joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802255b0
Capabilities:
Hash data using djb2

Disassembly:
mov r9d, 0x1505
lea r8, [rcx + 0x68]
mov r10d, 4
cvttss2si rax, dword [r8 - 4]
imul ecx, eax, 0x21
cvttss2si rax, dword [r8]
add ecx, eax
cvttss2si rax, dword [r8 + 4]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 + 8]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 + 0xc]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 + 0x10]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x14]
imul edx, ecx, 0x21
imul ecx, eax, 0x21
cvttss2si rax, dword [r8 - 0x10]
add ecx, eax
imul eax, ecx, 0x40a9121
add edx, eax
cvttss2si rax, dword [r8 - 0x64]
imul ecx, eax, 0x333b303f
cvttss2si rax, dword [r8 - 0x4c]
sub edx, ecx
imul ecx, eax, 0x53e7acff
cvttss2si rax, dword [r8 - 0x58]
sub edx, ecx
imul ecx, eax, 0x7d64009f
cvttss2si rax, dword [r8 - 0x2c]
sub edx, ecx
imul ecx, eax, 0x6d261dff
cvttss2si rax, dword [r8 - 0x38]
sub edx, ecx
imul ecx, eax, 0x33d8d19f
cvttss2si rax, dword [r8 - 0x44]
sub edx, ecx
imul ecx, eax, 0x37ca613f
cvttss2si rax, dword [r8 - 0x34]
sub edx, ecx
imul ecx, eax, 0x4f2599bf
cvttss2si rax, dword [r8 - 0x24]
sub edx, ecx
imul ecx, eax, 0x5cb8923f
cvttss2si rax, dword [r8 - 0x30]
sub edx, ecx
imul ecx, eax, 0x11e9dddf
cvttss2si rax, dword [r8 - 0x60]
sub edx, ecx
imul ecx, eax, 0x6666a45f
cvttss2si rax, dword [r8 - 0x5c]
sub edx, ecx
imul ecx, eax, 0x29e4147f
cvttss2si rax, dword [r8 - 8]
sub edx, ecx
imul ecx, eax, 0x13be2b1f
cvttss2si rax, dword [r8 - 0x48]
sub edx, ecx
imul ecx, eax, 0x3116891f
cvttss2si rax, dword [r8 - 0x28]
sub edx, ecx
imul ecx, eax, 0xc3525e1
cvttss2si rax, dword [r8 - 0x68]
add edx, ecx
imul ecx, eax, 0x655ec7e1
cvttss2si rax, dword [r8 - 0x50]
add edx, ecx
imul ecx, eax, 0x2f22b321
cvttss2si rax, dword [r8 - 0xc]
add edx, ecx
imul ecx, eax, 0x747c7101
cvttss2si rax, dword [r8 - 0x54]
add edx, ecx
imul ecx, eax, 0x13791741
cvttss2si rax, dword [r8 - 0x20]
add edx, ecx
imul ecx, eax, 0x3b4039a1
cvttss2si rax, dword [r8 - 0x18]
add edx, ecx
imul ecx, eax, 0x30f35d61
imul r9d, r9d, 0x1137c401
cvttss2si rax, dword [r8 - 0x1c]
lea r8, [r8 + 0x80]
add edx, ecx
imul ecx, eax, 0x4f5f0981
cvttss2si rax, dword [r8 - 0xc0]
add edx, ecx
imul ecx, eax, 0x72ac4aa1
cvttss2si rax, dword [r8 - 0xbc]
add edx, ecx
imul ecx, eax, 0x510cfa81
cvttss2si rax, dword [r8 - 0x6c]
add edx, ecx
add edx, eax
add r9d, edx
sub r10, 1
jne 0x1802255c0
mov eax, r9d
ret
Function at 0x180243020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180243195
lea rax, [0x180a548b5]
cmp qword [rcx], rax
jne 0x180243195
cmp dword [rcx + 0xc], 1
je 0x18024306e
lea rcx, str.SDL_LockTexture__:_texture_must_be_streaming
call fcn.180201e30
jmp 0x1802430cc
test rdx, rdx
jne 0x18024308d
xor eax, eax
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x3c], eax
cmp qword [rcx + 0x38], 0
mov qword [rsp + 0x50], rsi
je 0x1802430e2
mov rcx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x280]
cmp dword [rbx + 0x68], eax
jne 0x1802430b5
call fcn.18023fda0
test eax, eax
js 0x18024316f
mov rcx, qword [rbx + 0x38]
mov r9, r14
mov r8, r15
mov rdx, rdi
call fcn.180296240
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
cmp qword [rcx + 0x30], 0
je 0x180243154
movups xmm0, xmmword [rdi]
movups xmmword [rcx + 0x4c], xmm0
mov ecx, dword [rcx + 8]
test ecx, ecx
je 0x18024312b
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x10000000
je 0x18024312b
cmp ecx, 0x32595559
je 0x180243124
cmp ecx, 0x59565955
je 0x180243124
cmp ecx, 0x55595659
je 0x180243124
mov edx, 1
jmp 0x18024312e
mov edx, 2
jmp 0x18024312e
movzx edx, cl
mov eax, dword [rdi + 4]
imul eax, dword [rbx + 0x48]
imul edx, dword [rdi]
movsxd rcx, eax
mov eax, edx
add rcx, rax
add rcx, qword [rbx + 0x40]
mov qword [r8], rcx
mov eax, dword [rbx + 0x48]
mov dword [r9], eax
xor eax, eax
jmp 0x1802430c7
mov rsi, qword [rcx + 0x28]
mov eax, dword [rsi + 0x280]
cmp dword [rcx + 0x68], eax
jne 0x180243179
mov rcx, rsi
call fcn.18023fda0
test eax, eax
jns 0x180243179
mov eax, 0xffffffff
jmp 0x1802430c7
mov r9, r15
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [rsi + 0x88]
jmp 0x1802430c7
lea rdx, str.texture
lea rcx, str.Parameter__s_is_invalid
call fcn.180201e30
mov eax, 0xffffffff
jmp 0x1802430cc

Function at 0x18024b4a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
cmp qword [0x180a548d0], rax
jne 0x18024b551
mov qword [rsp + 0x50], rbx
mov ebx, 1
mov qword [0x180a548e0], 0x40000
mov qword [0x180a548e8], 0x200000
mov dword [0x180a548f0], 7
lock cmpxchg dword [0x180a548c0], ebx
je 0x18024b4fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [0x180a548c0], ebx
jne 0x18024b4e7
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
cmp qword [0x180a548c8], rcx
jne 0x18024b528
mov eax, dword [0x180a548f0]
mov dword [0x180a54c60], eax
mov qword [0x180a548c8], 0x58585858
mov dword [0x180a54c64], ecx
xchg dword [0x180a548c0], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x180a548d0], rax
mov eax, dword [rsp + 0x48]
mov qword [0x180a548d8], rax
xor eax, eax
add rsp, 0x58
ret
Function at 0x18024ccb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x18024cd2c
cmp byte [rcx], 0
je 0x18024cd2c
mov r8d, dword [0x180a54c90]
mov rdx, qword [0x180a54c88]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x18024cd2c
cmp rdi, qword [0x180a54c90]
jbe 0x18024cd1a
mov rcx, qword [0x180a54c88]
mov edx, edi
call fcn.18024af20
test rax, rax
je 0x18024cd2c
mov r8d, edi
mov qword [0x180a54c88], rax
mov rdx, rax
mov qword [0x180a54c90], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x180a54c88]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x180254670
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x40], 0
mov r10, rdx
mov r9, rbx
mov rdx, qword [rcx + 0x48]
mov rax, rdx
neg rax
mov qword [rbx + 0x68], r8
lea rax, [rsp + 0x40]
sbb ecx, ecx
mov qword [rsp + 0x28], rax
and ecx, 0x10000
mov dword [rsp + 0x20], ecx
xor ecx, ecx
test r10, r10
je 0x1802546be
lea r8, [0x180254650]
call r10
jmp 0x1802546cb
lea r8, [0x180254650]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1802546e5
lea rcx, str.Not_enough_resources_to_create_thread
add rsp, 0x30
pop rbx
jmp fcn.180201e30
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1802552e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp dword [0x180a54d84], 0
jne 0x180255327
xor r8d, r8d
mov dword [0x180a54d84], 1
lea rdx, [0x180255420]
lea rcx, str.SDL_TIMER_RESOLUTION
call fcn.180227c50
lea rcx, [0x180a54d90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [0x180a54d88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x180a54d88]
imul rax, rax, 0x3e8
cqo
idiv qword [0x180a54d90]
add rsp, 0x28
ret

Function at 0x18025dcf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r10, rdx
mov r9d, r11d
test r8, r8
je 0x18025ddaa
mov qword [rsp], rbx
mov ebx, 0xff000000
nop
movzx edx, byte [r10 + r9]
movzx eax, cl
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr edx, 1
xor eax, edx
mov edx, 0xedb88320
test al, 1
cmovne edx, r11d
shr eax, 1
xor edx, eax
mov eax, 0xedb88320
test dl, 1
cmovne eax, r11d
shr ecx, 7
shr edx, 1
xor eax, edx
xor ecx, eax
shr ecx, 1
test al, 1
mov eax, 0x12b88320
cmovne eax, ebx
inc r9
xor ecx, eax
cmp r9, r8
jb 0x18025dd10
mov rbx, qword [rsp]
mov eax, ecx
add rsp, 8
ret
Function at 0x180262870
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180a54ec8], 0
jne 0x180262a41
lea rcx, str.hid.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180a54ec0], rax
test rax, rax
je 0x180262a5d
lea rdx, str.HidD_GetAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e60], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetSerialNumberString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e68], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetManufacturerString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e70], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetProductString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e78], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_SetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e80], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e88], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetIndexedString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e90], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_GetPreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54e98], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_FreePreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54ea0], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidP_GetCaps
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54ea8], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_SetNumInputBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54eb0], rax
test rax, rax
je 0x180262a48
mov rcx, qword [0x180a54ec0]
lea rdx, str.HidD_SetOutputReport
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180a54eb8], rax
test rax, rax
je 0x180262a48
mov byte [0x180a54ec8], 1
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x180a54ec0]
test rax, rax
je 0x180262a5d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x180a54ec0], 0
mov eax, 0xffffffff
mov byte [0x180a54ec8], 0
add rsp, 0x28
ret
Function at 0x180268a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rdx
movzx r10d, cx
test r8, r8
je 0x180268b09
nop dword [rax + rax]
movzx r9d, r10b
xor r9b, byte [rbx + r11]
movzx eax, r9b
and al, 1
neg al
sbb cx, cx
shr r9b, 1
and cx, 0xa001
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, 0xa001
shr r9b, 1
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, 0xa001
shr r9b, 1
xor cx, dx
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, 0xa001
shr r9b, 1
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, 0xa001
shr r9b, 1
xor cx, dx
movzx eax, r9b
xor al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
shr r9b, 1
and dx, 0xa001
xor dx, cx
movzx eax, r9b
xor al, dl
and al, 1
neg al
sbb cx, cx
shr r9b, 1
and cx, 0xa001
shr dx, 1
xor cx, dx
xor r9b, cl
and r9b, 1
neg r9b
sbb ax, ax
shr cx, 1
and ax, 0xa001
shr r10w, 8
xor ax, cx
inc r11
xor r10w, ax
cmp r11, r8
jb 0x180268a20
mov rbx, qword [rsp + 8]
movzx eax, r10w
ret

Function at 0x180268b20
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
mov ebx, eax
cmp qword [0x180a52e68], rdi
jne 0x1802068b8
lea rcx, [0x180a52e64]
call fcn.1802108c0
cmp qword [0x180a52e68], rdi
jne 0x1802068ac
call fcn.18023b920
nop
mov qword [0x180a52e68], rax
test rax, rax
jne 0x1802068ac
lea rcx, [0x180a52e64]
call fcn.180210920
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x180a52e64]
call fcn.180210920
nop
mov rcx, qword [0x180a52e68]
call fcn.18023ba20
mov rax, qword [0x180a52e70]
test rax, rax
je 0x1802068e4
cmp dword [rax], ebx
je 0x1802068e0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1802068d1
jmp 0x1802068e4
mov rdi, qword [rax + 8]
mov rcx, qword [0x180a52e68]
call fcn.18023ba40
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x180a29b70], 0xffffffff
jne 0x180268b7e
cmp dword [0x180a54ed0], 0
jne case.default.0x180268b9b
lea rcx, [0x180a54ed4]
call fcn.1802108c0
cmp dword [0x180a29b70], 0xffffffff
jne 0x180268b72
cmp dword [0x180a54ed0], 0
jne 0x180268b72
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x180268b68
nop
mov dword [0x180a29b70], eax
jmp 0x180268b72
mov dword [0x180a54ed0], 1
lea rcx, [0x180a54ed4]
call fcn.180210920
cmp dword [0x180a54ed0], 0
je 0x180268b90
add rsp, 0x28
jmp 0x180206850
nop
mov ecx, dword [0x180a29b70]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
invalid
Function at 0x180268bb0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x180a52e68]
mov edi, eax
call fcn.18023ba20
mov rbx, qword [0x180a52e70]
xor edx, edx
test rbx, rbx
je 0x180206943
cmp dword [rbx], edi
je 0x18020698b
mov rdx, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180206933
mov ecx, 0x18
call fcn.18024aee0
mov rbx, rax
test rax, rax
je 0x180206994
mov rcx, qword [0x180a52e68]
mov dword [rax], edi
mov qword [rax + 8], rsi
mov rax, qword [0x180a52e70]
mov qword [rbx + 0x10], rax
mov qword [0x180a52e70], rbx
call fcn.18023ba40
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1802069bb
mov qword [rbx + 8], rsi
mov rcx, qword [0x180a52e68]
call fcn.18023ba40
test rbx, rbx
jne 0x180206979
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180201d50
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x1802069d2
mov rcx, rbx
mov qword [rdx + 0x10], rax
call fcn.18024aeb0
jmp 0x180206994
mov rcx, rbx
mov qword [0x180a52e70], rax
call fcn.18024aeb0
jmp 0x180206994
sub rsp, 0x28
cmp dword [0x180a54ed0], 0
je 0x180268bc6
add rsp, 0x28
jmp 0x180206900
mov rdx, rcx
mov ecx, dword [0x180a29b70]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x180268be9
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.180201e30
xor eax, eax
add rsp, 0x28
ret
Function at 0x18026a100
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
movzx ebp, word [rcx + 0x160]
mov esi, r8d
mov r15, rdx
mov rdi, rcx
mov edx, esi
mov rcx, r15
xor r9d, r9d
xor r8d, r8d
call sub.IMM32.dll_ImmGetCompositionStringW
movsxd rbx, eax
test eax, eax
jle 0x18026a168
cmp dword [rdi + 0xe0], ebx
jge 0x18026a168
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x18026a152
call fcn.18024aeb0
lea rcx, [rbx + 2]
call fcn.18024aee0
mov qword [rdi + 0xd8], rax
mov dword [rdi + 0xe0], ebx
mov r9d, dword [rdi + 0xe0]
mov edx, esi
mov r8, qword [rdi + 0xd8]
mov rcx, r15
call sub.IMM32.dll_ImmGetCompositionStringW
xor ebx, ebx
mov edx, 0x80
test eax, eax
mov ecx, ebx
cmovns ecx, eax
xor r9d, r9d
movsxd rsi, ecx
xor r8d, r8d
mov rcx, r15
shr rsi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx ecx, ax
lea eax, [rbp - 0x404]
mov dword [rdi + 0x104], ecx
test eax, 0xfffffbff
jne 0x18026a20c
test ecx, ecx
je 0x18026a20c
movsxd rax, dword [rdi + 0xe0]
shr rax, 1
cmp ecx, eax
jge 0x18026a20c
mov rax, qword [rdi + 0xd8]
movzx edx, word [rax]
mov eax, 0x3000
cmp dx, ax
je 0x18026a1e4
cmp dx, 0x20
jne 0x18026a20c
lea edx, [rcx + 1]
movsxd r8, esi
cmp rdx, r8
jge 0x18026a20a
nop
mov rax, qword [rdi + 0xd8]
lea rcx, [rax + rdx*2]
inc rdx
movzx eax, word [rcx]
mov word [rcx - 2], ax
cmp rdx, r8
jl 0x18026a1f0
dec esi
mov rax, qword [rdi + 0xd8]
movsxd rcx, esi
mov word [rax + rcx*2], bx
cmp dword [rdi + 0x104], ebx
jne 0x18026a2c4
test esi, esi
jle 0x18026a2c4
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov edx, 0x10
mov rcx, r15
call sub.IMM32.dll_ImmGetCompositionStringW
movsxd r14, eax
test eax, eax
jle 0x18026a2b9
lea rcx, [r14 + 2]
call fcn.18024aee0
mov r9d, r14d
mov r8, rax
mov edx, 0x10
mov rcx, r15
mov rbp, rax
call sub.IMM32.dll_ImmGetCompositionStringW
test r14d, r14d
jle 0x18026a289
mov rdx, rbx
movzx ecx, byte [rdx + rbp]
dec cl
test cl, 0xfd
je 0x18026a289
inc ebx
inc rdx
cmp rdx, r14
jl 0x18026a274
movsxd rax, ebx
mov edx, ebx
cmp rax, r14
jge 0x18026a2a8
movzx ecx, byte [rax + rbp]
dec cl
test cl, 0xfd
jne 0x18026a2a8
inc edx
inc rax
cmp rax, r14
jl 0x18026a293
cmp ebx, r14d
mov rcx, rbp
cmove edx, r14d
mov ebx, edx
call fcn.18024aeb0
mov r14, qword [rsp + 0x40]
mov dword [rdi + 0x104], ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x18026af90
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, word [rcx + 0x160]
mov rbx, rcx
mov esi, 0x3ff
xor ecx, ecx
and edi, esi
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [rbx + 0x160]
xor edx, edx
cmp rax, rcx
je 0x18026aff3
movzx ecx, ax
mov qword [rbx + 0x160], rax
and cx, si
cmp cx, 0x12
je 0x18026afe8
mov ecx, 0x804
cmp ax, cx
mov ecx, 1
jne 0x18026afea
mov ecx, edx
mov dword [rbx + 0x12c], ecx
mov rcx, rax
cmp dword [rbx + 0x1a0], edx
jne 0x18026b00c
mov eax, 0xe0060404
cmp rcx, rax
setne dl
mov dword [rbx + 0x128], edx
mov rcx, rbx
call fcn.18026b2e0
movzx eax, word [rbx + 0x160]
and eax, esi
cmp edi, eax
je 0x18026b029
mov rcx, rbx
call fcn.180269e00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18026b440
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp rax, qword [rbx + 0x160]
je 0x18026b495
movzx edx, ax
mov qword [rbx + 0x160], rax
mov ecx, 0x3ff
and dx, cx
cmp dx, 0x12
je 0x18026b48d
mov ecx, 0x804
cmp ax, cx
je 0x18026b48d
mov eax, 1
mov dword [rbx + 0x12c], eax
add rsp, 0x20
pop rbx
ret
xor eax, eax
mov dword [rbx + 0x12c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x18026b620
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rdi, qword [rcx + 0x5f8]
xor ebx, ebx
mov ecx, 0x42
mov dword [rdi + 0x98], ebx
mov qword [rdi + 0xa0], rbx
mov qword [rdi + 0xa8], rbx
mov dword [rdi + 0xb0], ebx
mov qword [rdi + 0xb8], rbx
mov qword [rdi + 0xc0], rbx
mov qword [rdi + 0xd0], rbx
mov dword [rdi + 0xe0], 0x40
call fcn.18024aee0
mov qword [rdi + 0xd8], rax
lea rcx, [rdi + 0x134]
xor edx, edx
mov r8d, 0x10
mov word [rax], bx
mov word [rdi + 0xe4], bx
mov qword [rdi + 0x104], rbx
mov qword [rdi + 0x110], rbx
mov qword [rdi + 0x118], rbx
mov qword [rdi + 0x120], rbx
mov dword [rdi + 0x128], ebx
mov qword [rdi + 0x12c], 1
call fcn.18024e1c0
lea rcx, [rdi + 0x144]
xor edx, edx
mov r8d, 0x10
call fcn.18024e1c0
lea rcx, [rsp + 0x20]
mov qword [rdi + 0x154], rbx
mov qword [rdi + 0x160], rbx
mov qword [rdi + 0x168], rbx
mov qword [rdi + 0x170], rbx
mov qword [rdi + 0x178], rbx
mov qword [rdi + 0x180], rbx
mov qword [rdi + 0x188], rbx
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], rbx
mov dword [rdi + 0x1a0], ebx
mov qword [rdi + 0x1a8], rbx
mov qword [rdi + 0x1b0], 0xffffffffffffffff
mov qword [rdi + 0x1b8], 0xffffffffffffffff
mov qword [rdi + 0x1c0], rbx
mov qword [rdi + 0x1c8], rbx
call fcn.18022f810
lea rsi, [0x1803bebb0]
movsxd rax, dword [rsi]
test eax, eax
je 0x18026b7b0
lea rdi, [rsp + 0x20]
test dword [rdi + rax*4], 0x40000000
lea rdi, [rdi + rax*4]
jne 0x18026b7b0
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x18026b7b0
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x18026b7b0
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x18026b7ae
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x18026b765
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x200
xor ecx, ecx
call fcn.180230880
lea rdx, str.Menu
mov ecx, 0x65
call fcn.180230a30
lea rdx, str.Left_Windows
mov ecx, 0xe3
call fcn.180230a30
lea rdx, str.Right_Windows
mov ecx, 0xe7
call fcn.180230a30
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x2000
mov edx, eax
call fcn.180230a50
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x1000
mov edx, eax
call fcn.180230a50
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
mov ecx, 0x8000
mov edx, eax
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
jmp fcn.180230a50
Function at 0x18026b8f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x150
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
mov ecx, 0x20
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test eax, eax
je 0x18026b96e
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rsi
xor esi, esi
mov ebx, esi
nop dword [rax + rax]
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
mov edx, edi
mov ecx, 0x20
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jg 0x18026b95e
inc ebx
cmp ebx, 5
jl 0x18026b930
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x18026bc00
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
sub rsp, 0x820
mov ebp, ecx
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 0x10], rsi
call fcn.18022f810
xor ebx, ebx
mov qword [rsp + 0x840], rdi
lea rsi, [0x1803bebb0]
movsxd rax, dword [rsi]
test eax, eax
je 0x18026bc7b
lea rdi, [rsp + 0x20]
test dword [rdi + rax*4], 0x40000000
lea rdi, [rdi + rax*4]
jne 0x18026bc7b
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x18026bc7b
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x18026bc7b
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x18026bc79
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x18026bc30
mov rdi, qword [rsp + 0x840]
lea rdx, [rsp + 0x20]
mov rsi, qword [rsp + 0x838]
mov r9d, ebp
mov rbx, qword [rsp + 0x830]
mov r8d, 0x200
xor ecx, ecx
call fcn.180230880
add rsp, 0x820
pop rbp
ret