joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002990
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.10098090
add esi, 0x24
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x100029d1
mov eax, dword [esi]
jmp 0x100029d3
mov eax, esi
push 0x10191884
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002a0c
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x10002a14
mov esi, dword [esi]
push str.Dict
push esi
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x10002a4e
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret

Function at 0x10002a60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x10002a81
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002abb
lea eax, [ebp - 0x20c]
push eax
call fcn.1000c920
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10002ac4
mov eax, dword [str.Config.ini]
mov dword [ecx], eax
mov eax, dword [0x101918ac]
mov dword [ecx + 4], eax
mov eax, dword [0x101918b0]
mov dword [ecx + 8], eax
mov eax, dword [0x101918b4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x101918b8]
mov dword [ecx + 0x10], eax
mov ax, word [0x101918bc]
mov word [ecx + 0x14], ax
cmp word [ebp - 0x20c], 0
jne 0x10002b0f
xor ecx, ecx
jmp 0x10002b2f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x10002b20
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002b20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x54]
call fcn.100048b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10002b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x10002b71
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002bab
lea eax, [ebp - 0x20c]
push eax
call fcn.1000c920
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10002bb4
mov eax, dword [str.Related.ini]
mov dword [ecx], eax
mov eax, dword [0x101918c4]
mov dword [ecx + 4], eax
mov eax, dword [0x101918c8]
mov dword [ecx + 8], eax
mov eax, dword [0x101918cc]
mov dword [ecx + 0xc], eax
mov eax, dword [0x101918d0]
mov dword [ecx + 0x10], eax
mov eax, dword [0x101918d4]
mov dword [ecx + 0x14], eax
cmp word [ebp - 0x20c], 0
jne 0x10002bfd
xor ecx, ecx
jmp 0x10002c15
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002c06
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xcc]
call fcn.100048b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret

Function at 0x10002d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x10002d81
mov eax, dword [eax]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002dbb
lea eax, [ebp - 0x20c]
push eax
call fcn.1000c920
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x10002dc9
xor ecx, ecx
jmp 0x10002de1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002dd2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x12c]
call fcn.100048b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10003960
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
mov edi, ecx
push eax
mov dword [ebp - 0x43c], edi
call fcn.10098090
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x434]
push 0
push eax
mov dword [ebp - 0x438], 0
call fcn.10098090
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003a81
lea eax, [ebp - 0x438]
push eax
push esi
mov dword [ebp - 0x438], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10003a3e
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x10003a00
cmp dword [ebp - 0x430], ebx
je 0x10003a18
lea eax, [ebp - 0x438]
push eax
push esi
call edi
test eax, eax
jne 0x10003a00
jmp 0x10003a38
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ebp + ecx - 0x414]
mov word [ebp + ecx - 0x20c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10003a20
mov edi, dword [ebp - 0x43c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call fcn.10092063
mov edx, eax
add esp, 4
cmp word [edx], 0
jne 0x10003a60
xor ecx, ecx
jmp 0x10003a74
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003a65
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [edi + 0x144]
call fcn.100048b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret

Function at 0x10003b20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x190]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esi]
sub edx, dword [edi + 0x188]
mov eax, dword [esi + 4]
lea ebx, [edi + 0x188]
push 0
sbb eax, dword [ebx + 4]
push 0x3e8
push eax
push edx
call fcn.10099e00
push dword [edi + 0x1cc]
push dword [edi + 0x1c8]
push edx
push eax
call fcn.100a4aa0
test edx, edx
jl 0x10003b8e
jg 0x10003b74
cmp eax, 0x3e8
jbe 0x10003b8e
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.10013e50
mov dword [edi + 0xc], eax
mov eax, dword [0x101e2ddc]
mov dword [edi + 0x15c], eax
mov eax, dword [edi + 0xc]
pop edi
pop esi
pop ebx
ret
Function at 0x10003ba0
Capabilities:
Check for time delay via queryperformancecounter
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
lea esi, [ebx + 0x180]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi]
sub ecx, dword [ebx + 0x178]
mov eax, dword [esi + 4]
lea edi, [ebx + 0x178]
push 0
sbb eax, dword [edi + 4]
push 0x3e8
push eax
push ecx
call fcn.10099e00
push dword [ebx + 0x1cc]
push dword [ebx + 0x1c8]
push edx
push eax
call fcn.100a4aa0
test edx, edx
jl 0x10003c58
jg 0x10003c04
cmp eax, 0x3e8
jbe 0x10003c58
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [0x101e2ddc]
mov dword [ebx + 0x15c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret

Function at 0x10003d50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x10003dc1
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x10003da8
cmp eax, 1
jne 0x10003dc1
cmp byte [ebp - 6], 1
jne 0x10003dc1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1009174c
mov esp, ebp
pop ebp
ret

Function at 0x10003de0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
push str.SHGetKnownFolderPath
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x10003e1d
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x18]
push eax
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x400
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
js 0x10003e09
mov ecx, dword [ebp - 0x1c]
mov edx, esi
sub edx, ecx
jmp 0x10003e50
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10003e50
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 8]
test eax, eax
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret 4
Function at 0x10003e80
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10003eaf
push eax
mov ecx, ebx
call fcn.10003de0
test al, al
je 0x10003eaf
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x104
push ebx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x10003ef3
lea edi, [ebx - 2]
jmp 0x10003ed0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10003ed0
mov ecx, 9
mov esi, str.AppDataLocalLow
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10003ea5
pop edi
pop esi
xor al, al
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x10003f00
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov ebx, ecx
call fcn.10098090
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.10003e80
test al, al
jne 0x10003f77
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003f62
sub ecx, edx
sar ecx, 1
je 0x10004025
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10003f80
mov eax, dword [0x101917d8]
mov dword [edi], eax
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10003fa0
mov ecx, 7
mov esi, str.SmartCloudIME
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10003fc1
mov dword [edi], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10003fef
lea eax, [ebp - 0x210]
push eax
call fcn.1000c920
add esp, 4
cmp word [ebp - 0x210], 0
jne 0x10003ffd
xor ecx, ecx
jmp 0x10004015
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004006
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3c]
call fcn.100048b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10004040
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov ebx, ecx
call fcn.10098090
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.10003e80
test al, al
jne 0x100040b7
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100040a2
sub ecx, edx
sar ecx, 1
je 0x10004165
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100040c0
mov eax, dword [0x101917d8]
mov dword [edi], eax
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100040e0
mov ecx, 0xa
mov esi, str.SmartCloudIME.users
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10004101
mov dword [edi], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000412f
lea eax, [ebp - 0x210]
push eax
call fcn.1000c920
add esp, 4
cmp word [ebp - 0x210], 0
jne 0x1000413d
xor ecx, ecx
jmp 0x10004155
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004146
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x24]
call fcn.100048b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10004180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov ebx, ecx
call fcn.10098090
add esp, 0xc
xor ecx, ecx
jmp 0x100041c0
movzx eax, word [ecx + str.SOFTWARE_]
mov word [ebp + ecx - 0x20c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100041c0
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100041e1
cmp dword [ebx + 0x50], 8
mov ecx, 8
mov esi, 0x101917dc
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x3c]
pop edi
jb 0x10004205
mov ecx, dword [ecx]
lea edx, [ebp - 0x414]
jmp 0x10004210
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x10004210
cmp dword [ebx + 0x38], 8
lea ecx, [ebx + 0x24]
jb 0x1000422c
mov ecx, dword [ecx]
lea edx, [ebp - 0x61c]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x10004232
lea eax, [ebp - 0x620]
push eax
push 2
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100042a4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.CfgRootPath
push dword [ebp - 0x620]
call esi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 1
push 0
push str.CfgUserPath
push dword [ebp - 0x620]
call esi
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10007570
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016f3f1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
push 0x11
movzx edi, ax
call esi
movzx esi, ax
test di, di
jns 0x1000760d
cmp dword [0x101ed6a8], 0
jne 0x100075c6
push 1
call fcn.10092352
add esp, 4
mov dword [0x101ed6a8], eax
mov eax, dword [0x101ed724]
test eax, eax
jne 0x10007601
push 0x1d4
call fcn.10092352
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x100075f3
mov ecx, eax
call fcn.1002c6b0
jmp 0x100075f5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x101ed724], eax
mov dword [eax + 0x8c], 1
jmp 0x10007612
mov eax, dword [0x101ed724]
test si, si
jns 0x10007674
cmp dword [0x101ed6a8], 0
jne 0x10007634
push 1
call fcn.10092352
mov dword [0x101ed6a8], eax
mov eax, dword [0x101ed724]
add esp, 4
test eax, eax
jne 0x1000766a
push 0x1d4
call fcn.10092352
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x1000765c
mov ecx, eax
call fcn.1002c6b0
jmp 0x1000765e
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x101ed724], eax
mov dword [eax + 0x90], 1
mov eax, dword [0x101ed6b8]
test eax, eax
jne 0x100076ac
push 0x14
call fcn.10092352
add esp, 4
test eax, eax
je 0x100076a5
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 1
mov dword [eax + 0x10], 0
jmp 0x100076a7
xor eax, eax
mov dword [0x101ed6b8], eax
push 1
mov ecx, eax
call fcn.1006a220
mov eax, dword [0x101ed6d0]
test eax, eax
jne 0x100076e9
push 0xe0
call fcn.10092352
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x100076e2
mov ecx, eax
call fcn.10058ce0
jmp 0x100076e4
xor eax, eax
mov dword [0x101ed6d0], eax
mov dword [eax + 0xdc], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100086e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 8], 0
push edi
je 0x1000871c
push str.Already_Opertor
call fcn.10014420
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
call fcn.100066b0
cmp dword [eax + 0xf8], 8
lea esi, [eax + 0xe4]
jb 0x10008732
mov esi, dword [esi]
call fcn.1000cc80
push esi
push 0xffffffffffffffff
push str.SrfSoftOpertorDate
push str.Setting
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
je 0x100088bc
xor eax, eax
push edi
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
push 0x10191a90
push eax
movq qword [ebp - 0x16], xmm0
movq qword [ebp - 0xe], xmm0
call fcn.10091da4
add esp, 0xc
lea eax, [ebp - 0x18]
push esi
push eax
push str.SrfSoftOpertorDate
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.10098090
add esp, 0xc
call fcn.100066b0
cmp dword [eax + 0xb0], 8
lea ecx, [eax + 0x9c]
jb 0x100087e4
mov ecx, dword [ecx]
lea edx, [ebp - 0x428]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x100087f0
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10008810
mov ecx, 6
mov esi, str.SCMutual.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x220]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10008833
mov eax, dword [0x10191b3c]
lea edx, [ebp - 0x428]
mov dword [edi], eax
mov esi, edx
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10008850
lea edi, [ebp - 0x220]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10008866
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x220]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10008890
mov ecx, 0xa
mov esi, str.__SoftExtraOperate_1
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x220]
movsw word es:[edi], word [esi]
call fcn.1000dfc0
mov dword [ebx + 8], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100088d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.100066b0
cmp dword [eax + 0xf8], 8
lea esi, [eax + 0xe4]
jb 0x100088fb
mov esi, dword [esi]
call fcn.1000cc80
push esi
push 0xffffffffffffffff
push str.SrfUpOnlineData
push str.Setting
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
je 0x10008a8f
xor eax, eax
push edi
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
push 0x10191a90
push eax
movq qword [ebp - 0x16], xmm0
movq qword [ebp - 0xe], xmm0
call fcn.10091da4
add esp, 0xc
lea eax, [ebp - 0x18]
push esi
push eax
push str.SrfUpOnlineData
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.10098090
add esp, 0xc
call fcn.100066b0
cmp dword [eax + 0xb0], 8
lea ecx, [eax + 0x9c]
jb 0x100089ad
mov ecx, dword [ecx]
lea edx, [ebp - 0x220]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x100089b3
lea edi, [ebp - 0x220]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100089d0
mov ecx, 6
mov esi, str.SCMutual.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x10191b3c]
mov word [ebp + ecx - 0x428], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100089f0
lea edx, [ebp - 0x220]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10008a10
lea edi, [ebp - 0x428]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10008a26
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10008a50
mov ecx, 8
mov esi, str.__UpOnlineData_1
rep movsd dword es:[edi], dword [esi]
push 0x7d0
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x220]
call fcn.1000e830
test eax, eax
je 0x10008a8f
lea ecx, [ebp - 0x428]
call fcn.1000dfc0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret