joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006963
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x888]
add edx, 1
mov dword [ebp - 0x888], edx
mov eax, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x888]
cmp ecx, dword [eax + 0x18]
jae 0x100069d5
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp - 0x26d4]
mov ecx, dword [ebp - 0x3ac]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x88c], ecx
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp - 0x26d8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1f3c]
mov eax, dword [ebp - 0x3ac]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1f40], eax
mov dword [ebp - 0x1dc], 0
jmp 0x10006839
mov ecx, dword [ebp - 0x1dc]
add ecx, 1
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x88c]
add edx, dword [ebp - 0x1dc]
movsx eax, byte [edx]
test eax, eax
je 0x100068eb
mov ecx, dword [ebp - 0x1dc]
movsx edx, byte [ebp + ecx - 0x9c0]
test edx, edx
je 0x100068eb
push ebx
push eax
add esp, 4
sub ebx, 0xbcc5
or ebx, 0xce94
pop ebx
push ebx
push ecx
add esp, 4
or ebx, 0x16654
add ebx, 0xf20c
pop ebx
push ebx
xor ebx, 0x14bac
or ebx, 0xefc1
pop ebx
mov eax, dword [ebp - 0x88c]
add eax, dword [ebp - 0x1dc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1dc]
movsx eax, byte [ebp + edx - 0x9c0]
cmp ecx, eax
je 0x100068dd
mov ecx, dword [ebp - 0x88c]
add ecx, dword [ebp - 0x1dc]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x1dc]
movsx ecx, byte [ebp + eax - 0x9c0]
cmp edx, ecx
jne 0x100068e4
jmp 0x1000682a
jmp 0x100068eb
push esi
push ecx
add esp, 4
jmp 0x100068f5
pop esi
push eax
add eax, 0x17cd5
sub eax, 0x1095b
xor eax, 0x13eff
call fcn.10006919
add byte [edx + eax*2 + 0x32], cl
aas
inc eax
cmp dword [0x8348333d], esi
add esp, 4
pop eax
add esp, 4
pop eax
mov edx, dword [ebp - 0x88c]
add edx, dword [ebp - 0x1dc]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x1dc]
movsx edx, byte [ebp + ecx - 0x9c0]
cmp eax, edx
jne 0x1000694a
mov dword [ebp - 0xeb8], 0
jmp 0x100069b9
push edx
xor edx, 0x97a0
and edx, 0x14cb
call 0x10006963
add byte [edx + 0x37], al
dec ebx
inc ecx
aas
xor al, 0x83
les eax, [edx + ebx*2]
push ecx
push edi
add esp, 4
jmp 0x10006975
jmp 0x1000697b
pop ecx
mov eax, dword [ebp - 0x88c]
add eax, dword [ebp - 0x1dc]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x1dc]
movsx eax, byte [ebp + edx - 0x9c0]
or eax, 0x20
cmp ecx, eax
jge 0x100069af
mov dword [ebp - 0xeb8], 0xffffffff
jmp 0x100069b9
mov dword [ebp - 0xeb8], 1
cmp dword [ebp - 0xeb8], 0
jne 0x100069d0
mov ecx, dword [ebp - 0x1f40]
mov dword [ebp - 0x5d0], ecx
jmp 0x100069e1
jmp 0x100067ba
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], edx
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x8bc], eax

Function at 0x100074f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x8bfffff7
lea esi, [eax]
cld
invalid

Function at 0x10007500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
loopne 0x10007501
invalid
dec dword [ebx - 0x8976b]
dec dword [ebx - 0x3cf7b]
inc dword [ebx]
Function at 0x10007600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x146da
pop eax
push ebx
add ebx, 0x14779
pop ebx
push ebx
Function at 0x10007b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3e
inc eax
xor eax, 0xc4834d3e
add esp, 4
invalid
invalid

Function at 0x10007b96
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3e
inc eax
xor eax, 0xc4834d3e
add esp, 4
invalid
invalid

Function at 0x10007bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
ljmp 0x8b5a

Function at 0x10008150
Capabilities:
Encode data using xor

Disassembly:
fcmovnb st(0), st(2)
add al, byte [edx]
pop ebx
enter 0x6e87, 0xfffffffffffffff6
add dword [ecx], eax
dec ecx
enter 0x6f87, 0xfffffffffffffff6
add dword [ecx], eax
enter 0x7087, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x1000810c
xchg dword [ecx - 0xa], esi
add dword [ecx], eax
dec edi
enter 0x7287, 0xfffffffffffffff6
xchg dword [edx - 0xa], esi
add dword [ecx], eax
jno 0x1000811a
xchg dword [ebx - 0xa], esi
add dword [ecx], eax
enter 0x7487, 0xfffffffffffffff6
add dword [ecx], eax
ja 0x10008128
xchg dword [ebp - 0xa], esi
add dword [ecx], eax
outsb dx, byte [esi]
enter 0x7687, 0xfffffffffffffff6
add dword [ecx], eax
enter 0x7787, 0xfffffffffffffff6
add dword [ecx], eax
dec edx
enter 0x7887, 0xfffffffffffffff6
add dword [ecx], eax
arpl ax, cx
xchg dword [ecx - 0xa], edi
add dword [ecx], eax
jo 0x1000814b
xchg dword [edx - 0xa], edi
add dword [ecx], eax
enter 0x7b87, 0xfffffffffffffff6
add dword [ecx], eax
outsb dx, byte [esi]
enter 0x7c87, 0xfffffffffffffff6
add dword [ecx], eax
enter 0x7d87, 0xfffffffffffffff6
add dword [ecx], eax
pop ecx
enter 0x7e87, 0xfffffffffffffff6
add dword [ecx], eax
add dl, byte [edx - 0x13]
push es
cmp dword [ebx], edi
dec edx
inc esi
add edx, 0xffffff8c
sbb eax, 0xf2830203
sbb al, 2
sbb al, 2
add bl, byte [edx + 0x54]
push edx
test esi, eax
push es
xor esp, 0x5a
xor al, byte [ebx]
add al, byte [ebx + 0x2d4e0c4]
add al, byte [ebx + 0x248fbf4]
add al, byte [ebx + 0x21252cc]
add bl, byte [eax + ecx*8 - 0x79]
pop esi
out dx, al
int3
xchg dword [esi - 0x12], ebx
add dword [ecx], eax
dec eax
enter 0x5f87, 0xffffffffffffffee
xchg dword [edi - 0x12], ebx
add dword [ecx], eax
imul ecx, eax, 0xffffff87
pushal
out dx, al
xchg dword [eax - 0x12], esp
add dword [ecx], eax
jo 0x100081b5
xchg dword [ecx - 0x12], esp
add dword [ecx], eax
enter 0x6287, 0xffffffffffffffee
add dword [ecx], eax
push esp
enter 0x6387, 0xffffffffffffffee
add dword [ecx], eax
enter 0x6487, 0xffffffffffffffee
add dword [ecx], eax
jne 0x100081d1
xchg dword [ebp - 0x12], esp
add dword [ecx], eax
jno 0x100081d8
xchg dword [esi - 0x12], esp
add dword [ecx], eax
ja 0x100081df
xchg dword [edi - 0x12], esp
add dword [ecx], eax
je 0x100081e6
xchg dword [eax - 0x12], ebp
add dword [ecx], eax
enter 0x6987, 0xffffffffffffffee
add dword [ecx], eax
enter 0x6a87, 0xffffffffffffffee
add dword [ecx], eax
pop ecx
enter 0x6b87, 0xffffffffffffffee
add dword [ecx], eax
add dl, byte [edx - 0x7d]
retf 0x44ce
Function at 0x1000bd40
Capabilities:
Encode data using xor

Disassembly:
push 0xe6de8f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xe6e0978b
add dword [ecx], eax
xor eax, 0x878b68c2
loop 0x1000bd28
add dword [ecx], eax
push ebp
push esp
test esi, eax
push es
sub ebp, 0xffffff8f
inc edx
add eax, dword [edx]
pop ebp
push esp
and esp, 0x60
mov es, word [edx]
add al, byte [ebx + 0x25ffdc4]
add ch, dl
or al, 2
add al, byte [edx]
add al, byte [ebx + 0x35]
push eax
cmp byte [esi], dh
inc edi
aaa
cmp al, byte [ebp - 0x1b7cf93a]
mov ebx, 0x5c0202a5
enter 0x3687, 0xfffffffffffffff7
add dword [ecx], eax
dec esi
enter 0x3787, 0xfffffffffffffff7
add dword [ecx], eax
jno 0x1000bd4d
xchg dword [esi], esi
test dword [ecx], 0x87c84e01
aaa
test dword [ecx], 0x87c87101
cmp bh, dh
add dword [ecx], eax
arpl ax, cx
xchg dword [ecx], edi
test dword [ecx], 0x87c86601
cmp dh, bh
xchg dword [eax], edi
test dword [ecx], 0x87c86301
cmp edi, esi
add dword [ecx], eax
enter 0x3a87, 0xfffffffffffffff7
add dword [ecx], eax
dec esi
enter 0x3b87, 0xfffffffffffffff7
add dword [ecx], eax
imul ecx, eax, 0xffffff87
cmp al, 0xf7
add dword [ecx], eax
enter 0x3d87, 0xfffffffffffffff7
add dword [ecx], eax
je 0x1000bd77
xchg dword [esi], edi
test dword [ecx], 0x87c86301
aas
test dword [ecx], 0x87c87401
inc eax
test dword [ecx], 0x87c87b01
inc ecx
test dword [ecx], 0x87c85901
inc edx
test dword [ecx], 0x8d660201
bndldx bnd0, [edx]
add al, byte [edx]
mov ecx, dword [edi + 0x101e1e2]
lea edx, [edi + 0x101e1e2]
lea eax, [edx + esi - 0x75]
xchg esi, ebx
loope 0x1000bded
add dword [ebp + 0x1e1de8f], ecx
add dword [ebx + 0x1e7b68f], ecx
add dword [ecx - 0x7d], ebx
int1
pushal
lea ecx, [edi + 0x101e1de]
mov ecx, dword [edi + 0x101e7b6]
pop ecx
xor ecx, 0x60
mov ebp, 0x55610202
ljmp 0x3802
Function at 0x10011d80
Capabilities:
Encode data using xor

Disassembly:
push ebx
or ebx, 0xffffff87
lds eax, [edx]
add ch, dl
or al, 2
add al, byte [edx]
add bh, byte [eax + ecx*2]
inc ebx
aas
dec esp
dec edi
dec eax
aaa
aaa
test esi, eax
push es
and ebx, 0xffffffe1
jle 0x10011da1
add al, byte [ebx + 0x2aff5cb]
add bl, byte [ebx - 0x44]
add eax, 0x83020202
in al, 1
cmc
scasd eax, dword es:[edi]
add al, byte [edx]
pop ebx
mov esp, 0x2020205
and esp, 1
add dword [edx], eax
add dl, byte [ecx]
mov ecx, 0xda878bc4
test byte [ecx], 1
leave
xchg edx, ebx
inc byte [ecx]
add dword [edx], eax
add al, byte [edx]
add ch, bl
adc byte [eax + 2], cl
add dl, byte [ebx + 0x54]
test esi, eax
push es
add ebx, 0xffffffff
push 3
add ch, dl
or eax, dword [edx]
add al, byte [edx]
add cl, byte [esi + 0x47]
dec eax
aas
xor al, 0x44
inc edx
cmp eax, dword [ebp + 0x525b06c6]
push ebx
test esi, eax
push es
xor edx, 0xa
je 0x10011df3
add ch, ch
or dword [edx + 0x43], edx
push edx
inc ebx
aas
inc ecx
xor al, 0x5a
mov ebx, 0x2020270
push 0xedfe8f8b
add dword [ecx], eax
mov esp, 0x2020276
push 0xed00978b
add dword [ecx], eax
mov edx, 0x2020266
push 0xee02878b
add dword [ecx], eax
mov ebx, 0x202026e
push 0xee048f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xee06978b
add dword [ecx], eax
mov edx, 0x2020230
push 0xee08878b
add dword [ecx], eax
mov ebx, 0x2020266
push 0xee0a8f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xee0c978b
add dword [ecx], eax
mov edx, 0x202026e
push 0xee0e878b
add dword [ecx], eax
xor eax, 0x8f8b68cb
adc dh, ch
add dword [ecx], eax
push ebx
push edx
test esi, eax
push es
and ebx, 0x60
jns 0x10011e7c
add al, byte [edx]
pop ebx
add bl, byte [ebx + 0x55]
push ebp
and ebp, 0xffffffd1
arpl word [ebx], ax
add al, byte [ebx + 0x27a53cd]
add ch, dl
or eax, 0x2020202
cmp al, 0x3d
dec ecx
xor al, 0x3e
cmp al, 0x4d
xor eax, 0xc6854840
push es
in eax, dx
add eax, 0x5d4b4f36
enter 0xfffffffffffff287, 0xfffffffffffffff4
add dword [ecx], eax
push esp
enter 0xfffffffffffff387, 0xfffffffffffffff4
add dword [ecx], eax
jbe 0x10011e79
xchg esp, esi
hlt

Function at 0x10012570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + 0x101e66c]
mov ebx, 0x202026e
push 0xe66e8f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xe670978b
add dword [ecx], eax
xor eax, 0x878b68c2
jb 0x1001257b
add dword [ecx], eax
push esp
push ebp
test esi, eax
push es
ljmp 0x5202
Function at 0x10020450
Capabilities:
Encode data using xor

Disassembly:
add dword [edi + 0x68020202], edi
mov edx, dword [edi + 0x101e75e]
mov edx, 0x202026e
push 0xe760878b
add dword [ecx], eax
mov ebx, 0x2020235
push 0xe7628f8b
add dword [ecx], eax
mov esp, 0x2020234
push 0xe764978b
add dword [ecx], eax
mov edx, 0x2020230
push 0xe766878b
add dword [ecx], eax
mov ebx, 0x2020266
push 0xe7688f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xe76a978b
add dword [ecx], eax
add dword [esi + ebp*2 + 0x68020202], edi
mov edx, dword [edi + 0x101e76a]
mov edx, 0x202026e
push 0xe76c878b
add dword [ecx], eax
xor eax, 0x8f8b68cb
outsb dx, byte [esi]
add al, byte [edx]
add ch, byte [eax - 0x75]
xchg dword [edi + 1], ebp
add dword [0x8f8b68cb], esi
outsb dx, byte [esi]
out 1, eax
add eax, ecx
xchg dword [esi + 0x580101f6], esi
enter 0xffffffffffffb787, 0xfffffffffffffff6
add dword [ecx], eax
imul ecx, eax, 0xffffff87
mov eax, 0x740101f6
enter 0xffffffffffffb987, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x1002049f
xchg dword [edi + 0x6b0101f6], esi
enter 0xffffffffffffb887, 0xfffffffffffffff6
add dword [ecx], eax
je 0x10020498
xchg dword [ecx + 0x760101f6], edi
enter 0xffffffffffffba87, 0xfffffffffffffff6
add dword [ecx], eax
ja 0x100204a6
xchg dword [edx + 0x770101f6], edi
enter 0xffffffffffffbb87, 0xfffffffffffffff6
add dword [ecx], eax
arpl ax, cx
xchg dword [ebx + 0x630101f6], edi
enter 0xffffffffffffbc87, 0xfffffffffffffff6
add dword [ecx], eax
outsb dx, byte [esi]
enter 0xffffffffffffbd87, 0xfffffffffffffff6
add dword [ecx], eax
push edx
xchg dword [esi + esi*8 - 0x3791feff], edi
xchg dword [ebp + 0x520101f6], edi
enter 0xffffffffffffbe87, 0xfffffffffffffff6
add dword [ecx], eax
je 0x100204c2
xchg dword [edi + 0x710101f6], edi
enter 0xffffffffffffc087, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x100204d0
xchg ecx, eax
test byte [ecx], 1
enter 0xffffffffffffc287, 0xfffffffffffffff6
add dword [ecx], eax
enter 0xffffffffffffc387, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x100204e5
xchg esp, eax
test byte [ecx], 1
add cl, cl
xchg dword [edx], ebx
fiadd word [ecx]
add dword [edx], eax
add al, byte [edx]
add cl, byte [ebp + 0x1daea97]
add dword [ebx + 0x1f53e97], ecx
add dword [ebp + 0x53], edx
test esi, eax
push es
ljmp 0x3b02
Function at 0x10026c50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x24], 0
jne 0x10026c6d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x1fc], 0
je 0x10026c9d
cmp dword [esi + 0x20], 0
mov dword [esi + 0x1fc], 0
je 0x10026c9d
mov ecx, dword [esi + 4]
movups xmm0, xmmword [esi + 0x10]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esi + 0x1f8], 0
movzx edi, ax
je 0x10026cbf
test di, di
jne 0x10026cbf
push 0
mov ecx, esi
call sym.mui.dll_public:_void___thiscall_MUI::CustomLightMode::ResetAllItemCheck_int_
push dword [ebp + 0x10]
mov eax, dword [esi + 0x1c0]
lea ebx, [esi + 0x10]
push dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x10026def
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x204], eax
mov dword [esi + 0x20c], eax
mov eax, dword [esi + 0x1bc]
mov dword [esi + 0x200], ecx
mov dword [esi + 0x208], ecx
mov dword [esi + 0x1c0], eax
cmp eax, 0xffffffff
je 0x10026e21
lea ebx, [esi + 0x1a0]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test di, di
jns 0x10026d8e
push dword [esi + 0x1c0]
lea ecx, [esi + 0x194]
call fcn.100281b0
mov ecx, dword [eax]
test ecx, ecx
je 0x10026d65
xor eax, eax
cmp dword [ecx + 0x20], eax
sete al
mov dword [ecx + 0x20], eax
cmp dword [esi + 0x20], 0
je 0x10026d65
mov ecx, dword [esi + 4]
movups xmm0, xmmword [esi + 0x10]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0xc]
lea ebx, [esi + 0x10]
cmp dword [esi + 0x1c0], eax
jne 0x10026e2d
mov dword [esi + 0x1c0], 0xffffffff
jmp 0x10026e25
mov edi, dword [esi + 0x198]
xor ecx, ecx
sub edi, dword [esi + 0x194]
sar edi, 2
test edi, edi
je 0x10026d48
nop dword [eax]
nop word [eax + eax]
mov eax, dword [esi + 0x198]
mov edx, dword [esi + 0x194]
sub eax, edx
sar eax, 2
cmp eax, ecx
jbe 0x10026de4
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x10026dda
xor eax, eax
cmp dword [esi + 0x1c0], ecx
sete al
mov dword [edx + 0x20], eax
inc ecx
cmp ecx, edi
jb 0x10026db0
jmp 0x10026d48
push str.invalid_vector_T__subscript
call dword [0x100951ac]
mov dword [esi + 0x1fc], 0
mov dword [esi + 0x200], 0
mov dword [esi + 0x204], 0
mov dword [esi + 0x208], 0
mov dword [esi + 0x20c], 0
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1c0], eax
je 0x10026e4f
cmp dword [esi + 0x60], 0
jne 0x10026e4f
cmp dword [esi + 0x20], 0
je 0x10026e4f
mov ecx, dword [esi + 4]
movups xmm0, xmmword [ebx]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002aa90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008fd48
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100ca00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x1002aaca
xor eax, eax
jmp 0x1002ab7a
cmp dword [esi + 0x14], 0
je 0x1002aac3
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
lea eax, [ebx + ebx]
call fcn.1008db70
mov edi, esp
test edi, edi
je 0x1002aac3
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x14]
push eax
call sym.mui.dll_public:_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______thiscall_MUI::MEdit::GetTitleEx_void_
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1002c2f0
test al, al
je 0x1002ab53
mov ecx, dword [esi + 0x14]
push edi
call sym.mui.dll_public:_void___thiscall_MUI::MEdit::SetEditText_wchar_t_const__
mov eax, dword [esi + 0x14]
push 0
push 0
push 0x1a
mov ecx, dword [eax + 4]
push dword [eax + 0xc]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov esi, dword [esi + 0x14]
cmp dword [esi + 0x20], 0
je 0x1002ab53
mov ecx, dword [esi + 4]
movups xmm0, xmmword [esi + 0x10]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002ab75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
lea esp, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c351
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10031480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x24], 0
jne 0x1003149d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x20c], 0
je 0x100314cd
cmp dword [esi + 0x20], 0
mov dword [esi + 0x20c], 0
je 0x100314cd
mov ecx, dword [esi + 4]
movups xmm0, xmmword [esi + 0x10]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esi + 0x208], 0
movzx eax, ax
je 0x100314ef
test ax, ax
jne 0x100314ef
push 0
mov ecx, esi
call sym.mui.dll_public:_void___thiscall_MUI::KeyboardCtrl::ResetAllItemCheck_int_
push dword [ebp + 0x10]
mov eax, dword [esi + 0x1c4]
lea ebx, [esi + 0x10]
push dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x10031611
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x214], eax
mov dword [esi + 0x21c], eax
mov eax, dword [esi + 0x1c0]
mov dword [esi + 0x210], ecx
mov dword [esi + 0x218], ecx
mov dword [esi + 0x1c4], eax
cmp eax, 0xffffffff
je 0x100315fe
lea eax, [esi + 0x1a0]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x198]
mov ecx, dword [esi + 0x194]
sub eax, ecx
mov edi, dword [esi + 0x1c4]
sar eax, 2
cmp eax, edi
ja 0x10031579
push str.invalid_vector_T__subscript
call dword [0x100951ac]
mov edi, dword [ecx + edi*4]
test edi, edi
je 0x100315b9
cmp dword [esi + 0x1d8], 0x14
jne 0x100315b0
xor eax, eax
cmp dword [edi + 0x28], eax
sete al
mov dword [edi + 0x28], eax
cmp dword [esi + 0x20], ebx
je 0x100315b0
mov ecx, dword [esi + 4]
movups xmm0, xmmword [esi + 0x10]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
mov ebx, dword [edi + 4]
mov dword [esi + 0x1dc], ebx
lea eax, [esi + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x1d8], 0x14
mov edi, dword [esp + 0xc]
jne 0x100315e5
cmp dword [esi + 0x1c4], edi
jne 0x100315e5
mov dword [esi + 0x1c4], 0xffffffff
mov ecx, dword [esi + 4]
push ebx
push dword [esi + 0x1c4]
mov eax, dword [ecx]
push 1
push dword [esi + 0xc]
call dword [eax + 0x14]
lea ebx, [esi + 0x10]
jmp 0x10031647
mov ecx, dword [esi + 4]
push 0
push 0xffffffffffffffff
push 1
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 0x14]
jmp 0x10031643
mov dword [esi + 0x20c], 0
mov dword [esi + 0x210], 0
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 0
mov dword [esi + 0x21c], 0
mov edi, dword [esp + 0xc]
cmp dword [esi + 0x1c4], edi
je 0x10031671
cmp dword [esi + 0x60], 0
jne 0x10031671
cmp dword [esi + 0x20], 0
je 0x10031671
mov ecx, dword [esi + 4]
movups xmm0, xmmword [ebx]
push esi
push 1
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [edx + 0x18]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10045ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x100ca00c]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x10045c97
cmp dword [ebp + 0x18], 0
je 0x10045b06
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x30]
mov eax, dword [edi + 0x1c]
sub eax, dword [edi + 0x14]
mov dword [esp + 0xc], 0
cmp dword [edi + 0x174], eax
jle 0x10045b4a
mov edx, dword [edi + 0x17c]
mov esi, dword [edx + 0x180]
test esi, esi
jle 0x10045b44
mov eax, dword [edi + 0x14]
sub eax, dword [edi + 0x1c]
add eax, dword [edi + 0x174]
imul eax, dword [edx + 0x184]
cdq
idiv esi
jmp 0x10045b46
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x178], eax
jle 0x10045b8e
mov edx, dword [edi + 0x180]
mov esi, dword [edx + 0x180]
test esi, esi
jle 0x10045b88
mov eax, dword [edi + 0x18c]
sub eax, dword [edi + 0x18]
add eax, dword [edi + 0x10]
imul eax, dword [edx + 0x184]
cdq
idiv esi
jmp 0x10045b8a
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [edi + 0x170], 0
movups xmm0, xmmword [ebp + 8]
movups xmmword [esp + 0x20], xmm0
je 0x10045c5d
mov eax, dword [edi + 0x78]
xor ecx, ecx
sub eax, dword [edi + 0x74]
xor esi, esi
sar eax, 2
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], esi
test eax, eax
je 0x10045c5d
mov eax, dword [edi + 0x78]
mov edx, dword [edi + 0x74]
sub eax, edx
sar eax, 2
cmp eax, esi
jbe 0x10045cbe
mov esi, dword [edx + esi*4]
test esi, esi
je 0x10045c4a
test ecx, ecx
je 0x10045cac
cmp dword [esi + 0x20], 0
je 0x10045c4a
movups xmm0, xmmword [esi + 0x10]
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x34]
push eax
movups xmmword [esp + 0x38], xmm0
lea eax, [esp + 0x48]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x4c], xmm0
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x10045c46
movups xmm0, xmmword [esi + 0x10]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push eax
movups xmmword [esp + 0x3c], xmm0
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esi]
mov ecx, esi
push 0
push 0
call dword [eax + 0x30]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x1c]
jb 0x10045bc5
mov eax, dword [esp + 0xc]
neg eax
push eax
mov eax, dword [esp + 0x14]
neg eax
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [edi + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push 1
push ecx
mov ecx, edi
call dword [eax + 0x90]
mov ecx, dword [esp + 0x5c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1008c351
mov esp, ebp
pop ebp
ret 0x18
cmp esi, dword [esp + 0x18]
mov eax, 1
cmove ecx, eax
mov dword [esp + 8], ecx
jmp 0x10045c4a
push str.invalid_vector_T__subscript
call dword [0x100951ac]
int3