Function at 0x41a540
Capabilities:
Log keystrokes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
jne 0x41a600
mov esi, dword [0x4ee220]
test esi, esi
je 0x41a600
cmp word [0x4ee230], 0
lea ebx, [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
je 0x41a720
movzx eax, word [0x4ee232]
mov word [ebp - 0x30], ax
movzx eax, byte [0x4ee236]
mov byte [ebp - 0x34], al
mov eax, dword [0x4ee238]
test al, 0xc
mov dword [ebp - 0x2c], eax
je 0x41a5d5
test byte [ebp - 0x2c], 3
je 0x41a5d5
cmp byte [ebp - 0x34], 0
je 0x41a5d5
test byte [ebp - 0x2c], 1
jne 0x41a8c7
mov eax, dword [ebp - 0x2c]
test al, 2
je 0x41a5d5
test al, 8
jne 0x41a8d0
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
mov edx, ecx
and eax, 0xfffffffd
and edx, 0xfffffff9
and ecx, 4
cmovne eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
and eax, 0x100
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x30]
je 0x41a7e0
sub eax, 0xd
cmp ax, 0x62
ja case.0x41a7f0.2
movzx eax, ax
jmp dword [eax*4 + 0x4b2f14]
mov ecx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
call sub.msvcrt.dll__read
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x2c]
mov edx, 0x2e
mov eax, ebx
mov dword [esp], str.e_3
call fcn.00414d00
mov edx, eax
test edx, edx
jne 0x41a9b0
cmp byte [ebp - 0x34], 0
jne 0x41ab72
test byte [0x4ee060], 0x80
je 0x41a720
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x3c], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], 0x4ee068
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x34], eax
call sub.msvcrt.dll__getpid
mov edx, dword [ebp - 0x34]
mov dword [esp + 8], str._console_read
mov dword [esp + 4], 0x4b2138
mov dword [esp + 0x10], edx
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], eax
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049e490
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
call ecx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
test edx, edx
mov edx, 0x4b2cbd
mov dword [eax], ecx
mov eax, 0x4b2cb8
cmove eax, edx
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x30]
mov dword [esp + 4], str._console_read:_unknown_virtual_key_code:__d__enhanced:__s_n
mov dword [esp + 8], eax
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049e490
mov edx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [edx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x34]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
nop
mov dword [ebp - 0x28], 0
mov dword [0x4ee228], 0
mov dword [0x4ee22c], 0
mov dword [0x4ee230], 0
mov dword [0x4ee234], 0
mov dword [0x4ee238], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4ee228
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
je 0x41a7f7
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41a7c8
cmp eax, 1
je 0x41a791
mov dword [esp], str.ReadConsoleInputA_did_not_return_one_input_record
call fcn.0040a7b0
cmp word [0x4ee228], 1
jne 0x41a720
mov ecx, dword [0x4ee22c]
test ecx, ecx
je 0x41a720
cmp word [0x4ee230], 0
jne 0x41a579
mov dword [esp], str.ReadConsoleInputA_returned_a_key_event_with_zero_repeat_count
call fcn.0040a7b0
jmp 0x41a579
mov dword [esp], str.ReadConsoleInputA_returned_0
call fcn.0040a7b0
mov eax, dword [ebp - 0x28]
jmp 0x41a780
sub eax, 8
cmp ax, 0xda
ja case.0x41a7f0.2
movzx eax, ax
jmp dword [eax*4 + 0x4b30a0]
test byte [0x4ee060], 0x80
mov ecx, dword [sym.imp.msvcrt.dll__errno]
je 0x41a8a9
mov dword [ebp - 0x2c], ecx
call ecx
mov ebx, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._get_interesting_input_record_uncached
mov dword [esp + 4], 0x4b2138
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov ecx, dword [ebp - 0x2c]
call ecx
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str._get_interesting_input_record_uncached:_ReadConsoleInputA___failure__error__ld_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ebx
call ecx
xor ebx, ebx
mov dword [eax], 5
mov eax, 0xffffffff
mov word [0x4ee230], bx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
and dword [ebp - 0x2c], 0xfffffff6
jmp 0x41a5d5
and dword [ebp - 0x2c], 0xfffffff5
jmp 0x41a5d5
mov ecx, dword [ebp - 0x2c]
mov edx, 0x2d
mov eax, ebx
mov dword [esp], str.e_2
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x28
mov eax, ebx
mov dword [esp], 0x4b2e04
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x27
mov eax, ebx
mov dword [esp], 0x4b2e00
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x26
mov eax, ebx
mov dword [esp], 0x4b2dfc
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x25
mov eax, ebx
mov dword [esp], 0x4b2df8
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x22
mov eax, ebx
mov dword [esp], str.e_6
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x21
mov eax, ebx
mov dword [esp], str.e_5
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov edx, 3
mov ebx, 0x4b2d04
nop
xor eax, eax
cmp word [0x4ee230], 0
je 0x41a616
cmp dword [ebp + 0x10], edx
jb 0x41aa2d
mov edi, dword [ebp + 0xc]
sub dword [ebp + 0x10], edx
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp + 0x10]
lea esi, [edi + edx]
mov dword [ebp - 0x30], esi
mov esi, edx
jmp 0x41a9e2
mov ebx, edx
mov eax, dword [ebp - 0x2c]
mov dword [esp], edi
add edi, esi
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
movzx ecx, word [0x4ee230]
mov eax, edi
sub eax, dword [ebp - 0x30]
lea edx, [ecx - 1]
add eax, esi
test dx, dx
mov word [0x4ee230], dx
je 0x41a616
mov edx, ebx
sub edx, esi
cmp esi, ebx
jbe 0x41a9e0
test eax, eax
mov edx, esi
mov dword [ebp + 0x10], ebx
jne 0x41a616
test byte [0x4ee060], 0x80
mov ecx, dword [sym.imp.msvcrt.dll__errno]
je 0x41aae6
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
call ecx
mov ebx, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._console_read
mov dword [esp + 4], 0x4b2138
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov ecx, dword [ebp - 0x2c]
call ecx
mov edx, dword [ebp - 0x30]
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 4], str._console_read:_no_buffer_space_to_write_one_sequence__buffer:__ld__sequence:__ld_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ebx
call ecx
mov dword [eax], 0xc
mov eax, 0xffffffff
jmp 0x41a616
mov edx, 3
mov ebx, 0x4b2d08
jmp 0x41a9b0
test byte [ebp - 0x2c], 0xc
mov ebx, 0x4b2cec
mov eax, 0x4b2cee
mov edx, 1
cmovne ebx, eax
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2d02
jmp 0x41a9b0
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4ee22c
mov eax, ebx
call fcn.00415240
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41a636
test byte [ebp - 0x2c], 0xc
je 0x41ab5c
test byte [ebp - 0x2c], 0x10
je 0x41a636
test edx, edx
je case.0x41a7f0.2
mov eax, ebx
call fcn.00415320
mov edx, eax
jmp 0x41a636
movzx eax, byte [ebp - 0x34]
mov edx, 1
lea ebx, [ebp - 0x28]
mov byte [ebp - 0x28], al
jmp 0x41a9b0
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.20
mov byte [ebp - 0x28], 0x39
mov edx, 1
lea ebx, [ebp - 0x28]
jmp 0x41a9b0
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.21
mov byte [ebp - 0x28], 0x33
jmp 0x41ab94
mov edi, dword [ebp - 0x2c]
mov ebx, str.e_4
mov eax, 0x4b2cc5
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 3
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41a9b0
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b2cdd
mov eax, 0x4b2cc7
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 3
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41a9b0
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.24
mov byte [ebp - 0x28], 0x34
jmp 0x41ab94
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.25
mov byte [ebp - 0x28], 0x38
jmp 0x41ab94
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.26
mov byte [ebp - 0x28], 0x36
jmp 0x41ab94
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.27
mov byte [ebp - 0x28], 0x32
jmp 0x41ab94
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7c
mov eax, ebx
mov dword [esp], str.e_25
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7d
mov eax, ebx
mov dword [esp], str.e_26
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7e
mov eax, ebx
mov dword [esp], str.e_28
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7f
mov eax, ebx
mov dword [esp], str.e_29
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, pe_nt_image_headers32
mov eax, ebx
mov dword [esp], str.e_31
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x81
mov eax, ebx
mov dword [esp], str.e_32
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b2cfd
mov eax, 0x4b2cff
and edi, 3
cmp edi, 1
sbb edx, edx
add edx, 2
test edi, edi
cmovne ebx, eax
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cd9
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cd7
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cd5
jmp 0x41a9b0
mov edx, 1
mov ebx, str.517_9864320
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cd3
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cc7
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cd1
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2ccf
jmp 0x41a9b0
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.32
mov byte [ebp - 0x28], 0x30
jmp 0x41ab94
mov dword [esp + 4], 2
mov dword [esp], 0x6e
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
test byte [ebp - 0x2c], 0x10
je case.0x41a5f6.33
test al, al
je case.0x41a7f0.2
mov byte [ebp - 0x28], al
jmp 0x41ab94
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4ee22c
mov eax, ebx
call fcn.00415240
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41a636
jmp 0x41ab5c
mov ecx, dword [ebp - 0x2c]
mov edx, 0x83
mov eax, ebx
mov dword [esp], str.e_34
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov edx, 1
mov ebx, 0x4b2cdb
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cc5
jmp 0x41a9b0
mov eax, dword [ebp - 0x2c]
movzx edx, word [ebp - 0x30]
movzx ecx, word [0x4ee234]
mov dword [esp + 8], 0x12
mov dword [esp + 4], eax
mov eax, ebx
mov dword [esp], 0x4ee236
call fcn.004150a0
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41a636
jmp 0x41ab5c
mov ecx, dword [ebp - 0x2c]
mov edx, 0x82
mov eax, ebx
mov dword [esp], str.e_33
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov edx, 1
mov ebx, 0x4b2ccd
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2ccb
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2cc9
jmp 0x41a9b0
mov eax, dword [ebp - 0x2c]
mov edx, 0x6e
movzx ecx, word [0x4ee234]
mov dword [esp + 8], 0x11
mov dword [esp], 0x4ee236
mov dword [esp + 4], eax
mov eax, ebx
call fcn.004150a0
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x70
mov eax, ebx
mov dword [esp], 0x4b2e12
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x71
mov eax, ebx
mov dword [esp], 0x4b2e16
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x72
mov eax, ebx
mov dword [esp], 0x4b2e1a
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x73
mov eax, ebx
mov dword [esp], 0x4b2e1e
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x74
mov eax, ebx
mov dword [esp], str.e_15
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x75
mov eax, ebx
mov dword [esp], str.e_17
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x76
mov eax, ebx
mov dword [esp], str.e_18
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x77
mov eax, ebx
mov dword [esp], str.e_19
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x78
mov eax, ebx
mov dword [esp], str.e_20
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x79
mov eax, ebx
mov dword [esp], str.e_21
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7a
mov eax, ebx
mov dword [esp], str.e_23
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7b
mov eax, ebx
mov dword [esp], str.e_24
call fcn.00414d00
mov edx, eax
jmp 0x41a636
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b2cf7
mov eax, 0x4b2cf9
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 0xfffffffe
add edx, 3
test edi, edi
cmovne ebx, eax
jmp 0x41a9b0
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b2cf3
mov eax, str.517_9864320
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 2
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41a9b0
test byte [ebp - 0x2c], 3
jne 0x41b0c9
test byte [ebp - 0x2c], 0xc
mov ebx, 0x4b2cee
mov eax, 0x4b2cec
mov edx, 1
cmove ebx, eax
jmp 0x41a9b0
test byte [ebp - 0x2c], 3
mov edx, 2
mov ebx, 0x4b2ce9
jne 0x41a9b0
test byte [ebp - 0x2c], 0xc
je 0x41b0d8
mov byte [ebp - 0x28], 0
jmp 0x41ab94
mov edx, 2
mov ebx, 0x4b2cf0
jmp 0x41a9b0
mov edx, 1
mov ebx, 0x4b2ce7
jmp 0x41a9b0