joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100200ca
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b8], 0
push esi
push edi
je 0x10020203
mov eax, dword [0x1011e224]
mov ecx, dword [0x1012058c]
dec eax
cmp eax, 3
ja case.default.0x100200b4
jmp dword [eax*4 + 0x1002020c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100200eb
mov al, byte [ebp + 0xb]
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020203
mov edi, dword [0x10120420]
test edi, edi
je 0x10020203
mov eax, dword [0x10120334]
test eax, eax
jne 0x10020165
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020203
call fcn.1000f8e0
cmp eax, 9
je 0x10020203
call fcn.1000f8e0
cmp eax, 8
je 0x10020203
call fcn.10023560
test byte [eax + 8], 1
je 0x10020203
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x100201d2
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020203
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a890
mov byte [eax + 0x1b], 1
cmp byte [0x1012078b], 0
je 0x100201f6
call fcn.1001faa0
cmp byte [0x10120793], 0
je 0x10020203
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x100200d9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b8], 0
push esi
push edi
je 0x10020203
mov eax, dword [0x1011e224]
mov ecx, dword [0x1012058c]
dec eax
cmp eax, 3
ja case.default.0x100200b4
jmp dword [eax*4 + 0x1002020c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100200eb
mov al, byte [ebp + 0xb]
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020203
mov edi, dword [0x10120420]
test edi, edi
je 0x10020203
mov eax, dword [0x10120334]
test eax, eax
jne 0x10020165
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020203
call fcn.1000f8e0
cmp eax, 9
je 0x10020203
call fcn.1000f8e0
cmp eax, 8
je 0x10020203
call fcn.10023560
test byte [eax + 8], 1
je 0x10020203
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x100201d2
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020203
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a890
mov byte [eax + 0x1b], 1
cmp byte [0x1012078b], 0
je 0x100201f6
call fcn.1001faa0
cmp byte [0x10120793], 0
je 0x10020203
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x10020220
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120585], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002045d
mov eax, dword [0x1011e210]
mov edx, dword [0x10120598]
dec eax
cmp eax, 3
ja case.default.0x10020246
jmp dword [eax*4 + 0x10020464]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002027d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002045d
mov edi, dword [0x10120420]
test edi, edi
je 0x1002045d
mov eax, dword [0x10120334]
test eax, eax
jne 0x100202f7
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x1002045d
call fcn.1000f8e0
cmp eax, 9
je 0x1002045d
call fcn.1000f8e0
cmp eax, 8
je 0x1002045d
call fcn.10023560
test byte [eax + 8], 1
jne 0x1002037d
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020368
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
je 0x1002037d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020458
cmp byte [ebx + 1], 0
jne 0x10020458
mov esi, dword [0x101204a4]
mov edi, dword [0x10120420]
test esi, esi
jne 0x100203d4
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110509
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100c5
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov esi, eax
mov dword [0x101204a4], esi
call fcn.10023560
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020458
call fcn.10023560
test byte [eax + 8], 1
jne 0x10020458
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020432
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020458
call fcn.1000f8e0
cmp eax, 8
je 0x10020458
call fcn.1000f8e0
cmp eax, 0xa
je 0x10020458
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002024d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120585], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002045d
mov eax, dword [0x1011e210]
mov edx, dword [0x10120598]
dec eax
cmp eax, 3
ja case.default.0x10020246
jmp dword [eax*4 + 0x10020464]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002027d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002045d
mov edi, dword [0x10120420]
test edi, edi
je 0x1002045d
mov eax, dword [0x10120334]
test eax, eax
jne 0x100202f7
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x1002045d
call fcn.1000f8e0
cmp eax, 9
je 0x1002045d
call fcn.1000f8e0
cmp eax, 8
je 0x1002045d
call fcn.10023560
test byte [eax + 8], 1
jne 0x1002037d
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020368
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
je 0x1002037d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020458
cmp byte [ebx + 1], 0
jne 0x10020458
mov esi, dword [0x101204a4]
mov edi, dword [0x10120420]
test esi, esi
jne 0x100203d4
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110509
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100c5
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov esi, eax
mov dword [0x101204a4], esi
call fcn.10023560
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020458
call fcn.10023560
test byte [eax + 8], 1
jne 0x10020458
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020432
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020458
call fcn.1000f8e0
cmp eax, 8
je 0x10020458
call fcn.1000f8e0
cmp eax, 0xa
je 0x10020458
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002025c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120585], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002045d
mov eax, dword [0x1011e210]
mov edx, dword [0x10120598]
dec eax
cmp eax, 3
ja case.default.0x10020246
jmp dword [eax*4 + 0x10020464]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002027d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002045d
mov edi, dword [0x10120420]
test edi, edi
je 0x1002045d
mov eax, dword [0x10120334]
test eax, eax
jne 0x100202f7
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x1002045d
call fcn.1000f8e0
cmp eax, 9
je 0x1002045d
call fcn.1000f8e0
cmp eax, 8
je 0x1002045d
call fcn.10023560
test byte [eax + 8], 1
jne 0x1002037d
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020368
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
je 0x1002037d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020458
cmp byte [ebx + 1], 0
jne 0x10020458
mov esi, dword [0x101204a4]
mov edi, dword [0x10120420]
test esi, esi
jne 0x100203d4
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110509
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100c5
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov esi, eax
mov dword [0x101204a4], esi
call fcn.10023560
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020458
call fcn.10023560
test byte [eax + 8], 1
jne 0x10020458
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020432
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020458
call fcn.1000f8e0
cmp eax, 8
je 0x10020458
call fcn.1000f8e0
cmp eax, 0xa
je 0x10020458
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002026b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120585], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002045d
mov eax, dword [0x1011e210]
mov edx, dword [0x10120598]
dec eax
cmp eax, 3
ja case.default.0x10020246
jmp dword [eax*4 + 0x10020464]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002027d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002027d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002045d
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002045d
mov edi, dword [0x10120420]
test edi, edi
je 0x1002045d
mov eax, dword [0x10120334]
test eax, eax
jne 0x100202f7
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x1002045d
call fcn.1000f8e0
cmp eax, 9
je 0x1002045d
call fcn.1000f8e0
cmp eax, 8
je 0x1002045d
call fcn.10023560
test byte [eax + 8], 1
jne 0x1002037d
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020368
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
je 0x1002037d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020458
cmp byte [ebx + 1], 0
jne 0x10020458
mov esi, dword [0x101204a4]
mov edi, dword [0x10120420]
test esi, esi
jne 0x100203d4
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110509
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100c5
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov esi, eax
mov dword [0x101204a4], esi
call fcn.10023560
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020458
call fcn.10023560
test byte [eax + 8], 1
jne 0x10020458
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x10020432
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020458
call fcn.1000f8e0
cmp eax, 8
je 0x10020458
call fcn.1000f8e0
cmp eax, 0xa
je 0x10020458
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10021710
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120584], 0
push ebx
push esi
push edi
je 0x100218dc
mov eax, dword [0x1011e20c]
mov ecx, dword [0x10120594]
dec eax
cmp eax, 3
ja case.default.0x10021734
jmp dword [eax*4 + 0x100218e4]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002176b
mov al, byte [ebp + 0xb]
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100218dc
mov edi, dword [0x10120420]
test edi, edi
je 0x100218dc
mov eax, dword [0x10120334]
test eax, eax
jne 0x100217e5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x100218dc
call fcn.1000f8e0
cmp eax, 9
je 0x100218dc
call fcn.1000f8e0
cmp eax, 8
je 0x100218dc
mov ecx, dword [0x101202e0]
mov edi, dword [0x10120420]
mov ebx, edi
test ecx, ecx
jne 0x10021857
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov edi, dword [0x10120420]
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x101202ec]
je 0x1002187d
cmp byte [0x101208a0], 0
jne 0x1002187d
mov edx, dword [eax + 0x1c]
mov dword [0x101209ec], edx
mov byte [0x101208a0], 1
jmp 0x10021883
mov edx, dword [0x101209ec]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011e24c]
jle 0x100218dc
test ecx, ecx
jne 0x100218c8
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + edi], 1
je 0x100218dc
mov eax, dword [ebp + 8]
mov byte [0x101208a0], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002173b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120584], 0
push ebx
push esi
push edi
je 0x100218dc
mov eax, dword [0x1011e20c]
mov ecx, dword [0x10120594]
dec eax
cmp eax, 3
ja case.default.0x10021734
jmp dword [eax*4 + 0x100218e4]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002176b
mov al, byte [ebp + 0xb]
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100218dc
mov edi, dword [0x10120420]
test edi, edi
je 0x100218dc
mov eax, dword [0x10120334]
test eax, eax
jne 0x100217e5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x100218dc
call fcn.1000f8e0
cmp eax, 9
je 0x100218dc
call fcn.1000f8e0
cmp eax, 8
je 0x100218dc
mov ecx, dword [0x101202e0]
mov edi, dword [0x10120420]
mov ebx, edi
test ecx, ecx
jne 0x10021857
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov edi, dword [0x10120420]
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x101202ec]
je 0x1002187d
cmp byte [0x101208a0], 0
jne 0x1002187d
mov edx, dword [eax + 0x1c]
mov dword [0x101209ec], edx
mov byte [0x101208a0], 1
jmp 0x10021883
mov edx, dword [0x101209ec]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011e24c]
jle 0x100218dc
test ecx, ecx
jne 0x100218c8
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + edi], 1
je 0x100218dc
mov eax, dword [ebp + 8]
mov byte [0x101208a0], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002174a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10120584], 0
push ebx
push esi
push edi
je 0x100218dc
mov eax, dword [0x1011e20c]
mov ecx, dword [0x10120594]
dec eax
cmp eax, 3
ja case.default.0x10021734
jmp dword [eax*4 + 0x100218e4]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002176b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002176b
mov al, byte [ebp + 0xb]
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100218dc
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100218dc
mov edi, dword [0x10120420]
test edi, edi
je 0x100218dc
mov eax, dword [0x10120334]
test eax, eax
jne 0x100217e5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x100218dc
call fcn.1000f8e0
cmp eax, 9
je 0x100218dc
call fcn.1000f8e0
cmp eax, 8
je 0x100218dc
mov ecx, dword [0x101202e0]
mov edi, dword [0x10120420]
mov ebx, edi
test ecx, ecx
jne 0x10021857
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov edi, dword [0x10120420]
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x101202ec]
je 0x1002187d
cmp byte [0x101208a0], 0
jne 0x1002187d
mov edx, dword [eax + 0x1c]
mov dword [0x101209ec], edx
mov byte [0x101208a0], 1
jmp 0x10021883
mov edx, dword [0x101209ec]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011e24c]
jle 0x100218dc
test ecx, ecx
jne 0x100218c8
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ecx, eax
mov dword [0x101202e0], ecx
test byte [ecx + edi], 1
je 0x100218dc
mov eax, dword [ebp + 8]
mov byte [0x101208a0], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4