joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f1150
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbp, rdx
lea rdx, [rsp + 0x40]
mov edi, r9d
mov ebx, r8d
mov rsi, rcx
call qword [rax + 0x100]
mov edx, dword [rsp + 0x60]
mov eax, ebx
sub eax, dword [rsp + 0x40]
mov ecx, edx
and byte [rbp + 0x50], 0xfc
and byte [rbp + 0x51], 0xe0
shr ecx, 2
mov dword [rbp + 0x54], eax
and cl, 1
add cl, cl
mov eax, edi
sub eax, dword [rsp + 0x44]
mov dword [rbp + 0x58], eax
mov eax, edx
shr eax, 3
and al, 1
or cl, al
mov eax, edx
or byte [rbp + 0x50], cl
mov ecx, edx
shr ecx, 6
and cl, 1
shr eax, 5
add cl, cl
and al, 1
or cl, al
mov eax, edx
add cl, cl
shr eax, 1
and al, 1
or cl, al
mov eax, edx
add cl, cl
shr eax, 4
and al, 1
and dl, 1
or cl, al
add cl, cl
or cl, dl
or byte [rbp + 0x51], cl
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov edx, 4
test ax, ax
cmovs ecx, edx
and byte [rbp + 0x50], 0xfb
or byte [rbp + 0x50], cl
call qword [sym.imp.USER32.dll_GetMessageTime]
mov qword [rbp + 0x10], rsi
lea r8, [rsp + 0x50]
mov dword [rbp + 0x1c], eax
lea rdx, [rsp + 0x60]
mov eax, dword [rsi + 0x78]
mov rcx, rsi
mov dword [rbp + 0x20], eax
mov rax, qword [rsi]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x50], edi
call qword [rax + 0x530]
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov dword [0x140575d70], eax
mov eax, dword [rsp + 0x50]
mov dword [0x140575d74], eax
mov eax, dword [rbp + 0x18]
mov dword [0x140575d78], eax
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f5fd0
Capabilities:
Hash data using murmur3
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r9, r9
je 0x1401f5ffc
mov eax, dword [r9 + 0x78]
mov qword [rcx + 0x10], r9
jmp 0x1401f6001
mov eax, 0xffffffff
mov dword [rcx + 0x20], eax
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov edx, 2
test ax, ax
cmovs ecx, edx
and byte [rdi + 0x50], 0xfd
or byte [rdi + 0x50], cl
lea ecx, [rdx + 0xf]
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, rsi
mov dword [rdi + 0x64], ebp
test ax, ax
mov dword [rdi + 0x68], esi
sets dl
and byte [rdi + 0x50], 0xfe
movzx eax, dl
shr rbx, 0x10
or al, byte [rdi + 0x50]
movzx ecx, bx
or dl, byte [rdi + 0x50]
shr cx, 0xd
shl cl, 2
xor cl, al
and cl, 4
xor cl, dl
mov byte [rdi + 0x50], cl
call qword [sym.imp.USER32.dll_GetMessageTime]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
shr bx, 0xe
and bl, 1
mov dword [rdi + 0x1c], eax
mov byte [rdi + 0x6c], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401f8f50
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
call fcn.1401e61d0
test al, al
jne 0x1401f8f84
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14036c0d0
add rsp, 0x50
pop rbx
ret
call fcn.140264100
test al, al
jne 0x1401f908e
lea rcx, [rbx + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test al, al
je 0x1401f9034
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x300]
test al, al
jne 0x1401f9014
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x20]
mov rdi, qword [rbx + 0x218]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x1401f8fe6
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], ecx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1401dde50
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.USER32.dll_PtInRect]
mov rdi, qword [rsp + 0x70]
test eax, eax
je 0x1401f908e
mov rcx, qword [rbx + 0xe8]
test rcx, rcx
jne 0x1401f9028
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1401f908e
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1401f908e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x1401f9058
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], ecx
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call fcn.1401fc4c0
test rax, rax
mov r9d, 0x2000001
mov edx, reloc.WLDAP32.dll_Ordinal_32
cmove rax, rbx
mov rcx, qword [rax + 0x218]
mov r8, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14036c0d0
add rsp, 0x50
pop rbx
ret
Function at 0x1401fb1d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
lea rdx, [0x140000000]
xor eax, eax
nop dword [rax + rax]
cmp dword [rdx + rax*8 + 0x4099a4], edi
je 0x1401fb2de
inc rax
cmp rax, 0x4d
jb 0x1401fb1f0
mov qword [rsp + 0x30], rbx
xor bl, bl
cmp edi, 0x177
jg 0x1401fb299
je 0x1401fb25c
lea eax, [rcx - 0x7f]
cmp eax, 0xf0
ja case.0x1401fb2b0.383
cdqe
movzx eax, byte [rdx + rax + 0x1fb328]
mov ecx, dword [rdx + rax*4 + 0x1fb2fc]
add rcx, rdx
jmp rcx
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_33
jmp 0x1401fb2c7
mov bl, 1
mov eax, Ordinal_35
jmp 0x1401fb2c7
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_35
jmp 0x1401fb2c7
mov bl, 1
mov eax, 0x24
jmp 0x1401fb2c7
mov bl, 1
mov eax, Ordinal_41
jmp 0x1401fb2c7
mov bl, 1
mov eax, Ordinal_41
jmp 0x1401fb2c7
mov bl, 1
mov eax, Ordinal_41
jmp 0x1401fb2c7
mov bl, 1
mov eax, Ordinal_41
jmp 0x1401fb2c7
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_45
jmp 0x1401fb2c7
mov bl, 1
mov eax, reloc.WLDAP32.dll_Ordinal_46
jmp 0x1401fb2c7
lea eax, [rcx - 0x178]
cmp eax, 9
ja case.0x1401fb2b0.383
cdqe
mov ecx, dword [rdx + rax*4 + 0x1fb41c]
add rcx, rdx
jmp rcx
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x1401fb2c4
movzx eax, al
jmp 0x1401fb2c7
movzx eax, di
test rsi, rsi
je 0x1401fb2ce
mov byte [rsi], bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1401fb2e6
mov byte [rsi], 0
movzx eax, word [rdx + rax*8 + 0x4099a0]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401fcd70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
lea eax, [rcx - 1]
mov ebx, ecx
test eax, 0xfffffffc
jne 0x1401fcdcd
cmp ecx, 3
je 0x1401fcdcd
cmp qword [0x14055a4b8], 0
je 0x1401fcdcd
lea rax, str.cant_use_wxGetKeyState___for_mouse_buttons
mov edx, 0x1b9b
lea r9, str.key___0x01__key___0x02__key___0x04
mov qword [rsp + 0x20], rax
lea r8, str.wxGetKeyState
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srcmswwindow.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x1401fcdcd
mov byte [0x1405750a8], 0
int3
xor edx, edx
mov ecx, ebx
call fcn.1401fb1d0
lea ecx, [rbx - 0x16c]
cmp ecx, 1
jbe 0x1401fcdf6
cmp ebx, 0x137
je 0x1401fcdf6
movzx ecx, ax
add rsp, 0x30
pop rbx
jmp 0x1401fd680
movzx ecx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
movzx ebx, cx
lea eax, [rbx - 1]
cmp ax, 1
ja 0x1401fd6b5
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1401fd6b5
mov eax, 1
mov ecx, 2
cmp bx, ax
cmove ax, cx
movzx ebx, ax
movzx ecx, bx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1401fce60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and byte [rcx], 0xf0
mov rbx, rcx
and byte [rcx + 1], 0xe0
xor edi, edi
mov qword [rcx + 4], rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x1401fceaa
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], ecx
jmp 0x1401fceb2
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 4], ecx
mov esi, 1
mov dword [rbx + 8], edx
lea ecx, [rsi + 0x16]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, esi
mov r14d, 2
test eax, eax
cmovne ecx, r14d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and byte [rbx + 1], 0xfe
mov ebp, 4
movsx ecx, ax
shr ecx, 0xf
and cl, sil
or byte [rbx + 1], cl
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and byte [rbx + 1], 0xfd
lea ecx, [rsi + 0x16]
movsx edx, ax
shr edx, 0xf
and dl, sil
add dl, dl
or byte [rbx + 1], dl
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov ecx, r14d
cmovne ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and byte [rbx + 1], 0xfb
movsx ecx, ax
shr ecx, 0xf
and cl, sil
shl cl, 2
or byte [rbx + 1], cl
lea ecx, [rsi + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and byte [rbx + 1], 0xf7
movsx ecx, ax
shr ecx, 0xf
and cl, sil
shl cl, 3
or byte [rbx + 1], cl
lea ecx, [rsi + 5]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and byte [rbx + 1], 0xef
movsx ecx, ax
shr ecx, 0xf
and cl, sil
shl cl, 4
or byte [rbx + 1], cl
lea ecx, [rsi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
lea ecx, [rsi + 0xf]
sets al
and byte [rbx], 0xfe
or byte [rbx], al
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
cmovs ecx, r14d
and byte [rbx], 0xfd
or byte [rbx], cl
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rax, rbx
cmovs edi, ebp
and byte [rbx], 0xfb
or byte [rbx], dil
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1401fd680
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
lea eax, [rcx - 1]
mov ebx, ecx
test eax, 0xfffffffc
jne 0x1401fcdcd
cmp ecx, 3
je 0x1401fcdcd
cmp qword [0x14055a4b8], 0
je 0x1401fcdcd
lea rax, str.cant_use_wxGetKeyState___for_mouse_buttons
mov edx, 0x1b9b
lea r9, str.key___0x01__key___0x02__key___0x04
mov qword [rsp + 0x20], rax
lea r8, str.wxGetKeyState
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srcmswwindow.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x1401fcdcd
mov byte [0x1405750a8], 0
int3
xor edx, edx
mov ecx, ebx
call fcn.1401fb1d0
lea ecx, [rbx - 0x16c]
cmp ecx, 1
jbe 0x1401fcdf6
cmp ebx, 0x137
je 0x1401fcdf6
movzx ecx, ax
add rsp, 0x30
pop rbx
jmp 0x1401fd680
movzx ecx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
movzx ebx, cx
lea eax, [rbx - 1]
cmp ax, 1
ja 0x1401fd6b5
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1401fd6b5
mov eax, 1
mov ecx, 2
cmp bx, ax
cmove ax, cx
movzx ebx, ax
movzx ecx, bx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1402335e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x194]
mov rbx, rdx
shr eax, 5
mov rdi, rcx
test al, 1
je 0x14023360e
cmp dword [rdx + 8], 0x200
jne 0x14023360e
mov rcx, rdx
call fcn.1402290d0
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.wxTopLevelWindowMSW.virtual_1712

Function at 0x140264000
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rsp + 0x20], 1
test rdx, rdx
je 0x1402640e2
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
movsxd r8, ebx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140121540
mov rdx, qword [rax + 8]
mov r8d, ebx
mov rdx, qword [rdx]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
nop
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
lea rdx, [0x1404d41c8]
test rcx, rcx
cmovne rdx, rcx
mov rcx, qword [rsp + 0x28]
call fcn.14001d2c0
nop
call fcn.14010aa30
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x1402640e2
mov eax, 0xffff
add word [rcx + 0x10], ax
jne 0x1402640dc
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1402640dc
cmp byte [rbx + 0x12], 0
je 0x1402640cf
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14036c454
call fcn.14010aa30
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1402719a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, rdx
jmp 0x140287c50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 8], 0x100
jne case.0x140287d66.3
mov rbx, qword [rcx + 0x10]
mov eax, 0x2000
test word [rcx + 0x1a], ax
je 0x140287c84
cmp rbx, 8
jmp 0x140287d12
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
test ax, ax
mov esi, edi
sets sil
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets dil
add edi, esi
je 0x140287d02
sub edi, 1
je 0x140287d26
cmp edi, 1
je case.0x140287d66.3
cmp qword [0x14055a4b8], 0
je 0x140287d02
lea rax, str.how_many_modifiers_have_we_got_
mov edx, 0x44d
lea r9, str._Assert_failure_
mov qword [rsp + 0x20], rax
lea r8, str.wxMSWTextEntryShouldPreProcessMessage
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srcmsw_textentry.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x140287d02
mov byte [0x1405750a8], 0
int3
sub rbx, 0x23
je case.0x140287d66.0
sub rbx, 1
je case.0x140287d66.0
cmp rbx, 0xa
jne case.0x140287d66.3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rbx, 0xffffffffffffffdd
test esi, esi
je 0x140287d4f
cmp rbx, 0x35
ja case.0x140287d66.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x287d84]
mov ecx, dword [rdx + rax*4 + 0x287d7c]
add rcx, rdx
jmp rcx
cmp rbx, 0xb
ja case.0x140287d66.3
lea rdx, [0x140000000]
mov eax, dword [rdx + rbx*4 + 0x287dbc]
add rax, rdx
jmp rax
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140273470
Capabilities:
Hash data using murmur3
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
cmp r8d, 6
jne 0x1402734fc
test r9, r9
jne 0x1402734fc
lea rax, [0x140273360]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r9d
lea ecx, [r9 + 0x68]
call fcn.14036c0f8
mov rbx, rax
mov qword [rsp + 0x30], rax
mov r8d, dword [0x140575384]
lea edx, [rsi - 1]
mov rcx, rax
call fcn.140140370
mov qword [rbx + 0x10], rdi
lea rax, vtable.wxAsyncMethodCallEvent0_class_wxPopupTransientWindow_.0
mov qword [rbx], rax
mov qword [rbx + 0x50], rdi
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + gethostname]
mov r9, rsi
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
jmp fcn.1401f3330
Function at 0x140280210
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x14028026a
mov eax, 0x2000
test word [rdx + 0x1a], ax
jne 0x14028026a
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14028026a
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14028026a
mov rax, qword [rbx + 0x10]
cmp rax, 0xd
je 0x14028027f
cmp rax, 0x1b
je 0x14028027f
cmp rax, 0x73
je 0x14028029c
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140115e70
mov rcx, qword [rdi + 0x218]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x157
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14028026a
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140286540
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1402865a1
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1402865a1
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1402865a1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_301]
mov rcx, rax
call fcn.1401f2860
mov rcx, rax
call fcn.1401f15b0
test al, al
je 0x1402865a1
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140287070
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rdx + 8], 0x100
jne case.0x1402871a1.3
mov rbx, qword [rdx + 0x10]
mov eax, 0x2000
test word [rdx + 0x1a], ax
je 0x1402870b7
cmp rbx, 8
jne case.0x1402871a1.3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
test ax, ax
mov esi, edi
sets sil
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets dil
add edi, esi
je 0x140287135
sub edi, 1
je 0x140287161
cmp edi, 1
je case.0x1402871a1.3
cmp qword [0x14055a4b8], 0
je 0x140287135
lea rax, str.how_many_modifiers_have_we_got_
mov edx, 0x44d
lea r9, str._Assert_failure_
mov qword [rsp + 0x20], rax
lea r8, str.wxMSWTextEntryShouldPreProcessMessage
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srcmsw_textentry.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x140287135
mov byte [0x1405750a8], 0
int3
sub rbx, 0x23
je case.0x1402871a1.0
sub rbx, 1
je case.0x1402871a1.0
cmp rbx, 0xa
jne case.0x1402871a1.3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rbx, 0xffffffffffffffdd
test esi, esi
je 0x14028718a
cmp rbx, 0x35
ja case.0x1402871a1.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x2871c0]
mov ecx, dword [rdx + rax*4 + 0x2871b8]
add rcx, rdx
jmp rcx
cmp rbx, 0xb
ja case.0x1402871a1.3
lea rdx, [0x140000000]
mov eax, dword [rdx + rbx*4 + 0x2871f8]
add rax, rdx
jmp rax
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140287c50
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, rdx
jmp 0x140287c50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 8], 0x100
jne case.0x140287d66.3
mov rbx, qword [rcx + 0x10]
mov eax, 0x2000
test word [rcx + 0x1a], ax
je 0x140287c84
cmp rbx, 8
jmp 0x140287d12
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
test ax, ax
mov esi, edi
sets sil
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets dil
add edi, esi
je 0x140287d02
sub edi, 1
je 0x140287d26
cmp edi, 1
je case.0x140287d66.3
cmp qword [0x14055a4b8], 0
je 0x140287d02
lea rax, str.how_many_modifiers_have_we_got_
mov edx, 0x44d
lea r9, str._Assert_failure_
mov qword [rsp + 0x20], rax
lea r8, str.wxMSWTextEntryShouldPreProcessMessage
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srcmsw_textentry.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x140287d02
mov byte [0x1405750a8], 0
int3
sub rbx, 0x23
je case.0x140287d66.0
sub rbx, 1
je case.0x140287d66.0
cmp rbx, 0xa
jne case.0x140287d66.3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rbx, 0xffffffffffffffdd
test esi, esi
je 0x140287d4f
cmp rbx, 0x35
ja case.0x140287d66.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x287d84]
mov ecx, dword [rdx + rax*4 + 0x287d7c]
add rcx, rdx
jmp rcx
cmp rbx, 0xb
ja case.0x140287d66.3
lea rdx, [0x140000000]
mov eax, dword [rdx + rbx*4 + 0x287dbc]
add rax, rdx
jmp rax
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14028ed70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x14028edfb
mov eax, 0x2000
test word [rdx + 0x1a], ax
jne 0x14028edfb
mov rax, qword [rdx + 0x10]
cmp rax, 8
je 0x14028edcf
cmp rax, 0xd
jne 0x14028edfb
lea ecx, [rax + 3]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14028edfb
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14028edfb
mov eax, dword [rdi + 0x194]
shr eax, 5
test al, 1
jmp 0x14028edf9
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14028edfb
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14028edfb
mov rcx, rdi
call fcn.14028dc70
test al, al
jne 0x14028ee2a
lea rcx, [rdi + 0x590]
mov rdx, rbx
call fcn.140287070
test al, al
je 0x14028ee2a
mov rdx, rbx
mov rcx, rdi
call fcn.140115e70
test al, al
je 0x14028ee2a
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140313590
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x1403135ed
cmp qword [rdx + 0x10], 0xd
jne 0x1403135ed
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403135ed
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403135ed
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403135ed
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140115e70

Function at 0x140316580
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403165bb
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403165bb
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1403165bb
xor al, al
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret