joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c0d70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rcx
call fcn.140044e20
mov qword [rsp + 0x38], rax
call fcn.140044e20
mov qword [rsp + 0x40], rax
mov r8, 0xffffffffffffffff
lea rdx, str.dbghelp:__s___failed:__s_r_n
lea rcx, [rsp + 0x48]
call fcn.14003ee50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140052f00
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rax
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.1400559f0
mov ecx, eax
and ecx, 6
lea rbx, str.format_specifier_doesnt_match_argument_type
cmp ecx, eax
je 0x1400c0e49
cmp qword [0x1404b3060], 0
je 0x1400c0e49
mov qword [rsp + 0x20], rbx
lea r9, str._argtype___wxFormatString::Arg_String____argtype
lea r8, str.wxArgNormalizerWchar_class_wxString_const__::wxArgNormalizerWchar
mov edx, 0x230
lea rcx, str.C:LibrarieswxWidgets3.2.4includewx_strvararg.h
call fcn.140041e40
cmp byte [0x1404c47a8], 0
je 0x1400c0e49
mov byte [0x1404c47a8], 0
int3
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1400559f0
mov edx, eax
and edx, 6
cmp edx, eax
je 0x1400c0ea0
cmp qword [0x1404b3060], 0
je 0x1400c0ea0
mov qword [rsp + 0x20], rbx
lea r9, str._argtype___wxFormatStringSpecifier_T_::value____argtype
lea r8, str.wxArgNormalizer_wchar_t_const__::wxArgNormalizer
mov edx, 0x1e4
lea rcx, str.C:LibrarieswxWidgets3.2.4includewx_strvararg.h
call fcn.140041e40
cmp byte [0x1404c47a8], 0
je 0x1400c0ea0
mov byte [0x1404c47a8], 0
int3
lea rcx, [rsp + 0x38]
call fcn.140055070
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140056960
mov r9, rax
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x98]
call fcn.140044030
nop
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call fcn.1400119a0
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x98]
call fcn.1400119a0
nop
lea rcx, [rsp + 0x38]
call fcn.14003dbf0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14003b100
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400cf4b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
cmp dword [0x1404c4ab8], 0
je 0x1400cf4e7
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x1404c4ab8]
je 0x1400cf4e7
xor ecx, ecx
call fcn.140050f50
movzx edi, al
jmp 0x1400cf4f5
movzx edi, byte [reloc.WS2_32.dll_accept]
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [rsp + 0x50], dil
xor edx, edx
mov rcx, rsi
call fcn.1400cf770
test al, al
jne 0x1400cf50c
xor bl, bl
jmp 0x1400cf543
xor eax, eax
cmp qword [rbx + 0x10], rax
jne 0x1400cf518
mov ebx, eax
jmp 0x1400cf522
cmp qword [rbx + 0x18], 8
jb 0x1400cf522
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
cmp dword [0x1404c4ab8], 0
je 0x1400cf564
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x1404c4ab8]
je 0x1400cf564
movzx ecx, dil
call fcn.140050f50
jmp 0x1400cf56b
mov byte [reloc.WS2_32.dll_accept], dil
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e2a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add rcx, 8
jmp fcn.1400a00b0

Function at 0x1400e4410
Capabilities:
Encode data using base64

Disassembly:
push rbx
sub rsp, 0x30
mov r11, rdx
test r8, r8
je 0x1400e4538
xor r10d, r10d
lea rbx, [0x14036cb70]
cmp r9, 3
jb 0x1400e44b0
add r10, 4
test rcx, rcx
je 0x1400e44a2
cmp r10, r11
ja 0x1400e457e
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [rcx], al
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 1], al
movzx edx, byte [r8 + 1]
movzx eax, byte [r8 + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + 2]
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 3], al
add rcx, 4
sub r9, 3
add r8, 3
cmp r9, 3
jae 0x1400e4432
test r9, r9
je 0x1400e452f
add r10, 4
test rcx, rcx
je 0x1400e452f
cmp r10, r11
ja 0x1400e457e
cmp r9, 2
jne 0x1400e44d4
movzx edx, byte [r8 + 1]
jmp 0x1400e44d6
xor dl, dl
movzx eax, byte [r8]
shr rax, 2
movzx r11d, dl
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, r11d
movzx edx, byte [r8]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 1], al
cmp r9, 2
jne 0x1400e4527
and r11d, 0xf
mov rax, r10
shl r11d, 2
movzx edx, byte [r11 + rbx]
mov byte [rcx + 2], dl
mov byte [rcx + 3], 0x3d
add rsp, 0x30
pop rbx
ret
mov dl, 0x3d
mov byte [rcx + 2], dl
mov byte [rcx + 3], dl
mov rax, r10
add rsp, 0x30
pop rbx
ret
cmp qword [0x1404b3060], 0
je 0x1400e457e
lea rax, str.NULL_input_buffer
mov edx, reloc.WS2_32.dll_send
lea r9, str._src__
mov qword [rsp + 0x20], rax
lea r8, str.wxBase64Encode
lea rcx, str.C:LibrarieswxWidgets3.2.4_srccommon_base64.cpp
call fcn.140042050
cmp byte [0x1404c47a8], 0
je 0x1400e457e
mov byte [0x1404c47a8], 0
int3
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x14010f1a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rsi, rcx
and byte [rcx + 0x228], 0xfe
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ebx, ax
sar ebx, 0xf
and ebx, 4
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
or edi, 8
test ax, ax
cmovns edi, ebx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
or ebx, 1
test ax, ax
cmovns ebx, edi
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
or edi, 0x10
test ax, ax
cmovns edi, ebx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
or ebx, 2
test ax, ax
cmovns ebx, edi
lea rcx, [rsp + 0xd0]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14010f255
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [rsp + 0xd0], ecx
shr eax, 0x10
cwde
mov dword [rsp + 0xd4], eax
mov rdx, qword [rsi + 0x218]
lea rcx, [rsp + 0x30]
call fcn.14011fbd0
mov rax, qword [rax]
sub dword [rsp + 0xd0], eax
shr rax, 0x20
sub dword [rsp + 0xd4], eax
mov edx, dword [0x1404c6100]
lea rcx, [rsp + 0x40]
call fcn.14013b190
nop
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0xd4]
mov r8d, dword [rsp + 0xd0]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140113600
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140105820
nop
lea rax, vtable.wxObject.0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14004cf00
nop
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140113600
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbp, rdx
lea rdx, [rsp + 0x40]
mov edi, r9d
mov ebx, r8d
mov rsi, rcx
call qword [rax + 0x100]
mov edx, dword [rsp + 0x60]
mov eax, ebx
sub eax, dword [rsp + 0x40]
mov ecx, edx
mov dword [rbp + 0x54], eax
mov eax, edi
sub eax, dword [rsp + 0x44]
mov dword [rbp + 0x58], eax
mov eax, edx
shr ecx, 2
shr eax, 3
add cl, cl
xor cl, byte [rbp + 0x50]
and cl, 2
xor cl, byte [rbp + 0x50]
xor al, cl
and al, 1
xor al, cl
movzx ecx, byte [rbp + 0x51]
xor cl, dl
mov byte [rbp + 0x50], al
and cl, 1
mov eax, edx
xor cl, byte [rbp + 0x51]
shr eax, 4
add al, al
xor al, cl
and al, 2
xor al, cl
mov ecx, edx
shr ecx, 1
shl cl, 2
xor cl, al
and cl, 4
xor cl, al
mov eax, edx
shr eax, 5
shr edx, 6
shl al, 3
xor al, cl
shl dl, 4
and al, 8
xor al, cl
mov ecx, reloc.WS2_32.dll_select
xor dl, al
and dl, 0x10
xor dl, al
mov byte [rbp + 0x51], dl
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rbp + 0x50]
shr ax, 0xf
and cl, 0xfb
shl al, 2
or al, cl
mov byte [rbp + 0x50], al
call qword [sym.imp.USER32.dll_GetMessageTime]
mov qword [rbp + 0x10], rsi
lea r8, [rsp + 0x50]
mov dword [rbp + 0x1c], eax
lea rdx, [rsp + 0x60]
mov eax, dword [rsi + 0x78]
mov rcx, rsi
mov dword [rbp + 0x20], eax
mov rax, qword [rsi]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x50], edi
call qword [rax + 0x530]
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov dword [0x1404c58b0], eax
mov eax, dword [rsp + 0x50]
mov dword [0x1404c58b4], eax
mov eax, dword [rbp + 0x18]
mov dword [0x1404c58b8], eax
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401185c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r9, r9
je 0x1401185ec
mov eax, dword [r9 + 0x78]
mov qword [rcx + 0x10], r9
jmp 0x1401185f1
mov eax, 0xffffffff
mov dword [rcx + 0x20], eax
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rdi + 0x50]
shr ax, 0xf
and cl, 0xfd
add al, al
or al, cl
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov byte [rdi + 0x50], al
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rdi + 0x50]
mov rbx, rsi
and cl, 0xfe
shr ax, 0xf
or al, cl
shr rbx, 0x10
movzx ecx, bx
mov dword [rdi + 0x64], ebp
shr cx, 0xd
shl cl, 2
xor cl, al
mov dword [rdi + 0x68], esi
and cl, 4
xor cl, al
mov byte [rdi + 0x50], cl
call qword [sym.imp.USER32.dll_GetMessageTime]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
shr bx, 0xe
and bl, 1
mov dword [rdi + 0x1c], eax
mov byte [rdi + 0x6c], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14011b540
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
call fcn.140108d70
test al, al
jne 0x14011b574
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003b100
add rsp, 0x50
pop rbx
ret
call fcn.1401560e0
test al, al
jne 0x14011b67e
lea rcx, [rbx + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test al, al
je 0x14011b624
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x300]
test al, al
jne 0x14011b604
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x20]
mov rdi, qword [rbx + 0x218]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14011b5d6
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], ecx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14011fbd0
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.USER32.dll_PtInRect]
mov rdi, qword [rsp + 0x70]
test eax, eax
je 0x14011b67e
mov rcx, qword [rbx + 0xe8]
test rcx, rcx
jne 0x14011b618
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x14011b67e
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x14011b67e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14011b648
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], ecx
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call fcn.14011ea70
test rax, rax
mov r9d, 0x2000001
mov edx, reloc.WLDAP32.dll_Ordinal_32
cmove rax, rbx
mov rcx, qword [rax + 0x218]
mov r8, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003b100
add rsp, 0x50
pop rbx
ret
Function at 0x14011d7f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
lea rdx, [0x140000000]
xor eax, eax
nop dword [rax + rax]
lea rcx, [rax*8]
cmp dword [rcx + rdx + 0x378584], edi
je 0x14011d906
inc rax
cmp rax, 0x4d
jb 0x14011d810
mov qword [rsp + 0x30], rbx
xor bl, bl
cmp edi, 0x177
jg 0x14011d8c1
je 0x14011d884
lea eax, [rdi - 0x7f]
cmp eax, 0xf0
ja case.0x14011d8d8.383
cdqe
movzx eax, byte [rdx + rax + 0x11d950]
mov ecx, dword [rdx + rax*4 + 0x11d924]
add rcx, rdx
jmp rcx
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_33
jmp 0x14011d8ef
mov bl, 1
mov eax, Ordinal_35
jmp 0x14011d8ef
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_35
jmp 0x14011d8ef
mov bl, 1
mov eax, 0x24
jmp 0x14011d8ef
mov bl, 1
mov eax, Ordinal_41
jmp 0x14011d8ef
mov bl, 1
mov eax, Ordinal_41
jmp 0x14011d8ef
mov bl, 1
mov eax, Ordinal_41
jmp 0x14011d8ef
mov bl, 1
mov eax, Ordinal_41
jmp 0x14011d8ef
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_45
jmp 0x14011d8ef
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_46
jmp 0x14011d8ef
lea eax, [rdi - 0x178]
cmp eax, 9
ja case.0x14011d8d8.383
cdqe
mov ecx, dword [rdx + rax*4 + 0x11da44]
add rcx, rdx
jmp rcx
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x14011d8ec
movzx eax, al
jmp 0x14011d8ef
movzx eax, di
test rsi, rsi
je 0x14011d8f6
mov byte [rsi], bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x14011d90e
mov byte [rsi], 0
movzx eax, word [rcx + rdx + 0x378580]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14011f330
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
lea eax, [rcx - 1]
mov ebx, ecx
test eax, 0xfffffffc
jne 0x14011f38d
cmp ecx, 3
je 0x14011f38d
cmp qword [0x1404b3060], 0
je 0x14011f38d
lea rax, str.cant_use_wxGetKeyState___for_mouse_buttons
mov edx, 0x1b9b
lea r9, str.key___0x01__key___0x02__key___0x04
mov qword [rsp + 0x20], rax
lea r8, str.wxGetKeyState
lea rcx, str.C:LibrarieswxWidgets3.2.4_srcmswwindow.cpp
call fcn.140042050
cmp byte [0x1404c47a8], 0
je 0x14011f38d
mov byte [0x1404c47a8], 0
int3
xor edx, edx
mov ecx, ebx
call fcn.14011d7f0
lea ecx, [rbx - 0x16c]
cmp ecx, 1
jbe 0x14011f3b6
cmp ebx, 0x137
je 0x14011f3b6
movzx ecx, ax
add rsp, 0x30
pop rbx
jmp 0x140120140
movzx ecx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
movzx ebx, cx
lea eax, [rbx - 1]
cmp ax, 1
ja 0x140120175
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140120175
mov eax, 1
mov ecx, 2
cmp bx, ax
cmove ax, cx
movzx ebx, ax
movzx ecx, bx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14011f420
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and byte [rcx], 0xf0
mov rbx, rcx
and byte [rcx + 1], 0xe0
xor edi, edi
mov qword [rcx + 4], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x14011f462
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x30], ecx
jmp 0x14011f46a
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
mov dword [rbx + 4], ecx
mov ecx, reloc.WS2_32.dll_socket
mov dword [rbx + 8], edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne dil
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, byte [rbx + 1]
movsx ecx, ax
shr ecx, 0xf
xor dl, cl
mov ecx, 4
and dl, 1
xor byte [rbx + 1], dl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
mov ecx, reloc.WS2_32.dll_socket
shr edx, 0xf
add dl, dl
xor dl, byte [rbx + 1]
and dl, 2
xor byte [rbx + 1], dl
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
add ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
shr ecx, 0xf
shl cl, 2
xor cl, byte [rbx + 1]
and cl, 4
xor byte [rbx + 1], cl
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
shr ecx, 0xf
shl cl, 3
xor cl, byte [rbx + 1]
and cl, 8
xor byte [rbx + 1], cl
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
shr ecx, 0xf
shl cl, 4
xor cl, byte [rbx + 1]
and cl, 0x10
xor byte [rbx + 1], cl
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rbx]
and cl, 0xfe
shr ax, 0xf
or al, cl
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
mov byte [rbx], al
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rbx]
shr ax, 0xf
and cl, 0xfd
add al, al
or al, cl
mov ecx, reloc.WS2_32.dll_select
mov byte [rbx], al
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, byte [rbx]
shr ax, 0xf
and cl, 0xfb
shl al, 2
or al, cl
mov byte [rbx], al
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140120140
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
lea eax, [rcx - 1]
mov ebx, ecx
test eax, 0xfffffffc
jne 0x14011f38d
cmp ecx, 3
je 0x14011f38d
cmp qword [0x1404b3060], 0
je 0x14011f38d
lea rax, str.cant_use_wxGetKeyState___for_mouse_buttons
mov edx, 0x1b9b
lea r9, str.key___0x01__key___0x02__key___0x04
mov qword [rsp + 0x20], rax
lea r8, str.wxGetKeyState
lea rcx, str.C:LibrarieswxWidgets3.2.4_srcmswwindow.cpp
call fcn.140042050
cmp byte [0x1404c47a8], 0
je 0x14011f38d
mov byte [0x1404c47a8], 0
int3
xor edx, edx
mov ecx, ebx
call fcn.14011d7f0
lea ecx, [rbx - 0x16c]
cmp ecx, 1
jbe 0x14011f3b6
cmp ebx, 0x137
je 0x14011f3b6
movzx ecx, ax
add rsp, 0x30
pop rbx
jmp 0x140120140
movzx ecx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
movzx ebx, cx
lea eax, [rbx - 1]
cmp ax, 1
ja 0x140120175
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140120175
mov eax, 1
mov ecx, 2
cmp bx, ax
cmove ax, cx
movzx ebx, ax
movzx ecx, bx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140156040
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rsp + 0x20], 1
test rdx, rdx
je 0x1401560c5
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
lea r8, [rbx + 1]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14005c7d0
lea r8d, [rbx + 1]
mov rdx, qword [rax + 8]
mov rdx, qword [rdx]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x28]
call fcn.1400429e0
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401a8e20
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, rdx
jmp 0x1401bad00
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 8], 0x100
jne case.0x1401bae1a.3
mov rbx, qword [rcx + 0x10]
mov eax, 0x2000
test word [rcx + 0x1a], ax
je 0x1401bad39
cmp rbx, 8
je case.0x1401bae1a.0
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
shr edi, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ecx, ax
shr ecx, 0xf
add ecx, edi
je 0x1401badaf
sub ecx, 1
je 0x1401badd2
cmp ecx, 1
je case.0x1401bae1a.3
cmp qword [0x1404b3060], 0
je 0x1401badaf
lea rax, str.how_many_modifiers_have_we_got_
mov edx, 0x44d
lea r9, str._Assert_failure_
mov qword [rsp + 0x20], rax
lea r8, str.wxMSWTextEntryShouldPreProcessMessage
lea rcx, str.C:LibrarieswxWidgets3.2.4_srcmsw_textentry.cpp
call fcn.140042050
cmp byte [0x1404c47a8], 0
je 0x1401badaf
mov byte [0x1404c47a8], 0
int3
sub rbx, 0x23
je case.0x1401bae1a.0
sub rbx, 1
je case.0x1401bae1a.0
cmp rbx, 0xa
jne case.0x1401bae1a.3
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
add rbx, 0xffffffffffffffdd
test edi, edi
je 0x1401badff
cmp rbx, 0x35
ja case.0x1401bae1a.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x1bae24]
mov ecx, dword [rdx + rax*4 + 0x1bae1c]
add rcx, rdx
jmp rcx
cmp rbx, 0xb
ja case.0x1401bae1a.3
lea rdx, [0x140000000]
mov eax, dword [rdx + rbx*4 + 0x1bae5c]
add rax, rdx
jmp rax

Function at 0x1401aa860
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp r8d, 6
jne 0x1401aa8f4
test r9, r9
jne 0x1401aa8f4
lea rax, [0x1401aa740]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], r9d
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x4c], eax
lea ecx, [r9 + 0x68]
call fcn.14003b21c
mov rbx, rax
mov qword [rsp + 0x30], rax
mov r8d, dword [0x1404c4924]
lea edx, [rdi - 1]
mov rcx, rax
call fcn.14004d060
mov qword [rbx + 0x10], rsi
lea rax, vtable.wxAsyncMethodCallEvent0_class_wxPopupTransientWindow_.0
mov qword [rbx], rax
mov qword [rbx + 0x50], rsi
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rsi]
mov rdx, rbx
mov rcx, rsi
call qword [rax + gethostname]
mov r9, rdi
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
jmp fcn.140115780
Function at 0x1401b2cc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x1401b2d1a
mov eax, 0x2000
test word [rdx + 0x1a], ax
jne 0x1401b2d1a
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401b2d1a
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401b2d1a
mov rax, qword [rbx + 0x10]
cmp rax, 0xd
je 0x1401b2d2f
cmp rax, 0x1b
je 0x1401b2d2f
cmp rax, 0x73
je 0x1401b2d4c
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140011320
mov rcx, qword [rdi + 0x218]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x157
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1401b2d1a
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1401b9540
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, reloc.COMCTL32.dll_CreateUpDownControl
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401b95a1
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401b95a1
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401b95a1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_301]
mov rcx, rax
call fcn.140114cf0
mov rcx, rax
call fcn.140113a20
test al, al
je 0x1401b95a1
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret