joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1226adb
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
mov eax, 0x125594c
call fcn.0113d4e8
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0x10294b0
mov dword [esi + 4], 0x10294a0
mov dword [esi + 8], 0x102948c
mov dword [esi + 0xc], 0x1029468
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [ebp - 0x10], esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [ebp - 4], eax
fldz
fstp qword [esi + 0x48]
fldz
fstp qword [esi + 0x50]
mov ecx, dword [0x12890a0]
mov dword [esi + 0x58], ecx
mov byte [ebp - 4], 1
fld1
lea ecx, [esi + 0x70]
fstp qword [esi + 0x60]
mov dword [esi + 0x5c], 1
mov dword [esi + 0x68], eax
call fcn.0119cff5
mov byte [ebp - 4], 2
lea ecx, [esi + 0x88]
call fcn.0122611a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x12295a3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1255c83
call fcn.0113d4e8
push ecx
push esi
mov esi, ecx
and dword [esi], 0
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [esi + 4]
call fcn.0122950d
xor eax, eax
inc eax
mov byte [ebp - 4], al
and dword [esi + 0x3c], 0
push 2
pop ecx
push 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
pop eax
mov dword [esi + 8], 0xd
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], 0x43535449
mov dword [esi + 0x18], 0x2000
mov dword [esi + 0x1c], 0x14
mov dword [esi + 0x24], 6
mov dword [esi + 0x28], 0x43585a4c
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x12295ae
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1255c83
call fcn.0113d4e8
push ecx
push esi
mov esi, ecx
and dword [esi], 0
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [esi + 4]
call fcn.0122950d
xor eax, eax
inc eax
mov byte [ebp - 4], al
and dword [esi + 0x3c], 0
push 2
pop ecx
push 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
pop eax
mov dword [esi + 8], 0xd
mov dword [esi + 0xc], 5
mov dword [esi + 0x10], 0x43535449
mov dword [esi + 0x18], 0x2000
mov dword [esi + 0x1c], 0x14
mov dword [esi + 0x24], 6
mov dword [esi + 0x28], 0x43585a4c
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x420ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x420ee4
pop dword [ebp - 0x34]
mov eax, 0xe3e92fd3
sub eax, 0xe3a720ef
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe487b6b6
sub dword [ebp - 0x44], 0x9635716b
mov dword [ebp - 0x40], 0xd3cb6524
sub dword [ebp - 0x40], 0xa19818df
mov dword [ebp - 0x3c], 0xf5cea025
sub dword [ebp - 0x3c], 0xa9825bf7
mov dword [ebp - 0x38], 0x26cb75e3
add dword [ebp - 0x38], 0xd9348a1d
lea eax, [ebp - 0x44]
push eax
mov eax, 0x8e2cbe76
sub eax, 0x8dea8e02
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x7bf32e67
sub dword [ebp - 0x44], 0x780c511
mov dword [ebp - 0x40], 0xd373c6d1
sub dword [ebp - 0x40], 0x9207655c
mov dword [ebp - 0x3c], 0x49cccae1
add dword [ebp - 0x3c], 0x19a2a18b
mov dword [ebp - 0x38], 0xef67f716
add dword [ebp - 0x38], 0x109808ea
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe51f5a04
sub eax, 0xe4dd28e0
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c458
push 0
call eax
mov ecx, 0xba6f0768
sub ecx, 0xba6ec555
xor ebx, ebx
add ebx, eax
mov edi, 0x434400
add edi, dword [ebp - 0x34]
mov edx, 0xeb281ac8
add edx, 0x5997467c
add dword [ebp - 0xc], 0xaf4954a7
mov esi, dword [edi]
add dword [ebp - 8], ecx
xor esi, edx
sub dword [ebp - 0x28], edi
mov dword [ebx], esi
xor dword [ebp - 0x14], edx
add ebx, 4
add edi, 4
loop 0x421002
add eax, 0xfb1f
xor ebx, ebx
add ebx, eax
add eax, 0x74459325
sub eax, 0x74459320
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x41a1f8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x41a1fc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x311a414], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x84c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [0x41a200]
mov edx, dword [0x41a204]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x311a414], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x311a410]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x311a414], 0x3eb
mov dword [0x311a410], eax
mov eax, dword [0x311a364]
cmove eax, dword [ebp - 8]
mov dword [0x311a364], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
add dword [ebp - 0x10], edx
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [0x311a40c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x311a414], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x40135a
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x311a414], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139d
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
jne 0x40127f
mov edi, dword [ebp - 0x28]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c027
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4195a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040797c
mov dword [ebp - 0x14], eax
cmp dword [0x820af0], esi
jne 0x40c11a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c0a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c1fa
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c1fa
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c1fa
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x820af0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x820af4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x820af8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x820b00], eax
test eax, eax
je 0x40c117
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x820afc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c13f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c132
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c154
push 4
pop eax
jmp 0x40c1fc
cmp dword [ebp - 0x14], esi
je 0x40c154
push dword [0x820af0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c139
mov eax, dword [0x820afc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c1b2
cmp dword [0x820b00], edi
je 0x40c1b2
push eax
call ebx
push dword [0x820b00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c1b2
test eax, eax
je 0x40c1b2
call ecx
test eax, eax
je 0x40c1a7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c1a7
test byte [ebp - 8], 1
jne 0x40c1b2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c1e2
mov eax, dword [0x820af4]
cmp eax, edi
je 0x40c1df
push eax
call ebx
test eax, eax
je 0x40c1df
call eax
mov esi, eax
test esi, esi
je 0x40c1df
mov eax, dword [0x820af8]
cmp eax, edi
je 0x40c1df
push eax
call ebx
test eax, eax
je 0x40c1df
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x820af0]
call ebx
test eax, eax
je 0x40c1fa
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c1fc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040388c
mov esp, ebp
pop ebp
ret
Function at 0x100042c0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x100042f3
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [esp + 0xc]
push 0x10003e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100042f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0xc

Function at 0x10004f10
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x10004f19
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.10004f10
Function at 0x10010fd0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [0x1024b32c]
push esi
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je case.default.0x100110eb
mov ecx, dword [0x1024b32c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je case.default.0x100110eb
mov edi, dword [0x10281360]
test edi, edi
je case.default.0x100110eb
mov eax, dword [0x1028135c]
test eax, eax
jne 0x10011044
mov edx, 0xe80c2f78
mov ecx, 0x10219689
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x1028135c], eax
cmp dword [eax + edi], 0
jle case.default.0x100110eb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x10011064
mov esi, 0x811c9dc5
jmp 0x1001107a
movsx eax, al
inc ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.10004f10
mov esi, eax
mov ecx, dword [ebx]
push 0
push str.attacker
mov edx, dword [ecx + 0x18]
mov ecx, ebx
call edx
mov ecx, dword [0x1024b32c]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
call edx
mov ecx, dword [0x102812e0]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
test eax, eax
je case.default.0x100110eb
test esi, esi
je case.default.0x100110eb
cmp esi, 0x1b30ddf0
jne case.default.0x100110eb
cmp eax, dword [0x10281360]
jne case.default.0x100110eb
cmp byte [0x10281410], 0
mov dword [0x102813fc], 0xff
je case.default.0x100110eb
mov eax, dword [0x10281454]
cmp eax, 3
ja case.default.0x100110eb
jmp dword [eax*4 + 0x10011158]
mov ecx, dword [0x102813f8]
push str.buttons_arena_switch_press_02.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102813f8]
push str.buttons_button22.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102813f8]
push str.survivalmoney_collect_01.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102813f8]
push str.Ui_beep07.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
Function at 0x100161c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x10281360]
mov ebx, edx
mov dword [esp + 0x10], ecx
test edi, edi
je case.0x10016242.0
mov eax, dword [0x1028135c]
test eax, eax
jne 0x10016217
mov edx, 0xe80c2f78
mov ecx, 0x10219689
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x1028135c], eax
cmp dword [eax + edi], 0
jle case.0x10016242.0
cmp byte [0x1028165a], 0
je case.0x10016242.0
mov ecx, dword [0x10247244]
mov eax, dword [0x10281650]
cmp ecx, 3
ja case.0x10016242.0
jmp dword [ecx*4 + 0x10016358]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001627a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001627a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
jne case.0x10016242.0
call fcn.1000b770
cmp eax, 9
je case.0x10016242.0
cmp eax, 8
je case.0x10016242.0
mov eax, dword [0x102813b4]
mov edi, dword [0x10281360]
test eax, eax
jne 0x100162d6
mov edx, 0xe80c2f78
mov ecx, 0x102197a5
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813b4], eax
test byte [eax + edi], 1
je case.0x10016242.0
movss xmm3, dword [0x102472bc]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
movaps xmm1, xmm3
movss dword [esp + 0xc], xmm3
xorps xmm1, xmmword [0x10240c20]
movaps xmm2, xmm3
xorps xmm2, xmmword [0x10240c20]
movss xmm0, dword [edx]
comiss xmm0, xmm1
movss dword [esp + 0x14], xmm1
cmovae ecx, edx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
cmp byte [0x102815cd], 0
je case.0x10016242.0
movss xmm0, dword [ebx]
lea ecx, [esp + 0x14]
comiss xmm0, xmm2
lea eax, [esp + 0xc]
movss dword [esp + 0x14], xmm2
cmovae ecx, ebx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ba70
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10281635], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001bccc
mov ecx, dword [0x102472a8]
mov eax, dword [0x102815e0]
cmp ecx, 3
ja case.0x1001ba92.0
jmp dword [ecx*4 + 0x1001bcd0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001baca
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001baca
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001bccc
mov edi, dword [0x10281360]
test edi, edi
je 0x1001bccc
mov eax, dword [0x1028135c]
test eax, eax
jne 0x1001bb17
mov edx, 0xe80c2f78
mov ecx, 0x10219689
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x1028135c], eax
cmp dword [eax + edi], 0
jle 0x1001bccc
call fcn.1000b770
cmp eax, 9
je 0x1001bccc
cmp eax, 8
je 0x1001bccc
cmp byte [0x102496a5], 0
je 0x1001bccc
mov eax, dword [0x1028159c]
mov ecx, dword [0x1024b2f0]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10286fd0]
cmp eax, dword [ecx + 4]
jle 0x1001bba1
push 0x10286fd0
call fcn.1018b6e4
add esp, 4
cmp dword [0x10286fd0], 0xffffffff
jne 0x1001bba1
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10007f00
push 0x10286fd0
mov dword [0x10286fd4], eax
call fcn.1018b693
add esp, 4
push esi
push 0
call dword [0x10286fd4]
cmp byte [0x102496a4], 0
jne 0x1001bc40
mov eax, dword [0x102496ac]
cmp eax, dword [ebx + 8]
jge 0x1001bbf1
cmp byte [0x102815e9], 0
je 0x1001bbe6
cmp byte [0x10286f5b], 0
jne 0x1001bbe6
push str._gravity___print_pixelbug
push dword [0x102813dc]
call fcn.1000b720
add esp, 8
mov byte [0x102496a4], 1
mov al, 1
jmp 0x1001bbf3
xor al, al
mov byte [0x10281674], al
lea edx, [ebx + 0x30]
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov ecx, dword [0x102496b4]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x2c], eax
jmp 0x1001bc43
lea edx, [ebx + 0x30]
cmp byte [0x102496a6], 0
mov eax, dword [edx]
je 0x1001bc53
or eax, 4
jmp 0x1001bc56
and eax, 0xfffffffb
mov dword [edx], eax
cmp byte [0x102496a4], 0
je 0x1001bccc
mov eax, dword [0x102813d8]
mov edi, dword [0x10281360]
test eax, eax
jne 0x1001bc9e
mov edx, 0xe80c2f78
mov ecx, 0x10219945
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195d9
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813d8], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x10240958]
lahf
test ah, 0x44
jnp 0x1001bccc
mov byte [0x10286f5e], 0
mov byte [0x10281674], 0
mov word [0x102496a4], 0
pop edi
pop esi
pop ebx
ret
Function at 0x1001ba99
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10281635], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001bccc
mov ecx, dword [0x102472a8]
mov eax, dword [0x102815e0]
cmp ecx, 3
ja case.0x1001ba92.0
jmp dword [ecx*4 + 0x1001bcd0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001baca
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001baca
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001bccc
mov edi, dword [0x10281360]
test edi, edi
je 0x1001bccc
mov eax, dword [0x1028135c]
test eax, eax
jne 0x1001bb17
mov edx, 0xe80c2f78
mov ecx, 0x10219689
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x1028135c], eax
cmp dword [eax + edi], 0
jle 0x1001bccc
call fcn.1000b770
cmp eax, 9
je 0x1001bccc
cmp eax, 8
je 0x1001bccc
cmp byte [0x102496a5], 0
je 0x1001bccc
mov eax, dword [0x1028159c]
mov ecx, dword [0x1024b2f0]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10286fd0]
cmp eax, dword [ecx + 4]
jle 0x1001bba1
push 0x10286fd0
call fcn.1018b6e4
add esp, 4
cmp dword [0x10286fd0], 0xffffffff
jne 0x1001bba1
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10007f00
push 0x10286fd0
mov dword [0x10286fd4], eax
call fcn.1018b693
add esp, 4
push esi
push 0
call dword [0x10286fd4]
cmp byte [0x102496a4], 0
jne 0x1001bc40
mov eax, dword [0x102496ac]
cmp eax, dword [ebx + 8]
jge 0x1001bbf1
cmp byte [0x102815e9], 0
je 0x1001bbe6
cmp byte [0x10286f5b], 0
jne 0x1001bbe6
push str._gravity___print_pixelbug
push dword [0x102813dc]
call fcn.1000b720
add esp, 8
mov byte [0x102496a4], 1
mov al, 1
jmp 0x1001bbf3
xor al, al
mov byte [0x10281674], al
lea edx, [ebx + 0x30]
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov ecx, dword [0x102496b4]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [0x102496b4]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x2c], eax
jmp 0x1001bc43
lea edx, [ebx + 0x30]
cmp byte [0x102496a6], 0
mov eax, dword [edx]
je 0x1001bc53
or eax, 4
jmp 0x1001bc56
and eax, 0xfffffffb
mov dword [edx], eax
cmp byte [0x102496a4], 0
je 0x1001bccc
mov eax, dword [0x102813d8]
mov edi, dword [0x10281360]
test eax, eax
jne 0x1001bc9e
mov edx, 0xe80c2f78
mov ecx, 0x10219945
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195d9
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813d8], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x10240958]
lahf
test ah, 0x44
jnp 0x1001bccc
mov byte [0x10286f5e], 0
mov byte [0x10281674], 0
mov word [0x102496a4], 0
pop edi
pop esi
pop ebx
ret