joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100801a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 8
push esi
mov esi, ecx
push edi
cmp eax, 0xffffffff
jne 0x100802a9
mov eax, dword [esi + 8]
movsd xmm0, qword [eax + 0x68]
comisd xmm0, xmmword [eax + 0x10]
jbe 0x100801d5
cmp dword [eax + 0x70], 0
jle 0x100801d5
mov dword [eax + 0x70], 0xffffffff
mov eax, dword [esi + 8]
cmp dword [eax + 0x70], 0
jle 0x100801ea
movsd xmm0, qword [eax + 0x18]
addsd xmm0, qword [eax + 0x68]
jmp 0x100801f4
movsd xmm0, qword [eax + 0x68]
subsd xmm0, qword [eax + 0x20]
movsd qword [eax + 0x68], xmm0
mov eax, dword [esi + 8]
movsd xmm0, qword [0x10139a58]
comisd xmm0, xmmword [eax + 0x68]
jbe 0x10080360
cmp dword [eax + 0x70], 0
jge 0x10080360
mov ecx, dword [esi + 0xc]
push 0xffffffffffffffff
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 8]
movsd xmm0, qword [0x10139a58]
mov dword [eax + 0x44], 1
mov eax, dword [esi + 8]
movsd qword [eax + 0x68], xmm0
mov eax, dword [esi + 8]
mov dword [eax + 0x70], 0xffffffff
mov edi, dword [esi + 8]
mov eax, dword [edi + 0x48]
test eax, eax
je 0x1008026a
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x1008026a
mov dword [edi + 0x48], 0
mov edi, dword [esi + 8]
push dword [edi + 0x4c]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x10080281
mov dword [edi + 0x4c], 0
mov ecx, dword [esi + 0xc]
push 0
push 0
push 0x7f04
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x3c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xfffffffe
jne 0x10080383
mov eax, dword [esi + 8]
movsd xmm0, qword [eax + 0x68]
subsd xmm0, qword [eax + 0x30]
movsd qword [eax + 0x68], xmm0
mov eax, dword [esi + 8]
movsd xmm0, qword [eax + 0x28]
comisd xmm0, xmmword [eax + 0x68]
jbe 0x10080360
mov ecx, dword [esi + 0xc]
push 0xfffffffffffffffe
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 8]
movsd xmm0, qword [0x10139a58]
mov dword [eax + 0x44], 1
mov eax, dword [esi + 8]
movsd qword [eax + 0x68], xmm0
mov eax, dword [esi + 8]
mov dword [eax + 0x70], 1
mov edi, dword [esi + 8]
mov eax, dword [edi + 0x48]
test eax, eax
je 0x10080328
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x10080328
mov dword [edi + 0x48], 0
mov edi, dword [esi + 8]
push dword [edi + 0x4c]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x1008033f
mov dword [edi + 0x4c], 0
mov ecx, dword [esi + 0xc]
push 0
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x40]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0
push 0
push 0x7f04
call fcn.1007ff40
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov dword [esi + 4], 0
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100807b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10110283
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10056af0
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x10]
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.10093640
mov byte [esp + 0x14], 1
mov byte [esi + 0x30], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100813c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test dword [esp + 0xc], ebx
jne 0x100813cf
xor al, al
pop ebx
ret
push ebp
push 0
push 0
push ebx
push dword [esp + 0x18]
call sub.IMM32.dll_ImmGetCompositionStringW
mov ebp, eax
test ebp, ebp
jg 0x100813e9
pop ebp
xor al, al
pop ebx
ret
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, ebp
shr edi, 1
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x1c], ecx
lea eax, [edi + 1]
cmp ecx, eax
ja 0x1008142d
cmp dword [esi + 0x14], eax
je 0x1008142d
push 1
push eax
mov ecx, esi
call fcn.100069a0
test al, al
je 0x1008142d
cmp dword [esi + 0x14], 8
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
jb 0x10081425
mov eax, dword [esi]
jmp 0x10081427
mov eax, esi
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [esi + 0x10]
cmp edi, eax
ja 0x10081451
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edi
jb 0x10081447
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
jmp 0x1008145d
mov eax, esi
xor ecx, ecx
mov word [eax + edi*2], cx
jmp 0x1008145d
push 0
sub edi, eax
mov ecx, esi
push edi
call fcn.100126a0
cmp dword [esi + 0x14], 8
jb 0x10081465
mov esi, dword [esi]
push ebp
push esi
push ebx
push dword [esp + 0x20]
call sub.IMM32.dll_ImmGetCompositionStringW
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x10082110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101105f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], esi
test esi, esi
je 0x10082157
call fcn.100272c0
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
push 0
push dword [esp + 0x48]
lea ecx, [esp + 0x1c]
movq qword [esp + 0x2c], xmm0
push edi
movdqu xmmword [esp + 0x20], xmm0
call fcn.100938c0
mov eax, dword [esi + 0x48]
mov esi, dword [eax]
cmp esi, eax
je 0x100821d9
mov eax, dword [esp + 0x10]
jmp 0x10082190
mov edi, dword [esi + 8]
test edi, edi
je 0x100821ab
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.10093910
test al, al
jne 0x100821b4
mov eax, dword [esp + 0x10]
mov esi, dword [esi]
cmp esi, dword [eax + 0x48]
jne 0x10082190
jmp 0x100821d9
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push esi
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
dec dword [eax + 0x4c]
call fcn.1005d7c6
push edi
call fcn.1005d7c6
add esp, 8
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x10]
call fcn.100272d0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1005d006
add esp, 0x30
ret 8

Function at 0x10082a20
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x10110658
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.RC::RCMiniUIRealWnd.0
mov dword [esi + 4], vtable.RC::RCMiniUIRealWnd.1.0
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x10082a80
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10082a80
push 0
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xac]
test eax, eax
je 0x10082a9b
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0xac], 0
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x10082ab6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0xb0], 0
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.1007b620
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1009e4e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10113838
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
xorps xmm0, xmm0
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call sub.gdiplus.dll_GdipGetFamily
test eax, eax
je 0x1009e58a
mov dword [esp + 0x20], eax
mov dword [esi + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
push dword [esp + 0x1c]
call sub.gdiplus.dll_GdipDeleteFontFamily
fld dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005d006
add esp, 0x28
ret
lea eax, [esp + 0x10]
push eax
push dword [esi]
call sub.gdiplus.dll_GdipGetFontStyle
test eax, eax
je 0x1009e59d
mov dword [esi + 4], eax
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0x24]
call sub.gdiplus.dll_GdipGetEmHeight
movzx esi, word [esp + 0x14]
test eax, eax
mov ecx, dword [esp + 0x20]
xorps xmm1, xmm1
cmovne ecx, eax
mov dword [esp + 0x20], ecx
movd xmm0, esi
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x1009e550
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0x24]
call sub.gdiplus.dll_GdipGetCellAscent
mov ecx, dword [esp + 0x20]
test eax, eax
movzx edi, word [esp + 0x14]
cmovne ecx, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x28], ecx
push dword [esp + 0x24]
call sub.gdiplus.dll_GdipGetCellDescent
mov ecx, dword [esp + 0x20]
test eax, eax
cmovne ecx, eax
movzx eax, word [esp + 0x18]
mov dword [esp + 0x20], ecx
movd xmm1, eax
mov eax, edi
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x18]
cvtdq2ps xmm0, xmm0
push eax
push dword [esp + 0x14]
addss xmm1, xmm0
push dword [esp + 0x24]
movss dword [esp + 0x20], xmm1
call sub.gdiplus.dll_GdipGetLineSpacing
movzx edi, word [esp + 0x18]
test eax, eax
mov ecx, dword [esp + 0x20]
movss xmm1, dword [esp + 0x14]
cmovne ecx, eax
mov dword [esp + 0x20], ecx
movd xmm0, edi
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jae 0x1009e550
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push dword [eax]
call sub.gdiplus.dll_GdipGetFontSize
mov ecx, eax
test ecx, ecx
je 0x1009e68f
mov eax, dword [esp + 0xc]
mov dword [eax + 4], ecx
movss xmm0, dword [esp + 0x10]
cvtps2pd xmm0, xmm0
movd xmm1, edi
andpd xmm0, xmmword [0x101235d0]
cvtdq2ps xmm1, xmm1
cvtpd2ps xmm0, xmm0
subss xmm1, dword [esp + 0x14]
mulss xmm0, xmm1
movd xmm1, esi
cvtdq2ps xmm1, xmm1
divss xmm0, xmm1
movss dword [esp + 0xc], xmm0
jmp 0x1009e558
Function at 0x1009e760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10113868
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call sub.gdiplus.dll_GdipGetFamily
test eax, eax
je 0x1009e7dd
mov dword [esp + 0x1c], eax
mov dword [edi + 4], eax
mov dword [esp + 0xc], 0
jmp 0x1009e8e2
lea eax, [esp + 0x14]
push eax
push dword [edi]
call sub.gdiplus.dll_GdipGetFontStyle
test eax, eax
je 0x1009e7f0
mov dword [edi + 4], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.gdiplus.dll_GdipGetEmHeight
movzx esi, word [esp + 0x20]
test eax, eax
mov ecx, dword [esp + 0x1c]
xorps xmm0, xmm0
cmovne ecx, eax
mov dword [esp + 0x1c], ecx
movd xmm1, esi
cvtdq2ps xmm1, xmm1
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x1009e834
mov dword [esp + 0xc], 0
jmp 0x1009e8e2
lea eax, [esp + 0x14]
push eax
push dword [edi]
call sub.gdiplus.dll_GdipGetFontStyle
test eax, eax
je 0x1009e847
mov dword [edi + 4], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.gdiplus.dll_GdipGetLineSpacing
mov ecx, dword [esp + 0x1c]
test eax, eax
movzx edi, word [esp + 0x20]
cmovne ecx, eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
push dword [eax]
call sub.gdiplus.dll_GdipGetFontSize
mov ecx, eax
test ecx, ecx
je 0x1009e888
mov eax, dword [esp + 0xc]
mov dword [eax + 4], ecx
movss xmm0, dword [esp + 0x14]
sub esp, 8
cvtps2pd xmm0, xmm0
movd xmm1, edi
andpd xmm0, xmmword [0x101235d0]
cvtpd2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
movd xmm1, esi
cvtdq2ps xmm1, xmm1
divss xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.100deff0
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
movss dword [esp + 0xc], xmm0
mov dword [esp + 0x30], 0xffffffff
push dword [esp + 0x18]
call sub.gdiplus.dll_GdipDeleteFontFamily
fld dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005d006
add esp, 0x28
ret
Function at 0x1009e920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10113898
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x14]
push eax
push dword [esi]
call sub.gdiplus.dll_GdipGetFamily
test eax, eax
je 0x1009e99d
mov dword [esp + 0x18], eax
mov dword [esi + 4], eax
mov dword [esp + 0x20], 0
jmp 0x1009eab4
lea eax, [esp + 0x20]
push eax
push dword [esi]
call sub.gdiplus.dll_GdipGetFontStyle
test eax, eax
je 0x1009e9b0
mov dword [esi + 4], eax
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x1c]
call sub.gdiplus.dll_GdipGetEmHeight
movzx esi, word [esp + 0x1c]
test eax, eax
mov ecx, dword [esp + 0x18]
xorps xmm1, xmm1
cmovne ecx, eax
mov dword [esp + 0x18], ecx
movd xmm0, esi
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1009e9f5
mov dword [esp + 0x20], 0
jmp 0x1009eab4
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x1c]
call sub.gdiplus.dll_GdipGetCellAscent
mov ecx, dword [esp + 0x18]
test eax, eax
movzx edi, word [esp + 0x1c]
cmovne ecx, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
mov dword [esp + 0x20], ecx
push dword [esp + 0x1c]
call sub.gdiplus.dll_GdipGetCellDescent
mov ecx, dword [esp + 0x18]
test eax, eax
cmovne ecx, eax
movzx eax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
movd xmm1, eax
mov eax, edi
mov edi, dword [esp + 0xc]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
push dword [edi]
addss xmm1, xmm0
movss dword [esp + 0x18], xmm1
call sub.gdiplus.dll_GdipGetFontSize
test eax, eax
je 0x1009ea6b
mov dword [edi + 4], eax
movss xmm0, dword [esp + 0x20]
cvtps2pd xmm0, xmm0
push edi
movd xmm1, esi
andpd xmm0, xmmword [0x101235d0]
cvtpd2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, dword [esp + 0x14]
divss xmm0, xmm1
movss dword [esp + 0x10], xmm0
call fcn.1009eaf0
movss xmm0, dword [esp + 0x10]
add esp, 4
movss dword [esp + 0xc], xmm0
fsubr dword [esp + 0xc]
fstp dword [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
push dword [esp + 0x14]
call sub.gdiplus.dll_GdipDeleteFontFamily
fld dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005d006
add esp, 0x28
ret
Function at 0x100b27b4
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x208
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
mov esi, ecx
cmp dword [esi + 0xe4], 0
jne 0x100b27da
xor al, al
pop esi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.1005d006
add esp, 0x208
ret 0xc
push edi
push dword [esp + 0x21c]
mov edi, dword [esp + 0x218]
push edi
call fcn.100b1d00
test eax, eax
je 0x100b2802
push eax
mov ecx, esi
call fcn.100b1a10
mov al, 1
jmp 0x100b2941
lea eax, [edi - 9]
push ebx
mov bl, 1
cmp eax, 0x1e
ja case.0x100b2814.10
movzx eax, byte [eax + 0x100b296c]
jmp dword [eax*4 + 0x100b295c]
mov ecx, dword [esi + 0xb0]
test ecx, ecx
je 0x100b293e
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100b293e
push dword [esp + 0x220]
mov ecx, esi
push edi
call fcn.100b2250
jmp 0x100b293e
xor al, al
jmp 0x100b2940
cmp byte [esi + 0xdc], 0
jne 0x100b293c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x40]
call eax
test al, al
je 0x100b293c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xe0]
call eax
test al, al
jne 0x100b293c
push 0x1ff
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push 0
push eax
call fcn.100639b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp eax, 1
jne 0x100b293e
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x228]
movzx eax, ax
push eax
push edi
call dword [sym.imp.USER32.dll_ToAscii]
cmp byte [esi + 0xde], 0
movzx eax, word [esp + 0xc]
push eax
je 0x100b28fa
call fcn.100650a0
add esp, 4
test eax, eax
je 0x100b293e
push dword [esp + 0xc]
mov ecx, esi
call fcn.100b2110
jmp 0x100b293e
call fcn.100650a0
add esp, 4
test eax, eax
jne 0x100b28ed
movzx eax, word [esp + 0xc]
push eax
call fcn.10065073
add esp, 4
test eax, eax
jne 0x100b28ed
movzx eax, word [esp + 0xc]
push eax
call fcn.10065121
add esp, 4
test eax, eax
jne 0x100b28ed
movzx eax, word [esp + 0xc]
push eax
call fcn.100650f6
add esp, 4
test eax, eax
jne 0x100b28ed
xor bl, bl
mov al, bl
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.1005d006
add esp, 0x208
ret 0xc
Function at 0x100bf090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10116838
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.100bf560
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.0
mov dword [esi + 0x24], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.1.0
mov dword [esi + 0x28], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.2.0
mov dword [esi + 0x2c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.3.0
mov dword [esi + 0x30], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.4.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.5.0
mov dword [esi + 0x38], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.6.0
mov dword [esi + 0x40], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.7.0
mov dword [esi + 0x44], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.8.0
mov dword [esi + 0x48], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.9.0
mov dword [esi + 0x4c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.10.0
mov dword [esi + 0x50], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x100cd390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10117d4b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
lea ecx, [edi + 4]
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi], eax
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 4]
push eax
call fcn.10006240
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100ce7e0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x10117f88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xac], 0
mov esi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
jne 0x100ce840
xor ecx, ecx
call fcn.100ad730
test al, al
je 0x100ce99e
mov ecx, dword [edi + 0xac]
call fcn.100ad6e0
test al, al
je 0x100ce857
mov ebx, dword [edi + 0xb4]
jmp 0x100ce85d
mov ebx, dword [edi + 0xb8]
test ebx, ebx
je 0x100ce99e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
mov esi, dword [esi + 0xc]
push ecx
mov ecx, ebx
sub esi, dword [eax + 4]
mov eax, dword [ebx]
call dword [eax + 0x18]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x48], eax
add eax, ecx
mov dword [esp + 0x50], eax
lea ecx, [esp + 0x3c]
lea eax, [edx + esi]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.100cd960
add esp, 0xc
movdqu xmm0, xmmword [eax]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4c]
push eax
movdqu xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, edi
xor esi, esi
call fcn.1007c350
mov dword [esp + 0x14], eax
test eax, eax
je 0x100ce961
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], esi
push eax
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x3c]
push eax
call fcn.100862f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
push edi
mov dword [esp + 0x4c], edx
call fcn.1007bbc0
add esp, 0xc
lea eax, [esp + 0x48]
push dword [esp + 0x40]
push dword [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x100ce961
mov esi, 1
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, 2
cmovne esi, eax
push dword [esp + 0x18]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], 0
push ebp
call fcn.10084430
mov dword [esp + 0x64], 0
lea ecx, [esp + 0x48]
mov eax, dword [ebx]
push esi
push ecx
push ebp
mov ecx, ebx
call dword [eax + 0x14]
mov dword [esp + 0x64], 0xffffffff
lea ecx, [esp + 0x44]
call fcn.10084650
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.1005d006
add esp, 0x54
ret 0xc