joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea3f0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], 0x180
lea r9d, [rbp + 0x40]
mov r8d, 0x8109
call fcn.1402a6884
mov esi, eax
test eax, eax
je 0x1400ea5af
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x60]
call fcn.140289490
lea edx, [rbp + 2]
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x60]
call fcn.14000dab0
nop
lea rdx, str.open
lea rcx, [rsp + 0x60]
call fcn.14000c3d0
mov rcx, rax
mov rdx, rdi
call fcn.14000c3d0
mov rcx, rax
lea rdx, str._error.__
call fcn.14000c3d0
mov rcx, rax
mov edx, esi
call fcn.14000f1f0
mov rcx, rax
lea rdx, [0x14030c7e0]
call fcn.14000c3d0
nop
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0xd8]
test cl, 2
jne 0x1400ea50d
mov rax, qword [rsp + 0xa8]
mov r8, qword [rax]
test r8, r8
je 0x1400ea50d
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xd0]
cmovb r8, qword [rsp + 0xd0]
sub r8, rdx
jmp 0x1400ea541
test cl, 4
jne 0x1400ea54f
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400ea54f
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xb8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x38]
call fcn.1400810d0
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400ea5a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea59f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea5eb
call fcn.140171af0
nop
lea rcx, [rsp + 0x60]
call fcn.14000f8a0
mov ecx, dword [rbx]
cmp ecx, 0xffffffff
je 0x1400ea5c3
xor edx, edx
lea r8d, [rdx + 2]
call fcn.1402a6e20
jmp 0x1400ea5c8
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
call fcn.14028c66c
nop
int3
Function at 0x1400ebc00
Capabilities:
Create thread

Disassembly:
add rcx, 8
jmp 0x1400ead80
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400ebc00
xor eax, eax
ret
push r14
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rbp, rdx
mov rdi, rcx
test r8d, r8d
jne 0x1400ebc3b
mov r8d, r9d
call fcn.1400ebdb0
jmp 0x1400ebd86
mov rax, qword [rcx + 0x140]
test rax, rax
jne 0x1400ebca4
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x148], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x150], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x1400ec3d0]
xor edx, edx
xor ecx, ecx
call fcn.1402967ac
mov qword [rdi + 0x140], rax
test rax, rax
je 0x1400ebd84
cmp qword [rdi + 0x148], 0
je 0x1400ebd84
cmp qword [rdi + 0x150], 0
je 0x1400ebd84
lea rax, vtable._BaseModule::CAutoLocker.0
mov qword [rsp + 0x38], rax
lea rsi, [rdi + 0xe8]
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x1400ebce6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
nop
lea rbx, [rdi + 0x118]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x20]
inc rax
cmp rcx, rax
ja 0x1400ebd0e
mov edx, 1
mov rcx, rbx
call fcn.1400ec4d0
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
and qword [rbx + 0x18], rax
mov rdx, qword [rbx + 0x18]
add rdx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x10]
dec rax
and rax, rdx
lea r14, [rax*8]
mov rcx, qword [rbx + 8]
cmp qword [rcx + r14], 0
jne 0x1400ebd51
mov ecx, 0x28
call fcn.140171ab4
mov rcx, qword [rbx + 8]
mov qword [r14 + rcx], rax
mov rcx, qword [rbx + 8]
mov rdx, rbp
mov rcx, qword [r14 + rcx]
call fcn.1400e5da0
inc qword [rbx + 0x20]
test rsi, rsi
je 0x1400ebd70
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rdi + 0x150]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
jmp 0x1400ebd86
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x1400f07b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f07df
or ebx, 1
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f07f2
or ebx, 2
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f0805
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f0818
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400f3450
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rcx
xor r12d, r12d
add rcx, 0x140
mov ebx, r12d
mov r15, r9
mov r14, r8
mov edi, edx
call fcn.1400ed5f0
test eax, eax
jle 0x1400f34e4
nop word [rax + rax]
mov edx, ebx
mov byte [rsp + 0x90], r12b
lea rcx, [rsi + 0x140]
call fcn.1400ecd50
lea rcx, [rsp + 0x90]
mov r9, r15
mov qword [rsp + 0x20], rcx
mov r8, r14
mov edx, edi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rsp + 0x90], r12b
jne 0x1400f3658
lea rcx, [rsi + 0x140]
inc ebx
call fcn.1400ed5f0
cmp ebx, eax
jl 0x1400f3490
sub edi, 0x100
je 0x1400f35db
sub edi, 4
je 0x1400f355c
cmp edi, 2
jne 0x1400f35c0
mov ecx, r14d
mov dword [rsp + 0x90], r12d
call fcn.14029035c
mov rcx, qword [rsi + 0x98]
lea r8, [rsp + 0x90]
mov word [rsp + 0x90], ax
lea rdx, [0x1400f58a0]
mov r9d, 0x8000000a
mov rax, qword [rcx]
call qword [rax + 0x298]
mov rbx, rax
test rax, rax
je 0x1400f35c0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x278]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x38]
mov al, 1
jmp 0x1400f35c2
cmp qword [rsi + 0xa0], r12
je 0x1400f35c0
mov rax, qword [rsi + 0xc8]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rsp + 0x44], rax
movdqu xmmword [rsp + 0x34], xmm0
mov word [rsp + 0x5e], r12w
movdqu xmmword [rsp + 0x4e], xmm1
mov dword [rsp + 0x30], 6
mov word [rsp + 0x4c], r14w
call fcn.1400f07b0
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsi + 0xa0]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x2b0]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r14, 9
jne 0x1400f35c0
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1400f363f
mov rax, qword [rcx]
call qword [rax + 0x220]
test al, al
je 0x1400f363f
mov rcx, qword [rsi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x238]
test al, al
je 0x1400f363f
mov rcx, qword [rsi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
lea rdx, str.RichEditUI
call fcn.1402897b8
test rax, rax
je 0x1400f363f
mov rcx, qword [rsi + 0xa0]
call fcn.14012e700
test al, al
jne 0x1400f35c0
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rsi
setns dl
call fcn.1400f4db0
mov al, 1
jmp 0x1400f35c2
Function at 0x1400fbc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r9d, r9d
mov dword [rbp - 0x39], 0x6f0053
lea rax, [0x1403d9950]
mov dword [rbp - 0x35], 0x740066
lea r8, [rbp - 0x39]
mov dword [rbp - 0x31], 0x610077
sub r8, rax
mov dword [rbp - 0x2d], 0x650072
mov dword [rbp - 0x29], 0x4d005c
mov edx, 0x3a
mov dword [rbp - 0x25], 0x630069
mov dword [rbp - 0x21], 0x6f0072
mov dword [rbp - 0x1d], 0x6f0073
mov dword [rbp - 0x19], 0x740066
mov dword [rbp - 0x15], 0x49005c
mov dword [rbp - 0x11], 0x74006e
mov dword [rbp - 0xd], 0x720065
mov dword [rbp - 9], 0x65006e
mov dword [rbp - 5], 0x200074
mov dword [rbp - 1], 0x780045
mov dword [rbp + 3], 0x6c0070
mov dword [rbp + 7], 0x72006f
mov dword [rbp + 0xb], 0x720065
mov dword [rbp + 0xf], 0x4d005c
mov dword [rbp + 0x13], 0x690061
mov dword [rbp + 0x17], 0x5c006e
mov dword [rbp + 0x1b], 0x650046
mov dword [rbp + 0x1f], 0x740061
mov dword [rbp + 0x23], 0x720075
mov dword [rbp + 0x27], 0x430065
mov dword [rbp + 0x2b], 0x6e006f
mov dword [rbp + 0x2f], 0x720074
mov dword [rbp + 0x33], 0x6c006f
mov dword [rbp + 0x37], 0x5c
lea rcx, [rdx + 0x7fffffc4]
test rcx, rcx
je 0x1400fbdc3
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400fbdc3
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400fbda0
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
mov word [rcx], r9w
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400fe720
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov dword [rsp + 0x38], r8d
xor ebx, ebx
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x30]
call fcn.1400fb920
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000dc30
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400fe780
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400e078c
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400fe81d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140289490
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test rax, rax
je 0x1400fe81d
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400fe82e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400fe86c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe88f
call fcn.140171af0
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
call fcn.14028c66c
int3
Function at 0x14010b240
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x1403b8c08]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x38], 0
mov rbx, rcx
je 0x14010b309
cmp qword [rcx + 0x28], 0
je 0x14010b309
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14010b2a0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401722d0
sub rsp, rcx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x14010b309
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
add rcx, 0x200
call fcn.1400ecc90
mov rbx, qword [rbx + 0x28]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x40]
mov byte [rsp + 0x28], 0
lea r8, str.textchanged
mov rcx, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
call fcn.1400f3f60
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140172190
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14011cc00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x14011cc68
cmp word [rdx], 0x3c
jne 0x14011cc5e
call fcn.14011a550
test al, al
jne 0x14011ccf4
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor r8d, r8d
call fcn.14011a620
jmp 0x14011cc3b
call fcn.1400f0310
mov rcx, rax
mov r8, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14011cc43
call fcn.1400f0310
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x14011cca8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x14011cc43
mov qword [rdi + 0x148], r15
call fcn.1400f0310
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.14011a9a0
test al, al
je 0x14011cc43
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14011b910
jmp 0x14011cc45
Function at 0x14012bd00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
movzx eax, word [r9 + 0x18]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
cmp ax, 0x41
je 0x14012bd76
cmp ax, 0x43
je 0x14012bd58
cmp ax, 0x58
jne 0x14012bdde
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14012bdde
lea r8, str.cutkey
jmp 0x14012bdc4
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14012bdde
lea r8, str.copykey
jmp 0x14012bdc4
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14012bdde
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x30]
mov edx, 0x102b
mov dword [rsp + 0x40], 2
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x3c], 2
mov rcx, qword [rcx + 0x5c0]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.selectallkey
mov rdx, qword [rbx + 0x28]
mov r9, rsi
mov rcx, qword [rbx + 0x20]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400f3f60
lea r11, [rsp + 0x90]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140130310
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x610], 0
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
je 0x1401303c0
cmp edx, 0x100
jne 0x14013039a
cmp di, 0xd
jne 0x14013039a
cmp byte [rcx + 0x61a], 0
je 0x14013036d
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14013039a
cmp byte [rbx + 0x61b], 0
jne 0x14013039a
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140130396
mov byte [rsp + 0x28], 0
lea r8, str.return
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rbx
call fcn.1400f3f60
xor eax, eax
jmp 0x1401303c5
mov rax, qword [rbx + 0x610]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + SafeArrayCopy]
jmp 0x1401303c5
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140131610
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rdx, [0x1403d8608]
mov ecx, 0x60
call fcn.140172710
xor edi, edi
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
je 0x14013167f
mov dword [rax], 2
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rdi
mov qword [rax + 0x50], rdi
mov qword [rax + 0x58], rdi
jmp 0x140131682
mov rbx, rdi
cmp qword [rsi + 0x18], 8
jb 0x14013168c
mov rsi, qword [rsi]
mov ebp, edi
test rsi, rsi
je 0x140131749
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140131749
mov edx, 1
mov qword [rsp + 0x30], rdi
mov r8d, edx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140131749
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x24], eax
cmp eax, 0x16
jb 0x140131749
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140131749
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140131749
mov r8d, dword [rbx + 0x24]
mov rdx, rax
mov rcx, rbx
call fcn.140130f30
mov ebp, eax
test eax, eax
jne 0x14013176f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14013175c
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x18], rdi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14013176f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140131787
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
test ebp, ebp
jne 0x1401317a2
mov rcx, rbx
call fcn.140130b80
lea edx, [rbp + 0x60]
mov rcx, rbx
call fcn.140171af0
xor eax, eax
jmp 0x1401317a5
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14013b4d0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x4ab8]
mov rbx, rcx
cmp eax, 1
jne 0x14013b520
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14013bd50]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call fcn.1402967ac
mov qword [rbx], rax
test rax, rax
je 0x14013b52f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rsp, 0x30
pop rbx
ret
xor ecx, ecx
mov eax, 2
lock cmpxchg dword [rbx + 0x4ab8], ecx
add rsp, 0x30
pop rbx
ret
Function at 0x14013c0e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
mov r12, qword [r8 + 0x18]
cmp r12, 8
jb 0x14013c124
mov r9, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r8, [r11 + r11]
xor ecx, ecx
test r8, r8
je 0x14013c164
movabs rbx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r9]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, r8
jb 0x14013c150
mov r9, qword [rsi + 0x30]
and r9, rdx
mov rbx, qword [rsi + 8]
mov rcx, r9
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov r15, qword [rax + rcx*8]
cmp rbx, r15
je 0x14013c223
mov rbx, qword [rax + rcx*8 + 8]
mov rbx, qword [rbx]
nop
cmp rbx, r15
je 0x14013c223
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x14013c1ac
mov rax, qword [rbx + 0x10]
mov r8, r10
cmp r12, 8
jb 0x14013c1b8
mov r8, qword [r10]
cmp r11, qword [rbx + 0x20]
jne 0x14013c190
mov rdx, r11
test r11, r11
je 0x14013c1e4
sub r8, rax
nop dword [rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14013c190
add rax, 2
sub rdx, 1
jne 0x14013c1d0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rdi + 0x10]
call fcn.14000ece0
mov edx, 0x30
mov rcx, rdi
call fcn.140171af0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14013c2ba
mov rax, qword [rdi]
cmp rbx, rax
je 0x14013c258
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r9, 4
mov rdx, qword [rsi + 0x18]
add rdx, r9
mov rax, qword [rdx]
cmp rax, qword [rsi + 8]
jne 0x14013c27a
mov qword [rdx], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r9 + 8], rdi
jmp 0x14013c2a6
cmp rax, rbx
jne 0x14013c284
mov qword [rdx], rdi
jmp 0x14013c2a6
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14013c2a6
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r9 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r9 + 8], rcx
mov rcx, rsi
call fcn.14013e570
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14013d35c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x630
jmp method.DuiLib::CMultiListUIEx.virtual_696
Function at 0x14013eb00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r12, qword [r8 + 0x18]
mov rbx, r8
mov r14, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r10, r8
cmp r12, 8
jb 0x14013eb37
mov r10, qword [r8]
lea r8, [r14 + r14]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x14013eb74
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + r10]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r8
jb 0x14013eb60
mov rdi, qword [r11 + 0x18]
mov rax, qword [r11 + 0x30]
mov rdx, qword [r11 + 8]
and rax, r9
mov rsi, rax
add rsi, rsi
add rax, rax
mov rcx, qword [rdi + rsi*8]
mov rbp, qword [rdi + rax*8]
lea r11, [rdi + rax*8]
cmp rbp, rdx
jne 0x14013eba2
mov rax, rdx
jmp 0x14013eba9
mov rax, qword [r11 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14013ec68
mov r8, rbx
cmp r12, 8
jb 0x14013ebbe
mov r8, qword [rbx]
cmp qword [rcx + 0x28], 8
lea r10, [rcx + 0x10]
jb 0x14013ebcd
mov r10, qword [rcx + 0x10]
mov r9, qword [rcx + 0x20]
cmp r9, r14
jne 0x14013ec02
test r9, r9
je 0x14013ebf5
sub r10, r8
nop
movzx eax, word [r8]
cmp word [r10 + r8], ax
jne 0x14013ec02
add r8, 2
sub r9, 1
jne 0x14013ebe0
mov r8, rcx
cmp rbp, rdx
jne 0x14013ec07
mov rax, rdx
jmp 0x14013ec0f
mov rcx, qword [rcx]
jmp 0x14013eb98
mov rax, qword [rdi + rsi*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14013ec5a
cmp qword [rcx + 0x28], 8
lea rax, [rcx + 0x10]
jb 0x14013ec23
mov rax, qword [rcx + 0x10]
mov r11, rbx
cmp r12, 8
jb 0x14013ec2f
mov r11, qword [rbx]
cmp r14, qword [rcx + 0x20]
jne 0x14013ec5a
mov r10, r14
test r14, r14
je 0x14013ec55
sub r11, rax
movzx r9d, word [rax]
cmp word [r11 + rax], r9w
jne 0x14013ec5a
add rax, 2
sub r10, 1
jne 0x14013ec40
mov rcx, qword [rcx]
jmp 0x14013ebf8
cmp r8, rcx
je 0x14013ec68
mov qword [r15], r8
mov qword [r15 + 8], rcx
jmp 0x14013ec6f
mov qword [r15], rdx
mov qword [r15 + 8], rdx
mov rbx, qword [rsp + 0x20]
mov rax, r15
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret