al
jne 0x408eea
cmp byte [ebp + 0xc], 0
jne 0x408f77
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4ca694], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408f22
test byte [esp + 0x1e], 1
jne 0x408f3b
push str.AHK_Keybd
push 0
push 0
call esi
mov dword [0x4cad88], eax
jmp 0x408f3b
mov ecx, dword [0x4cad90]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408f02
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x408e92
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408e31
mov edx, dword [0x4cad90]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4cad90], 0
call fcn.004093e0
jmp 0x408ea2
test byte [esp + 0x1e], 1
je 0x408f3b
mov eax, dword [0x4cad88]
push eax
call edi
mov dword [0x4cad88], 0
cmp dword [0x4ca698], 0
je 0x408f5d
test byte [esp + 0x1e], 2
jne 0x408f77
push str.AHK_Mouse
push 0
push 0
call esi
mov dword [0x4cad8c], eax
jmp 0x408f77
test byte [esp + 0x1e], 2
je 0x408f77
mov ecx, dword [0x4cad8c]
push ecx
call edi
mov dword [0x4cad8c], 0
cmp byte [esp + 0x1f], 0
je 0x408fb0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4c694c], 0
push 0
push 0
push 0x10000
push str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.0047ab10
add esp, 0x18
mov dword [0x4c694c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aa40
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.0049af60
cmp byte [0x4cc1fc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
jne 0x40abb2
cmp dword [0x4cadac], 0
jne 0x40aa76
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cadac], eax
mov ebx, 1
add dword [0x4cc200], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4cc200]
mov esi, dword [0x4c6960]
mov ecx, eax
sub ecx, dword [0x4cadac]
mov dword [0x4cadb0], eax
cmp edx, dword [0x4c695c]
jbe 0x40aaac
cmp ecx, esi
jb 0x40ab10
xor ebx, ebx
cmp ecx, esi
jbe 0x40aac9
mov dword [0x4cc200], 0
mov dword [0x4cadac], eax
test ebx, ebx
jne 0x40abb2
mov esi, dword [esp + 0x1018]
mov cl, byte [esi + 0xf]
push 0
mov byte [0x4cbfe6], cl
mov ecx, dword [ebp]
inc byte [ebp + 0x16]
push 0
push 0x4a3914
push ecx
xor eax, eax
xor edx, edx
call fcn.0046e030
dec byte [ebp + 0x16]
add esp, 0x10
test eax, eax
jne 0x40ab80
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.00475ec0
add esp, 0xc
call fcn.004099e0
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4cc1fc], bl
mov dword [0x4c694c], 0
call fcn.0047ab10
add esp, 0x18
cmp eax, 7
jne 0x40ab69
push 0
push 5
push 0x4cb520
call fcn.00417910
mov eax, dword [0x4cadb0]
mov dword [0x4c694c], ebx
mov byte [0x4cc1fc], 0
jmp 0x40aab2
cmp byte [ebp + 0x1b], 0
je 0x40abb2
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40abb2
movzx edx, word [esi + 4]
mov eax, dword [0x4ca564]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
Function at 0x4106c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
cmp dword [0x4cade4], 2
push ebx
push ebp
push esi
sete bl
push edi
mov esi, ecx
test bl, bl
je 0x410705
movzx eax, ax
lea ecx, [esp + 0x30]
test eax, 0xffffff80
je 0x4106f3
mov ecx, 0x30
mov word [esp + 0x30], cx
lea ecx, [esp + 0x32]
push 0xa
push ecx
push eax
call fcn.0048f4e5
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp 0x410708
movzx edi, ax
test esi, esi
jle 0x4107b9
mov ebp, esi
cmp dword [0x4cade4], 0
jne 0x410775
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4cc01c]
mov edx, dword [0x4c6a44]
cmp eax, dword [edx + 0xd8]
jbe 0x410775
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41076e
push 1
push 0xffffffffffffffff
mov dword [0x4c694c], 0
call fcn.004013d0
add esp, 8
mov dword [0x4c694c], 1
call esi
mov dword [0x4cc01c], eax
test bl, bl
je 0x410784
lea eax, [esp + 0x30]
call fcn.004107d0
jmp 0x410791
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0040edb0
add esp, 4
cmp dword [0x4cade4], 2
jne 0x4107a5
mov edx, dword [0x4c6a44]
mov esi, dword [edx + 0x60]
jmp 0x4107ad
mov eax, dword [0x4c6a44]
mov esi, dword [eax + 0x5c]
call fcn.00412660
dec ebp
jne 0x410712
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x4107d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
cmp dword [0x4cade4], 0
push ebx
push esi
push edi
mov esi, eax
je 0x4107eb
mov al, byte [0x4c9483]
jmp 0x410910
cmp dword [0x4ca694], 0
je 0x4107fe
mov al, byte [0x4ca561]
jmp 0x410910
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [esp + 0x13], 0
call edi
mov ecx, 0x8000
test cx, ax
je 0x41081f
mov byte [esp + 0xf], 0x10
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
je 0x410835
or byte [esp + 0xf], 0x20
push 0xa2
call edi
mov ecx, 0x8000
test cx, ax
je 0x41084b
or byte [esp + 0xf], 1
push 0xa3
call edi
mov edx, 0x8000
test dx, ax
je 0x410861
or byte [esp + 0xf], 2
push 0xa4
call edi
mov ecx, 0x8000
test cx, ax
je 0x410877
or byte [esp + 0xf], 4
push 0xa5
call edi
mov edx, 0x8000
test dx, ax
je 0x41088d
or byte [esp + 0xf], 8
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
je 0x4108a0
or byte [esp + 0xf], 0x40
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x4108b3
or byte [esp + 0xf], 0x80
cmp dword [0x4ca694], 0
je 0x41090c
mov bl, byte [esp + 0xf]
not bl
and bl, byte [0x4ca561]
je 0x41090c
mov cl, byte [0x4ca563]
mov al, bl
not al
and byte [0x4ca561], al
and byte [0x4ca562], al
and cl, al
mov al, cl
mov byte [0x4ca563], cl
mov ecx, 0x4ca588
call fcn.00413230
mov eax, dword [0x4c9474]
test eax, eax
je 0x41090c
test byte [eax + 8], bl
je 0x41090c
mov dword [0x4c9474], 0
mov al, byte [esp + 0xf]
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
push 1
and al, 0xc4
push 0
or al, 4
movzx edx, al
push 0
push ecx
push edx
mov eax, 0xffc3d44f
call fcn.00412a50
movzx eax, word [esi]
add esp, 0x14
cmp eax, 0x30
jb 0x41096f
lea esp, [esp]
cmp ax, 0x39
ja 0x41096f
mov al, byte [esi]
push 0xffc3d44d
push 0
add al, 0x30
push 0
movzx ecx, al
push 0
push ecx
push 2
call fcn.00410c00
movzx eax, word [esi + 2]
add esi, 2
add esp, 0x18
cmp eax, 0x30
jae 0x410940
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
call fcn.00410c00
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x411ef0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x4120d1
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x4120d1
mov edx, dword [0x4cade4]
cmp edx, 2
jne 0x411f65
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.004122b0
add esp, 4
call fcn.00412730
cmp byte [esp + 0x24], 0
je 0x4120d1
mov dword [esi], SysReAllocString
mov dword [ebp], SysStringLen
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x411fba
cmp edx, 1
jne 0x411fa0
cmp dword [0x4c9484], 0x80000000
jne 0x411f8e
push 0x4c9484
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c9484]
add dword [esi], eax
mov ecx, dword [0x4c9488]
add dword [ebp], ecx
jmp 0x411fdf
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x411fdf
mov edx, dword [0x4c6a44]
movzx eax, word [edx + 0xf0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x411fdf
push eax
mov edi, ebp
mov ebx, esi
call fcn.004772c0
add esp, 4
cmp dword [0x4cade4], 1
jne 0x411ff8
mov eax, dword [esi]
mov dword [0x4c9484], eax
mov ecx, dword [ebp]
mov dword [0x4c9488], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x4120bb
cmp eax, 0x64
jle 0x412053
mov dword [esp + 0x20], 0x64
jmp 0x412057
test eax, eax
je 0x4120bb
cmp dword [0x4cade4], 1
je 0x4120bb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.00455b00
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.004120e0
add esp, 4
call fcn.00412730
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x412510
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 8
cmp dword [0x4cade4], 1
push ebx
jne 0x4125d7
xor bl, bl
cmp dword [0x4ca694], 0
mov byte [esp + 8], bl
je 0x412536
mov bl, 1
mov byte [esp + 8], bl
cmp dword [0x4ca698], 0
je 0x412546
or bl, 2
mov byte [esp + 8], bl
test bl, bl
je 0x412561
mov al, byte [0x4c9482]
not al
and al, bl
movzx ecx, al
push 1
push ecx
call fcn.00408d70
add esp, 8
mov edx, dword [0x4c9498]
mov eax, dword [0x4c9494]
push 0x1c
push edx
push eax
call dword [sym.imp.USER32.dll_SendInput]
test bl, bl
je 0x412655
mov cl, byte [0x4c9482]
and cl, bl
test cl, 1
je 0x4125be
push 1
call fcn.00413100
mov dl, byte [esp + 0x18]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4ca563]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4ca563], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4c92c0], eax
mov edx, dword [esp + 8]
pop ebx
add esp, 8
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.00408d70
mov eax, dword [0x4ca55c]
push 0
push eax
push 0x410990
push 1
mov dword [0x4c948c], 0
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4ca69c], eax
test eax, eax
je 0x412655
mov byte [0x4ca586], 1
push 1
push 0x8000012f
mov dword [0x4c694c], 0
call fcn.004013d0
add esp, 8
cmp dword [0x4ca69c], 0
mov dword [0x4c694c], 1
jne 0x412606
mov eax, dword [0x4c9498]
mov ecx, dword [0x4c9494]
cmp dword [eax + ecx*8 - 8], 0
mov byte [0x4ca586], 0
jne 0x412655
mov ecx, dword [eax + ecx*8 - 4]
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
pop ebx
add esp, 8
ret

Function at 0x412820
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4cad78]
test eax, eax
je 0x412938
mov ecx, dword [0x4cad7c]
imul ecx, ecx, 0xd4
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 6], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov ecx, 0x69
mov word [eax + 2], dx
push esi
mov word [eax + 4], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4cc1cc]
mov dword [0x4cad80], eax
mov dword [esp + 4], edx
fild dword [esp + 4]
jns 0x41287b
fadd dword [0x4c0ce0]
fdiv qword [0x4c0cd8]
mov ecx, dword [0x4cad7c]
mov edx, dword [0x4cad78]
mov dword [0x4cc1cc], eax
imul ecx, ecx, 0xd4
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [ecx + edx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4128e8
mov eax, dword [0x4cad7c]
imul eax, eax, 0xd4
cmp esi, dword [0x4cad84]
je 0x4128d9
mov ecx, dword [0x4cad78]
push 0x64
lea edx, [eax + ecx + 0xc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412914
mov edx, dword [0x4cad78]
xor ecx, ecx
mov word [eax + edx + 0xc], cx
jmp 0x412914
mov ecx, dword [0x4cad7c]
mov edx, dword [0x4cad78]
imul ecx, ecx, 0xd4
mov eax, 0x4a5954
lea edx, [ecx + edx + 0xc]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x412905
mov eax, dword [0x4cad7c]
inc eax
mov dword [0x4cad84], esi
mov dword [0x4cad7c], eax
pop esi
cmp eax, dword [0x4c6950]
jl 0x412938
mov dword [0x4cad7c], 0
pop ecx
ret