joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18023a610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 8], rax
test rcx, rcx
je 0x18023a803
cmp r8d, 0x80
jb 0x18023a803
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r14
mov r14d, 5
mov dword [rsp], 0x35343332
mov dword [rsp + 4], 0x30636970
nop word [rax + rax]
lea r8d, [r14 - 5]
lea rax, [r8 + rcx]
mov edx, r8d
and edx, 7
movzx ebp, byte [rsp + rdx]
xor byte [rax], bpl
lea eax, [r14 - 4]
mov edx, eax
and edx, 7
movzx esi, byte [rsp + rdx]
xor byte [rax + rcx], sil
lea eax, [r14 - 3]
mov edx, eax
and edx, 7
movzx edi, byte [rsp + rdx]
xor byte [rax + rcx], dil
lea eax, [r14 - 2]
mov edx, eax
and edx, 7
movzx ebx, byte [rsp + rdx]
lea edx, [r14 - 1]
xor byte [rax + rcx], bl
lea eax, [r8 - 4]
and eax, 7
movzx r11d, byte [rsp + rax]
lea eax, [r8 - 3]
and eax, 7
xor byte [rdx + rcx], r11b
mov edx, r14d
movzx r10d, byte [rsp + rax]
lea eax, [r8 - 2]
and eax, 7
xor byte [rdx + rcx], r10b
lea edx, [r14 + 1]
movzx r9d, byte [rsp + rax]
lea eax, [r8 - 1]
and eax, 7
xor byte [rdx + rcx], r9b
lea edx, [r14 + 2]
movzx r8d, byte [rsp + rax]
lea eax, [r14 + 3]
xor byte [rax + rcx], bpl
lea eax, [r14 + 4]
xor byte [rax + rcx], sil
lea eax, [r14 + 5]
xor byte [rax + rcx], dil
lea eax, [r14 + 6]
xor byte [rax + rcx], bl
lea eax, [r14 + 7]
xor byte [rax + rcx], r11b
lea eax, [r14 + 8]
xor byte [rax + rcx], r10b
lea eax, [r14 + 9]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0xa]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0xb]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0xc]
xor byte [rax + rcx], sil
lea eax, [r14 + 0xd]
xor byte [rax + rcx], dil
lea eax, [r14 + 0xe]
xor byte [rax + rcx], bl
lea eax, [r14 + 0xf]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x10]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x11]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x12]
xor byte [rax + rcx], r8b
lea eax, [r14 + 0x13]
xor byte [rax + rcx], bpl
lea eax, [r14 + 0x14]
xor byte [rax + rcx], sil
lea eax, [r14 + 0x15]
xor byte [rax + rcx], dil
lea eax, [r14 + 0x16]
xor byte [rdx + rcx], r8b
xor byte [rax + rcx], bl
lea eax, [r14 + 0x17]
xor byte [rax + rcx], r11b
lea eax, [r14 + 0x18]
xor byte [rax + rcx], r10b
lea eax, [r14 + 0x19]
xor byte [rax + rcx], r9b
lea eax, [r14 + 0x1a]
xor byte [rax + rcx], r8b
add r14d, 0x20
lea eax, [r14 - 5]
cmp eax, 0x80
jb 0x18023a670
mov r14, qword [rsp + 0x10]
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x28
ret
xor al, al
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x28
ret
Function at 0x18023bf80
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x70]
call fcn.180370eb0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x30]
call fcn.1800058a0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180160610
nop
lea rcx, [rsp + 0x30]
call fcn.1800057f0
lea rcx, [rsp + 0x50]
call fcn.1800057b0
mov r9, rax
mov r8d, dword [rsp + 0xb0]
lea rdx, str.Status
lea rcx, str.Matting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800057f0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180393f50
add rsp, 0xa8
ret

Function at 0x18023c8a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x370
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rdx, str.2345OCR
lea rcx, [rsp + 0x90]
call fcn.1800058a0
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.180370f70
nop
lea rcx, [rsp + 0x90]
call fcn.1800057f0
lea rdx, str.config.ini
lea rcx, [rsp + 0xb0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180160610
nop
lea rcx, [rsp + 0xb0]
call fcn.1800057f0
lea rcx, [rsp + 0x50]
call fcn.18015b0b0
movzx eax, al
test eax, eax
jne 0x18023c96c
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800057f0
movzx eax, byte [rsp + 0x30]
jmp 0x18023caa0
lea rax, [rsp + 0x150]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.1800057b0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x150]
lea r8, [0x1803cd4c0]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xd0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x110]
call fcn.180160610
nop
lea rcx, [rsp + 0xd0]
call fcn.1800057f0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xf0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x130]
call fcn.180160610
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x380]
call fcn.180005810
nop
lea rcx, [rsp + 0x130]
call fcn.1800057f0
nop
lea rcx, [rsp + 0xf0]
call fcn.1800057f0
mov rcx, qword [rsp + 0x380]
call fcn.18015af70
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0x110]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x50]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800057f0
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x370
pop rdi
ret
Function at 0x18023ccd0
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xc8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rdx, str.2345OCR
lea rcx, [rsp + 0x30]
call fcn.1800058a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.180370f70
nop
lea rcx, [rsp + 0x30]
call fcn.1800057f0
lea rdx, str.config.ini
lea rcx, [rsp + 0x50]
call fcn.1800058a0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.180160610
nop
lea rcx, [rsp + 0x50]
call fcn.1800057f0
lea rcx, [rsp + 0x70]
call fcn.1800057b0
mov r9, rax
mov r8d, dword [rsp + 0xd0]
lea rdx, str.Status
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x70]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x90]
call fcn.1800057f0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180393f50
add rsp, 0xc8
ret

Function at 0x18023d3a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x370
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rdx, str.2345PicDesigner
lea rcx, [rsp + 0x90]
call fcn.1800058a0
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.180370f70
nop
lea rcx, [rsp + 0x90]
call fcn.1800057f0
lea rdx, str.config.ini
lea rcx, [rsp + 0xb0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180160610
nop
lea rcx, [rsp + 0xb0]
call fcn.1800057f0
lea rcx, [rsp + 0x50]
call fcn.18015b0b0
movzx eax, al
test eax, eax
jne 0x18023d46c
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800057f0
movzx eax, byte [rsp + 0x30]
jmp 0x18023d5a0
lea rax, [rsp + 0x150]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.1800057b0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x150]
lea r8, [0x1803cd4c0]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.Application
lea rcx, [rsp + 0xd0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x110]
call fcn.180160610
nop
lea rcx, [rsp + 0xd0]
call fcn.1800057f0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xf0]
call fcn.1800058a0
nop
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x130]
call fcn.180160610
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x380]
call fcn.180005810
nop
lea rcx, [rsp + 0x130]
call fcn.1800057f0
nop
lea rcx, [rsp + 0xf0]
call fcn.1800057f0
mov rcx, qword [rsp + 0x380]
call fcn.18015af70
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0x110]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x50]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800057f0
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x370
pop rdi
ret
Function at 0x18023d770
Capabilities:
Read .ini file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xc8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rdx, str.2345PicDesigner
lea rcx, [rsp + 0x30]
call fcn.1800058a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.180370f70
nop
lea rcx, [rsp + 0x30]
call fcn.1800057f0
lea rdx, str.config.ini
lea rcx, [rsp + 0x50]
call fcn.1800058a0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.180160610
nop
lea rcx, [rsp + 0x50]
call fcn.1800057f0
lea rcx, [rsp + 0x70]
call fcn.1800057b0
mov r9, rax
mov r8d, dword [rsp + 0xd0]
lea rdx, str.Status
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x70]
call fcn.1800057f0
nop
lea rcx, [rsp + 0x90]
call fcn.1800057f0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180393f50
add rsp, 0xc8
ret
Function at 0x180251b20
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
je 0x180251c00
mov qword [rsp + 0x250], rdi
lea rdi, str.2345Pic_SetDefault
nop dword [rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x180251ba0
test rax, rax
je 0x180251bdd
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x180251bc0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x180251bf5
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x180251b80
jmp 0x180251bf8
mov rax, rbx
mov rdi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x240
pop rbx
ret
Function at 0x180254580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x180254653
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.180254680
nop
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edx, eax
mov rcx, rdi
call fcn.180170d10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x1802545fe
xor sil, sil
jmp 0x180254612
mov r8, rsi
mov rdx, rax
mov rcx, qword [rdi]
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
setne sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18025464f
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x18025464f
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18025464f
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18025be40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x8f0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x98]
call fcn.1800058e0
nop
mov dword [rsp + 0x4c], 0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x400
lea rax, [rsp + 0x4e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0x400
mov dl, 1
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.180205020
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x910]
mov rdx, qword [rsp + 0x908]
mov rax, qword [rsp + 0x900]
mov rcx, qword [rax + 0x20]
call fcn.1802043a0
movzx eax, al
test eax, eax
jne 0x18025bf42
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x98]
call fcn.1800057f0
movzx eax, byte [rsp + 0x40]
jmp 0x18025c0a8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x18025c078
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x98]
call fcn.18000e530
lea rcx, [rsp + 0x98]
call fcn.1800057a0
movzx eax, al
test eax, eax
jne 0x18025c01f
lea rcx, [rsp + 0x98]
call fcn.18015a000
lea r8, [rsp + 0x4e0]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.18025f660
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x918]
call fcn.18025f6b0
nop
lea rax, [rsp + 0xb8]
mov rcx, rax
call fcn.1800057f0
mov dword [rsp + 0x44], 0x400
mov dword [rsp + 0x48], 0x400
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xe0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x70]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x4e0]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
jmp 0x18025bf42
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x908]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x41], 1
lea rcx, [rsp + 0x98]
call fcn.1800057f0
movzx eax, byte [rsp + 0x41]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x8f0
pop rdi
ret
Function at 0x1802600e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdi, [rsp + 0x468]
call fcn.180019c40
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x200
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf_s]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x448
pop rdi
pop rbx
ret
Function at 0x180266620
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x240
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x18026676d
mov edx, dword [rdx + 8]
xor esi, esi
sub edx, 0x100
je 0x180266680
sub edx, 4
je 0x180266680
cmp edx, 0x12f
jne 0x180266769
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
mov esi, 1
mov eax, esi
jmp 0x18026676f
cmp qword [rbx + 0x10], 0x1b
jne 0x1802666c6
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x103
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.RCInplaceEdit
lea rcx, [rsp + 0x20]
call fcn.180159c10
test al, al
jne 0x18026676d
mov eax, dword [rbx + 8]
sub eax, 0x100
test eax, 0xfffffffb
jne 0x180266769
cmp qword [rbx + 0x10], 0xe5
mov qword [rsp + 0x270], rbp
mov qword [rsp + 0x278], rdi
mov edi, dword [rbx + 0x10]
jne 0x180266701
mov rcx, qword [rbx]
call qword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ebp, 0x8000
bts ebx, 0x1f
mov ecx, 0x12
and ax, bp
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 0x10
bts edi, 0x1e
and ax, bp
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, edi
mov rcx, r14
bts edx, 0x1d
and ax, bp
cmove edx, edi
call fcn.180266b60
mov rdi, qword [rsp + 0x278]
test al, al
mov rbp, qword [rsp + 0x270]
setne sil
mov eax, esi
jmp 0x18026676f
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x240
pop r14
pop rsi
pop rbx
ret
Function at 0x180272910
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
cmp qword [rcx + 0x60], 0
jne 0x180272a3e
xor esi, esi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], 7
mov word [rsp + 0x30], si
lea r8d, [rsi + 0x26]
lea rdx, str.02099BA0_F791_4224_AD07_4C4EA722B792
lea rcx, [r11 - 0x38]
call fcn.180005cd0
nop
lea ecx, [rsi + 0x10]
call fcn.180393f74
mov rbx, rax
mov qword [rsp + 0x28], rax
mov qword [rax], rsi
mov word [rax + 8], si
cmp qword [rsp + 0x40], rsi
je 0x1802729a6
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
jmp 0x1802729a9
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x1802729cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1802729cc
mov byte [rbx + 9], 1
mov qword [rdi + 0x60], rbx
cmp qword [rbx], 0
jne 0x180272a60
mov rcx, rbx
call fcn.1802704c0
mov qword [rdi + 0x60], rsi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180272a2b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180272a26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180272a26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180272aa5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180272aa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180272aa0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov al, 1
jmp 0x180272a40
Function at 0x1802759d0
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x40], rcx
xor edi, edi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x20], 7
mov word [rsp + 0x30], di
lea r8d, [rdi + 0x3a]
lea rdx, str.RCCompatibleModeMgr_679A9BE7_8DA8_40D2_868C_E9BCD8107A84
lea rcx, [r11 - 0x38]
call fcn.180005cd0
nop
mov qword [rbx], rdi
mov word [rbx + 8], di
cmp qword [rsp + 0x40], rdi
je 0x180275a4b
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
jmp 0x180275a4e
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x180275a71
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180275a71
mov byte [rbx + 9], 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180275ab6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180275ab1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180275ab1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1802c07f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r14, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
cmp eax, r10d
mov qword [rsp + 0x20], rax
mov ecx, r10d
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x78], ecx
mov rcx, rax
cmp eax, r10d
je 0x1802c0853
cmp byte [r14 + 0x10], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x1802c09f4
mov qword [rsp + 0x88], rbp
mov rbp, r10
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x1802c09d6
mov rax, rdi
mov qword [rsp + 0x70], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x1804e5318]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1802c09cb
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1802c0972
mov rcx, qword [rsp + 0x70]
test byte [rcx + 0x34], 4
mov rdx, qword [rcx + 0x28]
je 0x1802c08f9
mov eax, dword [rcx + 0x30]
cmp dword [rdx + 0x1c], eax
jb 0x1802c08f9
cmp dword [rdx + 0x80], ebx
je 0x1802c08f5
call fcn.1802ac900
jmp 0x1802c091a
xor ebx, ebx
jmp 0x1802c0925
mov ebx, dword [rdx + 0x2c]
test ebx, ebx
jne 0x1802c0977
mov eax, dword [rdx + 0xbc]
cmp dword [rdx + 0xb8], eax
jbe 0x1802c0915
call fcn.1802ae1f0
jmp 0x1802c091a
call fcn.1802ae020
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jne 0x1802c0977
add rsi, qword [rcx + 8]
mov rax, rdi
movsxd r8, dword [rsp + 0x78]
cqo
idiv qword [rsp + 0x20]
mov rcx, rsi
add rdx, qword [rsp + 0x80]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], 0
test rdi, rdi
jne 0x1802c0972
test r12d, r12d
jne 0x1802c0972
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
btr eax, 0x1f
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1802c09cb
test byte [rcx + 0x34], 0x20
je 0x1802c09c6
mov r8, qword [rcx + 0x28]
mov rax, qword [r8 + 0xa8]
dec dword [r8 + 0x98]
mov qword [rcx + 0x20], rax
mov r9, qword [r8 + 0x48]
movsxd rax, dword [r8 + 0xbc]
mov qword [r8 + 0xa8], rcx
mov edx, dword [rcx + 0x30]
mov r8, qword [rcx + 8]
dec edx
mov r10, qword [r9]
mov rcx, r9
imul rdx, rax
call qword [r10 + 0x90]
jmp 0x1802c09cb
call fcn.1802a7da0
add rdi, rbp
test ebx, ebx
je 0x1802c0871
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret