joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b0840
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rdx
add rcx, 0x18
call fcn.140138318
test eax, eax
je 0x1400b088a
mov ecx, eax
call fcn.140138448
mov rsi, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
call fcn.14013833c
test eax, eax
je 0x1400b08a3
mov ecx, eax
call fcn.140138448
nop
movsxd rax, dword [rdi + 0x290]
cmp rsi, rax
jae 0x1400b08c8
mov rdx, rbx
lea rcx, [rdi + 8]
call fcn.1400b0c60
nop
mov rcx, rbx
call fcn.14000f150
mov al, 1
jmp 0x1400b08ee
call fcn.1400a7f30
cmp byte [rax + 0x28c], 0
je 0x1400b08e4
lea rcx, [0x1402c4710]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rcx, rbx
call fcn.14000f150
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14013a450
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400b1450
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400b1485
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_72
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
call fcn.140026fc0
mov rbp, rax
test rbx, rbx
jle 0x1400b14f5
test rax, rax
jle 0x1400b14d1
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call fcn.1400272c0
mov rcx, rax
mov r8, rbp
mov rdx, r14
call fcn.14000cf80
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call fcn.1400270c0
test rbx, rbx
jle 0x1400b14f5
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400b14f5
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140226380
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400b1520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400b1555
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_64
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
call fcn.140027110
mov rbp, rax
test rbx, rbx
jle 0x1400b15d2
test rax, rax
jle 0x1400b15a1
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call fcn.1400272e0
mov rdx, rax
mov r8, rbp
mov rcx, r14
call fcn.14000cf80
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call fcn.140027240
test rbx, rbx
jle 0x1400b15d2
cmp qword [rdi + 0x80], 0
je 0x1400b15d2
mov rcx, rdi
call fcn.1400b1f40
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140227008
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400b1a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rcx
mov dword [rbp + 0x27], edx
call fcn.140023cf0
lea rdx, [rbp + 0x27]
mov dword [rbp + 7], eax
lea rcx, [rbp + 7]
call fcn.140023c60
test al, al
je 0x1400b1add
lea rcx, [rbp + 0x27]
call fcn.140023ca0
jmp 0x1400b1c39
mov rcx, rdi
mov qword [rsp + 0xb0], rbx
call fcn.1400272c0
test rax, rax
je 0x1400b1b28
mov rcx, rdi
call fcn.1400271b0
mov rcx, rdi
mov rbx, rax
call fcn.1400272c0
cmp rax, rbx
jae 0x1400b1b28
mov rcx, rdi
call fcn.140027000
lea rcx, [rbp + 0x27]
mov rbx, rax
call fcn.140023c50
mov byte [rbx], al
mov eax, dword [rbp + 0x27]
jmp 0x1400b1c31
cmp qword [rdi + 0x80], 0
je 0x1400b1c2c
mov rcx, rdi
call fcn.140027300
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1400b1b60
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call fcn.1400271e0
cmp qword [rdi + 0x68], 0
lea rcx, [rbp + 0x27]
jne 0x1400b1b93
mov rbx, qword [rdi + 0x80]
call fcn.140023c50
movsx ecx, al
mov rdx, rbx
call fcn.140236390
cmp eax, 0xffffffff
je 0x1400b1c2c
mov eax, dword [rbp + 0x27]
jmp 0x1400b1c31
call fcn.140023c50
mov rcx, qword [rdi + 0x68]
lea r8, [rbp + 0xf]
mov qword [rsp + 0x38], r8
lea rdx, [rdi + 0x74]
lea r8, [rbp + 0x4f]
mov byte [rbp + 0x1f], al
mov qword [rsp + 0x30], r8
lea r9, [rbp + 0x20]
mov rax, qword [rcx]
lea r8, [rbp + 0x2f]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 0x1f]
call qword [rax + gethostname]
test eax, eax
js 0x1400b1c2c
cmp eax, 1
jle 0x1400b1bf0
cmp eax, 3
jne 0x1400b1c2c
movsx ecx, byte [rbp + 0x1f]
mov rdx, qword [rdi + 0x80]
jmp 0x1400b1b7d
mov rbx, qword [rbp + 0xf]
lea rax, [rbp + 0x2f]
sub rbx, rax
je 0x1400b1c1a
mov r9, qword [rdi + 0x80]
lea rcx, [rbp + 0x2f]
mov r8, rbx
mov edx, 1
call fcn.140226380
cmp rbx, rax
jne 0x1400b1c2c
lea rax, [rbp + 0x1f]
mov byte [rdi + 0x71], 1
cmp qword [rbp + 0x17], rax
jne 0x1400b1b20
call fcn.140023cf0
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14013a450
mov rdi, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
Function at 0x1400c94f0
Capabilities:
Get common file path
Get file version info

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x20], 0
call fcn.14000f250
mov dword [rsp + 0x20], 1
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400c96da
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.1400803b0
nop
lea rdx, str._ntoskrnl.exe
lea rcx, [rsp + 0x68]
call fcn.14000ee10
lea rcx, [rsp + 0x68]
call fcn.14000ab60
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x1400c96d0
mov ecx, esi
call fcn.140221c10
mov rdi, rax
test rax, rax
je 0x1400c96d0
lea rcx, [rsp + 0x68]
call fcn.14000ab60
mov rcx, rax
mov r9, rdi
mov r8d, esi
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400c96c7
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x58]
lea rdx, [0x1402c65bc]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400c96c7
mov rsi, qword [rsp + 0x58]
cmp dword [rsi], 0xfeef04bd
jne 0x1400c96c7
movzx edx, word [rsi + 0xa]
lea rcx, [rsp + 0x28]
call fcn.140032c10
mov rdx, rax
mov rcx, rbx
call fcn.14002db40
lea rcx, [rsp + 0x28]
call fcn.14000f150
lea rdx, [0x1402bf554]
mov rcx, rbx
call fcn.140020ae0
movzx edx, word [rsi + 8]
lea rcx, [rsp + 0x28]
call fcn.140032c10
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400284a0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
lea rdx, [0x1402bf554]
mov rcx, rbx
call fcn.140020ae0
movzx edx, word [rsi + 0xe]
lea rcx, [rsp + 0x28]
call fcn.140032c10
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400284a0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
lea rdx, [0x1402bf554]
mov rcx, rbx
call fcn.140020ae0
movzx edx, word [rsi + 0xc]
lea rcx, [rsp + 0x28]
call fcn.140032c10
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400284a0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
mov rcx, rdi
call fcn.140226d80
nop
lea rcx, [rsp + 0x68]
call fcn.1400050f0
mov rax, rbx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14013a450
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400cb030
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
mov r8d, InitCommonControls
lea r10, [rcx + 0xf]
cmp rcx, rax
ja 0x1400cb04b
xor r9d, r9d
cmp r10, rdx
jae 0x1400cb05e
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx], xmm1
mov r9, r8
cmp r9, r8
jae 0x1400cb080
sub rdx, rcx
lea rax, [r9 + rcx]
sub r8, r9
nop dword [rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1400cb070
ret

Function at 0x1400cb090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx]
mov edi, 1
mov r14, r8
mov rsi, rcx
mov eax, dword [r9]
xor eax, dword [rdx]
mov dword [rsp + 0x20], eax
mov eax, dword [r9 + 4]
xor eax, dword [rdx + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [r9 + 8]
xor eax, dword [rdx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [r9 + 0xc]
xor eax, dword [rdx + 0xc]
mov dword [rsp + 0x2c], eax
mov rax, qword [rcx + 8]
sub rax, r9
sar rax, 4
dec rax
cmp rax, rdi
jbe 0x1400cb15d
mov qword [rsp + 0x50], rbx
mov ebx, edi
lea rcx, [rsp + 0x20]
call fcn.1400c9e20
lea rcx, [rsp + 0x20]
call fcn.1400ca0a0
lea rcx, [rsp + 0x20]
call fcn.1400ca320
shl rbx, 4
inc edi
add rbx, qword [rsi]
mov eax, dword [rbx]
xor dword [rsp + 0x20], eax
mov eax, dword [rbx + 4]
xor dword [rsp + 0x24], eax
mov eax, dword [rbx + 8]
xor dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xc]
xor dword [rsp + 0x2c], eax
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 4
dec rax
mov ebx, edi
cmp rbx, rax
jb 0x1400cb101
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400c9e20
lea rcx, [rsp + 0x20]
call fcn.1400ca0a0
mov r9, qword [rsi + 8]
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
xor r8d, dword [r9 - 0x10]
xor edx, dword [r9 - 0xc]
xor ecx, dword [r9 - 8]
mov eax, dword [rsp + 0x2c]
xor eax, dword [r9 - 4]
mov dword [r14 + 0xc], eax
mov dword [r14], r8d
mov dword [r14 + 4], edx
mov dword [r14 + 8], ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14013a450
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400cb1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx + 8]
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov r14, r8
mov eax, dword [r9 - 0x10]
xor eax, dword [rdx]
mov dword [rsp + 0x20], eax
mov eax, dword [r9 - 0xc]
xor eax, dword [rdx + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [r9 - 8]
xor eax, dword [rdx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [r9 - 4]
xor eax, dword [rdx + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.1400ca1d0
lea rcx, [rsp + 0x20]
call fcn.1400c9f60
mov r9, qword [rsi]
mov rdi, qword [rsi + 8]
sub rdi, r9
sar rdi, 4
sub rdi, 2
je 0x1400cb2b1
mov qword [rsp + 0x50], rbx
mov rbx, rdi
shl rbx, 4
nop dword [rax + rax]
mov rcx, qword [rsi]
add rcx, rbx
mov eax, dword [rcx]
xor dword [rsp + 0x20], eax
mov eax, dword [rcx + 4]
xor dword [rsp + 0x24], eax
mov eax, dword [rcx + 8]
xor dword [rsp + 0x28], eax
mov eax, dword [rcx + 0xc]
lea rcx, [rsp + 0x20]
xor dword [rsp + 0x2c], eax
call fcn.1400ca660
lea rcx, [rsp + 0x20]
call fcn.1400ca1d0
lea rcx, [rsp + 0x20]
call fcn.1400c9f60
add rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400cb260
mov r9, qword [rsi]
mov rbx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x20]
xor r8d, dword [r9]
mov edx, dword [rsp + 0x24]
xor edx, dword [r9 + 4]
mov ecx, dword [rsp + 0x28]
xor ecx, dword [r9 + 8]
mov eax, dword [rsp + 0x2c]
xor eax, dword [r9 + 0xc]
mov dword [r14 + 0xc], eax
mov dword [r14], r8d
mov dword [r14 + 4], edx
mov dword [r14 + 8], ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14013a450
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400ccd50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0
mov rsi, rcx
mov eax, dword [rcx + 0x14]
mov rbp, rdx
mov ecx, eax
mov rdi, r8
shr ecx, 3
mov edx, dword [rsi + 0x18]
and ecx, 0x3f
lea r9d, [rax + r8*8]
lea eax, [r8*8]
mov dword [rsi + 0x14], r9d
cmp r9d, eax
jae 0x1400ccd95
inc edx
mov eax, edi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, ecx
add eax, edx
mov r8d, ebx
mov dword [rsi + 0x18], eax
cmp rdi, r8
jb 0x1400ccdef
mov eax, ecx
mov rdx, rbp
lea rcx, [rsi + 0x1c]
add rcx, rax
call fcn.14021eff0
lea rdx, [rsi + 0x1c]
mov rcx, rsi
call fcn.1400cce20
lea ecx, [rbx + 0x3f]
cmp rcx, rdi
jae 0x1400ccdeb
mov edx, ebx
mov rcx, rsi
add rdx, rbp
call fcn.1400cce20
add ebx, 0x40
lea ecx, [rbx + 0x3f]
cmp rcx, rdi
jb 0x1400ccdd3
xor ecx, ecx
jmp 0x1400ccdf1
xor ebx, ebx
mov eax, ebx
lea rdx, [rbx + rbp]
sub rdi, rax
mov eax, ecx
lea rcx, [rsi + 0x1c]
mov r8, rdi
add rcx, rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14021eff0
Function at 0x1400d2034
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rdi + 8]
mov ebx, edi
test ax, ax
cmovs ebx, ecx
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d2065
or ebx, 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d2078
or ebx, 2
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d208b
or ebx, 4
mov ecx, Ordinal_22
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d209e
or ebx, 0x20
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d52dc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea r15, [rcx + 0x540]
mov rbx, rcx
xor r13d, r13d
mov rcx, r15
mov r12, r9
mov r14, r8
mov edi, edx
mov esi, r13d
call fcn.1400cee90
test eax, eax
jle 0x1400d535b
mov edx, esi
mov byte [rbp + 0x30], r13b
mov rcx, r15
call fcn.1400ce868
lea rcx, [rbp + 0x30]
mov r9, r12
mov qword [rsp + 0x20], rcx
mov r8, r14
mov edx, edi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rbp + 0x30], r13b
jne 0x1400d53c3
mov rcx, r15
inc esi
call fcn.1400cee90
cmp esi, eax
jl 0x1400d531f
sub edi, 0x100
je 0x1400d543c
sub edi, 4
je 0x1400d53c7
cmp edi, 2
jne 0x1400d541c
mov ecx, r14d
mov dword [rbp + 0x30], r13d
call fcn.140233394
mov rcx, qword [rbx + 0x160]
lea r8, [rbp + 0x30]
mov word [rbp + 0x30], ax
lea rdx, [0x1400d70e4]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x268]
mov rbx, rax
test rax, rax
je 0x1400d541c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x250]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov al, 1
jmp 0x1400d541e
cmp qword [rbx + 0x168], r13
je 0x1400d541c
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call fcn.14021ee30
mov rax, qword [rbx + 0x190]
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x30], 6
mov word [rbp - 0x14], r14w
call fcn.1400d2034
mov word [rbp - 0x12], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x168]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r14, 9
jne 0x1400d541c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400d54a4
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400d54a4
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400d54a4
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, [0x140264b70]
call fcn.14021e74c
test rax, rax
je 0x1400d54a4
mov rcx, qword [rbx + 0x168]
call fcn.1400e086c
test al, al
jne 0x1400d541c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400d54f6
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400d54f6
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400d54f6
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, str.WkeWebkitUI
call fcn.14021e74c
test rax, rax
jne 0x1400d541c
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.1400d6930
jmp 0x1400d53c3
Function at 0x1400d651c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0xc8]
cmp rax, rcx
je 0x1400d654d
cmp rbx, qword [rdi + 0x168]
je 0x1400d654d
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rdi + 0x168]
cmp rbx, rax
je 0x1400d666c
test rax, rax
je 0x1400d65ca
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call fcn.14021ee30
mov dword [rsp + 0x30], Ordinal_26
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, [0x140264bf8]
xor r9d, r9d
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.1400d612c
and qword [rdi + 0x168], 0
test rbx, rbx
je 0x1400d666c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp rax, rdi
jne 0x1400d666c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
je 0x1400d666c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x1400d666c
xor edx, edx
mov qword [rdi + 0x168], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call fcn.14021ee30
mov dword [rsp + 0x30], Ordinal_26
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, [0x140264c10]
mov byte [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.1400d612c
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400d7ee8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rcx
call fcn.1400cd744
mov rcx, rax
mov edi, 0xfffffff0
mov edx, edi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
and ebx, 0xff3fffff
or ebx, 0x6000000
mov rcx, rsi
call fcn.1400cd744
mov rcx, rax
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea r14, [rsi + 0x58]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.1400d1c04
mov rax, rsi
lea rcx, [rsi + 0x40]
neg rax
sbb rdx, rdx
and rdx, rcx
mov rcx, r14
call fcn.1400d0e1c
lea rcx, [rbp + 0xf0]
call fcn.1400e6d6c
nop
mov rax, qword [rsi]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [rax + 0x50]
nop
lea rcx, [rbp - 0x30]
call fcn.1400cf128
lea rdx, [rsp + 0x40]
mov rcx, rsi
test al, al
mov rax, qword [rsi]
jne 0x1400d8020
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.1400ce874
mov rcx, rax
call fcn.14022f6b0
movzx ebx, ax
lea rcx, [rsp + 0x40]
call fcn.1400ce724
mov rax, rsi
lea rcx, [rsi + 0x48]
neg rax
sbb rdi, rdi
and rdi, rcx
lea rcx, [rbp - 0x30]
call fcn.1400ce874
mov r8, rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9, rdi
mov edx, ebx
lea rcx, [rbp + 0xf0]
call fcn.1400e7dd0
mov rbx, rax
jmp 0x1400d8066
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.1400ce874
mov rcx, rsi
lea rdx, [rsi + 0x48]
neg rcx
sbb r9, r9
and r9, rdx
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1400e7dd0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1400ce724
test rbx, rbx
jne 0x1400d80d0
or r8d, 0xffffffff
lea rdx, [0x140264e70]
lea rcx, [rsp + 0x40]
call fcn.1400ce5e8
nop
mov rax, qword [rsi]
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [rax + 0x58]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400ce958
nop
lea rcx, [rbp + 0x60]
call fcn.1400ce724
lea rcx, [rsp + 0x40]
call fcn.1400ce874
mov rdx, rax
lea r9d, [rbx + 0x10]
lea r8, str.Duilib
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
mov rcx, r14
call fcn.1400d0efc
mov rax, rsi
lea r8, [rsi + 0x38]
neg rax
sbb rdx, rdx
and rdx, r8
mov rcx, r14
call fcn.1400d0d38
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + gethostname]
nop
lea rcx, [rbp - 0x30]
call fcn.1400ce724
nop
lea rcx, [rbp + 0xf0]
call fcn.1400e8514
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.14013a450
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400de604
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x14031f2d0]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1400de6e9
cmp qword [rcx + 0x20], 0
je 0x1400de6e9
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400de664
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14013b200
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400de6e9
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x1f8
call fcn.1400ce80c
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + gethostname]
mov byte [rsp + 0x28], 0
lea r8, [0x140266910]
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov rdx, rbx
call fcn.1400d612c
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, rax
call fcn.1400d1ec0
test al, al
je 0x1400de6e9
mov rcx, qword [rdi + 0x20]
call fcn.1400daca8
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14013a450
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1400e2b00
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x710], r14
je 0x1400e2bae
cmp edx, 0x100
jne 0x1400e2b88
cmp r8, 0xd
jne 0x1400e2b88
cmp byte [rcx + 0x71a], r14b
je 0x1400e2b5f
lea ecx, [r8 + 4]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400e2b88
cmp byte [rbx + 0x71b], r14b
jne 0x1400e2b88
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400e2b84
mov byte [rsp + 0x28], r14b
lea r8, [0x140266900]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, rbx
call fcn.1400d612c
xor eax, eax
jmp 0x1400e2bb3
mov rax, qword [rbx + 0x710]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + Ordinal_26]
jmp 0x1400e2bb3
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret