joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [0x101f565c]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x10012f0b
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10012d5a
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5658], eax
cmp dword [eax + ebx], 0
jle 0x10012f0b
call fcn.10009f10
cmp eax, 9
je 0x10012f0b
cmp eax, 8
je 0x10012f0b
cmp eax, 0xa
je 0x10012f0b
cmp byte [0x101f58c3], 0
je 0x10012f0b
mov ecx, dword [0x101bc2c8]
mov eax, dword [0x101f593c]
cmp ecx, 3
ja case.0x10012da1.0
jmp dword [ecx*4 + 0x10012f10]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10012dd9
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10012dd9
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x10012f0b
test byte [0x101f59b8], 1
je 0x10012f04
mov eax, dword [0x101f5690]
mov ebx, dword [0x101f565c]
test eax, eax
jne 0x10012e2b
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + ebx], 1
jne 0x10012f04
cmp byte [0x101f5925], 0
je 0x10012e62
cmp byte [0x101f590d], 0
je 0x10012e62
mov ecx, dword [0x101bf77c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f58e5], 0
lea esi, [edi + 0x30]
je 0x10012e88
mov ecx, dword [0x101bf77c]
and dword [esi], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f58e6], 0
je 0x10012eae
mov ecx, dword [0x101bf77c]
and dword [esi], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x101f58e7], 0
mov ecx, esi
je 0x10012ed9
mov ecx, dword [0x101bf77c]
and dword [esi], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
lea ecx, [edi + 0x30]
cmp byte [0x101f5914], 0
mov byte [0x101fada8], 1
je 0x10012ef7
or dword [esi], 2
mov eax, dword [esi]
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
mov ecx, esi
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
ret
mov byte [0x101fada8], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10013cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x101f565c]
mov ebx, edx
mov dword [esp + 0x10], ecx
test edi, edi
je case.0x10013d42.0
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10013d17
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5658], eax
cmp dword [eax + edi], 0
jle case.0x10013d42.0
cmp byte [0x101f5942], 0
je case.0x10013d42.0
mov ecx, dword [0x101bc230]
mov eax, dword [0x101f5938]
cmp ecx, 3
ja case.0x10013d42.0
jmp dword [ecx*4 + 0x10013e58]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013d7a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013d7a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
jne case.0x10013d42.0
call fcn.10009f10
cmp eax, 9
je case.0x10013d42.0
cmp eax, 8
je case.0x10013d42.0
mov eax, dword [0x101f5690]
mov edi, dword [0x101f565c]
test eax, eax
jne 0x10013dd6
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + edi], 1
je case.0x10013d42.0
movss xmm3, dword [0x101bc2a8]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
movaps xmm1, xmm3
movss dword [esp + 0xc], xmm3
xorps xmm1, xmmword [0x101b6920]
movaps xmm2, xmm3
xorps xmm2, xmmword [0x101b6920]
movss xmm0, dword [edx]
comiss xmm0, xmm1
movss dword [esp + 0x14], xmm1
cmovae ecx, edx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
cmp byte [0x101f58c6], 0
je case.0x10013d42.0
movss xmm0, dword [ebx]
lea ecx, [esp + 0x14]
comiss xmm0, xmm2
lea eax, [esp + 0xc]
movss dword [esp + 0x14], xmm2
cmovae ecx, ebx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013e70
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f565c]
mov ebx, ecx
test edi, edi
je 0x100140d3
mov ebp, edi
test ebp, ebp
je 0x100140d3
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10013ecc
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5658], eax
cmp dword [eax + ebp], 0
jle 0x100140d3
cmp byte [0x101f592a], 0
je 0x100140d3
mov ecx, dword [0x101bc320]
mov eax, dword [0x101f58fc]
cmp ecx, 3
ja case.0x10013ef3.0
jmp dword [ecx*4 + 0x100140dc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100140d3
mov edi, dword [0x101f565c]
test byte [0x101f59b8], 1
mov eax, dword [0x101f5690]
jne 0x10013f8b
mov ebp, edi
test eax, eax
jne 0x10013f81
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013f8b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10013fc5
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013fcf
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f592a], 0
je 0x100140cc
cmp byte [0x101fadab], 0
jne 0x100140cc
mov ecx, dword [0x101f56d0]
mov ebx, edi
test ecx, ecx
jne 0x10014031
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov ecx, eax
mov eax, dword [0x101f5690]
mov dword [0x101f56d0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101be5f0]
jbe 0x100140cc
test byte [0x101f59b8], 1
jne 0x100140cc
test eax, eax
jne 0x1001407f
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + edi], 1
jne 0x100140cc
call fcn.10009f10
cmp eax, 9
je 0x100140cc
call fcn.10009f10
cmp eax, 8
je 0x100140cc
call fcn.10009f10
cmp eax, 0xa
je 0x100140cc
cmp byte [0x101f58e9], 0
mov byte [0x101f5949], 1
je 0x100140d3
push str.solutional_print_jumpbugged
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f5949], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013efa
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f565c]
mov ebx, ecx
test edi, edi
je 0x100140d3
mov ebp, edi
test ebp, ebp
je 0x100140d3
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10013ecc
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5658], eax
cmp dword [eax + ebp], 0
jle 0x100140d3
cmp byte [0x101f592a], 0
je 0x100140d3
mov ecx, dword [0x101bc320]
mov eax, dword [0x101f58fc]
cmp ecx, 3
ja case.0x10013ef3.0
jmp dword [ecx*4 + 0x100140dc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100140d3
mov edi, dword [0x101f565c]
test byte [0x101f59b8], 1
mov eax, dword [0x101f5690]
jne 0x10013f8b
mov ebp, edi
test eax, eax
jne 0x10013f81
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013f8b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10013fc5
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013fcf
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f592a], 0
je 0x100140cc
cmp byte [0x101fadab], 0
jne 0x100140cc
mov ecx, dword [0x101f56d0]
mov ebx, edi
test ecx, ecx
jne 0x10014031
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov ecx, eax
mov eax, dword [0x101f5690]
mov dword [0x101f56d0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101be5f0]
jbe 0x100140cc
test byte [0x101f59b8], 1
jne 0x100140cc
test eax, eax
jne 0x1001407f
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + edi], 1
jne 0x100140cc
call fcn.10009f10
cmp eax, 9
je 0x100140cc
call fcn.10009f10
cmp eax, 8
je 0x100140cc
call fcn.10009f10
cmp eax, 0xa
je 0x100140cc
cmp byte [0x101f58e9], 0
mov byte [0x101f5949], 1
je 0x100140d3
push str.solutional_print_jumpbugged
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f5949], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013f0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f565c]
mov ebx, ecx
test edi, edi
je 0x100140d3
mov ebp, edi
test ebp, ebp
je 0x100140d3
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10013ecc
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5658], eax
cmp dword [eax + ebp], 0
jle 0x100140d3
cmp byte [0x101f592a], 0
je 0x100140d3
mov ecx, dword [0x101bc320]
mov eax, dword [0x101f58fc]
cmp ecx, 3
ja case.0x10013ef3.0
jmp dword [ecx*4 + 0x100140dc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100140d3
mov edi, dword [0x101f565c]
test byte [0x101f59b8], 1
mov eax, dword [0x101f5690]
jne 0x10013f8b
mov ebp, edi
test eax, eax
jne 0x10013f81
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013f8b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10013fc5
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013fcf
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f592a], 0
je 0x100140cc
cmp byte [0x101fadab], 0
jne 0x100140cc
mov ecx, dword [0x101f56d0]
mov ebx, edi
test ecx, ecx
jne 0x10014031
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov ecx, eax
mov eax, dword [0x101f5690]
mov dword [0x101f56d0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101be5f0]
jbe 0x100140cc
test byte [0x101f59b8], 1
jne 0x100140cc
test eax, eax
jne 0x1001407f
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + edi], 1
jne 0x100140cc
call fcn.10009f10
cmp eax, 9
je 0x100140cc
call fcn.10009f10
cmp eax, 8
je 0x100140cc
call fcn.10009f10
cmp eax, 0xa
je 0x100140cc
cmp byte [0x101f58e9], 0
mov byte [0x101f5949], 1
je 0x100140d3
push str.solutional_print_jumpbugged
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f5949], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013f1b
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x101f565c]
mov ebx, ecx
test edi, edi
je 0x100140d3
mov ebp, edi
test ebp, ebp
je 0x100140d3
mov eax, dword [0x101f5658]
test eax, eax
jne 0x10013ecc
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5658], eax
cmp dword [eax + ebp], 0
jle 0x100140d3
cmp byte [0x101f592a], 0
je 0x100140d3
mov ecx, dword [0x101bc320]
mov eax, dword [0x101f58fc]
cmp ecx, 3
ja case.0x10013ef3.0
jmp dword [ecx*4 + 0x100140dc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10013f2b
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100140d3
mov edi, dword [0x101f565c]
test byte [0x101f59b8], 1
mov eax, dword [0x101f5690]
jne 0x10013f8b
mov ebp, edi
test eax, eax
jne 0x10013f81
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013f8b
or dword [ebx + 0x30], 4
mov ebp, edi
test eax, eax
jne 0x10013fc5
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov dword [0x101f5690], eax
test byte [eax + ebp], 1
je 0x10013fcf
and dword [ebx + 0x30], 0xfffffffd
cmp byte [0x101f592a], 0
je 0x100140cc
cmp byte [0x101fadab], 0
jne 0x100140cc
mov ecx, dword [0x101f56d0]
mov ebx, edi
test ecx, ecx
jne 0x10014031
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov edi, dword [0x101f565c]
mov ecx, eax
mov eax, dword [0x101f5690]
mov dword [0x101f56d0], ecx
movss xmm0, dword [ecx + ebx + 8]
comiss xmm0, dword [0x101be5f0]
jbe 0x100140cc
test byte [0x101f59b8], 1
jne 0x100140cc
test eax, eax
jne 0x1001407f
mov edx, 0xe80c2f78
mov ecx, 0x1019659d
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5690], eax
test byte [eax + edi], 1
jne 0x100140cc
call fcn.10009f10
cmp eax, 9
je 0x100140cc
call fcn.10009f10
cmp eax, 8
je 0x100140cc
call fcn.10009f10
cmp eax, 0xa
je 0x100140cc
cmp byte [0x101f58e9], 0
mov byte [0x101f5949], 1
je 0x100140d3
push str.solutional_print_jumpbugged
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x101f5949], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10016050
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x101f5926], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001629c
mov ecx, dword [0x101bc294]
mov eax, dword [0x101f58d0]
cmp ecx, 3
ja case.0x10016072.0
jmp dword [ecx*4 + 0x100162a0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100160aa
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100160aa
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001629c
mov edi, dword [0x101f565c]
test edi, edi
je 0x1001629c
mov eax, dword [0x101f5658]
test eax, eax
jne 0x100160f7
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5658], eax
cmp dword [eax + edi], 0
jle 0x1001629c
call fcn.10009f10
cmp eax, 9
je 0x1001629c
cmp eax, 8
je 0x1001629c
cmp byte [0x101be5c1], 0
je 0x1001629c
mov eax, dword [0x101f5894]
mov ecx, dword [0x101bf740]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101fae18]
cmp eax, dword [ecx + 4]
jle 0x10016181
push 0x101fae18
call fcn.1010e5e4
add esp, 4
cmp dword [0x101fae18], 0xffffffff
jne 0x10016181
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10006670
push 0x101fae18
mov dword [0x101fae1c], eax
call fcn.1010e593
add esp, 4
push esi
push 0
call dword [0x101fae1c]
cmp byte [0x101be5c0], 0
jne 0x10016217
mov eax, dword [0x101be5c8]
cmp eax, dword [ebx + 8]
jge 0x100161c8
cmp byte [0x101f58e0], 0
je 0x100161bd
push str.solutional_print_pixelsurfed
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
mov byte [0x101be5c0], 1
mov al, 1
jmp 0x100161ca
xor al, al
mov byte [0x101f5958], al
lea edx, [ebx + 0x30]
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov ecx, dword [0x101be5d0]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x2c], eax
jmp 0x1001621a
lea edx, [ebx + 0x30]
cmp byte [0x101be5c2], 0
mov eax, dword [edx]
je 0x1001622a
or eax, 4
jmp 0x1001622d
and eax, 0xfffffffb
mov dword [edx], eax
cmp byte [0x101be5c0], 0
je 0x1001629c
mov eax, dword [0x101f56d0]
mov edi, dword [0x101f565c]
test eax, eax
jne 0x10016275
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f56d0], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x101b6658]
lahf
test ah, 0x44
jnp 0x1001629c
mov byte [0x101fadad], 0
mov word [0x101be5c0], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10016079
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x101f5926], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001629c
mov ecx, dword [0x101bc294]
mov eax, dword [0x101f58d0]
cmp ecx, 3
ja case.0x10016072.0
jmp dword [ecx*4 + 0x100162a0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100160aa
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100160aa
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001629c
mov edi, dword [0x101f565c]
test edi, edi
je 0x1001629c
mov eax, dword [0x101f5658]
test eax, eax
jne 0x100160f7
mov edx, 0xe80c2f78
mov ecx, 0x1014a9e5
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a90d
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f5658], eax
cmp dword [eax + edi], 0
jle 0x1001629c
call fcn.10009f10
cmp eax, 9
je 0x1001629c
cmp eax, 8
je 0x1001629c
cmp byte [0x101be5c1], 0
je 0x1001629c
mov eax, dword [0x101f5894]
mov ecx, dword [0x101bf740]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101fae18]
cmp eax, dword [ecx + 4]
jle 0x10016181
push 0x101fae18
call fcn.1010e5e4
add esp, 4
cmp dword [0x101fae18], 0xffffffff
jne 0x10016181
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10006670
push 0x101fae18
mov dword [0x101fae1c], eax
call fcn.1010e593
add esp, 4
push esi
push 0
call dword [0x101fae1c]
cmp byte [0x101be5c0], 0
jne 0x10016217
mov eax, dword [0x101be5c8]
cmp eax, dword [ebx + 8]
jge 0x100161c8
cmp byte [0x101f58e0], 0
je 0x100161bd
push str.solutional_print_pixelsurfed
push dword [0x101f56d4]
call fcn.10009ec0
add esp, 8
mov byte [0x101be5c0], 1
mov al, 1
jmp 0x100161ca
xor al, al
mov byte [0x101f5958], al
lea edx, [ebx + 0x30]
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov ecx, dword [0x101be5d0]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [0x101be5d0]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x2c], eax
jmp 0x1001621a
lea edx, [ebx + 0x30]
cmp byte [0x101be5c2], 0
mov eax, dword [edx]
je 0x1001622a
or eax, 4
jmp 0x1001622d
and eax, 0xfffffffb
mov dword [edx], eax
cmp byte [0x101be5c0], 0
je 0x1001629c
mov eax, dword [0x101f56d0]
mov edi, dword [0x101f565c]
test eax, eax
jne 0x10016275
mov edx, 0xe80c2f78
mov ecx, 0x10196741
call fcn.10003700
mov edx, 0xc10bf213
mov ecx, 0x1014a935
mov esi, eax
call fcn.10003700
mov edx, esi
mov ecx, eax
call fcn.100aa660
mov dword [0x101f56d0], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x101b6658]
lahf
test ah, 0x44
jnp 0x1001629c
mov byte [0x101fadad], 0
mov word [0x101be5c0], 0
pop edi
pop esi
pop ebx
ret