joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ce70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83e929
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.wxColour.0
call fcn.00532170
push str.777777
lea ecx, [ebp - 0x30]
call fcn.00436220
mov eax, dword [edi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
lea esi, [edi + 0x14]
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], esi
mov dword [esi + 4], 0
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [esi], vtable.wxColour.0
call fcn.00532170
push str.000000
lea ecx, [ebp - 0x30]
call fcn.00436220
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 4
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
lea esi, [edi + 0x28]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 6
mov dword [esi], vtable.wxColour.0
call fcn.00532170
push str.EEEEEE
lea ecx, [ebp - 0x30]
call fcn.00436220
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 7
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
lea esi, [edi + 0x3c]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 9
mov dword [esi], vtable.wxColour.0
call fcn.00532170
push str.000000
lea ecx, [ebp - 0x30]
call fcn.00436220
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
lea esi, [edi + 0x50]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 0xc
mov dword [esi], vtable.wxColour.0
call fcn.00532170
push str.555555
lea ecx, [ebp - 0x30]
call fcn.00436220
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xd
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
lea esi, [edi + 0x64]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 0xf
mov dword [esi], vtable.wxColour.0
call fcn.00532170
push str.FFFFFF
lea ecx, [ebp - 0x30]
call fcn.00436220
mov edx, dword [esi]
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x10
call dword [edx + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436d10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
Function at 0x48dd10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x842785
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.007fff35
add esp, 4
test eax, eax
je 0x48dd4a
mov dword [eax], esi
jmp 0x48dd4c
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x48c7a0
push 0
push 0
call fcn.0080f04b
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x48ddae
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x48dda1
push ecx
push eax
call fcn.007fda3f
add esp, 8
test eax, eax
jne 0x48dda8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 1
call fcn.007fdc9f
push eax
call fcn.007fdc72
push 6
mov dword [ebp - 0x14], 0
call fcn.007fdc9f
int3
Function at 0x495f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [esp + 0xc]
cmovae edx, edi
test eax, eax
js 0x495fbc
push ebx
push esi
lea ebx, [esp + 0x14]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x495f98
pop esi
pop ebx
mov eax, edi
pop edi
ret
Function at 0x49a8b0
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x49a8c6
pop edi
xor eax, eax
pop esi
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x49a8f0
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x49a8d0
pop ebx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x49eca0
Capabilities:
Terminate process

Disassembly:
call fcn.0049ecf0
push eax
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
push 2
call fcn.00805b00
add esp, 4
push eax
call fcn.0049f000
add esp, 0x10
cmp dword [esp + 4], 0x3ef
jne 0x49ece4
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.00805b00
add esp, 4
push eax
call fcn.0049f000
add esp, 8
push 3
call fcn.00811572
int3
Function at 0x4bb400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4bb582
cmp dword [esi + 0x20], 0
je 0x4bb582
cmp dword [esi + 0x24], 0
je 0x4bb582
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x4bb582
cmp dword [edi], esi
jne 0x4bb582
mov eax, dword [edi + 4]
cmp eax, 0x2a
je 0x4bb466
cmp eax, 0x39
je 0x4bb466
cmp eax, 0x45
je 0x4bb466
cmp eax, 0x49
je 0x4bb466
cmp eax, 0x5b
je 0x4bb466
cmp eax, 0x67
je 0x4bb466
cmp eax, 0x71
je 0x4bb466
cmp eax, 0x29a
jne 0x4bb582
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x4bb49b
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x4bb4bd
call fcn.004b93d0
jmp 0x4bb4c2
call fcn.004bdc50
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.004be3e0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00802480
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x8a49d2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x8a49d0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x8a49d4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x8a49d6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
pop edi
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4c56e0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x843d55
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x48], vtable.._AV___Func_impl_no_alloc_V_lambda_edf78ffd1a7d636ee10be55aba6fbf16___XABV__unique_ptr___BY0A_DU__default_delete___BY0A_D_std___std__I_std__.0
mov dword [ebp - 0x24], eax
xor edi, edi
mov dword [ebp - 4], 0
mov dword [ebp + 8], 0
mov dword [ebp - 0x10], edi
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x4c57e3
mov esi, dword [ebp + 8]
cmp esi, edi
jbe 0x4c5794
push esi
call fcn.00800701
mov edi, eax
add esp, 4
test edi, edi
je 0x4c577a
push esi
push 0
push edi
call fcn.00802480
add esp, 0xc
jmp 0x4c577c
xor edi, edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], edi
test eax, eax
je 0x4c578f
push eax
call fcn.008006fc
add esp, 4
mov esi, dword [ebp + 8]
mov edi, esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push dword [ebp - 0x10]
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x4c57ce
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c57e3
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4c57ce
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
call dword [eax + 8]
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x4c5756
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4c57f3
push eax
call fcn.008006fc
add esp, 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4c580b
mov edx, dword [ecx]
lea eax, [ebp - 0x48]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5ae0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x843ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp + 8]
push 0
push ecx
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x38], esi
push dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4c5ca9
mov edx, dword [ebp - 0x2c]
xor eax, eax
shr edx, 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 7
ja 0x4c5b8a
mov dword [ebp - 0x18], edx
test edx, edx
je 0x4c5b7e
mov ecx, edx
lea edi, [ebp - 0x28]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor eax, eax
mov word [ebp + edx*2 - 0x28], ax
mov ecx, dword [ebp - 0x28]
jmp 0x4c5bf1
cmp edx, 0x7ffffffe
ja 0x4c5cdf
mov edi, edx
mov dword [ebp - 0x30], edx
or edi, 7
lea ecx, [ebp - 0x28]
cmp edi, 0x7ffffffe
jbe 0x4c5bb3
mov edi, SysReAllocString
lea eax, [edi + 1]
jmp 0x4c5bc0
mov eax, 0xa
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
push eax
call fcn.00437630
mov edx, dword [ebp - 0x3c]
mov ecx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x34]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x34]
xor eax, eax
mov word [ecx + edx*2], ax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov eax, dword [ebp - 0x38]
push 0
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4c5c73
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
shr ecx, 1
cmp ecx, eax
ja 0x4c5c3f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4c5c4c
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0043fa30
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
jmp 0x4c5cc2
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4c5ca9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c5c9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c5ce4
push edx
push ecx
call fcn.007fff65
add esp, 8
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
call fcn.00437620
call fcn.00805899
int3
Function at 0x4c5d60
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x843e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], edi
cmp dword [eax], 0
mov dword [ebp - 4], 0
je 0x4c5e63
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004c4ba0
add esp, 0xc
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 4], 1
je 0x4c5e24
cmp dword [ebp - 0x38], 0
je 0x4c5e24
lea eax, [esi + 0xb4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c5280
add esp, 8
mov edx, eax
mov ecx, dword [ebp + 0x38]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4c5ec1
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [eax + 8]
call eax
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00436590
test bl, bl
je 0x4c5e24
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 4
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x20000013
push dword [ebp - 0x38]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x38]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [edi + 0xc], eax
test ecx, ecx
je 0x4c5ea3
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4c5ea3
mov ecx, dword [ebp + 0x38]
mov dword [edi], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 6
test ecx, ecx
je 0x4c5ea3
mov esi, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
call fcn.007fc710
int3
Function at 0x503d00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84b2c0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
and byte [eax + 0x144], 0xfe
xor edi, edi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
mov ecx, 4
push 0x11
cmovs edi, ecx
call esi
test ax, ax
jns 0x503d56
or edi, 8
push 1
call esi
mov ecx, 0x8000
mov esi, edi
or esi, 1
and ax, cx
push 4
cmove esi, edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
mov edi, esi
or edi, 0x10
and ax, cx
push 2
cmove edi, esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov ecx, edi
or ecx, 2
test ax, ax
lea eax, [ebp - 0x1c]
cmove ecx, edi
push eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x503dc1
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [esi + 0x13c]
push eax
call fcn.005121b0
add esp, 8
lea ecx, [ebp - 0x84]
movups xmm0, xmmword [eax]
push dword [0xe7a178]
movd eax, xmm0
psrldq xmm0, 4
sub dword [ebp - 0x1c], eax
movd eax, xmm0
sub dword [ebp - 0x18], eax
call fcn.0051d430
push dword [ebp - 0x14]
lea eax, [ebp - 0x84]
mov dword [ebp - 4], 0
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x1c]
push eax
call fcn.005076a0
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004faf90
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 1
mov dword [ebp - 0x84], vtable.wxObject.0
call fcn.0073d950
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5076a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
push esi
push edi
push ecx
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x80]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, edi
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov ecx, edx
mov esi, dword [esp + 0x24]
mov dword [ebx + 0x30], eax
mov eax, esi
sub eax, dword [esp + 0x14]
mov dword [ebx + 0x34], eax
mov eax, edx
shr ecx, 2
and cl, 1
shr eax, 3
add cl, cl
and al, 1
or cl, al
movzx eax, byte [ebx + 0x2c]
and al, 0xfc
or cl, al
mov eax, edx
mov byte [ebx + 0x2c], cl
mov ecx, edx
shr ecx, 6
and cl, 1
shr eax, 5
and al, 1
add cl, cl
or cl, al
mov eax, edx
shr eax, 1
add cl, cl
and al, 1
or cl, al
mov eax, edx
shr eax, 4
add cl, cl
and al, 1
and dl, 1
or cl, al
movzx eax, byte [ebx + 0x2d]
add cl, cl
and al, 0xe0
or cl, al
or cl, dl
push 0x12
mov byte [ebx + 0x2d], cl
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
movzx eax, byte [ebx + 0x2c]
setns cl
and al, 0xfb
dec cl
and cl, 4
or al, cl
mov byte [ebx + 0x2c], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebx + 0x10], eax
lea ecx, [esp + 0x1c]
mov dword [ebx + 8], ebp
mov eax, dword [ebp + 0x40]
push ecx
mov dword [ebx + 0x14], eax
lea ecx, [esp + 0x24]
mov eax, dword [ebp]
push ecx
mov ecx, ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], esi
call dword [eax + 0x298]
mov eax, dword [esp + 0x20]
pop edi
mov dword [0xe79ad4], eax
mov eax, dword [esp + 0x18]
pop esi
mov dword [0xe79ad8], eax
mov eax, dword [ebx + 0xc]
pop ebp
mov dword [0xe79adc], eax
pop ebx
add esp, 8
ret 0x10

Function at 0x50c320
Capabilities:
Hash data using murmur3
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test eax, eax
je 0x50c337
mov ecx, dword [eax + 0x40]
mov dword [edi + 8], eax
jmp 0x50c33a
or ecx, 0xffffffff
mov dword [edi + 0x14], ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
movzx eax, byte [edi + 0x2c]
push 0x11
setns cl
and al, 0xfd
dec cl
and cl, 2
or al, cl
mov byte [edi + 0x2c], al
call esi
mov esi, dword [esp + 0x18]
test ax, ax
movzx eax, byte [edi + 0x2c]
mov ebx, esi
sets dl
mov dword [edi + 0x44], esi
shr ebx, 0x10
or al, dl
mov cx, bx
shr cx, 0xd
shl cl, 2
xor cl, al
movzx eax, byte [edi + 0x2c]
and al, 0xfe
and cl, 4
or al, dl
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [edi + 0x2c], cl
mov dword [edi + 0x40], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
shr ebx, 0xe
and bl, 1
mov dword [edi + 0x10], eax
mov byte [edi + 0x48], bl
pop edi
pop esi
pop ebx
ret
Function at 0x50ff80
Capabilities:
Log keystrokes

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, dx
nop dword [eax]
cmp dword [eax*8 + 0x8afbf8], ecx
je 0x5101a0
inc eax
cmp eax, 0x4d
jb 0x50ff90
lea eax, [ecx - 0xd]
cmp eax, 0xd5
ja case.0x50ffb8.14
movzx eax, byte [eax + 0x5101f0]
jmp dword [eax*4 + 0x5101bc]
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
xor edx, edx
shr ecx, 0x10
test cx, cx
mov ecx, dword [esp + 0xc]
cmovs eax, edx
test ecx, ecx
je 0x50ffe0
mov word [ecx], ax
xor ecx, ecx
cmp eax, 0xff
cmovle ecx, eax
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510007
shr eax, 0x10
test eax, 0x100
jne 0x510007
mov ecx, 0x17c
mov eax, ecx
ret
mov ecx, 0x16e
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510029
shr eax, 0x10
test eax, 0x100
jne 0x510029
mov ecx, 0x17d
mov eax, ecx
ret
mov ecx, 0x16f
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x51004b
shr eax, 0x10
test eax, 0x100
jne 0x51004b
mov ecx, 0x17e
mov eax, ecx
ret
mov ecx, 0x138
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x51006d
shr eax, 0x10
test eax, 0x100
jne 0x51006d
mov ecx, 0x177
mov eax, ecx
ret
mov ecx, 0x139
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x51008f
shr eax, 0x10
test eax, 0x100
jne 0x51008f
mov ecx, 0x178
mov eax, ecx
ret
mov ecx, 0x13a
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5100b1
shr eax, 0x10
test eax, 0x100
jne 0x5100b1
mov ecx, 0x179
mov eax, ecx
ret
mov ecx, 0x13b
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5100d3
shr eax, 0x10
test eax, 0x100
jne 0x5100d3
mov ecx, 0x17a
mov eax, ecx
ret
mov ecx, 0x13c
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5100f5
shr eax, 0x10
test eax, 0x100
jne 0x5100f5
mov ecx, 0x17b
mov eax, ecx
ret
mov ecx, 0x13d
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510117
shr eax, 0x10
test eax, 0x100
jne 0x510117
mov ecx, 0x180
mov eax, ecx
ret
mov ecx, 0x142
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510136
shr eax, 0x10
mov ecx, 0x181
test eax, 0x100
je 0x51013b
mov ecx, 0x7f
mov eax, dword [esp + 0xc]
test eax, eax
je 0x51019d
mov edx, 0x7f
mov word [eax], dx
mov eax, ecx
ret
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
shr ecx, 0x10
and ecx, 0x100
neg ecx
sbb ecx, ecx
and ecx, 0x165
add ecx, 0xd
test eax, eax
je 0x51019d
mov edx, 0xd
mov word [eax], dx
mov eax, ecx
ret
cmp dx, 0x30
jb 0x510187
cmp dx, 0x39
jbe 0x510192
lea eax, [edx - 0x41]
cmp ax, 0x19
jbe 0x510192
xor ecx, ecx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x51019d
mov word [eax], dx
mov eax, ecx
ret
mov eax, dword [eax*8 + 0x8afbfc]
cmp eax, 0x12c
jge 0x5101b9
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5101b9
mov word [ecx], ax
ret