joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
xor eax, eax
jmp 0x270a0
mov byte [esp + eax], al
inc eax
cmp eax, 0x100
jb 0x270a0
push ebx
push ebp
push esi
xor ecx, ecx
xor eax, eax
push edi
xor esi, esi
jmp 0x270c0
movzx edi, byte [eax + 0x297f0]
mov dl, byte [esp + esi + 0x10]
movzx ebx, dl
add edi, ecx
add ebx, edi
and ebx, 0xff
inc eax
mov ecx, ebx
cmp eax, 0x70
jb 0x270e2
xor eax, eax
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
inc esi
mov byte [esp + ecx + 0x10], dl
cmp esi, 0x100
jb 0x270c0
xor edi, edi
xor esi, esi
mov eax, 0x2a7aa
lea ebp, [edi + 0x7a]
inc esi
and esi, 0xff
mov dl, byte [esp + esi + 0x10]
movzx ecx, dl
add ecx, edi
and ecx, 0xff
movzx ebx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx edi, byte [esp + esi + 0x10]
movzx edx, dl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
xor byte [eax - 2], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax - 1], cl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx ecx, bl
add ecx, edx
and ecx, 0xff
movzx edx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + ecx + 0x10], bl
movzx edx, byte [esp + esi + 0x10]
movzx edi, bl
add edx, edi
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax + 1], cl
inc esi
and esi, 0xff
mov cl, byte [esp + esi + 0x10]
movzx edi, cl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + edi + 0x10], cl
movzx edx, byte [esp + esi + 0x10]
movzx ecx, cl
add edx, ecx
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax + 2], dl
add eax, 5
sub ebp, 1
jne 0x27103
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x27aa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, 0x1fc
or eax, 0xffffffff
push esi
lea esp, [esp]
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x29008]
dec ecx
inc edx
test ecx, ecx
jne 0x27ab0
not eax
pop esi
ret

Function at 0x27bc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
setge al
test al, al
je 0x27c02
test esi, esi
je 0x27c02
mov ecx, dword [esp + 4]
mov dword [esi], ecx
add esp, 8
ret 4
Function at 0x27c10
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x24
xor eax, eax
push 5
push 0x18
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x27c61
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov al, 1
add esp, 0x24
ret
xor al, al
add esp, 0x24
ret

Function at 0x27c70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x54
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
test esi, esi
je 0x27ced
test edi, edi
je 0x27ced
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00027240
push edi
lea esi, [esp + 0xc]
call fcn.00027300
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x2b034
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call section.INIT
pop ebp
jmp fcn.00025bc0
Function at 0x1009b2df
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b341
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b372
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b3a3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b3d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b402
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4
Function at 0x1009b430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
push 4
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x100bdc44
call fcn.100383f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 8
ja case.default.0x1009b2d1
mov eax, dword [ebp - 0xd0]
jmp dword [eax*4 + 0x1009b479]
mov al, 1
jmp 0x1009b464
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b2fe
mov byte [ebp - 0xcd], 1
jmp 0x1009b305
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b32f
mov byte [ebp - 0xcd], 1
jmp 0x1009b336
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b360
mov byte [ebp - 0xcd], 1
jmp 0x1009b367
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b391
mov byte [ebp - 0xcd], 1
jmp 0x1009b398
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3c2
mov byte [ebp - 0xcd], 1
jmp 0x1009b3c9
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b3f3
mov byte [ebp - 0xcd], 1
jmp 0x1009b3fa
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b421
mov byte [ebp - 0xcd], 1
jmp 0x1009b428
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
mov esi, esp
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10037973
test ax, ax
je 0x1009b44f
mov byte [ebp - 0xcd], 1
jmp 0x1009b456
mov byte [ebp - 0xcd], 0
mov al, byte [ebp - 0xcd]
jmp 0x1009b464
xor al, al
jmp 0x1009b464
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10037973
leave
ret 4