joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002012c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158171], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002032d
mov eax, dword [0x1011f208]
mov edx, dword [0x10158184]
dec eax
cmp eax, 3
ja case.default.0x10020116
jmp dword [eax*4 + 0x10020334]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002014d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002032d
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002032d
mov eax, dword [0x101226d4]
test eax, eax
jne 0x100201c7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002032d
call fcn.1000f990
cmp eax, 9
je 0x1002032d
call fcn.1000f990
cmp eax, 8
je 0x1002032d
call fcn.100231c0
test byte [eax + 8], 1
jne 0x1002024d
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020238
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
je 0x1002024d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020328
cmp byte [ebx + 1], 0
jne 0x10020328
mov esi, dword [0x10158094]
mov edi, dword [0x101227d4]
test esi, esi
jne 0x100202a4
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110459
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110025
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, eax
mov dword [0x10158094], esi
call fcn.100231c0
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020328
call fcn.100231c0
test byte [eax + 8], 1
jne 0x10020328
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020302
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10020328
call fcn.1000f990
cmp eax, 8
je 0x10020328
call fcn.1000f990
cmp eax, 0xa
je 0x10020328
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002013b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158171], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1002032d
mov eax, dword [0x1011f208]
mov edx, dword [0x10158184]
dec eax
cmp eax, 3
ja case.default.0x10020116
jmp dword [eax*4 + 0x10020334]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1002014d
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1002014d
mov al, byte [ebp + 0xb]
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002032d
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002032d
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002032d
mov eax, dword [0x101226d4]
test eax, eax
jne 0x100201c7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002032d
call fcn.1000f990
cmp eax, 9
je 0x1002032d
call fcn.1000f990
cmp eax, 8
je 0x1002032d
call fcn.100231c0
test byte [eax + 8], 1
jne 0x1002024d
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020238
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
je 0x1002024d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and eax, 0xfffffffd
or eax, 4
mov dword [ecx + 0x30], eax
cmp byte [ebx], 0
jne 0x10020328
cmp byte [ebx + 1], 0
jne 0x10020328
mov esi, dword [0x10158094]
mov edi, dword [0x101227d4]
test esi, esi
jne 0x100202a4
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110459
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x10110025
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov esi, eax
mov dword [0x10158094], esi
call fcn.100231c0
movss xmm0, dword [esi + edi + 8]
add eax, 0x18
comiss xmm0, dword [eax]
jbe 0x10020328
call fcn.100231c0
test byte [eax + 8], 1
jne 0x10020328
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10020302
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10020328
call fcn.1000f990
cmp eax, 8
je 0x10020328
call fcn.1000f990
cmp eax, 0xa
je 0x10020328
mov al, 1
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor al, al
mov byte [ebx + 0x1a], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100215b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x10158194], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x100217ae
mov eax, dword [0x1011f200]
mov edx, dword [0x10158174]
dec eax
cmp eax, 3
ja case.default.0x100215dc
jmp dword [eax*4 + 0x100217b8]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x10021614
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10021614
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x10021614
mov al, byte [esp + 0xf]
test al, al
je 0x100217ae
mov edi, dword [0x101227d4]
test edi, edi
je 0x100217ae
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10021664
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x100217ae
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100217ae
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100217ae
call fcn.1000f990
cmp eax, 9
je 0x100217ae
call fcn.1000f990
cmp eax, 8
je 0x100217ae
cmp byte [ebx], 0
je 0x100217ae
mov esi, dword [ebp + 8]
xorps xmm2, xmm2
movss xmm1, dword [esi]
ucomiss xmm1, xmm2
lahf
test ah, 0x44
jnp 0x10021777
mov edx, dword [ebx + 0x28]
xorps xmm0, xmm0
mov eax, dword [0x1012268c]
mov ecx, dword [ebx + 0x2c]
cvtsi2ss xmm0, edx
sub ecx, dword [eax + 0x1c]
add ecx, edx
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, ecx
fld qword [esp + 0x10]
divss xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
call sub.api_ms_win_crt_math_l1_1_0.dll__CIatan2
movsd xmm2, qword [0x10117f38]
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [ebx + 0x30]
addsd xmm1, xmm2
mulss xmm0, dword [0x1011f244]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
divsd xmm2, xmm1
cvtpd2ps xmm1, xmm2
movss dword [esp + 0x10], xmm1
fld dword [esp + 0x10]
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
ucomiss xmm0, xmm0
setp al
cmp al, 1
je 0x10021777
mulss xmm1, dword [esi]
movss dword [esi], xmm1
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
movss xmm2, dword [ecx]
ucomiss xmm2, xmm0
lahf
test ah, 0x44
jnp 0x100217ae
movss xmm0, dword [0x1011f244]
divss xmm0, dword [0x10117fd4]
movss xmm1, dword [0x10117ec0]
subss xmm1, xmm0
mulss xmm1, xmm2
movss dword [ecx], xmm1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100227a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158170], 0
push ebx
push esi
push edi
je 0x1002296c
mov eax, dword [0x1011f204]
mov ecx, dword [0x10158180]
dec eax
cmp eax, 3
ja case.default.0x100227c4
jmp dword [eax*4 + 0x10022974]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100227fb
mov al, byte [ebp + 0xb]
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002296c
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002296c
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022875
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002296c
call fcn.1000f990
cmp eax, 9
je 0x1002296c
call fcn.1000f990
cmp eax, 8
je 0x1002296c
mov ecx, dword [0x10122680]
mov edi, dword [0x101227d4]
mov ebx, edi
test ecx, ecx
jne 0x100228e7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov edi, dword [0x101227d4]
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x1012268c]
je 0x1002290d
cmp byte [0x10158358], 0
jne 0x1002290d
mov edx, dword [eax + 0x1c]
mov dword [0x10158484], edx
mov byte [0x10158358], 1
jmp 0x10022913
mov edx, dword [0x10158484]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011f240]
jle 0x1002296c
test ecx, ecx
jne 0x10022958
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + edi], 1
je 0x1002296c
mov eax, dword [ebp + 8]
mov byte [0x10158358], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100227da
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158170], 0
push ebx
push esi
push edi
je 0x1002296c
mov eax, dword [0x1011f204]
mov ecx, dword [0x10158180]
dec eax
cmp eax, 3
ja case.default.0x100227c4
jmp dword [eax*4 + 0x10022974]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100227fb
mov al, byte [ebp + 0xb]
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002296c
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002296c
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022875
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002296c
call fcn.1000f990
cmp eax, 9
je 0x1002296c
call fcn.1000f990
cmp eax, 8
je 0x1002296c
mov ecx, dword [0x10122680]
mov edi, dword [0x101227d4]
mov ebx, edi
test ecx, ecx
jne 0x100228e7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov edi, dword [0x101227d4]
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x1012268c]
je 0x1002290d
cmp byte [0x10158358], 0
jne 0x1002290d
mov edx, dword [eax + 0x1c]
mov dword [0x10158484], edx
mov byte [0x10158358], 1
jmp 0x10022913
mov edx, dword [0x10158484]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011f240]
jle 0x1002296c
test ecx, ecx
jne 0x10022958
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + edi], 1
je 0x1002296c
mov eax, dword [ebp + 8]
mov byte [0x10158358], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100227e9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10158170], 0
push ebx
push esi
push edi
je 0x1002296c
mov eax, dword [0x1011f204]
mov ecx, dword [0x10158180]
dec eax
cmp eax, 3
ja case.default.0x100227c4
jmp dword [eax*4 + 0x10022974]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100227fb
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x100227fb
mov al, byte [ebp + 0xb]
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1002296c
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002296c
mov edi, dword [0x101227d4]
test edi, edi
je 0x1002296c
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022875
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1002296c
call fcn.1000f990
cmp eax, 9
je 0x1002296c
call fcn.1000f990
cmp eax, 8
je 0x1002296c
mov ecx, dword [0x10122680]
mov edi, dword [0x101227d4]
mov ebx, edi
test ecx, ecx
jne 0x100228e7
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov edi, dword [0x101227d4]
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x1012268c]
je 0x1002290d
cmp byte [0x10158358], 0
jne 0x1002290d
mov edx, dword [eax + 0x1c]
mov dword [0x10158484], edx
mov byte [0x10158358], 1
jmp 0x10022913
mov edx, dword [0x10158484]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, dword [0x1011f240]
jle 0x1002296c
test ecx, ecx
jne 0x10022958
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, eax
mov dword [0x10122680], ecx
test byte [ecx + edi], 1
je 0x1002296c
mov eax, dword [ebp + 8]
mov byte [0x10158358], 0
or dword [eax + 0x30], 2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10022990
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101581ac], 0
push esi
push edi
je 0x10022b54
mov eax, dword [0x1011f1fc]
mov ecx, dword [0x101581a8]
dec eax
cmp eax, 3
ja case.default.0x100229c9
jmp dword [eax*4 + 0x10022b60]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x10022a00
mov al, byte [ebp - 1]
test al, al
je 0x10022b54
mov edi, dword [0x101227d4]
test edi, edi
je 0x10022b54
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022a50
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10022b54
call fcn.1000f990
cmp eax, 9
je 0x10022b54
call fcn.1000f990
cmp eax, 8
je 0x10022b54
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10022ae0
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10022b54
mov edx, dword [ebx + 8]
lea ecx, [ebp - 8]
movss xmm1, dword [0x1011f22c]
mov eax, 0x1011f22c
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f22c]
cmovbe eax, ecx
lea ecx, [ebp - 8]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, 0x1011f238
mov edx, dword [ebx + 0xc]
movss xmm1, dword [0x1011f238]
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f238]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x100229d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101581ac], 0
push esi
push edi
je 0x10022b54
mov eax, dword [0x1011f1fc]
mov ecx, dword [0x101581a8]
dec eax
cmp eax, 3
ja case.default.0x100229c9
jmp dword [eax*4 + 0x10022b60]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x10022a00
mov al, byte [ebp - 1]
test al, al
je 0x10022b54
mov edi, dword [0x101227d4]
test edi, edi
je 0x10022b54
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022a50
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10022b54
call fcn.1000f990
cmp eax, 9
je 0x10022b54
call fcn.1000f990
cmp eax, 8
je 0x10022b54
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10022ae0
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10022b54
mov edx, dword [ebx + 8]
lea ecx, [ebp - 8]
movss xmm1, dword [0x1011f22c]
mov eax, 0x1011f22c
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f22c]
cmovbe eax, ecx
lea ecx, [ebp - 8]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, 0x1011f238
mov edx, dword [ebx + 0xc]
movss xmm1, dword [0x1011f238]
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f238]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x100229df
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101581ac], 0
push esi
push edi
je 0x10022b54
mov eax, dword [0x1011f1fc]
mov ecx, dword [0x101581a8]
dec eax
cmp eax, 3
ja case.default.0x100229c9
jmp dword [eax*4 + 0x10022b60]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10022a00
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x10022a00
mov al, byte [ebp - 1]
test al, al
je 0x10022b54
mov edi, dword [0x101227d4]
test edi, edi
je 0x10022b54
mov eax, dword [0x101226d4]
test eax, eax
jne 0x10022a50
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10022b54
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10022b54
call fcn.1000f990
cmp eax, 9
je 0x10022b54
call fcn.1000f990
cmp eax, 8
je 0x10022b54
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x10022ae0
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
jne 0x10022b54
mov edx, dword [ebx + 8]
lea ecx, [ebp - 8]
movss xmm1, dword [0x1011f22c]
mov eax, 0x1011f22c
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f22c]
cmovbe eax, ecx
lea ecx, [ebp - 8]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, 0x1011f238
mov edx, dword [ebx + 0xc]
movss xmm1, dword [0x1011f238]
xorps xmm1, xmmword [0x10119820]
movss dword [ebp - 8], xmm1
movss xmm0, dword [edx]
comiss xmm1, xmm0
cmovbe ecx, edx
comiss xmm0, dword [0x1011f238]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8