joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10095777
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x100958d5
push esi
push edi
push 0x101ae814
call fcn.10046dd6
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x10095810
mov edi, dword [ebx + 0x168]
jmp 0x100957fc
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100957fc
push esi
call fcn.1003236b
push eax
push 0x101f8fb4
call fcn.10046e05
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x100957fc
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [section..00cfg]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x100957fc
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x100957ab
lea ecx, [ebx + 0x164]
call fcn.1003dc13
jmp 0x100958d3
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100958d3
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1003216a
mov edi, dword [eax]
test edi, edi
jne 0x1009583c
xor esi, esi
jmp 0x1009583f
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100958c3
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100958c3
cmp dword [ebp - 0x10], 0
jne 0x10095898
push edi
push 0x101f8fb4
call fcn.10046e05
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
push eax
push 0x101af848
call fcn.10046e05
pop ecx
pop ecx
test eax, eax
je 0x100958c3
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.10097b84
test eax, eax
jne 0x100958c3
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.10091fca
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x10095827
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1009ffde
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.1017d86b
pop ecx
test eax, eax
jne 0x100a0020
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10028ac3
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1009ffe6
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x100a3457
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.100a336b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100a349f
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1003211b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1003213e
jmp 0x100a34aa
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1004771e
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100a3515
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10043341
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x100a3551
call fcn.100a336b
mov dword [esi + 0xc], 1
jmp 0x100a3556
call fcn.100a336b
cmp dword [esi], 0
je 0x100a35a1
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x100a357c
push edi
call fcn.1003211b
lea ecx, [edi + 1]
push ecx
jmp 0x100a358b
push 0xff
call fcn.10026980
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1003213e
pop edi
jmp 0x100a35c5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x100a35c5
push dword [esi]
push dword [ebp - 4]
call fcn.1004771e
pop esi
leave
ret 0xc
Function at 0x100a3e1e
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100a3f9d
mov ecx, 0x10201ae0
call fcn.1004cded
mov esi, eax
test esi, esi
je 0x100a3f58
mov ebx, dword [ebp + 8]
xor eax, eax
cmp word [esi + 8], ax
jne 0x100a3f23
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x100a3ee4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
add ecx, 0xfffffffd
cmp ax, 0x11
jne 0x100a3eae
push str.MS_UI_Gothic
call fcn.100a3fdb
pop ecx
mov ecx, 0x3fc
test eax, eax
je 0x100a3eae
cmp dword [ebp + 0x10], 0
lea eax, [ecx - 0xe]
push 0xfc11
cmovne eax, ecx
push eax
push 5
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x100a3ec8
mov ecx, 0x3fc
cmp dword [ebp + 0x10], 0
mov eax, 0x3ee
push 5
cmovne eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100a3ee4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x100a3ee7
push edi
push ebx
push eax
call fcn.1005440f
add esp, 0xc
jmp 0x100a3ee7
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.1003e872
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x100a3f5d
mov eax, dword [ebx]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.1004d497
mov ax, word [edi]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
mov edi, dword [esi + 4]
test edi, edi
je 0x100a3f31
push edi
call fcn.1017f04c
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.10026300
mov eax, dword [ebp + 0xc]
mov edx, 0xffff
movzx ecx, word [esi + 8]
pop edi
pop esi
mov word [eax], cx
xor eax, eax
cmp cx, dx
pop ebx
setne al
pop ebp
ret 0xc
call fcn.1003ee4a
call fcn.1003ee16
int3
Function at 0x100a47b5
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x10198858
call fcn.10046c8e
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x700], edi
test ecx, ecx
je 0x100a493d
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x100a490f
sub eax, 1
je 0x100a4834
sub eax, 1
je 0x100a480c
sub eax, 1
je 0x100a4834
push 0x101dfff8
mov ecx, edi
call fcn.10027f57
mov eax, edi
call fcn.10046d11
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x100a47f6
lea eax, [ebp - 0x4e8]
push eax
jmp 0x100a47fb
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100a47f6
push esi
lea eax, [ebp - 0x448]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x218]
movlpd qword [ebp - 0x448], xmm0
push eax
movlpd qword [ebp - 0x440], xmm0
movlpd qword [ebp - 0x438], xmm0
call fcn.100a16c7
test eax, eax
je 0x100a47f6
lea ecx, [ebp - 0x700]
call fcn.100255e0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x100a48c5
test byte [ebp - 0x428], 0x18
jne 0x100a48e7
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x430]
call dword [section..00cfg]
mov ecx, ebx
call esi
jmp 0x100a48e7
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.10028b2f
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.10026840
jmp 0x100a4802
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x100a47f6
lea eax, [ebp - 0x6f0]
jmp 0x100a4831
call fcn.1003ee4a
int3

Function at 0x100a4943
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x101f8dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x100a4962
or eax, 0xffffffff
jmp 0x100a498e
push esi
push 0xc009
push 0x2b4
lea ecx, [ebp - 0x2b8]
or esi, 0xffffffff
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
cmovne esi, dword [ebp - 0x2b4]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10046c17
leave
ret 8
Function at 0x100a4a5b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x101f8dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test edx, edx
je 0x100a4c82
test ebx, ebx
je 0x100a4c82
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
xor edi, edi
movlpd qword [ebp - 0x644], xmm0
movlpd qword [ebp - 0x63c], xmm0
movlpd qword [ebp - 0x634], xmm0
movlpd qword [ebp - 0x874], xmm0
movlpd qword [ebp - 0x86c], xmm0
movlpd qword [ebp - 0x864], xmm0
sub eax, edi
je 0x100a4c4b
sub eax, 1
je 0x100a4ade
sub eax, 1
je 0x100a4baf
sub eax, 1
jne 0x100a4c7e
lea eax, [ebp - 0x20c]
push eax
push dword [edx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100a4c46
push edi
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100a16c7
test eax, eax
je 0x100a4c46
lea eax, [ebp - 0x414]
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100a4c41
push edi
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.100a16c7
test eax, eax
je 0x100a4c41
xor edx, edx
inc edx
cmp dword [ebp + 0x10], edx
jne 0x100a4c0a
test byte [ebp - 0x624], 0x10
jne 0x100a4c46
test byte [ebp - 0x854], 0x10
jne 0x100a4ba8
mov ecx, dword [ebp - 0x858]
mov eax, dword [ebp - 0x85c]
cmp dword [ebp - 0x628], ecx
ja 0x100a4ba8
jb 0x100a4c46
cmp dword [ebp - 0x62c], eax
jb 0x100a4c46
cmp dword [ebp - 0x628], ecx
jb 0x100a4c7e
ja 0x100a4ba8
cmp dword [ebp - 0x62c], eax
jbe 0x100a4c7e
mov edi, edx
jmp 0x100a4c7e
mov esi, 0x408
lea eax, [ebp - 0xddc]
push esi
push 0x2b4
push eax
push edi
push dword [edx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x100a4c7e
push esi
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push edi
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x100a4c7e
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, eax
jmp 0x100a4c7e
mov ecx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x638], ecx
jg 0x100a4ba8
jl 0x100a4c46
cmp dword [ebp - 0x63c], eax
jb 0x100a4c46
cmp dword [ebp - 0x638], ecx
jl 0x100a4c7e
jg 0x100a4ba8
cmp dword [ebp - 0x63c], eax
jmp 0x100a4ba2
xor edi, edi
inc edi
jmp 0x100a4c7e
or edi, 0xffffffff
jmp 0x100a4c7e
mov ecx, dword [edx]
push dword [ebx + 8]
push dword [edx + 8]
mov eax, dword [ecx]
push edi
push ecx
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [section..00cfg]
call esi
test eax, eax
jns 0x100a4c7b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10046c17
leave
ret 0xc
movsx edi, ax
mov eax, edi
jmp 0x100a4c6a
call fcn.1003ee4a
int3

Function at 0x100a4c88
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10142f87
call fcn.1003e655
cmp dword [eax + 0x14], 0
jne 0x100a4ca3
mov ecx, esi
pop esi
jmp fcn.100a57f3
pop esi
ret
Function at 0x100a666b
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [ecx + 0x14]
cmp dword [esi - 0xc], 0
je 0x100a66a1
push ebx
mov ebx, dword [ecx + 8]
push edi
mov edi, dword [ecx + 0xc]
call fcn.10028095
test eax, eax
je 0x100a6689
mov eax, dword [eax + 0x20]
push 1
push edi
push ebx
push esi
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
sbb eax, eax
pop ebx
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100a86ca
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x100a86f7
or dword [esi + 0x3c], 1
or dword [esi + 0x38], 2
jmp 0x100a870c
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x100a870c
or dword [esi + 0x3c], 2
or dword [esi + 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], edx
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.1003236b
jmp 0x100a87dd
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.1003236b
cmp eax, edi
jne 0x100a87e7
push 1
push 0x209
push 0x200
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100a8779
push 1
push 0x109
push 0x100
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x100a87bd
mov eax, dword [ebp - 0x1c]
cmp eax, 0x202
je 0x100a87e7
cmp eax, 0x205
je 0x100a87e7
cmp eax, 0x201
je 0x100a87e7
cmp eax, 0x204
je 0x100a87e7
cmp eax, 0x100
jne 0x100a87a5
cmp dword [ebp - 0x18], 0x1b
je 0x100a87e7
push dword [ebp - 8]
lea eax, [esi + 0x24]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
sbb edx, dword [ebp - 4]
test edx, edx
jb 0x100a87dd
ja 0x100a87d6
cmp eax, dword [0x10201b10]
jbe 0x100a87dd
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], 0
je 0x100a872e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100adb2d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x100adb46
call fcn.1003e580
mov esi, dword [eax + 0xc]
push 0x101def18
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100adb88
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100adb88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100adb88
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.100adb91
jmp 0x100adb8a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100c0941
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x101f8f1c], 0
push esi
push edi
je 0x100c09c9
cmp dword [0x101f9168], 0xfffffffe
jne 0x100c09b5
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x100c09c9
mov edi, 0x10201bb4
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10201bcc], 0
jne 0x100c09cd
push 0
push 0
push 0x100c09d3
call fcn.10176bc9
add esp, 0xc
mov dword [0x10201bcc], eax
test eax, eax
je 0x100c09a5
cmp eax, 0xffffffff
je 0x100c09a5
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x101f9168], esi
jmp 0x100c09ac
and dword [0x10201bcc], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x100c09c9
mov eax, dword [ebp + 8]
mov dword [0x101f9168], eax
cmp eax, 0xffffffff
jne 0x100c09c9
and dword [0x10201bcc], 0
pop edi
pop esi
pop ebp
ret
call fcn.1003ee4a
int3
Function at 0x100d1066
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x100d11ed
je 0x100d1214
sub eax, 0xa1
je 0x100d1214
sub eax, 1
je 0x100d1214
dec eax
sub eax, 1
je 0x100d1214
sub eax, 1
je 0x100d1214
dec eax
sub eax, 1
je 0x100d1214
sub eax, 1
je 0x100d1214
sub eax, 0x58
jne 0x100d1252
cmp dword [edi + 0xc0], 0xffffffff
je 0x100d1214
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100d1214
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x100d1142
sub eax, 1
jne 0x100d1214
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x100d1131
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
test eax, eax
jne 0x100d118e
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x100d1107
jmp 0x100d126c
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x100d126c
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
test eax, eax
jne 0x100d118e
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x100d1159
jmp 0x100d126c
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov ecx, eax
call fcn.100435de
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x100d126c
sub eax, 0x200
je 0x100d1214
sub eax, 1
je 0x100d1214
sub eax, 1
je 0x100d1214
dec eax
sub eax, 1
je 0x100d1214
sub eax, 1
je 0x100d1214
dec eax
sub eax, 1
je 0x100d1214
sub eax, 1
jne 0x100d1252
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x100d1233
cmp dword [eax + 0x20], ebx
je 0x100d1233
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x100d1252
cmp dword [eax + 0x20], ebx
je 0x100d1252
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 4], 0x203
jne 0x100d1271
lea eax, [edi + 0x2250]
test eax, eax
je 0x100d1268
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x100d1271
xor eax, eax
inc eax
jmp 0x100d1279
push esi
mov ecx, edi
call fcn.100cb7a8
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10110550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101f8dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x18], eax
cmp edi, 0x20
jne 0x101105bc
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 0x20]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
mov ecx, esi
add eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
add eax, 0x17
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.101116c8
mov ecx, esi
call fcn.10111be7
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x10110608
push ebx
xor ebx, ebx
cmp dword [esi + 0x318], ebx
jne 0x101105d8
cmp edi, 0x79
je 0x101105d1
cmp edi, 0x12
jne 0x101105d4
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10110607
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
push 0x10
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
cmp edi, 0x12
je 0x10110618
cmp edi, 0x79
je 0x10110618
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10046c17
leave
ret 0xc
cmp dword [0x10200f00], ebx
jne 0x10110605
test byte [esi + 0x330], 2
jne 0x10110605
cmp edi, 0x12
je 0x10110641
cmp edi, 0x79
jne 0x10110605
mov ecx, 0x8000
test dword [ebp - 0x20], ecx
jne 0x10110605
test ecx, eax
jne 0x10110605
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.1003236b
cmp eax, esi
jne 0x10110664
test dword [ebp + 0x10], 0x40000000
jne 0x10110664
cmp edi, 0x79
jne 0x10110672
mov ecx, dword [ebp - 0x18]
jmp 0x1011066b
cmp edi, 0x79
jne 0x10110672
mov ecx, esi
call fcn.100435de
jmp 0x1011068e
cmp dword [esi + 0x2d4], ebx
jge 0x1011068e
push ebx
push 0xc8
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
jmp 0x10110607
Function at 0x10118e0e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x1b8]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov ecx, dword [0x101f8fdc]
test al, 0x80
push 0xffffffffffffffff
pop eax
cmovne ecx, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x2b4]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
push dword [ebp - 4]
mov esi, eax
push 0x101f94bc
mov dword [ebp - 0xc], esi
call fcn.10046e05
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x10118f23
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x10118f23
test ebx, ebx
je 0x10118eb3
mov eax, dword [ebx]
push 0
mov esi, dword [eax + 0x228]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
call esi
push eax
push 0x101f94f4
call fcn.10046e05
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x10118eb5
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 2
jne 0x10118f2c
test eax, eax
je 0x10118f05
mov eax, dword [edi]
mov esi, dword [eax + 0x1c0]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
test al, 0x40
je 0x10118f23
cmp dword [ebp - 4], 0
je 0x10118f05
mov ebx, dword [ebp - 8]
push edi
mov eax, dword [ebx]
mov esi, dword [eax + 0x24c]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
call esi
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, edi
jmp 0x10118f25
mov eax, dword [edi]
push 5
push 0
push ebx
mov esi, dword [eax + 0x1f8]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp esi, 3
jne 0x10118f23
test ebx, ebx
je 0x10118f23
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 0x184]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
call esi
test eax, eax
je 0x10118f23
mov eax, dword [edi]
mov esi, dword [eax + 0x18c]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
test eax, eax
je 0x10118f23
mov eax, dword [edi]
push 0
mov esi, dword [eax + 0x240]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0
push 1
push 5
mov esi, dword [eax + 0x34c]
mov ecx, esi
push ebx
call dword [section..00cfg]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x10118f25