joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400115be
Capabilities:
Execute command

Disassembly:
jmp 0x14001d520
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x14003811b]
call fcn.14001190b
nop
mov r8, qword [rbp + 0x230]
lea rdx, str._ngit_clone___depth_1__
lea rcx, [rbp + 0x128]
call fcn.140011064
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x1e0], rax
lea r8, [0x14002aa8c]
mov rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x168]
call fcn.140011848
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov qword [rbp + 0x1f0], rax
mov r8, qword [rbp + 0x238]
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1a8]
call fcn.1400112e9
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
lea r8, [0x14002aa88]
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 8]
call fcn.140011848
nop
lea rcx, [rbp + 0x1a8]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x168]
call fcn.1400111a9
nop
lea rcx, [rbp + 0x128]
call fcn.1400111a9
nop
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011825
nop
lea rcx, [rbp + 8]
call fcn.1400110e6
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x14001d6a7
lea rdx, str.Datei_erfolgreich_heruntergeladen:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001110e
mov rdx, qword [rbp + 0x238]
mov rcx, rax
call fcn.140011825
mov qword [rbp + 0x1d8], rax
lea rdx, [0x14001105a]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x14001d6d6
lea rdx, str.Fehler_beim_Herunterladen_der_Datei.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
mov qword [rbp + 0x1d8], rax
lea rdx, [0x14001105a]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 8]
call fcn.1400111a9
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400297c0]
call fcn.14001178f
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.14001144c
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret
Function at 0x140011640
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021880
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400218a0
xor al, al
jmp 0x140021921
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400218b3
xor al, al
jmp 0x140021921
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400218dd
xor al, al
jmp 0x140021921
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400218f1
xor al, al
jmp 0x140021921
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021903
xor al, al
jmp 0x140021921
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002191f
xor al, al
jmp 0x140021921
mov al, 1
add rsp, 0x38
ret

Function at 0x14001164a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14001d900
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x14003811b]
call fcn.14001190b
nop
xor edx, edx
mov ecx, 2
call fcn.14001142e
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001d965
xor eax, eax
jmp 0x14001d9c2
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001157d
test eax, eax
je 0x14001d9b5
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x420]
call fcn.1400112df
movzx eax, al
test eax, eax
je 0x14001d9a4
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x38]
jmp 0x14001d9c2
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400117ee
test eax, eax
jne 0x14001d97d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140029420]
call fcn.14001178f
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14001144c
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x14001f6b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001195b
movzx eax, al
test eax, eax
jne 0x14001f6d0
mov ecx, 7
call fcn.14001179e
nop
mov byte [rsp + 0x20], 0
call fcn.1400117df
mov byte [rsp + 0x21], al
cmp dword [0x140030b78], 1
jne 0x14001f6f4
mov ecx, 7
call fcn.14001179e
nop
jmp 0x14001f74c
cmp dword [0x140030b78], 0
jne 0x14001f747
mov dword [0x140030b78], 1
lea rdx, [0x140028660]
lea rcx, [0x140028330]
call fcn.140011429
test eax, eax
je 0x14001f728
mov eax, 0xff
jmp 0x14001f851
lea rdx, [0x140028220]
lea rcx, [section..rdata]
call fcn.1400117cb
mov dword [0x140030b78], 2
jmp 0x14001f74c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011780
call fcn.14001167c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001f7a9
mov rcx, qword [rsp + 0x30]
call fcn.140011366
movzx eax, al
test eax, eax
je 0x14001f7a9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140039020]
nop
call fcn.1400116e5
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001f7dd
mov rcx, qword [rsp + 0x38]
call fcn.140011366
movzx eax, al
test eax, eax
je 0x14001f7dd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400118d9
nop
call fcn.14001f900
mov dword [rsp + 0x28], eax
call fcn.140011640
movzx eax, al
test eax, eax
jne 0x14001f7fc
mov ecx, dword [rsp + 0x28]
call fcn.1400110be
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001f80b
call fcn.1400118f7
nop
xor edx, edx
mov cl, 1
call fcn.140011311
mov eax, dword [rsp + 0x28]
jmp 0x14001f851
add rsp, 0x68
ret
Function at 0x14001196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140018098]
test rax, rax
je 0x1400119b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400119b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400119b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400119b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400119b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400119b8
xor al, al
add rsp, 0x28
ret

Function at 0x1400160a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400160c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400160c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400016a4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [0x140006080], 0
jne 0x140001769
movups xmm0, xmmword [0x1400045b0]
movzx eax, word [0x1400045d8]
lea r9, [0x140006080]
movups xmm1, xmmword [0x1400045c0]
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
lea r8, [0x140006088]
mov edx, 0x80
movsd xmm0, qword [0x1400045d0]
lea rcx, [rsp + 0x20]
movsd qword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x20], 0x2a0028
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov r9, qword [0x140006080]
lea rcx, [0x1400045e0]
mov r8, qword [0x140006088]
mov edx, eax
mov ebx, eax
call sub.ntoskrnl.exe_DbgPrint
test ebx, ebx
je 0x14000174f
xor al, al
jmp 0x14000176b
mov rcx, qword [0x140006088]
test rcx, rcx
je 0x140001769
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [0x140006088], 0
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140004000
add rsp, 0x70
pop rbx
ret

Function at 0x140002510
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
call fcn.1400038a0
lea r9, [rsp + 0x40]
mov rdx, rbx
lea r8, [rsp + 0x78]
mov rcx, rdi
call fcn.1400028f0
xor edi, edi
mov ebx, eax
test eax, eax
js 0x140002678
mov rax, qword [0x140006468]
lea rcx, [0x140006fd0]
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8d, 0x20019
mov rcx, qword [0x140006d38]
call qword [0x1400051d0]
mov ebx, eax
test eax, eax
js 0x140002678
xor ecx, ecx
lea r8, [0x140007030]
lea edx, [rdi + 2]
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
mov ebx, eax
test eax, eax
js 0x140002678
lea rax, [0x140007020]
mov qword [0x140007010], rdi
mov qword [0x140007028], rax
lea rcx, [0x140006fe0]
mov qword [0x140007020], rax
xor r8d, r8d
lea rax, [0x140007000]
mov qword [0x140006ff8], rdi
xor edx, edx
mov qword [0x140007008], rax
mov qword [0x140007000], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rax, qword [0x1400061a8]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x140006d38]
call qword [0x1400051d0]
mov rcx, rax
mov qword [0x140006fd8], rax
call fcn.140002c8c
mov ebx, eax
test eax, eax
js 0x140002678
lea rax, [0x1400020d0]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
js 0x140002678
mov rcx, qword [rsp + 0x70]
lea rax, [0x140006fa0]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x140002697
cmp qword [0x140006fc8], rdi
je 0x140002686
call fcn.140002e64
mov rcx, qword [0x140007030]
test rcx, rcx
je 0x140002697
call sub.fwpkclnt.sys_FwpsInjectionHandleDestroy0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400026a4
Capabilities:
Register network filter via wfp api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r15, qword [rbp + 0xe0]
mov r12, r8
mov rbx, qword [rbp + 0xe8]
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x20]
mov r14, r9
call fcn.140004200
xor edx, edx
lea rcx, [rbp - 0x10]
lea r8d, [rdx + 0x78]
call fcn.140004200
movups xmm0, xmmword [r15]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rsp + 0x38], rsi
mov dword [rbp - 0x60], 0x5003
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x48], r14
movdqu xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rbx]
movdqu xmmword [rbp - 0x5c], xmm0
movups xmm0, xmmword [0x140005280]
movdqu xmmword [rsp + 0x70], xmm0
test r12, r12
je 0x1400027e4
movups xmm0, xmmword [0x140005360]
mov rax, qword [r15]
cmp rax, qword [0x140005320]
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0xa
jne 0x14000277a
mov rax, qword [r15 + 8]
cmp rax, qword [0x140005328]
je 0x1400027c5
mov rax, qword [r15]
cmp rax, qword [0x140005310]
jne 0x140002793
mov rax, qword [r15 + 8]
cmp rax, qword [0x140005318]
je 0x1400027c5
mov rax, qword [r15]
cmp rax, qword [0x1400052f0]
jne 0x1400027ac
mov rax, qword [r15 + 8]
cmp rax, qword [0x1400052f8]
je 0x1400027c5
mov rax, qword [r15]
cmp rax, qword [0x140005300]
jne 0x1400027d3
mov rax, qword [r15 + 8]
cmp rax, qword [0x140005308]
jne 0x1400027d3
mov eax, dword [r12]
mov dword [rbp + 0x10], eax
mov eax, 3
jmp 0x1400027dc
mov qword [rbp + 0x10], r12
mov eax, 0xb
mov dword [rbp + 8], eax
mov eax, 1
mov rcx, qword [0x140006fc8]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov dword [rbp - 0x70], eax
xor r8d, r8d
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140004000
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x41d6d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call fcn.00430780
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.0042fa20
xor edx, edx
cmp eax, 2
je 0x41d720
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.00430780
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x41d708
Function at 0x41daa0
Capabilities:
Write clipboard data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rbx, qword [rcx + 0x7f8]
test rbx, rbx
jne 0x41dacd
jmp 0x41dcb6
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x41dcb6
cmp dword [rbx], 0x1f
jne 0x41dac0
mov r9, qword [rbx + 8]
xor edx, edx
test r9, r9
je 0x41dcec
movsxd r8, dword [r9 + 8]
mov rax, qword [r9]
add edx, r8d
add r8, rax
cmp rax, r8
jae 0x41db06
xor ecx, ecx
cmp byte [rax], 0xa
sete cl
add rax, 1
add edx, ecx
cmp rax, r8
jne 0x41daf3
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x41dae1
lea ecx, [rdx + 1]
mov rsi, qword [0x00670bd0]
mov rax, qword [rsi]
call qword [rax + 0x28]
mov rdi, rax
mov rax, qword [rbx + 8]
mov r11, rdi
test rax, rax
je 0x41db83
nop
movsxd rbx, dword [rax + 8]
mov r8, qword [rax]
add rbx, r8
cmp r8, rbx
jb 0x41db51
jmp 0x41db7a
add r8, 1
lea r11, [r9 + 1]
mov byte [r9], r10b
cmp r8, rbx
je 0x41db7a
movzx r10d, byte [r8]
mov r9, r11
cmp r10b, 0xa
jne 0x41db41
mov byte [r11], 0xd
movzx r10d, byte [r8]
add r8, 1
add r9, 1
cmp r8, rbx
lea r11, [r9 + 1]
mov byte [r9], r10b
jne 0x41db51
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x41db30
mov byte [r11], 0
lea rbp, [rsp + 0x20]
call fcn.0042fa20
cmp eax, 2
mov rax, qword [rsi]
je 0x41dc27
mov r9, rbp
mov r8d, 0xffffffff
mov rdx, rdi
xor ecx, ecx
call qword [rax + 0xa78]
mov rax, qword [rsi]
mov rcx, rdi
call qword [rax + 0x30]
mov edx, dword [rsp + 0x28]
mov ecx, 0x2002
add edx, 1
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x41dcd3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add r8d, 1
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsi]
mov rcx, rbp
call qword [rax + 0x3d0]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
nop
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call qword [rax + 0x3e0]
mov rax, qword [rsi]
mov r8, rbp
mov edx, 0xffffffff
mov rcx, rdi
call qword [rax + 0xb28]
mov rax, qword [rsi]
mov rcx, rdi
call qword [rax + 0x30]
mov edx, dword [rsp + 0x28]
mov ecx, 0x2002
add edx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x41dcd3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add r8d, 2
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsi]
mov rcx, rbp
call qword [rax + 0x3d0]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
nop
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rsi, qword [0x00670bd0]
mov ecx, 1
mov rax, qword [rsi]
call qword [rax + 0x28]
mov r11, rax
mov rdi, rax
jmp 0x41db83
mov rax, qword [rsi]
mov rcx, rbp
call qword [rax + 0x3d0]
nop
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 1
jmp 0x41db12

Function at 0x41dd00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, qword [rcx + 0x28]
mov rcx, qword [rax + 8]
jmp fcn.0041d6d0
Function at 0x424c50
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
movsx ebx, ax
mov ecx, 0x11
shr ebx, 0x1f
call rsi
mov edx, ebx
mov ecx, 0x12
or edx, 4
test ax, ax
cmovs ebx, edx
call rsi
mov edx, ebx
mov ecx, 0x14
or edx, 0x20000
test ax, ax
cmovs ebx, edx
call rsi
mov edx, ebx
mov ecx, 0x90
or edx, 2
test al, 1
cmovne ebx, edx
call rsi
mov edx, ebx
mov ecx, 0x91
or edx, 8
test al, 1
cmovne ebx, edx
call rsi
mov edx, ebx
mov ecx, 1
or edx, 0x20
test al, 1
cmovne ebx, edx
call rsi
mov edx, ebx
mov ecx, 4
or dh, 1
test ax, ax
cmovs ebx, edx
call rsi
mov edx, ebx
mov ecx, 2
or dh, 2
test ax, ax
cmovs ebx, edx
call rsi
mov edx, ebx
or dh, 4
test ax, ax
cmovs ebx, edx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x42b500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x38
test byte [rcx + 0xf4], 2
mov rbx, qword [rcx + 0x138]
mov rsi, rcx
je 0x42b570
mov dword [rbx + 0xd4], edx
mov edx, dword [rbx + 0x158]
mov dword [rbx + 0xd8], r8d
mov eax, edx
and eax, 0xfffffff3
or al, 0x80
mov dword [rbx + 0x158], eax
mov eax, dword [rbx + 0x88]
test al, 5
jne 0x42b54c
or eax, 1
mov dword [rbx + 0x88], eax
test dl, 1
jne 0x42b564
and edx, 2
jne 0x42b5a0
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.00426980
add rsp, 0x38
pop rbx
pop rsi
ret
mov rax, qword [0x00670bd0]
mov dword [rsp + 0x2c], r8d
lea rcx, str.Tk_MoveToplevelWindow_called_with_non_toplevel_window
mov dword [rsp + 0x28], edx
mov rax, qword [rax]
call qword [rax + 0x20]
mov r8d, dword [rsp + 0x2c]
mov edx, dword [rsp + 0x28]
jmp 0x42b519
mov rax, qword [0x00670bd0]
mov rdx, rsi
lea rcx, [fcn.00426980]
mov rax, qword [rax]
call qword [rax + 0x290]
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.00426980

Function at 0x42c1c0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rsi, qword [0x00670bd0]
mov edx, 1
lea rbx, [rsp + 0x50]
mov rdi, rcx
mov rax, qword [rsi]
mov rcx, rbx
call qword [rax + 0x5b8]
mov rdx, qword [rdi]
mov rcx, rdi
mov r8, rbx
call fcn.00426750
mov edx, dword [rsp + 0x7c]
mov rax, qword [rsi]
lea ecx, [rdx*8 + 8]
call qword [rax + 0x28]
mov rdi, rax
movsxd rax, dword [rsp + 0x7c]
test eax, eax
je 0x42c2a2
cmp eax, 1
je 0x42c280
lea rax, [rdi + rax*8]
mov qword [rsp + 0x20], rbx
lea rcx, [0x004266e0]
lea rdx, [rax - 8]
mov qword [rsp + 0x28], rdx
mov qword [rax], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x42c2b0
lea rax, [rdi - 8]
cmp qword [rsp + 0x28], rax
je 0x42c265
mov rax, qword [rsi]
lea rcx, str.num_matched_toplevel_windows_does_not_equal_num_children
call qword [rax + 0x20]
mov rax, qword [rsi]
mov rcx, rbx
call qword [rax + 0x378]
mov rax, rdi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x498]
mov rax, qword [rax + 0x18]
mov qword [rdi + 8], 0
mov qword [rdi], rax
jmp 0x42c265
mov qword [rdi], 0
jmp 0x42c265
mov rax, qword [rsi]
mov rcx, rdi
xor edi, edi
call qword [rax + 0x30]
jmp 0x42c265
Function at 0x42fa20
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rdi
push rsi
sub rsp, 0x1b8
mov eax, dword [0x0069f2b4]
test eax, eax
je 0x42fa40
add rsp, 0x1b8
pop rsi
pop rdi
ret
mov dword [rsp + 0x40], 0x94
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [rsp + 0x50]
cmp eax, 2
mov dword [0x0069f2b4], eax
je 0x42fa80
mov dword [0x0069f2b0], 1
add rsp, 0x1b8
pop rsi
pop rdi
ret
cmp dword [rsp + 0x44], 5
jne 0x42fa62
cmp dword [rsp + 0x48], 1
jne 0x42fa62
lea rsi, [rsp + 0xe0]
xor eax, eax
mov ecx, 0x19
xor r8d, r8d
mov dword [rsp + 0x34], 0xc8
mov r9d, 0x20019
mov rdi, rsi
lea rdx, str.Control_PanelAppearance
rep stosq qword [rdi], rax
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42faeb
mov dword [0x0069f2b0], 2
mov eax, dword [0x0069f2b4]
jmp 0x42fa33
lea rax, [rsp + 0x34]
lea rdi, str.Windows_Standard
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.Current
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x11
repe cmpsb byte [rsi], byte [rdi]
jne 0x42fad6
mov dword [0x0069f2b0], 1
jmp 0x42fae0

Function at 0x42fb40
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [0x0069f308]
test eax, eax
je 0x42fb55
add rsp, 0x60
pop rbx
ret
mov rbx, rcx
mov dword [0x0069f308], 1
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0xff
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x42fca0
call fcn.0042fa20
lea rdx, [0x005f9880]
cmp eax, 2
lea rax, [0x005f98c0]
mov dword [0x0069f2c0], 3
mov dword [0x0069f2d0], 0
lea rcx, [0x0069f2c0]
cmove rax, rdx
mov dword [0x0069f2d4], 0
mov qword [0x0069f2d8], rbx
mov qword [0x006a2d70], rax
lea rax, str.TkChild
mov qword [0x0069f2f0], 0
mov qword [0x0069f2f8], 0
mov qword [0x0069f2e0], 0
mov qword [0x0069f300], rax
lea rax, [0x00431300]
mov qword [0x0069f2e8], 0
mov qword [0x0069f2c8], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x42fc84
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9d, 4
movzx ecx, ax
lea r8, [rsp + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42fc60
lea rcx, [0x0042f8f0]
mov rdx, rbx
call fcn.004059a0
nop
add rsp, 0x60
pop rbx
ret
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x42fc4a
mov ecx, dword [rsp + 0x40]
call fcn.0042f850
jmp 0x42fc4a
mov rax, qword [0x00670bd0]
lea rcx, str.Unable_to_register_TkChild_class
mov rax, qword [rax]
call qword [rax + 0x20]
jmp 0x42fc25
mov rax, qword [0x00670bd0]
lea rcx, str.Unable_to_load_common_controls__
mov rax, qword [rax]
call qword [rax + 0x20]
jmp 0x42fb85
Function at 0x430550
Capabilities:
Open clipboard

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x7e0]
test rax, rax
je 0x4305dc
mov rbx, rcx
mov rcx, qword [rax + 0x28]
call fcn.00425f20
mov rsi, rax
call qword [sym.imp.USER32.dll_GetClipboardOwner]
cmp rax, rsi
je 0x4305e3
mov edx, dword [rbx + 0x7d8]
mov rcx, qword [rbx + 0x7e0]
mov r8d, dword [rbx + 0x7d0]
call fcn.004821a0
mov edx, dword [rbx + 0x7d8]
mov r8d, dword [rbx + 0x7d4]
mov rcx, qword [rbx + 0x7e0]
call fcn.004821a0
mov rcx, qword [rbx + 0x7e0]
call fcn.00409fa0
mov rax, qword [0x00670bd0]
mov rcx, qword [rbx + 0x7e0]
mov rax, qword [rax]
call qword [rax + 0x6d0]
mov qword [rbx + 0x7e0], 0
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, 1
mov rcx, rbx
call fcn.0041daa0
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x43057c