joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47cf90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83eb49
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.wxColour.0
call fcn.005322e0
push str.777777
lea ecx, [ebp - 0x30]
call fcn.00436310
mov eax, dword [edi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
lea esi, [edi + 0x14]
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], esi
mov dword [esi + 4], 0
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [esi], vtable.wxColour.0
call fcn.005322e0
push str.000000
lea ecx, [ebp - 0x30]
call fcn.00436310
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 4
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
lea esi, [edi + 0x28]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 6
mov dword [esi], vtable.wxColour.0
call fcn.005322e0
push str.EEEEEE
lea ecx, [ebp - 0x30]
call fcn.00436310
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 7
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
lea esi, [edi + 0x3c]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 9
mov dword [esi], vtable.wxColour.0
call fcn.005322e0
push str.000000
lea ecx, [ebp - 0x30]
call fcn.00436310
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
lea esi, [edi + 0x50]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 0xc
mov dword [esi], vtable.wxColour.0
call fcn.005322e0
push str.555555
lea ecx, [ebp - 0x30]
call fcn.00436310
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xd
call dword [eax + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
lea esi, [edi + 0x64]
mov dword [esi + 4], 0
mov dword [ebp - 0x34], esi
mov ecx, esi
mov byte [ebp - 4], 0xf
mov dword [esi], vtable.wxColour.0
call fcn.005322e0
push str.FFFFFF
lea ecx, [ebp - 0x30]
call fcn.00436310
mov edx, dword [esi]
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x10
call dword [edx + 0x30]
lea ecx, [ebp - 0x30]
call fcn.00436e00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret
Function at 0x48de40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8429a5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.008000f5
add esp, 4
test eax, eax
je 0x48de7a
mov dword [eax], esi
jmp 0x48de7c
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x48c8d0
push 0
push 0
call fcn.0080f20e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x48dede
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x48ded1
push ecx
push eax
call fcn.007fdbff
add esp, 8
test eax, eax
jne 0x48ded8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 1
call fcn.007fde5f
push eax
call fcn.007fde32
push 6
mov dword [ebp - 0x14], 0
call fcn.007fde5f
int3
Function at 0x496090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [esp + 0xc]
cmovae edx, edi
test eax, eax
js 0x4960dc
push ebx
push esi
lea ebx, [esp + 0x14]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x4960b8
pop esi
pop ebx
mov eax, edi
pop edi
ret
Function at 0x49a9d0
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x49a9e6
pop edi
xor eax, eax
pop esi
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x49aa10
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x49a9f0
pop ebx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x49edc0
Capabilities:
Terminate process

Disassembly:
call fcn.0049ee10
push eax
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
push 2
call fcn.00805cc0
add esp, 4
push eax
call fcn.0049f120
add esp, 0x10
cmp dword [esp + 4], 0x3ef
jne 0x49ee04
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.00805cc0
add esp, 4
push eax
call fcn.0049f120
add esp, 8
push 3
call fcn.00811735
int3
Function at 0x4bb530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4bb6b2
cmp dword [esi + 0x20], 0
je 0x4bb6b2
cmp dword [esi + 0x24], 0
je 0x4bb6b2
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x4bb6b2
cmp dword [edi], esi
jne 0x4bb6b2
mov eax, dword [edi + 4]
cmp eax, 0x2a
je 0x4bb596
cmp eax, 0x39
je 0x4bb596
cmp eax, 0x45
je 0x4bb596
cmp eax, 0x49
je 0x4bb596
cmp eax, 0x5b
je 0x4bb596
cmp eax, 0x67
je 0x4bb596
cmp eax, 0x71
je 0x4bb596
cmp eax, 0x29a
jne 0x4bb6b2
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x4bb5cb
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x4bb5ed
call fcn.004b9500
jmp 0x4bb5f2
call fcn.004bdd80
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.004be510
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00802640
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x8a5a52]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x8a5a50]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x8a5a54]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x8a5a56]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
pop edi
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4c5820
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x843f75
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x48], vtable.._AV___Func_impl_no_alloc_V_lambda_edf78ffd1a7d636ee10be55aba6fbf16___XABV__unique_ptr___BY0A_DU__default_delete___BY0A_D_std___std__I_std__.0
mov dword [ebp - 0x24], eax
xor edi, edi
mov dword [ebp - 4], 0
mov dword [ebp + 8], 0
mov dword [ebp - 0x10], edi
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x4c5923
mov esi, dword [ebp + 8]
cmp esi, edi
jbe 0x4c58d4
push esi
call fcn.008008c1
mov edi, eax
add esp, 4
test edi, edi
je 0x4c58ba
push esi
push 0
push edi
call fcn.00802640
add esp, 0xc
jmp 0x4c58bc
xor edi, edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], edi
test eax, eax
je 0x4c58cf
push eax
call fcn.008008bc
add esp, 4
mov esi, dword [ebp + 8]
mov edi, esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push dword [ebp - 0x10]
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x4c590e
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c5923
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4c590e
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
call dword [eax + 8]
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x4c5896
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4c5933
push eax
call fcn.008008bc
add esp, 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4c594b
mov edx, dword [ecx]
lea eax, [ebp - 0x48]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5c20
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x843ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp + 8]
push 0
push ecx
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x38], esi
push dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4c5de9
mov edx, dword [ebp - 0x2c]
xor eax, eax
shr edx, 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 7
ja 0x4c5cca
mov dword [ebp - 0x18], edx
test edx, edx
je 0x4c5cbe
mov ecx, edx
lea edi, [ebp - 0x28]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor eax, eax
mov word [ebp + edx*2 - 0x28], ax
mov ecx, dword [ebp - 0x28]
jmp 0x4c5d31
cmp edx, 0x7ffffffe
ja 0x4c5e1f
mov edi, edx
mov dword [ebp - 0x30], edx
or edi, 7
lea ecx, [ebp - 0x28]
cmp edi, 0x7ffffffe
jbe 0x4c5cf3
mov edi, SysReAllocString
lea eax, [edi + 1]
jmp 0x4c5d00
mov eax, 0xa
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
push eax
call fcn.00437720
mov edx, dword [ebp - 0x3c]
mov ecx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x34]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x34]
xor eax, eax
mov word [ecx + edx*2], ax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov eax, dword [ebp - 0x38]
push 0
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4c5db3
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
shr ecx, 1
cmp ecx, eax
ja 0x4c5d7f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4c5d8c
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0043fb20
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
jmp 0x4c5e02
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4c5de9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c5ddf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c5e24
push edx
push ecx
call fcn.00800125
add esp, 8
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret
call fcn.00437710
call fcn.00805a59
int3
Function at 0x4c5ea0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84404d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], edi
cmp dword [eax], 0
mov dword [ebp - 4], 0
je 0x4c5fa3
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004c4ce0
add esp, 0xc
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 4], 1
je 0x4c5f64
cmp dword [ebp - 0x38], 0
je 0x4c5f64
lea eax, [esi + 0xb4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c53c0
add esp, 8
mov edx, eax
mov ecx, dword [ebp + 0x38]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4c6001
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [eax + 8]
call eax
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00436680
test bl, bl
je 0x4c5f64
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 4
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x20000013
push dword [ebp - 0x38]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x38]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [edi + 0xc], eax
test ecx, ecx
je 0x4c5fe3
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4c5fe3
mov ecx, dword [ebp + 0x38]
mov dword [edi], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 6
test ecx, ecx
je 0x4c5fe3
mov esi, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret
call fcn.007fc8d0
int3
Function at 0x503e80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84b4d0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push esi
push edi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
and byte [eax + 0x144], 0xfe
xor edi, edi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
mov ecx, 4
push 0x11
cmovs edi, ecx
call esi
test ax, ax
jns 0x503ed6
or edi, 8
push 1
call esi
mov ecx, 0x8000
mov esi, edi
or esi, 1
and ax, cx
push 4
cmove esi, edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
mov edi, esi
or edi, 0x10
and ax, cx
push 2
cmove edi, esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov ecx, edi
or ecx, 2
test ax, ax
lea eax, [ebp - 0x1c]
cmove ecx, edi
push eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x503f41
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [esi + 0x13c]
push eax
call fcn.00512320
add esp, 8
lea ecx, [ebp - 0x84]
movups xmm0, xmmword [eax]
push dword [0xe7b1c8]
movd eax, xmm0
psrldq xmm0, 4
sub dword [ebp - 0x1c], eax
movd eax, xmm0
sub dword [ebp - 0x18], eax
call fcn.0051d590
push dword [ebp - 0x14]
lea eax, [ebp - 0x84]
mov dword [ebp - 4], 0
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x1c]
push eax
call fcn.00507820
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.004fb100
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 1
mov dword [ebp - 0x84], vtable.wxObject.0
call fcn.0073da90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x507820
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
push esi
push edi
push ecx
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x80]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, edi
sub eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov ecx, edx
mov esi, dword [esp + 0x24]
mov dword [ebx + 0x30], eax
mov eax, esi
sub eax, dword [esp + 0x14]
mov dword [ebx + 0x34], eax
mov eax, edx
shr ecx, 2
and cl, 1
shr eax, 3
add cl, cl
and al, 1
or cl, al
movzx eax, byte [ebx + 0x2c]
and al, 0xfc
or cl, al
mov eax, edx
mov byte [ebx + 0x2c], cl
mov ecx, edx
shr ecx, 6
and cl, 1
shr eax, 5
and al, 1
add cl, cl
or cl, al
mov eax, edx
shr eax, 1
add cl, cl
and al, 1
or cl, al
mov eax, edx
shr eax, 4
add cl, cl
and al, 1
and dl, 1
or cl, al
movzx eax, byte [ebx + 0x2d]
add cl, cl
and al, 0xe0
or cl, al
or cl, dl
push 0x12
mov byte [ebx + 0x2d], cl
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
movzx eax, byte [ebx + 0x2c]
setns cl
and al, 0xfb
dec cl
and cl, 4
or al, cl
mov byte [ebx + 0x2c], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebx + 0x10], eax
lea ecx, [esp + 0x1c]
mov dword [ebx + 8], ebp
mov eax, dword [ebp + 0x40]
push ecx
mov dword [ebx + 0x14], eax
lea ecx, [esp + 0x24]
mov eax, dword [ebp]
push ecx
mov ecx, ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], esi
call dword [eax + 0x298]
mov eax, dword [esp + 0x20]
pop edi
mov dword [0xe7ab24], eax
mov eax, dword [esp + 0x18]
pop esi
mov dword [0xe7ab28], eax
mov eax, dword [ebx + 0xc]
pop ebp
mov dword [0xe7ab2c], eax
pop ebx
add esp, 8
ret 0x10

Function at 0x50c480
Capabilities:
Hash data using murmur3
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test eax, eax
je 0x50c497
mov ecx, dword [eax + 0x40]
mov dword [edi + 8], eax
jmp 0x50c49a
or ecx, 0xffffffff
mov dword [edi + 0x14], ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
movzx eax, byte [edi + 0x2c]
push 0x11
setns cl
and al, 0xfd
dec cl
and cl, 2
or al, cl
mov byte [edi + 0x2c], al
call esi
mov esi, dword [esp + 0x18]
test ax, ax
movzx eax, byte [edi + 0x2c]
mov ebx, esi
sets dl
mov dword [edi + 0x44], esi
shr ebx, 0x10
or al, dl
mov cx, bx
shr cx, 0xd
shl cl, 2
xor cl, al
movzx eax, byte [edi + 0x2c]
and al, 0xfe
and cl, 4
or al, dl
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [edi + 0x2c], cl
mov dword [edi + 0x40], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
shr ebx, 0xe
and bl, 1
mov dword [edi + 0x10], eax
mov byte [edi + 0x48], bl
pop edi
pop esi
pop ebx
ret
Function at 0x5100f0
Capabilities:
Log keystrokes

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, dx
nop dword [eax]
cmp dword [eax*8 + 0x8b0c78], ecx
je 0x510310
inc eax
cmp eax, 0x4d
jb 0x510100
lea eax, [ecx - 0xd]
cmp eax, 0xd5
ja case.0x510128.14
movzx eax, byte [eax + 0x510360]
jmp dword [eax*4 + 0x51032c]
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
xor edx, edx
shr ecx, 0x10
test cx, cx
mov ecx, dword [esp + 0xc]
cmovs eax, edx
test ecx, ecx
je 0x510150
mov word [ecx], ax
xor ecx, ecx
cmp eax, 0xff
cmovle ecx, eax
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510177
shr eax, 0x10
test eax, 0x100
jne 0x510177
mov ecx, 0x17c
mov eax, ecx
ret
mov ecx, 0x16e
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510199
shr eax, 0x10
test eax, 0x100
jne 0x510199
mov ecx, 0x17d
mov eax, ecx
ret
mov ecx, 0x16f
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5101bb
shr eax, 0x10
test eax, 0x100
jne 0x5101bb
mov ecx, 0x17e
mov eax, ecx
ret
mov ecx, 0x138
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5101dd
shr eax, 0x10
test eax, 0x100
jne 0x5101dd
mov ecx, 0x177
mov eax, ecx
ret
mov ecx, 0x139
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5101ff
shr eax, 0x10
test eax, 0x100
jne 0x5101ff
mov ecx, 0x178
mov eax, ecx
ret
mov ecx, 0x13a
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510221
shr eax, 0x10
test eax, 0x100
jne 0x510221
mov ecx, 0x179
mov eax, ecx
ret
mov ecx, 0x13b
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510243
shr eax, 0x10
test eax, 0x100
jne 0x510243
mov ecx, 0x17a
mov eax, ecx
ret
mov ecx, 0x13c
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510265
shr eax, 0x10
test eax, 0x100
jne 0x510265
mov ecx, 0x17b
mov eax, ecx
ret
mov ecx, 0x13d
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x510287
shr eax, 0x10
test eax, 0x100
jne 0x510287
mov ecx, 0x180
mov eax, ecx
ret
mov ecx, 0x142
mov eax, ecx
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x5102a6
shr eax, 0x10
mov ecx, 0x181
test eax, 0x100
je 0x5102ab
mov ecx, 0x7f
mov eax, dword [esp + 0xc]
test eax, eax
je 0x51030d
mov edx, 0x7f
mov word [eax], dx
mov eax, ecx
ret
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
shr ecx, 0x10
and ecx, 0x100
neg ecx
sbb ecx, ecx
and ecx, 0x165
add ecx, 0xd
test eax, eax
je 0x51030d
mov edx, 0xd
mov word [eax], dx
mov eax, ecx
ret
cmp dx, 0x30
jb 0x5102f7
cmp dx, 0x39
jbe 0x510302
lea eax, [edx - 0x41]
cmp ax, 0x19
jbe 0x510302
xor ecx, ecx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x51030d
mov word [eax], dx
mov eax, ecx
ret
mov eax, dword [eax*8 + 0x8b0c7c]
cmp eax, 0x12c
jge 0x510329
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x510329
mov word [ecx], ax
ret