Function at 0x10001c61
Capabilities:
Delete registry value
Log keystrokes via polling
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x188], ebx
movzx eax, byte [ebx]
cmp eax, 0xd
ja case.default.0x1000175a
jmp dword [eax*4 + 0x10002d14]
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100017b2
movzx ecx, byte [ebx + 0xf]
movzx edx, byte [ebx + 3]
push ecx
movzx ecx, byte [ebx + 4]
shl edx, 8
add edx, ecx
push edx
push str.myAppsHookController:_KEYPRESSED_UP_code_x_key__d_
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x1c
mov al, byte [ebx + 0xf]
xorps xmm0, xmm0
movq qword [ebp - 0x110], xmm0
mov dword [ebp - 0x108], 0
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x120], 1
push 0x1c
test al, al
je 0x10001821
movzx eax, al
xor ecx, ecx
mov word [ebp - 0x11a], ax
lea eax, [ebp - 0x120]
push eax
push 1
mov word [ebp - 0x11c], cx
mov dword [ebp - 0x118], 6
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebx + 3]
mov eax, pe_nt_image_headers32
imul cx, ax
movzx eax, byte [ebx + 4]
mov edx, 0xb
add cx, ax
mov eax, 0xa
mov esi, 0xe000
mov word [ebp - 0x11a], cx
cmp cx, si
cmovae eax, edx
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100018ca
movzx ecx, byte [ebx + 0xf]
movzx edx, byte [ebx + 3]
push ecx
movzx ecx, byte [ebx + 4]
shl edx, 8
add edx, ecx
push edx
push str.myAppsHookController:_KEYPRESSED_DOWN_code_x_key__d_
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x1c
mov al, byte [ebx + 0xf]
xorps xmm0, xmm0
movq qword [ebp - 0x110], xmm0
mov dword [ebp - 0x108], 0
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x120], 1
push 0x1c
test al, al
je 0x1000191c
xor ecx, ecx
movzx eax, al
mov word [ebp - 0x11c], cx
mov word [ebp - 0x11a], ax
mov dword [ebp - 0x118], 4
jmp 0x10001857
movzx ecx, byte [ebx + 3]
mov eax, pe_nt_image_headers32
imul cx, ax
movzx eax, byte [ebx + 4]
add cx, ax
mov eax, 8
lea edx, [eax + 1]
jmp 0x1000183f
movzx ecx, byte [ebx + 0xd]
mov edx, pe_nt_image_headers32
movzx eax, byte [ebx + 0xe]
xorps xmm0, xmm0
imul cx, dx
push 0x400
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x108], 0
movq qword [ebp - 0x110], xmm0
add cx, ax
movq qword [ebp - 0x134], xmm0
movzx eax, cx
movzx ecx, byte [ebx + 1]
imul cx, dx
mov dword [ebp - 0x188], eax
movzx eax, byte [ebx + 2]
movdqu xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x12c], 0
add cx, ax
movq qword [ebp - 0x170], xmm0
movdqu xmmword [ebp - 0x180], xmm0
mov dword [ebp - 0x168], 0
movdqu xmmword [ebp - 0x164], xmm0
mov dword [ebp - 0x14c], 0
movq qword [ebp - 0x154], xmm0
movzx edi, cx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10001a20
mov eax, dword [ebp - 0x188]
movzx ecx, ax
push ecx
push edi
push str.myAppsHookController:_KEYPRESSED_DOWN_UP__x__x
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x1c
movzx ecx, byte [ebx + 3]
movzx eax, byte [ebx + 4]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x124], 0
test ecx, ecx
jle case.default.0x1000175a
mov ecx, dword [ebp - 0x188]
mov eax, ecx
mov esi, dword [sym.imp.USER32.dll_SendInput]
and eax, 0x700
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x18c], eax
mov edi, edi
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x164], 1
test ax, ax
je 0x10001b9e
xor eax, eax
and ecx, 0x100
mov dword [ebp - 0x128], ecx
je 0x10001ad5
push 0x10
call edx
mov ecx, 0xffff8000
test cx, ax
jne 0x10001aca
mov eax, 0x10
mov word [ebp - 0x140], ax
lea eax, [ebp - 0x144]
push 0x1c
push eax
push 1
call esi
jmp 0x10001acf
mov eax, 1
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp - 0x188]
test ecx, 0x200
je 0x10001b17
push 0x11
call edx
mov ecx, 0xffff8000
test cx, ax
jne 0x10001b0c
mov eax, 0x11
mov word [ebp - 0x17c], ax
lea eax, [ebp - 0x180]
push 0x1c
push eax
push 1
call esi
jmp 0x10001b11
mov eax, 1
mov ecx, dword [ebp - 0x188]
test ecx, 0x400
je 0x10001b4a
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xffff8000
test cx, ax
jne 0x10001b52
mov eax, 0x12
mov word [ebp - 0x160], ax
lea eax, [ebp - 0x164]
push 0x1c
push eax
push 1
call esi
test eax, eax
je 0x10001c1a
mov eax, dword [ebp - 0x188]
movzx eax, al
mov word [ebp - 0x11c], ax
xor eax, eax
cmp word [ebp - 0x128], ax
push 0x1c
setne al
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 1
call esi
cmp word [ebp - 0x128], 0
mov eax, 2
mov ecx, 3
cmovne eax, ecx
mov dword [ebp - 0x118], eax
jmp 0x10001c0d
cmp edi, 0x25
je 0x10001bdc
cmp edi, 0x27
je 0x10001bdc
cmp edi, 0x26
je 0x10001bdc
cmp edi, 0x28
je 0x10001bdc
push 0x1c
lea eax, [ebp - 0x120]
mov word [ebp - 0x11c], di
push eax
push 1
mov dword [ebp - 0x118], 0
call esi
mov dword [ebp - 0x118], 2
jmp 0x10001c0d
xor eax, eax
mov word [ebp - 0x11c], di
mov word [ebp - 0x11a], ax
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x118], 1
call esi
mov dword [ebp - 0x118], 3
push 0x1c
lea eax, [ebp - 0x120]
push eax
push 1
call esi
movzx ecx, byte [ebx + 3]
mov edx, dword [ebp - 0x124]
movzx eax, byte [ebx + 4]
inc edx
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x18c]
cmp edx, ecx
mov ecx, dword [ebp - 0x188]
mov edx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jl 0x10001a60
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebx + 3]
movzx eax, byte [ebx + 4]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x18c], 0
test ecx, ecx
jle case.default.0x1000175a
mov edi, dword [sym.imp.USER32.dll_SendInput]
mov edx, pe_nt_image_headers32
jmp 0x10001c90
movzx ecx, byte [ebx + 1]
xorps xmm0, xmm0
movzx eax, byte [ebx + 2]
imul cx, dx
movdqu xmmword [ebp - 0x120], xmm0
push 0x400
movdqu xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x108], 0
add cx, ax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [ebx + 0xe]
movzx esi, cx
movzx ecx, byte [ebx + 0xd]
imul cx, dx
movdqu xmmword [ebp - 0x180], xmm0
mov dword [ebp - 0x12c], 0
movdqu xmmword [ebp - 0x164], xmm0
mov dword [ebp - 0x168], 0
add cx, ax
movq qword [ebp - 0x134], xmm0
movzx eax, cx
movq qword [ebp - 0x170], xmm0
movq qword [ebp - 0x154], xmm0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x124], eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x128], eax
test eax, eax
je 0x10001da6
mov edi, dword [ebp - 0x124]
movzx ecx, di
push ecx
push esi
push str.myAppsHookController:_KEYPRESSED__x_vk_x
push 0x3ff
push 0x400
push eax
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov edi, dword [ebp - 0x128]
mov ecx, edi
lea edx, [eax + 1]
call fcn.10001680
push edi
call dword [sym.imp.MSVCR120.dll_free]
mov edi, dword [sym.imp.USER32.dll_SendInput]
add esp, 0x1c
cmp esi, 8
je 0x10002253
cmp esi, 9
je 0x10002253
cmp esi, 0xd
je 0x10002253
mov eax, dword [ebp - 0x124]
mov ecx, 0x62e
cmp ax, cx
jne 0x10002042
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10001e13
push str.myAppsHookController:_ctrlaltdel_received
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x14
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0xff
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 0x104], 0
push eax
push 0
push 0xffff
push str.SoftwareSASGeneration
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10001efc
cmp byte [ebp - 0x104], 3
je 0x10001eef
lea eax, [ebp - 0x188]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000227e
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x124]
push 4
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 0x188]
mov dword [ebp - 0x124], 3
call esi
test eax, eax
jne 0x10001ede
movsx eax, byte [ebp - 0x104]
push 4
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x124]
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 0x188]
call esi
push dword [ebp - 0x188]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000227e
push 1
call dword [sym.imp.SAS.dll_SendSAS]
jmp 0x1000227e
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x188]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemSoftwareSASGeneration
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10001ff4
push dword [ebp - 0x188]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x188]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000227e
push 4
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 3
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 0x188]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.SoftwareSASGeneration
push dword [ebp - 0x188]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10001fe3
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10001fe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.myAppsHookController:_failed_to_delete_key__d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
push dword [ebp - 0x188]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000227e
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1000227e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.myAppsHookController:_key_not_created__d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
jmp 0x1000227e
test eax, 0x700
je 0x10002215
mov edi, dword [ebp - 0x124]
xor eax, eax
mov ecx, edi
and ecx, 0x100
mov dword [ebp - 0x128], ecx
je 0x1000209f
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xffff8000
test cx, ax
jne 0x10002098
mov eax, 0x10
mov word [ebp - 0x140], ax
lea eax, [ebp - 0x144]
push 0x1c
push eax
push 1
call esi
jmp 0x100020a5
mov eax, 1
jmp 0x100020a5
mov esi, dword [sym.imp.USER32.dll_SendInput]
mov ecx, edi
and ecx, 0x200
mov dword [ebp - 0x190], ecx
je 0x100020e7
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xffff8000
test cx, ax
jne 0x100020e2
mov eax, 0x11
mov word [ebp - 0x17c], ax
lea eax, [ebp - 0x180]
push 0x1c
push eax
push 1
call esi
jmp 0x100020e7
mov eax, 1
mov esi, edi
and esi, 0x400
je 0x10002124
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xffff8000
test cx, ax
jne 0x1000212e
mov eax, 0x12
mov word [ebp - 0x160], ax
lea eax, [ebp - 0x164]
push 0x1c
push eax
push 1
call edi
jmp 0x1000212a
mov edi, dword [sym.imp.USER32.dll_SendInput]
test eax, eax
je 0x10002185
mov eax, dword [ebp - 0x124]
movzx eax, al
mov word [ebp - 0x11c], ax
xor eax, eax
cmp word [ebp - 0x128], ax
push 0x1c
setne al
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 1
call edi
cmp word [ebp - 0x128], 0
mov ecx, 3
mov eax, 2
cmovne eax, ecx
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
call edi
test si, si
je 0x100021b5
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0xffff8000
test si, ax
je 0x100021ba
push 0x1c
lea eax, [ebp - 0x164]
mov dword [ebp - 0x15c], 2
push eax
push 1
call edi
jmp 0x100021ba
mov esi, 0xffff8000
cmp word [ebp - 0x190], 0
je 0x100021e8
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x100021e8
push 0x1c
lea eax, [ebp - 0x180]
mov dword [ebp - 0x178], 2
push eax
push 1
call edi
cmp word [ebp - 0x128], 0
je 0x1000227e
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x1000227e
mov dword [ebp - 0x13c], 2
lea eax, [ebp - 0x144]
jmp 0x10002277
push 0x1c
cmp ax, 0x1b
jne 0x1000222b
mov eax, 0x1b
mov word [ebp - 0x11c], ax
jmp 0x1000225c
lea eax, [ebp - 0x120]
mov word [ebp - 0x11a], si
push eax
push 1
mov dword [ebp - 0x118], 4
call edi
mov dword [ebp - 0x118], 6
jmp 0x10002271
mov word [ebp - 0x11c], si
push 0x1c
lea eax, [ebp - 0x120]
push eax
push 1
call edi
mov dword [ebp - 0x118], 2
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
call edi
movzx ecx, byte [ebx + 3]
mov edx, dword [ebp - 0x18c]
movzx eax, byte [ebx + 4]
inc edx
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x18c], edx
cmp edx, ecx
mov edx, pe_nt_image_headers32
jl 0x10001c90
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx esi, byte [ebx + 5]
xorps xmm0, xmm0
movzx eax, byte [ebx + 6]
movzx edi, byte [ebx + 9]
shl esi, 8
add esi, eax
shl edi, 8
movzx eax, byte [ebx + 7]
shl esi, 8
add esi, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [ebx + 8]
shl esi, 8
add esi, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [ebx + 0xa]
add edi, eax
mov dword [ebp - 0x18c], esi
movzx eax, byte [ebx + 0xb]
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0xc]
shl edi, 8
add edi, eax
cmp byte [0x10005366], 0
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x190], edi
mov dword [ebp - 0x120], 0
jne 0x1000238e
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, dword [ebp - 0x18c]
lea esi, [eax - 1]
add ecx, edx
imul eax, ecx, 0xffff
push 1
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
movzx edx, byte [ebx + 3]
mov edi, dword [ebp - 0x190]
movzx ecx, byte [ebx + 4]
shl edx, 8
lea esi, [eax - 1]
add edx, edi
add ecx, edx
imul eax, ecx, 0xffff
cdq
idiv esi
mov esi, dword [ebp - 0x18c]
jmp 0x1000239e
mov eax, dword [0x1000535c]
mov dword [ebp - 0x11c], eax
mov eax, dword [0x10005360]
push 0x400
mov dword [ebp - 0x118], eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100023f0
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
push edi
push esi
push str.myAppsHookController:_LBUTTONUP_event__dx_d____dx_d
push 0x3ff
push 0x400
push ebx
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, ebx
lea edx, [eax + 1]
call fcn.10001680
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x24
mov esi, dword [sym.imp.USER32.dll_SendInput]
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x110], 0x8001
call esi
push 0x1c
lea eax, [ebp - 0x120]
mov dword [ebp - 0x110], 0x8004
push eax
push 1
call esi
pop edi
pop esi
mov byte [0x10005364], 0
xor al, al
mov byte [0x10005366], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebx + 5]
xorps xmm0, xmm0
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx eax, byte [ebx + 7]
shl ecx, 8
add ecx, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [ebx + 8]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [ebx + 0xa]
mov dword [ebp - 0x18c], ecx
movzx ecx, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xc]
shl ecx, 8
add ecx, eax
movdqu xmmword [ebp - 0x120], xmm0
push 0
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x120], 0
call edi
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, dword [ebp - 0x18c]
lea esi, [eax - 1]
add ecx, edx
imul eax, ecx, 0xffff
push 1
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 4]
mov edi, dword [ebp - 0x190]
shl edx, 8
lea esi, [eax - 1]
add edx, edi
mov dword [ebp - 0x110], 0x8001
add ecx, edx
imul eax, ecx, 0xffff
push 0x400
cdq
idiv esi
mov ebx, eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x118], ebx
mov dword [0x1000535c], eax
mov dword [0x10005360], ebx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10002579
push ebx
push dword [ebp - 0x11c]
push edi
push dword [ebp - 0x18c]
push str.myAppsHookController:_LBUTTONDOWN_event__dx_d____dx_d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x24
mov esi, dword [sym.imp.USER32.dll_SendInput]
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
call esi
mov dword [ebp - 0x110], 0x8002
push 0x1c
lea eax, [ebp - 0x120]
push eax
push 1
call esi
pop edi
pop esi
mov byte [0x10005364], 1
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx ebx, byte [ebx + 5]
mov edx, ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xorps xmm0, xmm0
shl ebx, 8
movdqu xmmword [ebp - 0x120], xmm0
movzx eax, byte [edx + 6]
movzx ecx, byte [edx + 9]
add ebx, eax
movzx eax, byte [edx + 7]
shl ebx, 8
add ebx, eax
shl ecx, 8
movzx eax, byte [edx + 8]
shl ebx, 8
add ebx, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [edx + 0xa]
add ecx, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [edx + 0xb]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x120], 0
movzx eax, byte [edx + 0xc]
shl ecx, 8
add ecx, eax
push 0
mov dword [ebp - 0x190], ecx
call edi
push 1
lea esi, [eax - 1]
mov eax, dword [ebp - 0x188]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax + 2]
shl edx, 8
add edx, ebx
add ecx, edx
imul eax, ecx, 0xffff
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
push 0x1c
mov dword [ebp - 0x110], 0x8001
lea esi, [eax - 1]
mov eax, dword [ebp - 0x188]
movzx edx, byte [eax + 3]
movzx ecx, byte [eax + 4]
shl edx, 8
add edx, dword [ebp - 0x190]
add ecx, edx
imul eax, ecx, 0xffff
cdq
idiv esi
mov esi, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 1
call esi
push 0x1c
lea eax, [ebp - 0x120]
mov dword [ebp - 0x110], 0x8002
push eax
push 1
call esi
jmp 0x10002596
movzx ecx, byte [ebx + 5]
xorps xmm0, xmm0
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx eax, byte [ebx + 7]
shl ecx, 8
add ecx, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [ebx + 8]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [ebx + 0xa]
mov dword [ebp - 0x18c], ecx
movzx ecx, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xc]
shl ecx, 8
add ecx, eax
movdqu xmmword [ebp - 0x120], xmm0
push 0
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x120], 0
call edi
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, dword [ebp - 0x18c]
lea esi, [eax - 1]
add ecx, edx
imul eax, ecx, 0xffff
push 1
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 4]
mov edi, dword [ebp - 0x190]
shl edx, 8
lea esi, [eax - 1]
add edx, edi
add ecx, edx
imul eax, ecx, 0xffff
push 0x400
cdq
idiv esi
mov ebx, eax
mov dword [ebp - 0x118], ebx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100027dc
push ebx
push dword [ebp - 0x11c]
push edi
push dword [ebp - 0x18c]
push str.myAppsHookController:_RBUTTONUP_event__dx_d____dx_d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x24
mov esi, dword [sym.imp.USER32.dll_SendInput]
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x110], 0x8001
call esi
mov dword [ebp - 0x110], 0x8010
push 0x1c
lea eax, [ebp - 0x120]
push eax
push 1
call esi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebx + 5]
xorps xmm0, xmm0
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
movzx eax, byte [ebx + 7]
shl ecx, 8
add ecx, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [ebx + 8]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [ebx + 0xa]
mov dword [ebp - 0x18c], ecx
movzx ecx, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0xc]
shl ecx, 8
add ecx, eax
movdqu xmmword [ebp - 0x120], xmm0
push 0
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x120], 0
call edi
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, dword [ebp - 0x18c]
lea esi, [eax - 1]
add ecx, edx
imul eax, ecx, 0xffff
push 1
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 4]
mov edi, dword [ebp - 0x190]
shl edx, 8
lea esi, [eax - 1]
add edx, edi
add ecx, edx
imul eax, ecx, 0xffff
push 0x400
cdq
idiv esi
mov ebx, eax
mov dword [ebp - 0x118], ebx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1000293c
push ebx
push dword [ebp - 0x11c]
push edi
push dword [ebp - 0x18c]
push str.myAppsHookController:_RBUTTONDOWN_event__dx_d____dx_d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x24
mov esi, dword [sym.imp.USER32.dll_SendInput]
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x110], 0x8001
call esi
mov dword [ebp - 0x110], 0x8008
jmp 0x10002803
movzx ebx, byte [ebx + 5]
mov edx, ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xorps xmm0, xmm0
shl ebx, 8
movdqu xmmword [ebp - 0x120], xmm0
movzx eax, byte [edx + 6]
movzx ecx, byte [edx + 9]
add ebx, eax
movzx eax, byte [edx + 7]
shl ebx, 8
add ebx, eax
shl ecx, 8
movzx eax, byte [edx + 8]
shl ebx, 8
add ebx, eax
movq qword [ebp - 0x110], xmm0
movzx eax, byte [edx + 0xa]
add ecx, eax
mov dword [ebp - 0x108], 0
movzx eax, byte [edx + 0xb]
shl ecx, 8
add ecx, eax
mov dword [ebp - 0x120], 0
movzx eax, byte [edx + 0xc]
shl ecx, 8
add ecx, eax
push 0
mov dword [ebp - 0x190], ecx
call edi
push 1
lea esi, [eax - 1]
mov eax, dword [ebp - 0x188]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax + 2]
shl edx, 8
add edx, ebx
add ecx, edx
imul eax, ecx, 0xffff
cdq
idiv esi
mov dword [ebp - 0x11c], eax
call edi
push 0x1c
mov dword [ebp - 0x110], 0x8001
lea esi, [eax - 1]
mov eax, dword [ebp - 0x188]
movzx edx, byte [eax + 3]
movzx ecx, byte [eax + 4]
shl edx, 8
add edx, dword [ebp - 0x190]
add ecx, edx
imul eax, ecx, 0xffff
cdq
idiv esi
mov esi, dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 1
call esi
push 0x1c
lea eax, [ebp - 0x120]
mov dword [ebp - 0x110], 0x8008
push eax
push 1
call esi
jmp 0x10002803
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10002aba
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, ecx
push edx
push str.myAppsHookController:_MOUSEWHEEL_delta__d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
movzx ecx, byte [ebx + 1]
xorps xmm0, xmm0
movzx eax, byte [ebx + 2]
shl ecx, 8
dec eax
add ecx, eax
movq qword [ebp - 0x134], xmm0
neg ecx
mov dword [ebp - 0x12c], 0
movdqu xmmword [ebp - 0x144], xmm0
sbb ecx, ecx
mov dword [ebp - 0x144], 0
and ecx, 0xf0
mov dword [ebp - 0x134], 0x800
add ecx, 0xffffff88
lea eax, [ebp - 0x144]
mov dword [ebp - 0x138], ecx
push 0x1c
jmp 0x1000185d
movzx esi, byte [ebx + 5]
movzx eax, byte [ebx + 6]
movzx edi, byte [ebx + 9]
shl esi, 8
add esi, eax
shl edi, 8
movzx eax, byte [ebx + 7]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 8]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 0xa]
add edi, eax
mov dword [ebp - 0x148], esi
movzx eax, byte [ebx + 0xb]
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0xc]
shl edi, 8
add edi, eax
push 0x400
mov dword [ebp - 0x18c], edi
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x190], eax
test eax, eax
je 0x10002bc9
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 4]
movzx eax, byte [ebx + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [ebx + 1]
push edx
shl ecx, 8
add ecx, eax
push ecx
push edi
push esi
mov esi, dword [ebp - 0x190]
push str.myAppsHookController:_MOUSEMOVE__dx_d____dx_d
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x24
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x144], xmm0
push 0
movq qword [ebp - 0x134], xmm0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x144], 0
call edi
movzx edx, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
shl edx, 8
add edx, dword [ebp - 0x148]
lea esi, [eax - 1]
add ecx, edx
imul eax, ecx, 0xffff
push 1
cdq
idiv esi
mov dword [ebp - 0x140], eax
call edi
movzx edx, byte [ebx + 3]
movzx ecx, byte [ebx + 4]
shl edx, 8
add edx, dword [ebp - 0x18c]
lea esi, [eax - 1]
add ecx, edx
mov dword [ebp - 0x134], 0x8001
imul eax, ecx, 0xffff
push 0x1c
cdq
idiv esi
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x144]
jmp 0x1000185d
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10002ca3
push dword [0x10005014]
push str.myAppsHookController:_received_stop_message___x_
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
pop edi
pop esi
mov byte [0x10005365], 1
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002d4c
mov esp, ebp
pop ebp
ret
push 0x400
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10002d01
push dword [0x10005014]
push str.myAppsHookController:_received_stop_thread_message___x_
push 0x3ff
push 0x400
push esi
call dword [sym.imp.MSVCR120.dll__snprintf_s]
mov ecx, esi
lea edx, [eax + 1]
call fcn.10001680
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002d4c
mov esp, ebp
pop ebp
ret