Function at 0x41b9f0
Capabilities:
Log keystrokes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
jne 0x41bab0
mov esi, dword [0x4f3220]
test esi, esi
je 0x41bab0
cmp word [0x4f3230], 0
lea ebx, [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
je 0x41bbd0
movzx eax, word [0x4f3232]
mov word [ebp - 0x30], ax
movzx eax, byte [0x4f3236]
mov byte [ebp - 0x34], al
mov eax, dword [0x4f3238]
test al, 0xc
mov dword [ebp - 0x2c], eax
je 0x41ba85
test byte [ebp - 0x2c], 3
je 0x41ba85
cmp byte [ebp - 0x34], 0
je 0x41ba85
test byte [ebp - 0x2c], 1
jne 0x41bd77
mov eax, dword [ebp - 0x2c]
test al, 2
je 0x41ba85
test al, 8
jne 0x41bd80
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
mov edx, ecx
and eax, 0xfffffffd
and edx, 0xfffffff9
and ecx, 4
cmovne eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
and eax, 0x100
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x30]
je 0x41bc90
sub eax, 0xd
cmp ax, 0x62
ja case.0x41bca0.2
movzx eax, ax
jmp dword [eax*4 + 0x4b8054]
mov ecx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
call sub.msvcrt.dll__read
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x2c]
mov edx, 0x2e
mov eax, ebx
mov dword [esp], str.e_3
call fcn.00415f90
mov edx, eax
test edx, edx
jne 0x41be60
cmp byte [ebp - 0x34], 0
jne 0x41c022
test byte [0x4f3060], 0x80
je 0x41bbd0
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x3c], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], 0x4f3068
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x34], eax
call sub.msvcrt.dll__getpid
mov edx, dword [ebp - 0x34]
mov dword [esp + 8], str._console_read
mov dword [esp + 4], 0x4b7278
mov dword [esp + 0x10], edx
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], eax
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049fc30
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
call ecx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
test edx, edx
mov edx, 0x4b7dfd
mov dword [eax], ecx
mov eax, 0x4b7df8
cmove eax, edx
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0x30]
mov dword [esp + 4], str._console_read:_unknown_virtual_key_code:__d__enhanced:__s_n
mov dword [esp + 8], eax
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049fc30
mov edx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [edx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4f3068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x34]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
nop
mov dword [ebp - 0x28], 0
mov dword [0x4f3228], 0
mov dword [0x4f322c], 0
mov dword [0x4f3230], 0
mov dword [0x4f3234], 0
mov dword [0x4f3238], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4f3228
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
je 0x41bca7
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41bc78
cmp eax, 1
je 0x41bc41
mov dword [esp], str.ReadConsoleInputA_did_not_return_one_input_record
call fcn.0040b930
cmp word [0x4f3228], 1
jne 0x41bbd0
mov ecx, dword [0x4f322c]
test ecx, ecx
je 0x41bbd0
cmp word [0x4f3230], 0
jne 0x41ba29
mov dword [esp], str.ReadConsoleInputA_returned_a_key_event_with_zero_repeat_count
call fcn.0040b930
jmp 0x41ba29
mov dword [esp], str.ReadConsoleInputA_returned_0
call fcn.0040b930
mov eax, dword [ebp - 0x28]
jmp 0x41bc30
sub eax, 8
cmp ax, 0xda
ja case.0x41bca0.2
movzx eax, ax
jmp dword [eax*4 + 0x4b81e0]
test byte [0x4f3060], 0x80
mov ecx, dword [sym.imp.msvcrt.dll__errno]
je 0x41bd59
mov dword [ebp - 0x2c], ecx
call ecx
mov ebx, dword [eax]
mov dword [esp], 0x4f3068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._get_interesting_input_record_uncached
mov dword [esp + 4], 0x4b7278
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049fc30
mov ecx, dword [ebp - 0x2c]
call ecx
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str._get_interesting_input_record_uncached:_ReadConsoleInputA___failure__error__ld_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049fc30
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4f3068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ebx
call ecx
xor ebx, ebx
mov dword [eax], 5
mov eax, 0xffffffff
mov word [0x4f3230], bx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
and dword [ebp - 0x2c], 0xfffffff6
jmp 0x41ba85
and dword [ebp - 0x2c], 0xfffffff5
jmp 0x41ba85
mov ecx, dword [ebp - 0x2c]
mov edx, 0x2d
mov eax, ebx
mov dword [esp], str.e_2
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x28
mov eax, ebx
mov dword [esp], 0x4b7f44
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x27
mov eax, ebx
mov dword [esp], 0x4b7f40
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x26
mov eax, ebx
mov dword [esp], 0x4b7f3c
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x25
mov eax, ebx
mov dword [esp], 0x4b7f38
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x22
mov eax, ebx
mov dword [esp], str.e_6
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x21
mov eax, ebx
mov dword [esp], str.e_5
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov edx, 3
mov ebx, 0x4b7e44
nop
xor eax, eax
cmp word [0x4f3230], 0
je 0x41bac6
cmp dword [ebp + 0x10], edx
jb 0x41bedd
mov edi, dword [ebp + 0xc]
sub dword [ebp + 0x10], edx
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp + 0x10]
lea esi, [edi + edx]
mov dword [ebp - 0x30], esi
mov esi, edx
jmp 0x41be92
mov ebx, edx
mov eax, dword [ebp - 0x2c]
mov dword [esp], edi
add edi, esi
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
movzx ecx, word [0x4f3230]
mov eax, edi
sub eax, dword [ebp - 0x30]
lea edx, [ecx - 1]
add eax, esi
test dx, dx
mov word [0x4f3230], dx
je 0x41bac6
mov edx, ebx
sub edx, esi
cmp esi, ebx
jbe 0x41be90
test eax, eax
mov edx, esi
mov dword [ebp + 0x10], ebx
jne 0x41bac6
test byte [0x4f3060], 0x80
mov ecx, dword [sym.imp.msvcrt.dll__errno]
je 0x41bf96
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
call ecx
mov ebx, dword [eax]
mov dword [esp], 0x4f3068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._console_read
mov dword [esp + 4], 0x4b7278
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049fc30
mov ecx, dword [ebp - 0x2c]
call ecx
mov edx, dword [ebp - 0x30]
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 4], str._console_read:_no_buffer_space_to_write_one_sequence__buffer:__ld__sequence:__ld_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049fc30
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4f3068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
call ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ebx
call ecx
mov dword [eax], 0xc
mov eax, 0xffffffff
jmp 0x41bac6
mov edx, 3
mov ebx, 0x4b7e48
jmp 0x41be60
test byte [ebp - 0x2c], 0xc
mov ebx, 0x4b7e2c
mov eax, 0x4b7e2e
mov edx, 1
cmovne ebx, eax
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e42
jmp 0x41be60
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4f322c
mov eax, ebx
call fcn.004165d0
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41bae6
test byte [ebp - 0x2c], 0xc
je 0x41c00c
test byte [ebp - 0x2c], 0x10
je 0x41bae6
test edx, edx
je case.0x41bca0.2
mov eax, ebx
call fcn.004166b0
mov edx, eax
jmp 0x41bae6
movzx eax, byte [ebp - 0x34]
mov edx, 1
lea ebx, [ebp - 0x28]
mov byte [ebp - 0x28], al
jmp 0x41be60
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.20
mov byte [ebp - 0x28], 0x39
mov edx, 1
lea ebx, [ebp - 0x28]
jmp 0x41be60
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.21
mov byte [ebp - 0x28], 0x33
jmp 0x41c044
mov edi, dword [ebp - 0x2c]
mov ebx, str.e_4
mov eax, 0x4b7e05
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 3
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41be60
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b7e1d
mov eax, 0x4b7e07
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 3
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41be60
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.24
mov byte [ebp - 0x28], 0x34
jmp 0x41c044
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.25
mov byte [ebp - 0x28], 0x38
jmp 0x41c044
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.26
mov byte [ebp - 0x28], 0x36
jmp 0x41c044
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.27
mov byte [ebp - 0x28], 0x32
jmp 0x41c044
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7c
mov eax, ebx
mov dword [esp], str.e_25
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7d
mov eax, ebx
mov dword [esp], str.e_26
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7e
mov eax, ebx
mov dword [esp], str.e_28
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7f
mov eax, ebx
mov dword [esp], str.e_29
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, pe_nt_image_headers32
mov eax, ebx
mov dword [esp], str.e_31
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x81
mov eax, ebx
mov dword [esp], str.e_32
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b7e3d
mov eax, 0x4b7e3f
and edi, 3
cmp edi, 1
sbb edx, edx
add edx, 2
test edi, edi
cmovne ebx, eax
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e19
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e17
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e15
jmp 0x41be60
mov edx, 1
mov ebx, str.517_9864320
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e13
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e07
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e11
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e0f
jmp 0x41be60
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.32
mov byte [ebp - 0x28], 0x30
jmp 0x41c044
mov dword [esp + 4], 2
mov dword [esp], 0x6e
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
test byte [ebp - 0x2c], 0x10
je case.0x41baa6.33
test al, al
je case.0x41bca0.2
mov byte [ebp - 0x28], al
jmp 0x41c044
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4f322c
mov eax, ebx
call fcn.004165d0
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41bae6
jmp 0x41c00c
mov ecx, dword [ebp - 0x2c]
mov edx, 0x83
mov eax, ebx
mov dword [esp], str.e_34
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov edx, 1
mov ebx, 0x4b7e1b
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e05
jmp 0x41be60
mov eax, dword [ebp - 0x2c]
movzx edx, word [ebp - 0x30]
movzx ecx, word [0x4f3234]
mov dword [esp + 8], 0x12
mov dword [esp + 4], eax
mov eax, ebx
mov dword [esp], 0x4f3236
call fcn.00416430
test byte [ebp - 0x2c], 3
mov edx, eax
je 0x41bae6
jmp 0x41c00c
mov ecx, dword [ebp - 0x2c]
mov edx, 0x82
mov eax, ebx
mov dword [esp], str.e_33
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov edx, 1
mov ebx, 0x4b7e0d
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e0b
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e09
jmp 0x41be60
mov eax, dword [ebp - 0x2c]
mov edx, 0x6e
movzx ecx, word [0x4f3234]
mov dword [esp + 8], 0x11
mov dword [esp], 0x4f3236
mov dword [esp + 4], eax
mov eax, ebx
call fcn.00416430
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x70
mov eax, ebx
mov dword [esp], 0x4b7f52
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x71
mov eax, ebx
mov dword [esp], 0x4b7f56
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x72
mov eax, ebx
mov dword [esp], 0x4b7f5a
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x73
mov eax, ebx
mov dword [esp], 0x4b7f5e
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x74
mov eax, ebx
mov dword [esp], str.e_15
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x75
mov eax, ebx
mov dword [esp], str.e_17
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x76
mov eax, ebx
mov dword [esp], str.e_18
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x77
mov eax, ebx
mov dword [esp], str.e_19
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x78
mov eax, ebx
mov dword [esp], str.e_20
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x79
mov eax, ebx
mov dword [esp], str.e_21
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7a
mov eax, ebx
mov dword [esp], str.e_23
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7b
mov eax, ebx
mov dword [esp], str.e_24
call fcn.00415f90
mov edx, eax
jmp 0x41bae6
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b7e37
mov eax, 0x4b7e39
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 0xfffffffe
add edx, 3
test edi, edi
cmovne ebx, eax
jmp 0x41be60
mov edi, dword [ebp - 0x2c]
mov ebx, 0x4b7e33
mov eax, str.517_9864320
and edi, 0x10
cmp edi, 1
sbb edx, edx
and edx, 2
add edx, 1
test edi, edi
cmovne ebx, eax
jmp 0x41be60
test byte [ebp - 0x2c], 3
jne 0x41c579
test byte [ebp - 0x2c], 0xc
mov ebx, 0x4b7e2e
mov eax, 0x4b7e2c
mov edx, 1
cmove ebx, eax
jmp 0x41be60
test byte [ebp - 0x2c], 3
mov edx, 2
mov ebx, 0x4b7e29
jne 0x41be60
test byte [ebp - 0x2c], 0xc
je 0x41c588
mov byte [ebp - 0x28], 0
jmp 0x41c044
mov edx, 2
mov ebx, 0x4b7e30
jmp 0x41be60
mov edx, 1
mov ebx, 0x4b7e27
jmp 0x41be60