joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f40f1
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1011f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x10122660]
mov edx, dword [eax + edx*4]
mov eax, dword [0x101584b4]
cmp eax, dword [edx + 4]
jle 0x1001f926
push 0x101584b4
call fcn.100f18de
add esp, 4
cmp dword [0x101584b4], 0xffffffff
jne 0x1001f926
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x10119560]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x24], 0x7166247e
movaps xmm0, xmmword [0x10119590]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x20], 0x73
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0x24
jb 0x1001f892
mov cl, 0x44
mov byte [ebp - 0x1c], 0x28
mov byte [ebp - 0x45], cl
mov al, 0x4b
xor al, byte [ebp - 0x1c]
mov dl, 0x41
mov byte [ebp - 0x46], cl
mov ch, 0x5c
xor cl, byte [ebp - 0x1c]
mov dh, 6
mov byte [ebp - 0x1b], al
mov ah, 0x46
mov al, byte [ebp - 0x45]
mov bl, 0x4d
mov byte [ebp - 0x1a], cl
mov bh, 0x4c
mov cl, byte [ebp - 0x1c]
xor al, cl
mov byte [ebp - 0x11], 0
xor dl, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x46]
xor dh, cl
xor ch, cl
mov byte [ebp - 0x19], dl
xor bl, cl
mov byte [ebp - 0x16], ch
xor ah, cl
mov byte [ebp - 0x15], dh
xor bh, cl
mov byte [ebp - 0x1f], 0
xor al, cl
mov byte [ebp - 0x18], bl
lea edx, [ebp - 0x43]
mov byte [ebp - 0x17], ah
lea ecx, [ebp - 0x1b]
mov byte [ebp - 0x14], bh
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 0
call fcn.10066ae0
push 0x101584b4
mov dword [0x101584c4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f188d
add esp, 4
push esi
push 0
call dword [0x101584c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f1854
mov esp, ebp
pop ebp
ret
Function at 0x1001fdc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1015819f], 0
push esi
push edi
je 0x1001ff22
mov eax, dword [0x1011f218]
mov ecx, dword [0x10158198]
dec eax
cmp eax, 3
ja case.default.0x1001fde4
jmp dword [eax*4 + 0x1001ff2c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001fe1b
mov al, byte [ebp + 0xb]
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001ff22
mov edi, dword [0x101227d4]
test edi, edi
je 0x1001ff22
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1001fe95
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1001ff22
call fcn.1000f990
cmp eax, 9
je 0x1001ff22
call fcn.1000f990
cmp eax, 8
je 0x1001ff22
call fcn.100231c0
test byte [eax + 8], 1
je 0x1001ff22
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x1001fefe
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x1001ff22
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a8f0
mov byte [eax + 0x19], 1
cmp byte [0x10158245], 0
je 0x1001ff22
call fcn.1001f950
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001fdeb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1015819f], 0
push esi
push edi
je 0x1001ff22
mov eax, dword [0x1011f218]
mov ecx, dword [0x10158198]
dec eax
cmp eax, 3
ja case.default.0x1001fde4
jmp dword [eax*4 + 0x1001ff2c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001fe1b
mov al, byte [ebp + 0xb]
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001ff22
mov edi, dword [0x101227d4]
test edi, edi
je 0x1001ff22
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1001fe95
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1001ff22
call fcn.1000f990
cmp eax, 9
je 0x1001ff22
call fcn.1000f990
cmp eax, 8
je 0x1001ff22
call fcn.100231c0
test byte [eax + 8], 1
je 0x1001ff22
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x1001fefe
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x1001ff22
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a8f0
mov byte [eax + 0x19], 1
cmp byte [0x10158245], 0
je 0x1001ff22
call fcn.1001f950
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001fdfa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1015819f], 0
push esi
push edi
je 0x1001ff22
mov eax, dword [0x1011f218]
mov ecx, dword [0x10158198]
dec eax
cmp eax, 3
ja case.default.0x1001fde4
jmp dword [eax*4 + 0x1001ff2c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001fe1b
mov al, byte [ebp + 0xb]
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001ff22
mov edi, dword [0x101227d4]
test edi, edi
je 0x1001ff22
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1001fe95
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1001ff22
call fcn.1000f990
cmp eax, 9
je 0x1001ff22
call fcn.1000f990
cmp eax, 8
je 0x1001ff22
call fcn.100231c0
test byte [eax + 8], 1
je 0x1001ff22
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x1001fefe
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x1001ff22
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a8f0
mov byte [eax + 0x19], 1
cmp byte [0x10158245], 0
je 0x1001ff22
call fcn.1001f950
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001fe09
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x1015819f], 0
push esi
push edi
je 0x1001ff22
mov eax, dword [0x1011f218]
mov ecx, dword [0x10158198]
dec eax
cmp eax, 3
ja case.default.0x1001fde4
jmp dword [eax*4 + 0x1001ff2c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001fe1b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001fe1b
mov al, byte [ebp + 0xb]
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001ff22
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001ff22
mov edi, dword [0x101227d4]
test edi, edi
je 0x1001ff22
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1001fe95
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1001ff22
call fcn.1000f990
cmp eax, 9
je 0x1001ff22
call fcn.1000f990
cmp eax, 8
je 0x1001ff22
call fcn.100231c0
test byte [eax + 8], 1
je 0x1001ff22
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x1001fefe
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x1001ff22
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a8f0
mov byte [eax + 0x19], 1
cmp byte [0x10158245], 0
je 0x1001ff22
call fcn.1001f950
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101581a4], 0
push esi
push edi
je 0x100200d3
mov eax, dword [0x1011f21c]
mov ecx, dword [0x10158178]
dec eax
cmp eax, 3
ja case.default.0x1001ff84
jmp dword [eax*4 + 0x100200dc]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ffbb
mov al, byte [ebp + 0xb]
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100200d3
mov edi, dword [0x101227d4]
test edi, edi
je 0x100200d3
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10020035
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x100200d3
call fcn.1000f990
cmp eax, 9
je 0x100200d3
call fcn.1000f990
cmp eax, 8
je 0x100200d3
call fcn.100231c0
test byte [eax + 8], 1
je 0x100200d3
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x100200a2
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x100200d3
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a8f0
mov byte [eax + 0x1b], 1
cmp byte [0x10158243], 0
je 0x100200c6
call fcn.1001f950
cmp byte [0x1015824b], 0
je 0x100200d3
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff8b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101581a4], 0
push esi
push edi
je 0x100200d3
mov eax, dword [0x1011f21c]
mov ecx, dword [0x10158178]
dec eax
cmp eax, 3
ja case.default.0x1001ff84
jmp dword [eax*4 + 0x100200dc]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ffbb
mov al, byte [ebp + 0xb]
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100200d3
mov edi, dword [0x101227d4]
test edi, edi
je 0x100200d3
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10020035
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x100200d3
call fcn.1000f990
cmp eax, 9
je 0x100200d3
call fcn.1000f990
cmp eax, 8
je 0x100200d3
call fcn.100231c0
test byte [eax + 8], 1
je 0x100200d3
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x100200a2
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x100200d3
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a8f0
mov byte [eax + 0x1b], 1
cmp byte [0x10158243], 0
je 0x100200c6
call fcn.1001f950
cmp byte [0x1015824b], 0
je 0x100200d3
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff9a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101581a4], 0
push esi
push edi
je 0x100200d3
mov eax, dword [0x1011f21c]
mov ecx, dword [0x10158178]
dec eax
cmp eax, 3
ja case.default.0x1001ff84
jmp dword [eax*4 + 0x100200dc]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ffbb
mov al, byte [ebp + 0xb]
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100200d3
mov edi, dword [0x101227d4]
test edi, edi
je 0x100200d3
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10020035
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x100200d3
call fcn.1000f990
cmp eax, 9
je 0x100200d3
call fcn.1000f990
cmp eax, 8
je 0x100200d3
call fcn.100231c0
test byte [eax + 8], 1
je 0x100200d3
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x100200a2
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x100200d3
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a8f0
mov byte [eax + 0x1b], 1
cmp byte [0x10158243], 0
je 0x100200c6
call fcn.1001f950
cmp byte [0x1015824b], 0
je 0x100200d3
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ffa9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101581a4], 0
push esi
push edi
je 0x100200d3
mov eax, dword [0x1011f21c]
mov ecx, dword [0x10158178]
dec eax
cmp eax, 3
ja case.default.0x1001ff84
jmp dword [eax*4 + 0x100200dc]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ffbb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ffbb
mov al, byte [ebp + 0xb]
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100200d3
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100200d3
mov edi, dword [0x101227d4]
test edi, edi
je 0x100200d3
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10020035
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x100200d3
call fcn.1000f990
cmp eax, 9
je 0x100200d3
call fcn.1000f990
cmp eax, 8
je 0x100200d3
call fcn.100231c0
test byte [eax + 8], 1
je 0x100200d3
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x100200a2
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x100200d3
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a8f0
mov byte [eax + 0x1b], 1
cmp byte [0x10158243], 0
je 0x100200c6
call fcn.1001f950
cmp byte [0x1015824b], 0
je 0x100200d3
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x100200f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158171], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002032d
mov eax, dword [0x1011f208]
mov edx, dword [0x10158184]
dec eax
cmp eax, 3
ja case.default.0x10020116
jmp dword [eax*4 + 0x10020334]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002014d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002032d
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002032d
mov eax, dword [0x101226d4]
test eax, eax
jne 0x100201c7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002032d
call fcn.1000f990
cmp eax, 9
je 0x1002032d
call fcn.1000f990
cmp eax, 8
je 0x1002032d
call fcn.100231c0
test byte [eax + 8], 1
jne 0x1002024d
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020238
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
je 0x1002024d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020328
cmp byte [ebx + 1], 0
jne 0x10020328
mov esi, dword [0x10158094]
mov edi, dword [0x101227d4]
test esi, esi
jne 0x100202a4
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110459
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110025
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, eax
mov dword [0x10158094], esi
call fcn.100231c0
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020328
call fcn.100231c0
test byte [eax + 8], 1
jne 0x10020328
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020302
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10020328
call fcn.1000f990
cmp eax, 8
je 0x10020328
call fcn.1000f990
cmp eax, 0xa
je 0x10020328
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002011d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158171], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002032d
mov eax, dword [0x1011f208]
mov edx, dword [0x10158184]
dec eax
cmp eax, 3
ja case.default.0x10020116
jmp dword [eax*4 + 0x10020334]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002014d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002032d
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002032d
mov eax, dword [0x101226d4]
test eax, eax
jne 0x100201c7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002032d
call fcn.1000f990
cmp eax, 9
je 0x1002032d
call fcn.1000f990
cmp eax, 8
je 0x1002032d
call fcn.100231c0
test byte [eax + 8], 1
jne 0x1002024d
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020238
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
je 0x1002024d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020328
cmp byte [ebx + 1], 0
jne 0x10020328
mov esi, dword [0x10158094]
mov edi, dword [0x101227d4]
test esi, esi
jne 0x100202a4
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110459
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110025
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, eax
mov dword [0x10158094], esi
call fcn.100231c0
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020328
call fcn.100231c0
test byte [eax + 8], 1
jne 0x10020328
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020302
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10020328
call fcn.1000f990
cmp eax, 8
je 0x10020328
call fcn.1000f990
cmp eax, 0xa
je 0x10020328
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4