joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3f71
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101202c4]
mov esi, dword [0x10120420]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101204b8]
cmp eax, dword [ecx + 4]
jle 0x1000f64b
push 0x101204b8
call fcn.100f24cd
add esp, 4
cmp dword [0x101204b8], 0xffffffff
jne 0x1000f64b
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x101173f0]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x28], 0x6e140c15
movaps xmm0, xmmword [0x10118740]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0x1b140c
mov cl, byte [ebp - 0x48]
xor byte [ebp + eax - 0x47], cl
inc eax
cmp eax, 0x26
jb 0x1000f5b7
mov cl, 0x4d
mov byte [ebp - 0x20], 0x21
mov byte [ebp - 0x49], cl
mov al, 0x42
xor al, byte [ebp - 0x20]
mov dl, 0x48
mov byte [ebp - 0x4a], cl
mov ch, 0x55
xor cl, byte [ebp - 0x20]
mov dh, 0xf
mov byte [ebp - 0x1f], al
mov ah, 0x4f
mov al, byte [ebp - 0x49]
mov bl, 0x44
mov byte [ebp - 0x1e], cl
mov bh, 0x45
mov cl, byte [ebp - 0x20]
xor al, cl
mov byte [ebp - 0x15], 0
xor dl, cl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x4a]
xor dh, cl
xor ch, cl
mov byte [ebp - 0x1d], dl
xor bl, cl
mov byte [ebp - 0x1a], ch
xor ah, cl
mov byte [ebp - 0x19], dh
xor bh, cl
mov byte [ebp - 0x21], 0
xor al, cl
mov byte [ebp - 0x1c], bl
lea edx, [ebp - 0x47]
mov byte [ebp - 0x1b], ah
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x18], bh
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], 0
call fcn.1006a820
push 0x101204b8
mov dword [0x101204c4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f2483
add esp, 4
mov eax, dword [0x101204c4]
mov ecx, esi
push 0
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret 4
Function at 0x1001aac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f44e5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1011e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x1001aaf7
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1001ab15
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1001ab03
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1001b1c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001ab46
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
jne 0x1001ab5a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x28
mov dword [ebp - 0x18], 0
call fcn.100f25a3
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.1000e120
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101180c0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101180c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1001abf2
mov ecx, ebx
call fcn.1001ae60
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b1c0
mov edx, dword [eax]
jmp 0x1001abf5
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1001ac1d
mov dword [ecx + eax*8], edi
jmp 0x1001ac2f
cmp esi, edx
jne 0x1001ac26
mov dword [ecx + eax*8], edi
jmp 0x1001ac33
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1001ac33
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ac50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f44e5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1011e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x1001ac87
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1001aca5
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1001ac93
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1001b1c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001acd6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
jne 0x1001acea
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x28
mov dword [ebp - 0x18], 0
call fcn.100f25a3
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.1000e120
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101180c0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101180c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1001ad89
mov ecx, ebx
call fcn.1001ae60
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b1c0
mov edx, dword [eax]
jmp 0x1001ad8c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1001adb4
mov dword [ecx + eax*8], edi
jmp 0x1001adc6
cmp esi, edx
jne 0x1001adbd
mov dword [ecx + eax*8], edi
jmp 0x1001adca
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1001adca
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001cb00
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f47f0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x268
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x278], eax
push ecx
push eax
mov dword [ebp - 0x260], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1001cba0
mov byte [ebp - 0x261], al
jmp 0x1001ccd6
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001cbc0
sub ecx, edx
lea eax, [ebp - 0x23c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000eaf0
cmp dword [ebp - 0x18], 8
lea edi, [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmovae edi, eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x1c], 0xb
jne 0x1001cc21
mov eax, str.Spotify.exe
mov esi, 0xb
sub edi, eax
movzx edx, word [edi + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x1001cc21
add eax, 2
sub esi, 1
jne 0x1001cc04
mov byte [ebp - 0x261], 1
jmp 0x1001cc28
mov byte [ebp - 0x261], 0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x1001cc65
mov edx, dword [ebp - 0x274]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001cc5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001cd05
push ecx
push edx
call fcn.100f28ed
add esp, 8
cmp byte [ebp - 0x261], 0
je 0x1001cca0
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [ebp - 0x268]
je 0x1001cc8d
mov eax, dword [ebp - 0x258]
mov dword [ecx], eax
add dword [ebp - 0x26c], 4
jmp 0x1001cca0
lea eax, [ebp - 0x258]
push eax
push ecx
lea ecx, [ebp - 0x270]
call fcn.10003520
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1001cba0
lea eax, [ebp - 0x270]
push eax
push 0x1001c8b0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
setne byte [ebp - 0x261]
mov edx, dword [ebp - 0x270]
test edx, edx
je 0x1001cd15
mov ecx, dword [ebp - 0x268]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1001cd0b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001cd0b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f28ed
add esp, 8
mov al, byte [ebp - 0x261]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001f950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4af1
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x101202c4]
mov edx, dword [eax + edx*4]
mov eax, dword [0x101209f0]
cmp eax, dword [edx + 4]
jle 0x1001fa76
push 0x101209f0
call fcn.100f24cd
add esp, 4
cmp dword [0x101209f0], 0xffffffff
jne 0x1001fa76
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x10118240]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x24], 0x584f0d57
movaps xmm0, xmmword [0x10118250]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x20], 0x5a
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0x24
jb 0x1001f9e2
mov cl, 0x46
mov byte [ebp - 0x1c], 0x2a
mov byte [ebp - 0x45], cl
mov al, 0x49
xor al, byte [ebp - 0x1c]
mov dl, 0x43
mov byte [ebp - 0x46], cl
mov ch, 0x5e
xor cl, byte [ebp - 0x1c]
mov dh, 4
mov byte [ebp - 0x1b], al
mov ah, 0x44
mov al, byte [ebp - 0x45]
mov bl, 0x4f
mov byte [ebp - 0x1a], cl
mov bh, 0x4e
mov cl, byte [ebp - 0x1c]
xor al, cl
mov byte [ebp - 0x11], 0
xor dl, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x46]
xor dh, cl
xor ch, cl
mov byte [ebp - 0x19], dl
xor bl, cl
mov byte [ebp - 0x16], ch
xor ah, cl
mov byte [ebp - 0x15], dh
xor bh, cl
mov byte [ebp - 0x1f], 0
xor al, cl
mov byte [ebp - 0x18], bl
lea edx, [ebp - 0x43]
mov byte [ebp - 0x17], ah
lea ecx, [ebp - 0x1b]
mov byte [ebp - 0x14], bh
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 0
call fcn.1006a820
push 0x101209f0
mov dword [0x10120a04], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f2483
add esp, 4
push esi
push 0
call dword [0x10120a04]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
Function at 0x1001ff10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b3], 0
push esi
push edi
je 0x10020072
mov eax, dword [0x1011e220]
mov ecx, dword [0x101205ac]
dec eax
cmp eax, 3
ja case.default.0x1001ff34
jmp dword [eax*4 + 0x1002007c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ff6b
mov al, byte [ebp + 0xb]
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020072
mov edi, dword [0x10120420]
test edi, edi
je 0x10020072
mov eax, dword [0x10120334]
test eax, eax
jne 0x1001ffe5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020072
call fcn.1000f8e0
cmp eax, 9
je 0x10020072
call fcn.1000f8e0
cmp eax, 8
je 0x10020072
call fcn.10023560
test byte [eax + 8], 1
je 0x10020072
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x1002004e
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020072
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a890
mov byte [eax + 0x19], 1
cmp byte [0x1012078d], 0
je 0x10020072
call fcn.1001faa0
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff3b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b3], 0
push esi
push edi
je 0x10020072
mov eax, dword [0x1011e220]
mov ecx, dword [0x101205ac]
dec eax
cmp eax, 3
ja case.default.0x1001ff34
jmp dword [eax*4 + 0x1002007c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ff6b
mov al, byte [ebp + 0xb]
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020072
mov edi, dword [0x10120420]
test edi, edi
je 0x10020072
mov eax, dword [0x10120334]
test eax, eax
jne 0x1001ffe5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020072
call fcn.1000f8e0
cmp eax, 9
je 0x10020072
call fcn.1000f8e0
cmp eax, 8
je 0x10020072
call fcn.10023560
test byte [eax + 8], 1
je 0x10020072
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x1002004e
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020072
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a890
mov byte [eax + 0x19], 1
cmp byte [0x1012078d], 0
je 0x10020072
call fcn.1001faa0
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff4a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b3], 0
push esi
push edi
je 0x10020072
mov eax, dword [0x1011e220]
mov ecx, dword [0x101205ac]
dec eax
cmp eax, 3
ja case.default.0x1001ff34
jmp dword [eax*4 + 0x1002007c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ff6b
mov al, byte [ebp + 0xb]
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020072
mov edi, dword [0x10120420]
test edi, edi
je 0x10020072
mov eax, dword [0x10120334]
test eax, eax
jne 0x1001ffe5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020072
call fcn.1000f8e0
cmp eax, 9
je 0x10020072
call fcn.1000f8e0
cmp eax, 8
je 0x10020072
call fcn.10023560
test byte [eax + 8], 1
je 0x10020072
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x1002004e
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020072
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a890
mov byte [eax + 0x19], 1
cmp byte [0x1012078d], 0
je 0x10020072
call fcn.1001faa0
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x1001ff59
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b3], 0
push esi
push edi
je 0x10020072
mov eax, dword [0x1011e220]
mov ecx, dword [0x101205ac]
dec eax
cmp eax, 3
ja case.default.0x1001ff34
jmp dword [eax*4 + 0x1002007c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001ff6b
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1001ff6b
mov al, byte [ebp + 0xb]
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020072
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020072
mov edi, dword [0x10120420]
test edi, edi
je 0x10020072
mov eax, dword [0x10120334]
test eax, eax
jne 0x1001ffe5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020072
call fcn.1000f8e0
cmp eax, 9
je 0x10020072
call fcn.1000f8e0
cmp eax, 8
je 0x10020072
call fcn.10023560
test byte [eax + 8], 1
je 0x10020072
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x1002004e
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020072
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
call fcn.1001a890
mov byte [eax + 0x19], 1
cmp byte [0x1012078d], 0
je 0x10020072
call fcn.1001faa0
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x10020090
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b8], 0
push esi
push edi
je 0x10020203
mov eax, dword [0x1011e224]
mov ecx, dword [0x1012058c]
dec eax
cmp eax, 3
ja case.default.0x100200b4
jmp dword [eax*4 + 0x1002020c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100200eb
mov al, byte [ebp + 0xb]
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020203
mov edi, dword [0x10120420]
test edi, edi
je 0x10020203
mov eax, dword [0x10120334]
test eax, eax
jne 0x10020165
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020203
call fcn.1000f8e0
cmp eax, 9
je 0x10020203
call fcn.1000f8e0
cmp eax, 8
je 0x10020203
call fcn.10023560
test byte [eax + 8], 1
je 0x10020203
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x100201d2
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020203
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a890
mov byte [eax + 0x1b], 1
cmp byte [0x1012078b], 0
je 0x100201f6
call fcn.1001faa0
cmp byte [0x10120793], 0
je 0x10020203
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x100200bb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101205b8], 0
push esi
push edi
je 0x10020203
mov eax, dword [0x1011e224]
mov ecx, dword [0x1012058c]
dec eax
cmp eax, 3
ja case.default.0x100200b4
jmp dword [eax*4 + 0x1002020c]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100200eb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100200eb
mov al, byte [ebp + 0xb]
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020203
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020203
mov edi, dword [0x10120420]
test edi, edi
je 0x10020203
mov eax, dword [0x10120334]
test eax, eax
jne 0x10020165
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x10020203
call fcn.1000f8e0
cmp eax, 9
je 0x10020203
call fcn.1000f8e0
cmp eax, 8
je 0x10020203
call fcn.10023560
test byte [eax + 8], 1
je 0x10020203
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x100201d2
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
jne 0x10020203
mov esi, dword [ebp + 8]
or dword [esi + 0x30], 4
call fcn.1001a890
mov byte [eax + 0x1b], 1
cmp byte [0x1012078b], 0
je 0x100201f6
call fcn.1001faa0
cmp byte [0x10120793], 0
je 0x10020203
or dword [esi + 0x30], 2
pop edi
pop esi
pop ecx
pop ebp
ret 4