joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a6dc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x14003a716
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x14003a7ba
call fcn.14002c73c
mov rcx, rax
test rax, rax
je 0x14003a7d5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14014fce9.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x118]
call qword [case.0x14014fce9.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1401e8008
test eax, eax
je 0x14003a77e
cmp eax, 0xc
je 0x14003a7cf
cmp eax, 0x50
jne 0x14003a7e0
test rbx, rbx
jne 0x14003a787
mov ebx, ebp
jmp 0x14003a792
mov rcx, rbx
call fcn.1401e7f60
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14003a7b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14014fce9.0]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.140012df0
nop
mov ecx, 0x80004005
call fcn.14000b7a0
nop
call fcn.140012dcc
int3

Function at 0x14003c5e0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r13, r8
mov edx, 1
mov r15, rcx
mov r12d, edx
mov r14d, edx
lea rdi, [rsi + 0x18]
cmp dword [rsi + 0x10], edx
jle 0x14003c679
lea ebx, [rdx + 7]
lea ebp, [rdx + 0xf]
test r13, r13
je 0x14003c63e
mov rax, qword [r15 + 0x10]
cmp qword [rax + rbp + 8], r13
je 0x14003c63e
mov rax, qword [rdi]
cmp qword [rbx + rax], 0
je 0x14003c663
xor r12d, r12d
jmp 0x14003c663
mov rax, qword [rdi]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14003c65b
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14014fce9.0]
mov edx, 1
mov rax, qword [rdi]
and qword [rbx + rax], 0
add r14d, edx
add rbp, 0x10
add rbx, 8
cmp r14d, dword [rsi + 0x10]
jl 0x14003c61f
test r12d, r12d
je 0x14003c6c1
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r15 + 0x18]
mov rdx, rsi
call fcn.14003c994
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14014fce9.0]
mov ecx, dword [r15]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003e4ac
Capabilities:
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1402ae7c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, ecx
xor esi, esi
mov rcx, qword [0x14034ffb8]
mov r12, r9
mov r15, r8
mov r14, rdx
test rcx, rcx
jne 0x14003e51c
lea rcx, [0x14021fee0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e543
lea rdx, str.GetThreadPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14034ffb8], rax
jmp 0x14003e525
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x14003e543
mov r9, r12
mov r8, r15
mov rdx, r14
mov ecx, edi
mov rax, rbx
call qword [case.0x14014fce9.0]
jmp 0x14003e685
mov dword [r14], esi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14003e938
lea rcx, [rbp - 0x20]
call fcn.1401e7c4c
mov edx, dword [r12]
lea r8, [rbp - 0x20]
mov rcx, r15
lea rdi, [rax + 1]
call fcn.1401e7a94
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
call fcn.14003e938
lea rcx, [rbp - 0x20]
call fcn.1401e7c4c
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401e7a94
inc dword [r14]
add rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14003e938
lea rcx, [rbp - 0x20]
call fcn.1401e7c4c
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401e7a94
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
add rdi, rbx
call fcn.14003e938
lea rcx, [rbp - 0x20]
call fcn.1401e7c4c
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401e7a94
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, 0x800
add rdi, rbx
call fcn.14003e938
lea rcx, [rbp - 0x20]
call fcn.1401e7c4c
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
mov rbx, rax
call fcn.1401e7a94
inc dword [r14]
lea rcx, [rdi + rbx]
xor eax, eax
mov word [r15 + rcx*2 + 2], ax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401aba90
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003ec60
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1402ae7c0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14003ed1e
test rdx, rdx
je 0x14003ed1e
mov rcx, rdx
call fcn.1401e7f60
xor edx, edx
mov byte [rsp + 0x20], 0
mov r8d, 0xff
lea rcx, [rsp + 0x21]
mov rsi, rax
call fcn.14020e940
mov r8d, 0x100
cmp rsi, r8
ja 0x14003eced
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x14003eced
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14003ecf9
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1401aba90
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140012dcc
int3

Function at 0x14004004c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x14004007e
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004007e
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.140100ae4
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140040090
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400400b6
mov r8, rdx
mov rdx, qword [rbx]
call fcn.1400306e4
jmp 0x140040122
cmp byte [0x140350058], 0
jne 0x1400400fa
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400400ea
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140350050], rax
jmp 0x1400400f1
mov rax, qword [0x140350050]
mov byte [0x140350058], 1
jmp 0x140040101
mov rax, qword [0x140350050]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x14004011b
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x14014fce9.0]
jmp 0x140040122
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14004243c
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 0x77], rdx
cmp qword [rcx + 0x20], 0
je 0x14004252f
xor esi, esi
and qword [rbp + 0x17], rsi
and dword [rbp + 0x1f], esi
and qword [rbp + 0x27], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x40]
call qword [case.0x14014fce9.0]
nop
mov rbx, qword [rax]
call fcn.14003b2b8
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.140027220
nop
and qword [rbp + 0x7f], rsi
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, eax
test eax, eax
jne 0x1400424eb
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
and dword [rbp + 0x1f], ecx
mov eax, ecx
neg eax
sbb ebx, ebx
and ebx, ecx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042518
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14014fce9.0]
test ebx, ebx
je 0x140042619
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14004252f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002c73c
mov rcx, rax
test rax, rax
je 0x140042648
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14014fce9.0]
add rax, 0x18
mov qword [rbp + 0x6f], rax
call fcn.14002c73c
mov rcx, rax
test rax, rax
je 0x14004263d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14014fce9.0]
add rax, 0x18
mov qword [rbp + 7], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 7]
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x77]
call fcn.140040744
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x1400425d2
mov rcx, rbx
call fcn.1401e7f60
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400425f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14014fce9.0]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042619
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14014fce9.0]
cmp qword [rbp + 0x77], 0
jne 0x14004253d
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140042633
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140042531
mov ecx, 0x80004005
call fcn.14000b7a0
nop
mov ecx, 0x80004005
call fcn.14000b7a0
int3
Function at 0x1400553d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test r8, r8
jne 0x1400553fb
call fcn.14003b2b8
mov rbx, qword [rax + 0x18]
lea r8, [0x140225650]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x140055454
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140055454
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140055454
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, rbp
mov r8d, eax
call fcn.14005546c
jmp 0x140055456
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140069ca4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1402ae7c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
test ax, ax
js 0x140069d7b
mov rdi, qword [rsi + 0x248]
test rdi, rdi
jne 0x140069d11
mov rcx, qword [rsi + 0x130]
call fcn.140033d6c
mov rdx, rax
lea rcx, vtable.CGlobalUtils.0
call fcn.140058d08
mov rdi, rax
test rax, rax
je 0x140069d74
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rbx
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
lea rcx, [rbp - 0x18]
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x30], ebx
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov qword [rbp - 0x20], rbx
call fcn.140075ea0
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x140069d74
cmp dword [rbp - 0x30], ebx
setne bl
mov eax, ebx
jmp 0x140069d7d
mov eax, 1
jmp 0x140069d7d
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401aba90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400a4eec
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1402ae7c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r15d, r15d
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov edi, 0xfffffffd
mov dword [rcx + 0xd4], r15d
cmp dword [rcx + 0xc8], r15d
je 0x1400a4f8c
test r8d, r8d
jne 0x1400a4f8c
cmp dword [rcx + 0xcc], r15d
jne 0x1400a4f8c
mov eax, dword [rcx + 0x24]
dec eax
cmp eax, edi
ja 0x1400a4f82
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], r15
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [r14 + 0x40]
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbx + 0x108]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rbx + 0xd4], eax
test eax, eax
je 0x1400a5158
jmp 0x1400a4f8c
mov dword [rcx + 0xd4], 1
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x1e0]
call qword [case.0x14014fce9.0]
test eax, eax
je 0x1400a4fdc
test esi, esi
jne 0x1400a4fdc
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], r15
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [r14 + 0x40]
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbx + 0x118]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1400a5158
cmp dword [rbx + 0xd4], r15d
jne 0x1400a5004
mov eax, dword [rbx + 0x24]
dec eax
cmp eax, edi
ja 0x1400a5004
cmp dword [rbx + 0xc8], r15d
jne 0x1400a5004
cmp dword [rbx + 0xe0], r15d
je 0x1400a5158
mov rdx, qword [rbx + 0x80]
lea rcx, str.CMFCMenuBar
call fcn.14003b8a8
mov rdi, rax
mov rax, qword [rbx + 0xc0]
test rax, rax
je 0x1400a5054
mov dword [rax + 0x1f0], r15d
mov rcx, qword [rbx + 0xc0]
mov rax, qword [rcx]
mov rax, qword [rax + 0xc0]
call qword [case.0x14014fce9.0]
mov qword [rbx + 0xc0], r15
test rdi, rdi
je 0x1400a50a6
xor edx, edx
jmp 0x1400a509e
mov rdx, qword [rbx + 0x80]
lea rcx, str.CMFCPopupMenuBar
call fcn.14003b8a8
test esi, esi
je 0x1400a5113
test rax, rax
je 0x1400a5113
cmp dword [0x14035012c], r15d
jne 0x1400a5113
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1400a23dc
test rdi, rdi
je 0x1400a50a6
mov rdx, rbx
mov rcx, rdi
call fcn.140065238
cmp qword [rbx + 0x80], r15
je 0x1400a50ee
movups xmm0, xmmword [rbx + 0x68]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.1400547b0
lea rcx, [rbp - 0x20]
mov edx, dword [rax + 0xcc]
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
mov rcx, qword [rbx + 0x80]
lea rdx, [rbp - 0x20]
mov r9d, 0x401
xor r8d, r8d
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401aba90
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x1400a513a
xor edx, edx
mov rcx, rdi
call fcn.14005d228
mov rcx, rax
test rax, rax
je 0x1400a513a
mov rax, qword [rax]
mov rax, qword [rax + 0xb0]
call qword [case.0x14014fce9.0]
mov rax, qword [rbx]
mov rdx, r14
mov rcx, rbx
mov rax, qword [rax + 0x198]
call qword [case.0x14014fce9.0]
test eax, eax
jne 0x1400a5096
xor eax, eax
jmp 0x1400a50f3
Function at 0x1400bf72c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbp, rdx
mov rbx, rcx
jne 0x1400bf81c
xor edx, edx
call fcn.14005d228
mov rcx, rbx
test rax, rax
je 0x1400bf774
mov rdx, rbp
call fcn.140109524
jmp 0x1400bf827
call fcn.14005d220
cmp dword [rbx + 0x1394], 0
mov esi, eax
je 0x1400bf78a
sub esi, dword [rbx + 0x1388]
mov r14d, dword [rbx + 0x1138]
test r14d, r14d
js 0x1400bf81c
cmp r14d, esi
jge 0x1400bf81c
mov edi, dword [rbp + 0x10]
cmp edi, 9
jne 0x1400bf7bd
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, al
btc edi, 7
shr edi, 6
or edi, 0x25
mov rcx, rbx
call fcn.14003a254
bt eax, 0x16
jae 0x1400bf7dd
cmp edi, 0x25
je 0x1400bf85f
cmp edi, 0x27
je 0x1400bf8b5
sub edi, 0xd
je 0x1400bf8fb
sub edi, 0xe
je 0x1400bf8c9
sub edi, 0xa
je 0x1400bf8b5
sub edi, 2
je 0x1400bf85f
mov rcx, rbx
cmp edi, 1
je 0x1400bf842
mov rax, qword [rbx]
mov edx, dword [rbp + 0x10]
mov rax, qword [rax + 0x728]
call qword [case.0x14014fce9.0]
test eax, eax
jne 0x1400bf858
mov rdx, rbp
mov rcx, rbx
call fcn.14006345c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, dword [rbx + 0x1138]
call fcn.14005cfcc
mov rdx, rax
mov rcx, rbx
call fcn.14005c5cc
mov eax, 1
jmp 0x1400bf827
inc dword [rbx + 0x1138]
cmp dword [rbx + 0x1138], esi
jl 0x1400bf874
and dword [rbx + 0x1138], 0
mov edx, r14d
mov rcx, rbx
call fcn.14005db18
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14005db18
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x1138]
mov rax, qword [rax + 0x4b8]
call qword [case.0x14014fce9.0]
jmp 0x1400bf81c
sub dword [rbx + 0x1138], 1
jns 0x1400bf874
lea eax, [rsi - 1]
mov dword [rbx + 0x1138], eax
jmp 0x1400bf874
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x6c0]
call qword [case.0x14014fce9.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x6c8]
call qword [case.0x14014fce9.0]
and dword [0x140351c44], 0
jmp 0x1400bf81c
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14005cfcc
mov rdx, rax
mov rcx, rbx
call fcn.14005c5cc
test eax, eax
jne 0x1400bf858
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14005cfcc
mov rdx, rax
mov rcx, rbx
call fcn.1400636f0
jmp 0x1400bf858
Function at 0x1400cd2c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov esi, edx
mov rdi, rcx
xor ebp, ebp
cmp edx, 0x79
jne 0x1400cd2ee
lea ecx, [rdx - 0x69]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400cd2f3
cmp esi, 0x5d
jne 0x1400cd318
or eax, 0xffffffff
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rdi
call fcn.1400cce68
mov eax, 1
jmp 0x1400cd3ba
mov edx, esi
mov rcx, qword [rdi + 0x1558]
call fcn.140138418
test eax, eax
jne 0x1400cd30e
cmp qword [rdi + 0x1560], rbp
je 0x1400cd374
lea rax, vtable.CMFCDisableMenuAnimation.0
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.14005ceb8
mov ebx, eax
mov dword [rsp + 0x28], eax
mov dword [0x140351e4c], ebp
mov rcx, qword [rdi + 0x1560]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x1b8]
mov edx, esi
call qword [case.0x14014fce9.0]
nop
mov dword [0x140351e4c], ebx
jmp 0x1400cd3ba
cmp qword [rdi + 0x1580], rbp
je 0x1400cd3b8
lea rax, vtable.CMFCDisableMenuAnimation.0
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.14005ceb8
mov ebx, eax
mov dword [rsp + 0x28], eax
mov dword [0x140351e4c], ebp
mov rcx, qword [rdi + 0x1580]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x1d0]
mov edx, esi
call qword [case.0x14014fce9.0]
nop
jmp 0x1400cd36c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400cf9b4
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1402ae7c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea eax, [rcx - 0x60]
xor esi, esi
mov edi, ecx
mov ebx, 0x12
cmp eax, 9
ja 0x1400cf9f6
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400cfa20
cmp dword [0x140350114], esi
jne 0x1400cfa20
lea eax, [rdi - 0x41]
cmp eax, 0x19
jbe 0x1400cfa1c
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400cfa1c
mov ecx, edi
call fcn.1401e7a60
jmp 0x1400cfa8d
mov eax, edi
jmp 0x1400cfa8d
lea rcx, [rsp + 0x40]
mov word [rsp + 0x34], si
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1400cfab2
call fcn.14002fb70
mov ecx, dword [rax + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, edi
mov rbx, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x34]
mov edx, eax
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.USER32.dll_ToAsciiEx]
mov al, byte [rsp + 0x34]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], al
mov byte [rsp + 0x31], sil
call qword [sym.imp.USER32.dll_CharUpperA]
movsx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401aba90
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140012dcc
int3