joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180258050
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1802580cc
cmp byte [rcx], 0
je 0x1802580cc
mov r8d, dword [0x180ae3ad0]
mov rdx, qword [0x180ae3ac8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x1802580cc
cmp rdi, qword [0x180ae3ad0]
jbe 0x1802580ba
mov rcx, qword [0x180ae3ac8]
mov edx, edi
call fcn.1802562c0
test rax, rax
je 0x1802580cc
mov r8d, edi
mov qword [0x180ae3ac8], rax
mov rdx, rax
mov qword [0x180ae3ad0], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x180ae3ac8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x18025fa10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x40], 0
mov r10, rdx
mov r9, rbx
mov rdx, qword [rcx + 0x48]
mov rax, rdx
neg rax
mov qword [rbx + 0x68], r8
lea rax, [rsp + 0x40]
sbb ecx, ecx
mov qword [rsp + 0x28], rax
and ecx, 0x10000
mov dword [rsp + 0x20], ecx
xor ecx, ecx
test r10, r10
je 0x18025fa5e
lea r8, [0x18025f9f0]
call r10
jmp 0x18025fa6b
lea r8, [0x18025f9f0]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x18025fa85
lea rcx, str.Not_enough_resources_to_create_thread
add rsp, 0x30
pop rbx
jmp fcn.18020d1d0
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180260680
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp dword [0x180ae3bc4], 0
jne 0x1802606c7
xor r8d, r8d
mov dword [0x180ae3bc4], 1
lea rdx, [0x1802607c0]
lea rcx, str.SDL_TIMER_RESOLUTION
call fcn.180232ff0
lea rcx, [0x180ae3bd0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [0x180ae3bc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x180ae3bc8]
imul rax, rax, 0x3e8
cqo
idiv qword [0x180ae3bd0]
add rsp, 0x28
ret

Function at 0x180269090
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r10, rdx
mov r9d, r11d
test r8, r8
je 0x18026914a
mov qword [rsp], rbx
mov ebx, 0xff000000
nop
movzx edx, byte [r10 + r9]
movzx eax, cl
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr ecx, 7
shr edx, 1
xor eax, edx
xor ecx, eax
shr ecx, 1
test al, 1
mov eax, 0x12b88320
cmovne eax, ebx
inc r9
xor ecx, eax
cmp r9, r8
jb 0x1802690b0
mov rbx, qword [rsp]
mov eax, ecx
add rsp, 8
ret
Function at 0x18026dc10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180ae3d08], 0
jne 0x18026dde1
lea rcx, str.hid.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180ae3d00], rax
test rax, rax
je 0x18026ddfd
lea rdx, str.HidD_GetAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3ca0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetSerialNumberString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3ca8], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetManufacturerString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cb0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetProductString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cb8], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_SetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cc0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cc8], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetIndexedString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cd0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_GetPreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cd8], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_FreePreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3ce0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidP_GetCaps
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3ce8], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_SetNumInputBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cf0], rax
test rax, rax
je 0x18026dde8
mov rcx, qword [0x180ae3d00]
lea rdx, str.HidD_SetOutputReport
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae3cf8], rax
test rax, rax
je 0x18026dde8
mov byte [0x180ae3d08], 1
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x180ae3d00]
test rax, rax
je 0x18026ddfd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x180ae3d00], 0
mov eax, 0xffffffff
mov byte [0x180ae3d08], 0
add rsp, 0x28
ret
Function at 0x180273da0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rdx
movzx r10d, cx
test r8, r8
je 0x180273ea9
nop dword [rax + rax]
movzx r9d, r10b
xor r9b, byte [rbx + r11]
movzx eax, r9b
and al, 1
neg al
sbb cx, cx
shr r9b, 1
and cx, 0xa001
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, 0xa001
shr r9b, 1
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, 0xa001
shr r9b, 1
xor cx, dx
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, 0xa001
shr r9b, 1
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, 0xa001
shr r9b, 1
xor cx, dx
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
shr r9b, 1
and dx, 0xa001
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr r9b, 1
and cx, 0xa001
shr dx, 1
xor cx, dx
xor r9b, cl
and r9b, 1
neg r9b
sbb ax, ax
shr cx, 1
and ax, 0xa001
shr r10w, 8
xor ax, cx
inc r11
xor r10w, ax
cmp r11, r8
jb 0x180273dc0
mov rbx, qword [rsp + 8]
movzx eax, r10w
ret

Function at 0x180273ec0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
mov ebx, eax
cmp qword [0x180ae1ca8], rdi
jne 0x180211c58
lea rcx, [0x180ae1ca4]
call fcn.18021bc60
cmp qword [0x180ae1ca8], rdi
jne 0x180211c4c
call fcn.180246cc0
nop
mov qword [0x180ae1ca8], rax
test rax, rax
jne 0x180211c4c
lea rcx, [0x180ae1ca4]
call fcn.18021bcc0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x180ae1ca4]
call fcn.18021bcc0
nop
mov rcx, qword [0x180ae1ca8]
call fcn.180246dc0
mov rax, qword [0x180ae1cb0]
test rax, rax
je 0x180211c84
cmp dword [rax], ebx
je 0x180211c80
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180211c71
jmp 0x180211c84
mov rdi, qword [rax + 8]
mov rcx, qword [0x180ae1ca8]
call fcn.180246de0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x180ab8380], 0xffffffff
jne 0x180273f1e
cmp dword [0x180ae3d10], 0
jne case.default.0x180273f3b
lea rcx, [0x180ae3d14]
call fcn.18021bc60
cmp dword [0x180ab8380], 0xffffffff
jne 0x180273f12
cmp dword [0x180ae3d10], 0
jne 0x180273f12
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x180273f08
nop
mov dword [0x180ab8380], eax
jmp 0x180273f12
mov dword [0x180ae3d10], 1
lea rcx, [0x180ae3d14]
call fcn.18021bcc0
cmp dword [0x180ae3d10], 0
je 0x180273f30
add rsp, 0x28
jmp 0x180211bf0
nop
mov ecx, dword [0x180ab8380]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
invalid
Function at 0x180273f50
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x180ae1ca8]
mov edi, eax
call fcn.180246dc0
mov rbx, qword [0x180ae1cb0]
xor edx, edx
test rbx, rbx
je 0x180211ce3
cmp dword [rbx], edi
je 0x180211d2b
mov rdx, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180211cd3
mov ecx, 0x18
call fcn.180256280
mov rbx, rax
test rax, rax
je 0x180211d34
mov rcx, qword [0x180ae1ca8]
mov dword [rax], edi
mov qword [rax + 8], rsi
mov rax, qword [0x180ae1cb0]
mov qword [rbx + 0x10], rax
mov qword [0x180ae1cb0], rbx
call fcn.180246de0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x180211d5b
mov qword [rbx + 8], rsi
mov rcx, qword [0x180ae1ca8]
call fcn.180246de0
test rbx, rbx
jne 0x180211d19
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18020d0f0
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x180211d72
mov rcx, rbx
mov qword [rdx + 0x10], rax
call fcn.180256250
jmp 0x180211d34
mov rcx, rbx
mov qword [0x180ae1cb0], rax
call fcn.180256250
jmp 0x180211d34
sub rsp, 0x28
cmp dword [0x180ae3d10], 0
je 0x180273f66
add rsp, 0x28
jmp 0x180211ca0
mov rdx, rcx
mov ecx, dword [0x180ab8380]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x180273f89
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.18020d1d0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1802754a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
movzx ebp, word [rcx + 0x160]
mov esi, r8d
mov r15, rdx
mov rdi, rcx
mov edx, esi
mov rcx, r15
xor r9d, r9d
xor r8d, r8d
call sub.IMM32.dll_ImmGetCompositionStringW
movsxd rbx, eax
test eax, eax
jle 0x180275508
cmp dword [rdi + 0xe0], ebx
jge 0x180275508
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1802754f2
call fcn.180256250
lea rcx, [rbx + 2]
call fcn.180256280
mov qword [rdi + 0xd8], rax
mov dword [rdi + 0xe0], ebx
mov r9d, dword [rdi + 0xe0]
mov edx, esi
mov r8, qword [rdi + 0xd8]
mov rcx, r15
call sub.IMM32.dll_ImmGetCompositionStringW
xor ebx, ebx
mov edx, 0x80
test eax, eax
mov ecx, ebx
cmovns ecx, eax
xor r9d, r9d
movsxd rsi, ecx
xor r8d, r8d
mov rcx, r15
shr rsi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx ecx, ax
lea eax, [rbp - 0x404]
mov dword [rdi + 0x104], ecx
test eax, 0xfffffbff
jne 0x1802755ac
test ecx, ecx
je 0x1802755ac
movsxd rax, dword [rdi + 0xe0]
shr rax, 1
cmp ecx, eax
jge 0x1802755ac
mov rax, qword [rdi + 0xd8]
movzx edx, word [rax]
mov eax, 0x3000
cmp dx, ax
je 0x180275584
cmp dx, 0x20
jne 0x1802755ac
lea edx, [rcx + 1]
movsxd r8, esi
cmp rdx, r8
jge 0x1802755aa
nop
mov rax, qword [rdi + 0xd8]
lea rcx, [rax + rdx*2]
inc rdx
movzx eax, word [rcx]
mov word [rcx - 2], ax
cmp rdx, r8
jl 0x180275590
dec esi
mov rax, qword [rdi + 0xd8]
movsxd rcx, esi
mov word [rax + rcx*2], bx
cmp dword [rdi + 0x104], ebx
jne 0x180275664
test esi, esi
jle 0x180275664
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov edx, 0x10
mov rcx, r15
call sub.IMM32.dll_ImmGetCompositionStringW
movsxd r14, eax
test eax, eax
jle 0x180275659
lea rcx, [r14 + 2]
call fcn.180256280
mov r9d, r14d
mov r8, rax
mov edx, 0x10
mov rcx, r15
mov rbp, rax
call sub.IMM32.dll_ImmGetCompositionStringW
test r14d, r14d
jle 0x180275629
mov rdx, rbx
movzx ecx, byte [rdx + rbp]
dec cl
test cl, 0xfd
je 0x180275629
inc ebx
inc rdx
cmp rdx, r14
jl 0x180275614
movsxd rax, ebx
mov edx, ebx
cmp rax, r14
jge 0x180275648
movzx ecx, byte [rax + rbp]
dec cl
test cl, 0xfd
jne 0x180275648
inc edx
inc rax
cmp rax, r14
jl 0x180275633
cmp ebx, r14d
mov rcx, rbp
cmove edx, r14d
mov ebx, edx
call fcn.180256250
mov r14, qword [rsp + 0x40]
mov dword [rdi + 0x104], ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x180276330
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, word [rcx + 0x160]
mov rbx, rcx
mov esi, 0x3ff
xor ecx, ecx
and edi, esi
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [rbx + 0x160]
xor edx, edx
cmp rax, rcx
je 0x180276393
movzx ecx, ax
mov qword [rbx + 0x160], rax
and cx, si
cmp cx, 0x12
je 0x180276388
mov ecx, 0x804
cmp ax, cx
mov ecx, 1
jne 0x18027638a
mov ecx, edx
mov dword [rbx + 0x12c], ecx
mov rcx, rax
cmp dword [rbx + 0x1a0], edx
jne 0x1802763ac
mov eax, 0xe0060404
cmp rcx, rax
setne dl
mov dword [rbx + 0x128], edx
mov rcx, rbx
call fcn.180276680
movzx eax, word [rbx + 0x160]
and eax, esi
cmp edi, eax
je 0x1802763c9
mov rcx, rbx
call fcn.1802751a0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1802767e0
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp rax, qword [rbx + 0x160]
je 0x180276835
movzx edx, ax
mov qword [rbx + 0x160], rax
mov ecx, 0x3ff
and dx, cx
cmp dx, 0x12
je 0x18027682d
mov ecx, 0x804
cmp ax, cx
je 0x18027682d
mov eax, 1
mov dword [rbx + 0x12c], eax
add rsp, 0x20
pop rbx
ret
xor eax, eax
mov dword [rbx + 0x12c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x1802769c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rdi, qword [rcx + 0x5f8]
xor ebx, ebx
mov ecx, 0x42
mov dword [rdi + 0x98], ebx
mov qword [rdi + 0xa0], rbx
mov qword [rdi + 0xa8], rbx
mov dword [rdi + 0xb0], ebx
mov qword [rdi + 0xb8], rbx
mov qword [rdi + 0xc0], rbx
mov qword [rdi + 0xd0], rbx
mov dword [rdi + 0xe0], 0x40
call fcn.180256280
mov qword [rdi + 0xd8], rax
lea rcx, [rdi + 0x134]
xor edx, edx
mov r8d, 0x10
mov word [rax], bx
mov word [rdi + 0xe4], bx
mov qword [rdi + 0x104], rbx
mov qword [rdi + 0x110], rbx
mov qword [rdi + 0x118], rbx
mov qword [rdi + 0x120], rbx
mov dword [rdi + 0x128], ebx
mov qword [rdi + 0x12c], 1
call fcn.180259560
lea rcx, [rdi + 0x144]
xor edx, edx
mov r8d, 0x10
call fcn.180259560
lea rcx, [rsp + 0x20]
mov qword [rdi + 0x154], rbx
mov qword [rdi + 0x160], rbx
mov qword [rdi + 0x168], rbx
mov qword [rdi + 0x170], rbx
mov qword [rdi + 0x178], rbx
mov qword [rdi + 0x180], rbx
mov qword [rdi + 0x188], rbx
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], rbx
mov dword [rdi + 0x1a0], ebx
mov qword [rdi + 0x1a8], rbx
mov qword [rdi + 0x1b0], 0xffffffffffffffff
mov qword [rdi + 0x1b8], 0xffffffffffffffff
mov qword [rdi + 0x1c0], rbx
mov qword [rdi + 0x1c8], rbx
call fcn.18023abb0
lea rsi, [0x1803cbbd0]
movsxd rax, dword [rsi]
test eax, eax
je 0x180276b50
lea rdi, [rsp + 0x20]
test dword [rdi + rax*4], 0x40000000
lea rdi, [rdi + rax*4]
jne 0x180276b50
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x180276b50
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x180276b50
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x180276b4e
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x180276b05
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x200
xor ecx, ecx
call fcn.18023bc20
lea rdx, str.Menu
mov ecx, 0x65
call fcn.18023bdd0
lea rdx, str.Left_Windows
mov ecx, 0xe3
call fcn.18023bdd0
lea rdx, str.Right_Windows
mov ecx, 0xe7
call fcn.18023bdd0
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x2000
mov edx, eax
call fcn.18023bdf0
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x1000
mov edx, eax
call fcn.18023bdf0
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x8000
mov edx, eax
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
jmp fcn.18023bdf0
Function at 0x180276c90
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x150
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
mov ecx, 0x20
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test eax, eax
je 0x180276d0e
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rsi
xor esi, esi
mov ebx, esi
nop dword [rax + rax]
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
mov edx, edi
mov ecx, 0x20
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jg 0x180276cfe
inc ebx
cmp ebx, 5
jl 0x180276cd0
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x180276fa0
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
sub rsp, 0x820
mov ebp, ecx
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 0x10], rsi
call fcn.18023abb0
xor ebx, ebx
mov qword [rsp + 0x840], rdi
lea rsi, [0x1803cbbd0]
movsxd rax, dword [rsi]
test eax, eax
je 0x18027701b
lea rdi, [rsp + 0x20]
test dword [rdi + rax*4], 0x40000000
lea rdi, [rdi + rax*4]
jne 0x18027701b
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x18027701b
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x18027701b
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x180277019
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x180276fd0
mov rdi, qword [rsp + 0x840]
lea rdx, [rsp + 0x20]
mov rsi, qword [rsp + 0x838]
mov r9d, ebp
mov rbx, qword [rsp + 0x830]
mov r8d, 0x200
xor ecx, ecx
call fcn.18023bc20
add rsp, 0x820
pop rbp
ret
Function at 0x180278e00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
lea rax, [rbp + 0x77]
movd xmm6, ecx
lea rdx, str.Control_PanelMouse
cvtdq2ps xmm6, xmm6
mov r9d, 0x20019
mov dword [rbp + 0x6f], 3
xor r8d, r8d
mov dword [rbp + 0x67], 0x28
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
divss xmm6, dword [0x180425e78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180278fdf
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x6f]
lea rax, [rbp + 0x1f]
xor r8d, r8d
lea rdx, str.SmoothMouseXCurve
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180278fd5
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x1f]
call fcn.180278580
test eax, eax
je 0x180278fd5
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x6f]
lea rax, [rbp + 0x1f]
xor r8d, r8d
lea rdx, str.SmoothMouseYCurve
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180278fd5
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x1f]
call fcn.180278580
test eax, eax
je 0x180278fd5
movss xmm2, dword [rbp - 0x39]
xorps xmm0, xmm0
comiss xmm2, xmm0
jbe 0x180278f0b
movss xmm1, dword [rbp - 0x21]
divss xmm1, xmm2
mulss xmm1, xmm6
jmp 0x180278f0e
xorps xmm1, xmm1
movss xmm3, dword [rbp - 0x35]
comiss xmm3, xmm0
movss dword [rbp - 9], xmm2
movss xmm2, dword [0x1803cd1fc]
divss xmm1, xmm2
movss dword [rbp - 5], xmm1
jbe 0x180278f3d
movss xmm1, dword [rbp - 0x1d]
divss xmm1, xmm3
mulss xmm1, xmm6
jmp 0x180278f40
xorps xmm1, xmm1
divss xmm1, xmm2
movss dword [rbp - 1], xmm3
movss xmm3, dword [rbp - 0x31]
comiss xmm3, xmm0
movss dword [rbp + 3], xmm1
jbe 0x180278f67
movss xmm1, dword [rbp - 0x19]
divss xmm1, xmm3
mulss xmm1, xmm6
jmp 0x180278f6a
xorps xmm1, xmm1
divss xmm1, xmm2
movss dword [rbp + 7], xmm3
movss xmm3, dword [rbp - 0x2d]
comiss xmm3, xmm0
movss dword [rbp + 0xb], xmm1
jbe 0x180278f91
movss xmm1, dword [rbp - 0x15]
divss xmm1, xmm3
mulss xmm1, xmm6
jmp 0x180278f94
xorps xmm1, xmm1
divss xmm1, xmm2
movss dword [rbp + 0xf], xmm3
movss xmm3, dword [rbp - 0x29]
comiss xmm3, xmm0
movss dword [rbp + 0x13], xmm1
jbe 0x180278fb9
movss xmm0, dword [rbp - 0x11]
divss xmm0, xmm3
mulss xmm0, xmm6
divss xmm0, xmm2
lea rdx, [rbp - 9]
mov ecx, 0xa
movss dword [rbp + 0x17], xmm3
movss dword [rbp + 0x1b], xmm0
call fcn.180246300
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbp
ret
Function at 0x180289250
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
cmp dword [0x180ae3e40], 0
je 0x1802892c0
xor r9d, r9d
lea r8, [rsp + 0x22]
lea r10, [0x1803d3a18]
mov edx, 1
movzx eax, word [r10]
inc r9d
mov word [r8], ax
lea r10, [r10 + 2]
mov word [r8 - 2], dx
mov dword [r8 + 2], 0x2100
mov qword [r8 + 6], rcx
lea r8, [r8 + 0x10]
cmp r9d, edx
jb 0x180289271
mov r8d, 0x10
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1802892c0
lea rcx, str.Couldnt_register_for_raw_input_events
call fcn.18020d1d0
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1802893f0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
cmp dword [0x180ae3e40], 0
je 0x180289468
xor r10d, r10d
lea rax, [rsp + 0x22]
mov r8d, r10d
lea r9, [0x1803d3a18]
mov edx, 1
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r9]
inc r8d
mov word [rax], cx
lea r9, [r9 + 2]
mov word [rax - 2], dx
mov dword [rax + 2], edx
mov qword [rax + 6], r10
lea rax, [rax + 0x10]
cmp r8d, edx
jb 0x180289420
mov r8d, 0x10
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x180289468
lea rcx, str.Couldnt_unregister_for_raw_input_events
call fcn.18020d1d0
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1802b51c0
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
sub rsp, 0x28
cmp qword [0x180ae4098], 0
mov rbx, rdx
mov rbp, rcx
jne 0x1802b5209
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x180ae4098], rax
test rax, rax
je 0x1802b5209
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180ae4090], rax
jmp 0x1802b5210
mov rax, qword [0x180ae4090]
test rax, rax
jne 0x1802b5226
mov rdx, rbx
mov rcx, rbp
add rsp, 0x28
pop rbp
pop rbx
jmp 0x1802b5310
mov qword [rsp + 0x40], rsi
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x58]
xor edi, edi
xor r8d, r8d
mov ecx, 8
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
call rax
mov ecx, dword [rsp + 0x50]
add rcx, rcx
call fcn.180256280
mov rsi, rax
test rax, rax
jne 0x1802b527a
xor ecx, ecx
call fcn.18020d0f0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rbp
pop rbx
ret
lea r9, [rsp + 0x50]
mov r8, rsi
lea rdx, [rsp + 0x58]
mov ecx, 8
call qword [0x180ae4090]
test eax, eax
jne 0x1802b52a3
mov rdx, rbx
mov rcx, rbp
call 0x1802b5310
jmp 0x1802b52f1
mov ecx, dword [rsp + 0x50]
dec ecx
mov eax, ecx
cmp rbx, rax
cmovae ebx, ecx
mov ecx, edi
test ebx, ebx
je 0x1802b52eb
mov r9, rbp
mov r8, rdi
mov r10d, 0x5f
movzx edx, byte [r8 + rsi]
test dl, dl
jne 0x1802b52d2
mov edi, ecx
mov al, 0x2c
jmp 0x1802b52db
cmp dl, 0x2d
mov eax, edx
cmove eax, r10d
mov byte [r9], al
inc ecx
inc r9
add r8, 2
cmp ecx, ebx
jb 0x1802b52c3
mov eax, edi
mov byte [rax + rbp], 0
mov rcx, rsi
call fcn.180256250
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rbp
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
lea r8, [rsp + 0x40]
mov rsi, rcx
mov edx, 0x59
mov ecx, 0x400
mov r9d, 0x10
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov r9d, 0x10
lea r8, [rsp + 0x30]
mov edx, 0x5a
mov ecx, 0x400
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edx, eax
test ebx, ebx
jne 0x1802b537f
lea rcx, [0x1803dc430]
call fcn.18020d1d0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
test edx, edx
lea rcx, [0x1803ffa55]
lea r8, [0x18040094c]
mov rdx, rdi
lea rax, [rsp + 0x30]
cmove rax, rcx
lea r9, [rsp + 0x40]
cmovne rcx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, str._s_s_s
mov rcx, rsi
call fcn.18020f1e0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret