joyce8/EMBER2024-capa huggingface dataset:
Function at 0x599ce0
Capabilities:
Prepare http request

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
nop
mov rax, qword [rbp + 0x40]
mov byte [rax + 0x141], 0
mov byte [rax + 0x140], 0
mov rax, qword [rbp + 0x48]
cmp dword [rax + 0x20], 0
jle 0x599d43
mov rax, qword [rbp + 0x48]
movzx rbx, word [rax + 0x20]
jmp 0x599d45
xor ebx, ebx
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.0042e8e0
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0xa0]
mov rcx, qword [rcx + 0x130]
mov rdx, rax
mov r8d, ebx
xor r9, r9
call fcn.0073ae90
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x118], rax
test rax, rax
jne 0x599dc4
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x90], rax
mov byte [rbp + 0x98], 0x11
mov rcx, qword [0x008423b0]
mov dl, 1
mov r8, qword [0x0096f180]
lea r9, [rbp + 0x90]
mov dword [rsp + 0x20], 0
call fcn.0044c880
mov rcx, rax
call fcn.0042c5c0
xor ebx, ebx
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
lea rdx, [0x00599fb0]
call fcn.0042ef00
test eax, eax
jne 0x599de3
or ebx, 0x800000
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp + 0x88]
call fcn.00586480
mov rcx, qword [rbp + 0x88]
call fcn.0042e8e0
mov rsi, rax
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x48]
call fcn.005979b0
mov rcx, qword [rbp + 0x80]
call fcn.0042e8e0
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0x118]
mov rdx, rsi
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], ebx
call fcn.0073aeb0
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x120], rax
test rax, rax
jne 0x599eb5
call fcn.00739bb8
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call fcn.00739bb8
lea rcx, [rbp + 0x58]
mov edx, eax
mov r8, qword [0x00980378]
call fcn.0044a1b0
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x008423b0]
mov dl, 1
mov r8, qword [0x0096f190]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0044c880
mov rcx, rax
call fcn.0042c5c0
mov rax, qword [rbp + 0x40]
mov ebx, dword [rax + 0x18]
mov rcx, qword [rbp + 0x40]
call fcn.00586670
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0x120]
mov edx, ebx
mov r8d, ebx
mov r9d, eax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x20], eax
call fcn.0073af08
test eax, eax
jne 0x599f44
call fcn.00739bb8
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call fcn.00739bb8
lea rcx, [rbp + 0x50]
mov edx, eax
mov r8, qword [0x00980378]
call fcn.0044a1b0
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x008423b0]
mov dl, 1
mov r8, qword [0x0096f1a0]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0044c880
mov rcx, rax
call fcn.0042c5c0
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0042d2d0
lea rcx, [rbp + 0x80]
mov edx, 2
call fcn.0042d2d0
lea rsp, [rbp + 0xa0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x59be60
Capabilities:
Initialize winhttp library

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
mov rcx, qword [0x00980370]
mov rax, qword [0x00980370]
mov rbx, qword [rax]
call qword [rbx]
nop
cmp qword [0x00980380], 0
jne 0x59bedc
lea rcx, [0x0059bf24]
mov edx, 1
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
call fcn.0073aea8
mov qword [0x00980380], rax
cmp qword [0x00980380], 0
jne 0x59bedc
mov rcx, qword [0x00842250]
mov dl, 1
mov r8, qword [0x0096f150]
call fcn.0044c6c0
mov rcx, rax
call fcn.0042c5c0
nop
mov rcx, qword [0x00980370]
mov rax, qword [0x00980370]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x5ddad0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xc0], rcx
mov byte [rbp + 0xc8], dl
mov qword [rbp + 0xd0], r8
mov qword [rbp + 0xd8], r9
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0xe0], rax
movzx rax, byte [rbp + 0xe8]
mov byte [rbp + 0xe8], al
cmp byte [rbp + 0xc8], 0
je 0x5ddb4d
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0xc8]
call fcn.0042aaf0
mov qword [rbp + 0xc0], rax
nop
nop
mov rcx, qword [rbp + 0xc0]
xor edx, edx
call fcn.0042a090
mov rax, qword [rbp + 0xc0]
mov rsi, qword [rbp + 0xe0]
lea rdi, [rax + 0x10]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xd0]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0xc0]
mov byte [rax + 0x28], 0
mov rax, qword [rbp + 0xc0]
movzx rcx, byte [rbp + 0xe8]
mov byte [rax + 0x29], cl
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xd8]
mov rcx, qword [rcx]
mov qword [rax + 0x20], rcx
mov rax, qword [rbp + 0xc0]
mov dword [rax + 0x2c], 0
mov rax, qword [rbp + 0xc0]
lea rax, [rax + 0x10]
mov qword [rbp + 0x80], rax
mov rax, qword [0x0096eb20]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax]
cmp rax, qword [rcx]
jne 0x5ddc22
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rax + 8]
cmp rax, qword [rcx + 8]
jne 0x5ddc22
mov rax, qword [rbp + 0xc0]
mov byte [rax + 0x28], 1
mov rax, qword [rbp + 0xc0]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x5ddd14
mov rax, qword [0x00970310]
mov eax, dword [rax]
add eax, 1
test eax, eax
je 0x5ddc57
sub eax, 1
test eax, eax
jne 0x5ddc63
mov dword [rbp + 0x8c], 1
jmp 0x5ddc72
mov dword [rbp + 0x8c], 0
jmp 0x5ddc72
mov rax, qword [0x00970310]
mov eax, dword [rax]
mov dword [rbp + 0x8c], eax
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax + 8]
mov edx, 0xffff
mov r8d, 0x1006
lea r9, [rbp + 0x8c]
mov dword [rsp + 0x20], 4
call fcn.0073ad48
cmp eax, 0xffffffff
jne 0x5ddcf6
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00970320]
call fcn.00435d90
call fcn.0073acc8
lea rcx, [rbp + 0x38]
mov edx, eax
xor r8, r8
call fcn.0044a1b0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0x11
mov rcx, qword [0x0086e080]
mov dl, 1
mov r8, qword [rbp + 0x50]
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 0
call fcn.0044c4e0
mov rcx, rax
call fcn.0042c5c0
mov rax, qword [rbp + 0xc0]
mov byte [rax + 0x28], 1
mov rax, qword [rbp + 0xc0]
mov rcx, qword [0x00970310]
mov ecx, dword [rcx]
mov dword [rax + 0x2c], ecx
nop
lea rcx, [rbp + 0x38]
call fcn.0042d1f0
lea rcx, [rbp + 0x50]
call fcn.0042d1f0
cmp byte [rbp + 0xc8], 0
je 0x5ddd82
mov rcx, qword [rbp + 0xc0]
call fcn.0042ab30
mov qword [rbp + 0xc0], rax
jmp 0x5ddd82
mov rax, qword [rbp + 0xc0]
lea rsp, [rbp + 0x98]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x5f9ae0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
xor r9, r9
sub edx, 1
mov ecx, r9d
cmp ecx, edx
jg 0x5f9b20
sub edx, r9d
add edx, 1
mov ecx, eax
and cx, 0xf800
movzx ecx, cx
shr ecx, 0xb
shl eax, 5
or cx, ax
mov eax, ecx
movzx cx, byte [r8]
xor ax, cx
add r8, 1
sub edx, 1
test edx, edx
jne 0x5f9af8
nop
ret
Function at 0x60ff70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbp, rsp
mov rax, qword [rcx]
mov qword [rbp + 0x64], rax
mov qword [rbp + 0xa8], rdx
xor eax, eax
mov qword [rbp + 0x38], rax
cmp qword [0x00986ea0], 0
je 0x610130
mov ecx, 0x11
call fcn.0073a6d0
mov rcx, qword [0x0096dc90]
mov rcx, qword [rcx]
test ax, 0x8000
setne al
movzx rcx, byte [rcx + 0x178]
xor cl, al
test cl, cl
je 0x610130
mov rcx, qword [0x00986ea8]
mov rax, qword [0x00986ea8]
mov rbx, qword [rax]
call qword [rbx + 0x10]
xor eax, eax
mov rcx, qword [0x00986ea0]
mov esi, dword [rcx + 0x10]
sub esi, 1
mov ebx, eax
cmp ebx, esi
jg 0x6100f3
sub esi, eax
add esi, 1
mov rcx, qword [0x00986ea0]
mov edx, ebx
call fcn.004a8a90
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
cmp rax, qword [rbp + 0xa8]
je 0x6100e5
mov rax, qword [rbp + 0x58]
cmp byte [rax + 0x3a1], 0
je 0x6100e5
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
call qword [rax + 0xf8]
test al, al
je 0x6100e5
mov rcx, qword [rbp + 0x58]
call fcn.006228d0
mov rcx, rax
call fcn.0073a848
test eax, eax
je 0x6100e5
mov rcx, rbp
call fcn.0060ff10
test al, al
jne 0x6100e5
mov rcx, qword [rbp + 0x58]
mov dx, 0xffb9
call fcn.0042a7b0
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0xa8]
call rax
test al, al
je 0x6100e5
mov byte [rbp + 0x6f], 1
mov rcx, qword [rbp + 0x58]
mov dx, 0xffba
call fcn.0042a7b0
mov rdi, rax
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0xa8]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x64]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call rdi
cmp byte [rbp + 0x6f], 0
je 0x6100e5
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x64]
call fcn.00437710
test al, al
je 0x6100e5
mov rcx, qword [0x00986ea8]
mov rdx, qword [rbp + 0x58]
call fcn.0060f1b0
add ebx, 1
sub esi, 1
test esi, esi
jne 0x60fffc
nop
mov rax, qword [0x00986ea8]
cmp dword [rax + 0x10], 0
jle 0x610111
mov rcx, qword [0x00986ea8]
call fcn.0060f2b0
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x610130
mov rcx, rbp
mov rdx, qword [rbp + 0x38]
call fcn.0060fd30
test al, al
jne 0x610130
xor eax, eax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x61d1e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call fcn.0073a738
mov ecx, eax
call fcn.00437eb0
mov dword [rbp + 0x3c], eax
movsx rax, word [rbp + 0x3c]
mov dword [rbp + 0x34], eax
movsx rax, word [rbp + 0x3e]
mov dword [rbp + 0x38], eax
mov rcx, rbx
lea rdx, [rbp + 0x34]
call fcn.00613850
mov qword [rbp + 0x158], rax
test rdi, rdi
jne 0x61d24b
mov rcx, rbx
lea rdx, [rbp + 0x158]
xor r8, r8
xor r9, r9
mov byte [rsp + 0x20], 0
call fcn.0061d040
mov rdi, rax
test rdi, rdi
je 0x61d328
cmp rdi, rbx
je 0x61d279
mov eax, dword [rbp + 0x158]
sub eax, dword [rdi + 0x90]
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x15c]
sub eax, dword [rdi + 0x94]
mov dword [rbp + 0x44], eax
jmp 0x61d284
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x40], rax
movzx eax, word [rsi + 0x10]
mov dword [rbp + 0x48], eax
mov rax, qword [rsi + 8]
mov qword [rbp + 0x50], rax
movzx eax, word [rsi + 0x12]
cmp eax, 0x201
jge 0x61d2ba
sub eax, 0xa1
cmp eax, 2
jb 0x61d2d6
sub eax, 3
cmp eax, 2
jb 0x61d2e2
sub eax, 3
cmp eax, 2
jae 0x61d2e8
jmp 0x61d2dc
sub eax, 0x201
cmp eax, 2
jb 0x61d2d6
sub eax, 3
cmp eax, 2
jb 0x61d2e2
sub eax, 3
cmp eax, 2
jae 0x61d2e8
jmp 0x61d2dc
mov byte [rbp + 0x4c], 0
jmp 0x61d2ec
mov byte [rbp + 0x4c], 2
jmp 0x61d2ec
mov byte [rbp + 0x4c], 1
jmp 0x61d2ec
mov byte [rbp + 0x4c], 0
lea rcx, [rbp + 0x58]
call fcn.0073a6f0
lea rcx, [rbp + 0x58]
call fcn.006e84a0
mov ebx, eax
call fcn.0060e700
or bx, ax
mov word [rbp + 0x4d], bx
mov rcx, rdi
mov edx, 0xb04b
xor r8, r8
lea r9, [rbp + 0x40]
call fcn.00616300
mov qword [rsi + 0x18], rax
mov al, 1
jmp 0x61d32a
xor eax, eax
lea rsp, [rbp + 0x168]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x68d7d0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0042d1f0
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x510], 0
je 0x68d858
mov rcx, qword [rbp + 0x20]
call fcn.0068d890
lea rcx, [rbp + 0x38]
mov edx, eax
add edx, 1
call fcn.0042eb60
xor ebx, ebx
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x68d827
mov ebx, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
call fcn.0042e8e0
mov rsi, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x510]
mov rdx, rsi
mov r8d, ebx
call fcn.0073a7e0
mov rcx, qword [rbp + 0x28]
mov rdx, rsi
mov r8d, eax
call fcn.0042d4f0
nop
lea rcx, [rbp + 0x38]
call fcn.0042d1f0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret

Function at 0x6a3b90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0042d3c0
nop
xor ecx, ecx
call fcn.0073a8e8
test eax, eax
je 0x6a3c7e
nop
mov dword [rbp + 0x3c], 0
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x6a3bdc
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call fcn.00739cd0
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.00739cf0
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6a3c1e
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.0042e8e0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.00426490
call fcn.0073a5d0
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call fcn.0073a990
nop
mov rcx, qword [rbp + 0x48]
call fcn.00739cf8
jmp 0x6a3c76
nop
call fcn.0073a4f0
jmp 0x6a3c9b
mov rcx, qword [0x00747710]
mov dl, 1
mov r8, qword [0x0096f750]
call fcn.0044c6c0
mov rcx, rax
call fcn.0042c5c0
nop
lea rcx, [rbp + 0x68]
call fcn.0042d1f0
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x6a9c20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006a9c70]
mov ecx, 0x10
call fcn.0073a6d0
test ax, ax
jge 0x6a9c40
or bx, 1
mov ecx, 0x11
call fcn.0073a6d0
test ax, ax
jge 0x6a9c53
or bx, 4
mov ecx, 0x12
call fcn.0073a6d0
test ax, ax
jge 0x6a9c66
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6aab90
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
cmp byte [rax + 0x4c9], 0
jne 0x6aac64
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c8], 1
nop
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x580]
call fcn.006228d0
mov rcx, rax
xor edx, edx
call fcn.0073aa50
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x580]
xor edx, edx
call fcn.00612b30
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c9], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x50]
mov ecx, dword [rcx + 0x9c]
mov dword [rax + 0x4f8], ecx
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
call qword [rax + 0x2e8]
mov rcx, qword [rbp + 0x50]
mov edx, eax
call fcn.00613140
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x540]
call fcn.0061ae40
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c8], 0
mov rax, qword [rbp + 0x50]
cmp qword [rax + 0x560], 0
je 0x6aac64
mov rax, qword [rbp + 0x50]
lea rbx, [rax + 0x560]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x50]
call qword [rbx]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x6abb10
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
cmp byte [rax + 0x4c9], 0
je 0x6abbf9
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c8], 1
nop
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x580]
mov dl, 5
call fcn.00612b30
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x580]
call fcn.006228d0
mov rcx, rax
mov edx, 5
call fcn.0073aa50
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c9], 0
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x50]
mov edx, dword [rax + 0x4f8]
call fcn.00613140
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0x540]
mov rcx, qword [rax + 0x4c8]
call fcn.006e8a60
test al, al
je 0x6abbca
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x540]
mov rdx, qword [rbp + 0x50]
call fcn.006e9e80
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x540]
call fcn.0061ae40
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x4c8], 0
mov rax, qword [rbp + 0x50]
cmp qword [rax + 0x570], 0
je 0x6abbf9
mov rax, qword [rbp + 0x50]
lea rbx, [rax + 0x570]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x50]
call qword [rbx]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x6b0310
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
mov edx, 0xe
xor r8, r8
xor r9, r9
call fcn.0073a978
mov rdi, rax
mov rcx, rbx
xor edx, edx
mov r8d, edi
call fcn.0042d4f0
test edi, edi
je 0x6b0385
mov rcx, qword [rbx]
call fcn.0042e8e0
mov rcx, rsi
mov edx, 0xd
mov r8d, edi
add r8d, 1
movsxd r8, r8d
mov r9, rax
call fcn.0073a978
sub edi, eax
test edi, edi
jle 0x6b0385
xor eax, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x6b0379
mov eax, dword [rcx - 4]
mov rcx, rbx
mov edx, eax
sub edx, edi
call fcn.0042eb60
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6e4fa0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x00962e90], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call fcn.0073a6e8
mov rcx, qword [0x00820140]
mov dl, 1
call fcn.00559890
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.00559b40
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.0042e9d0
lea rcx, [rbp + 0x30]
lea rdx, [0x006e5188]
mov r8, qword [rbp + 0x28]
call fcn.0042ed00
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00559f30
test al, al
je 0x6e50da
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x006e51fc]
call fcn.0055aa40
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.00451490
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x6e50da
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x006e5214]
call fcn.00438fd0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x6e50d0
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x6e50d0
mov rcx, qword [rbp + 0x90]
call fcn.006e4f10
test eax, eax
je 0x6e50b4
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x6e50be
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x00962e90], al
nop
mov rcx, qword [rbp + 0x78]
call fcn.00739b18
nop
mov rcx, qword [rbp + 0x70]
call fcn.0042a150
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0042d2d0
lea rcx, [rbp + 0x68]
call fcn.0042d1f0
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x6e5290
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x6e52eb
mov ecx, 0x10
call fcn.0073a6d0
test ax, ax
jge 0x6e52c8
add bx, 0x2000
mov ecx, 0x11
call fcn.0073a6d0
test ax, ax
jge 0x6e52dc
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x6e52eb
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6e83e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006e8444]
mov eax, ecx
test ax, 4
je 0x6e83f9
or bx, 1
mov eax, ecx
test ax, 8
je 0x6e8405
or bx, 4
mov eax, ecx
test ax, 1
je 0x6e8411
or bx, 8
mov eax, ecx
test ax, 2
je 0x6e841d
or bx, 0x10
test cx, 0x10
je 0x6e8428
or bx, 0x20
mov ecx, 0x12
call fcn.0073a6d0
test ax, ax
jge 0x6e843b
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6e8450
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006e849c]
mov ecx, 0x10
call fcn.0073a6d0
test ax, ax
jge 0x6e8473
or si, 1
mov ecx, 0x11
call fcn.0073a6d0
test ax, ax
jge 0x6e8486
or si, 4
test ebx, 0x20000000
je 0x6e8492
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x6e8510
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x128
lea rcx, [rsp + 0x20]
call fcn.0073a6f0
lea rcx, [rsp + 0x20]
call fcn.006e84a0
add rsp, 0x128
ret
Function at 0x6f7bd0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6f7ddd
mov rcx, qword [0x00787620]
mov dl, 1
call fcn.004b08b0
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0042d1f0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call fcn.0073a6e0
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6f7dc0
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.0062c310
test al, al
je 0x6f7da7
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006f7e48]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00442570
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call fcn.007399e8
test eax, eax
jne 0x6f7da7
nop
mov dword [rbp + 0x4f4], pe_nt_image_headers64
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006f7eb6]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call fcn.007399f8
test eax, eax
jne 0x6f7d9a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, 0x100
call fcn.0042e9d0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6f7d9a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, 0x100
call fcn.0042e9d0
nop
mov rcx, qword [rbp + 0x508]
call fcn.00739998
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6f7c83
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.004b0740
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0042d1f0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret