joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012e89
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [0x101f764c]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x10012fcb
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10012e1a
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7648], eax
cmp dword [eax + ebx], 0
jle 0x10012fcb
call fcn.1000a2e0
cmp eax, 9
je 0x10012fcb
cmp eax, 8
je 0x10012fcb
cmp eax, 0xa
je 0x10012fcb
cmp byte [0x101f78bb], 0
je 0x10012fcb
mov ecx, dword [0x101be2c4]
mov eax, dword [0x101f7934]
cmp ecx, 3
ja case.0x10012e61.0
jmp dword [ecx*4 + 0x10012fd0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10012e99
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10012e99
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x10012fcb
test byte [0x101f79b0], 1
je 0x10012fc4
mov eax, dword [0x101f7680]
mov ebx, dword [0x101f764c]
test eax, eax
jne 0x10012eeb
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + ebx], 1
jne 0x10012fc4
cmp byte [0x101f791d], 0
je 0x10012f22
cmp byte [0x101f7905], 0
je 0x10012f22
mov ecx, dword [0x101c176c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f78dd], 0
lea esi, [edi + 0x30]
je 0x10012f48
mov ecx, dword [0x101c176c]
and dword [esi], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f78de], 0
je 0x10012f6e
mov ecx, dword [0x101c176c]
and dword [esi], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f78df], 0
mov ecx, esi
je 0x10012f99
mov ecx, dword [0x101c176c]
and dword [esi], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
lea ecx, [edi + 0x30]
cmp byte [0x101f790c], 0
mov byte [0x101fcda0], 1
je 0x10012fb7
or dword [esi], 2
mov eax, dword [esi]
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
mov ecx, esi
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
ret
mov byte [0x101fcda0], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10013d90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x101f764c]
mov ebx, edx
mov dword [esp + 0x10], ecx
test edi, edi
je case.0x10013e12.0
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10013de7
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7648], eax
cmp dword [eax + edi], 0
jle case.0x10013e12.0
cmp byte [0x101f793a], 0
je case.0x10013e12.0
mov ecx, dword [0x101be22c]
mov eax, dword [0x101f7930]
cmp ecx, 3
ja case.0x10013e12.0
jmp dword [ecx*4 + 0x10013f28]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013e4a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013e4a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
jne case.0x10013e12.0
call fcn.1000a2e0
cmp eax, 9
je case.0x10013e12.0
cmp eax, 8
je case.0x10013e12.0
mov eax, dword [0x101f7680]
mov edi, dword [0x101f764c]
test eax, eax
jne 0x10013ea6
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + edi], 1
je case.0x10013e12.0
movss xmm3, dword [0x101be2a4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
movaps xmm1, xmm3
movss dword [esp + 0xc], xmm3
xorps xmm1, xmmword [0x101b88a0]
movaps xmm2, xmm3
xorps xmm2, xmmword [0x101b88a0]
movss xmm0, dword [edx]
comiss xmm0, xmm1
movss dword [esp + 0x14], xmm1
cmovae ecx, edx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
cmp byte [0x101f78be], 0
je case.0x10013e12.0
movss xmm0, dword [ebx]
lea ecx, [esp + 0x14]
comiss xmm0, xmm2
lea eax, [esp + 0xc]
movss dword [esp + 0x14], xmm2
cmovae ecx, ebx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013f40
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f764c]
mov ebx, ecx
test edi, edi
je 0x100141a3
mov ebp, edi
test ebp, ebp
je 0x100141a3
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10013f9c
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7648], eax
cmp dword [eax + ebp], 0
jle 0x100141a3
cmp byte [0x101f7922], 0
je 0x100141a3
mov ecx, dword [0x101be31c]
mov eax, dword [0x101f78f4]
cmp ecx, 3
ja case.0x10013fc3.0
jmp dword [ecx*4 + 0x100141ac]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100141a3
mov edi, dword [0x101f764c]
test byte [0x101f79b0], 1
mov eax, dword [0x101f7680]
jne 0x1001405b
mov ebp, edi
test eax, eax
jne 0x10014051
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001405b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10014095
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001409f
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f7922], 0
je 0x1001419c
cmp byte [0x101fcda3], 0
jne 0x1001419c
mov ecx, dword [0x101f76c0]
mov ebx, edi
test ecx, ecx
jne 0x10014101
mov edx, 0xe80c2f78
mov ecx, 0x10198749
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c93d
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov ecx, eax
mov eax, dword [0x101f7680]
mov dword [0x101f76c0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101c05e8]
jbe 0x1001419c
test byte [0x101f79b0], 1
jne 0x1001419c
test eax, eax
jne 0x1001414f
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + edi], 1
jne 0x1001419c
call fcn.1000a2e0
cmp eax, 9
je 0x1001419c
call fcn.1000a2e0
cmp eax, 8
je 0x1001419c
call fcn.1000a2e0
cmp eax, 0xa
je 0x1001419c
cmp byte [0x101f78e1], 0
mov byte [0x101f7941], 1
je 0x100141a3
push str.OlegWare_print_jumpbugged
push dword [0x101f76c4]
call fcn.1000a290
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f7941], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013fca
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f764c]
mov ebx, ecx
test edi, edi
je 0x100141a3
mov ebp, edi
test ebp, ebp
je 0x100141a3
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10013f9c
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7648], eax
cmp dword [eax + ebp], 0
jle 0x100141a3
cmp byte [0x101f7922], 0
je 0x100141a3
mov ecx, dword [0x101be31c]
mov eax, dword [0x101f78f4]
cmp ecx, 3
ja case.0x10013fc3.0
jmp dword [ecx*4 + 0x100141ac]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100141a3
mov edi, dword [0x101f764c]
test byte [0x101f79b0], 1
mov eax, dword [0x101f7680]
jne 0x1001405b
mov ebp, edi
test eax, eax
jne 0x10014051
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001405b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10014095
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001409f
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f7922], 0
je 0x1001419c
cmp byte [0x101fcda3], 0
jne 0x1001419c
mov ecx, dword [0x101f76c0]
mov ebx, edi
test ecx, ecx
jne 0x10014101
mov edx, 0xe80c2f78
mov ecx, 0x10198749
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c93d
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov ecx, eax
mov eax, dword [0x101f7680]
mov dword [0x101f76c0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101c05e8]
jbe 0x1001419c
test byte [0x101f79b0], 1
jne 0x1001419c
test eax, eax
jne 0x1001414f
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + edi], 1
jne 0x1001419c
call fcn.1000a2e0
cmp eax, 9
je 0x1001419c
call fcn.1000a2e0
cmp eax, 8
je 0x1001419c
call fcn.1000a2e0
cmp eax, 0xa
je 0x1001419c
cmp byte [0x101f78e1], 0
mov byte [0x101f7941], 1
je 0x100141a3
push str.OlegWare_print_jumpbugged
push dword [0x101f76c4]
call fcn.1000a290
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f7941], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013fdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f764c]
mov ebx, ecx
test edi, edi
je 0x100141a3
mov ebp, edi
test ebp, ebp
je 0x100141a3
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10013f9c
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7648], eax
cmp dword [eax + ebp], 0
jle 0x100141a3
cmp byte [0x101f7922], 0
je 0x100141a3
mov ecx, dword [0x101be31c]
mov eax, dword [0x101f78f4]
cmp ecx, 3
ja case.0x10013fc3.0
jmp dword [ecx*4 + 0x100141ac]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100141a3
mov edi, dword [0x101f764c]
test byte [0x101f79b0], 1
mov eax, dword [0x101f7680]
jne 0x1001405b
mov ebp, edi
test eax, eax
jne 0x10014051
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001405b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10014095
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001409f
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f7922], 0
je 0x1001419c
cmp byte [0x101fcda3], 0
jne 0x1001419c
mov ecx, dword [0x101f76c0]
mov ebx, edi
test ecx, ecx
jne 0x10014101
mov edx, 0xe80c2f78
mov ecx, 0x10198749
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c93d
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov ecx, eax
mov eax, dword [0x101f7680]
mov dword [0x101f76c0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101c05e8]
jbe 0x1001419c
test byte [0x101f79b0], 1
jne 0x1001419c
test eax, eax
jne 0x1001414f
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + edi], 1
jne 0x1001419c
call fcn.1000a2e0
cmp eax, 9
je 0x1001419c
call fcn.1000a2e0
cmp eax, 8
je 0x1001419c
call fcn.1000a2e0
cmp eax, 0xa
je 0x1001419c
cmp byte [0x101f78e1], 0
mov byte [0x101f7941], 1
je 0x100141a3
push str.OlegWare_print_jumpbugged
push dword [0x101f76c4]
call fcn.1000a290
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f7941], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013feb
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f764c]
mov ebx, ecx
test edi, edi
je 0x100141a3
mov ebp, edi
test ebp, ebp
je 0x100141a3
mov eax, dword [0x101f7648]
test eax, eax
jne 0x10013f9c
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7648], eax
cmp dword [eax + ebp], 0
jle 0x100141a3
cmp byte [0x101f7922], 0
je 0x100141a3
mov ecx, dword [0x101be31c]
mov eax, dword [0x101f78f4]
cmp ecx, 3
ja case.0x10013fc3.0
jmp dword [ecx*4 + 0x100141ac]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013ffb
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100141a3
mov edi, dword [0x101f764c]
test byte [0x101f79b0], 1
mov eax, dword [0x101f7680]
jne 0x1001405b
mov ebp, edi
test eax, eax
jne 0x10014051
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001405b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10014095
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov dword [0x101f7680], eax
test byte [eax + ebp], 1
je 0x1001409f
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f7922], 0
je 0x1001419c
cmp byte [0x101fcda3], 0
jne 0x1001419c
mov ecx, dword [0x101f76c0]
mov ebx, edi
test ecx, ecx
jne 0x10014101
mov edx, 0xe80c2f78
mov ecx, 0x10198749
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c93d
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov edi, dword [0x101f764c]
mov ecx, eax
mov eax, dword [0x101f7680]
mov dword [0x101f76c0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101c05e8]
jbe 0x1001419c
test byte [0x101f79b0], 1
jne 0x1001419c
test eax, eax
jne 0x1001414f
mov edx, 0xe80c2f78
mov ecx, 0x101985a5
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7680], eax
test byte [eax + edi], 1
jne 0x1001419c
call fcn.1000a2e0
cmp eax, 9
je 0x1001419c
call fcn.1000a2e0
cmp eax, 8
je 0x1001419c
call fcn.1000a2e0
cmp eax, 0xa
je 0x1001419c
cmp byte [0x101f78e1], 0
mov byte [0x101f7941], 1
je 0x100141a3
push str.OlegWare_print_jumpbugged
push dword [0x101f76c4]
call fcn.1000a290
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f7941], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10016120
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x101f791e], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001636c
mov ecx, dword [0x101be290]
mov eax, dword [0x101f78c8]
cmp ecx, 3
ja case.0x10016142.0
jmp dword [ecx*4 + 0x10016370]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001617a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001617a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001636c
mov edi, dword [0x101f764c]
test edi, edi
je 0x1001636c
mov eax, dword [0x101f7648]
test eax, eax
jne 0x100161c7
mov edx, 0xe80c2f78
mov ecx, 0x1014c9ed
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c915
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f7648], eax
cmp dword [eax + edi], 0
jle 0x1001636c
call fcn.1000a2e0
cmp eax, 9
je 0x1001636c
cmp eax, 8
je 0x1001636c
cmp byte [0x101c05b9], 0
je 0x1001636c
mov eax, dword [0x101f7890]
mov ecx, dword [0x101c1730]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101fce10]
cmp eax, dword [ecx + 4]
jle 0x10016251
push 0x101fce10
call fcn.1010fdd4
add esp, 4
cmp dword [0x101fce10], 0xffffffff
jne 0x10016251
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10006a40
push 0x101fce10
mov dword [0x101fce14], eax
call fcn.1010fd83
add esp, 4
push esi
push 0
call dword [0x101fce14]
cmp byte [0x101c05b8], 0
jne 0x100162e7
mov eax, dword [0x101c05c0]
cmp eax, dword [ebx + 8]
jge 0x10016298
cmp byte [0x101f78d8], 0
je 0x1001628d
push str.OlegWare_print_pixelsurfed
push dword [0x101f76c4]
call fcn.1000a290
add esp, 8
mov byte [0x101c05b8], 1
mov al, 1
jmp 0x1001629a
xor al, al
mov byte [0x101f7950], al
lea edx, [ebx + 0x30]
mov eax, dword [0x101c05c8]
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov ecx, dword [0x101c05c8]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x101c05c8]
mov eax, dword [eax + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [0x101c05c8]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [0x101c05c8]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x2c], eax
jmp 0x100162ea
lea edx, [ebx + 0x30]
cmp byte [0x101c05ba], 0
mov eax, dword [edx]
je 0x100162fa
or eax, 4
jmp 0x100162fd
and eax, 0xfffffffb
mov dword [edx], eax
cmp byte [0x101c05b8], 0
je 0x1001636c
mov eax, dword [0x101f76c0]
mov edi, dword [0x101f764c]
test eax, eax
jne 0x10016345
mov edx, 0xe80c2f78
mov ecx, 0x10198749
call fcn.10003ad0
mov edx, 0xc10bf213
mov ecx, 0x1014c93d
mov esi, eax
call fcn.10003ad0
mov edx, esi
mov ecx, eax
call fcn.100abe50
mov dword [0x101f76c0], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x101b85e0]
lahf
test ah, 0x44
jnp 0x1001636c
mov byte [0x101fcda5], 0
mov word [0x101c05b8], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10020760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1002078c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x100207b4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x100207ba
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10020822
jg 0x100207d1
test esi, esi
je 0x10020822
test ecx, ecx
jl 0x1002081d
jg 0x100207db
test eax, eax
je 0x1002081d
cmp edi, ecx
jg 0x100207ef
jl 0x100207e5
cmp esi, eax
jae 0x100207ef
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10020825
mov ecx, dword [ebp + 8]
jmp 0x1002082f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10020849
jg 0x1002082f
test esi, esi
je 0x10020849
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10020849
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020860
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x10020881
jl 0x10020877
test esi, esi
jne 0x10020881
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10020899
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edx, dword [eax]
mov edi, esi
test edx, edx
je 0x100208e0
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x100208e7
cmp eax, dword [esp + 0x1c]
cmovb esi, eax
push esi
push edx
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x100208e7
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x10020956
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10020911
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10020944
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call eax
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10020956
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10020920
test edi, edi
je 0x10020956
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call eax
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc