joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400626f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rbx, rcx
call qword [rax + 0x568]
test byte [rbx + 0x27c], 4
jne 0x14006272b
movzx eax, byte [rbx + 0x254]
test al, 1
je 0x140062733
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x4b8]
mov al, 1
add rsp, 0x20
pop rbx
ret
test al, 2
je 0x14006274b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x4e0]
mov al, 1
add rsp, 0x20
pop rbx
ret
test al, 4
je 0x14006279b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbx + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
lea rdx, [rsp + 0x30]
mov rcx, rbx
movzx r11d, ax
mov rax, qword [rbx]
shr r11d, 0xf
test r11d, r11d
setne r8b
call qword [rax + 0x550]
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.140061ce0
test al, al
je 0x1400627d0
cmp byte [0x140275049], 0
je 0x1400627d0
call fcn.1400794f0
test eax, eax
jne 0x1400627d0
mov rcx, rbx
call fcn.140013ba8
test rax, rax
je 0x1400627d0
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_BringWindowToTop]
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140063e80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x40], r8d
mov rax, qword [rcx]
mov qword [rsp + 0x28], r8
mov r8, rdx
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rcx
call qword [rax + 0x668]
test al, al
je 0x140063ec5
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140063f32
mov ecx, 1
mov qword [rsp + 0x50], rdi
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x8000
test di, ax
je 0x140063f16
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140063f16
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140063f16
mov al, 1
jmp 0x140063f18
xor eax, eax
and byte [rbx + 0x20], 0xfd
mov rdi, qword [rsp + 0x50]
and al, 1
add al, al
or al, 1
or byte [rbx + 0x20], al
xor eax, eax
add rsp, 0x30
pop rbx
ret
and byte [rbx + 0x20], 0xfc
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14006d590
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
test byte [rcx + 0x1d8], 4
mov rbx, rcx
jne 0x14006d76e
movzx eax, byte [rcx + 0x254]
test al, 4
jne 0x14006d76e
test al, 2
jne 0x14006d76e
test al, 1
jne 0x14006d76e
call fcn.1400636c0
test rax, rax
jne 0x14006d76e
mov rcx, rbx
call fcn.14000a5c4
bt eax, 0x1c
jb 0x14006d5ee
test byte [rbx + 0x2a0], 2
je 0x14006d76e
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14006d76e
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x40], rdi
xor dil, dil
call fcn.140068350
cmp eax, 1
jne 0x14006d66d
movzx eax, byte [rbx + 0x27c]
mov edx, 1
movzx esi, dil
test al, 4
mov ecx, edx
cmovne esi, edx
and al, 0xfb
mov byte [rbx + 0x27c], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x14006d68c
cmp qword [rbx + 0x40], 0
je 0x14006d68c
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, qword [rbx + 0x40]
jne 0x14006d68c
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x14006d68c
movzx ecx, byte [rbx + 0x27c]
movzx esi, dil
mov edx, 1
test cl, 4
cmove esi, edx
or cl, 4
mov byte [rbx + 0x27c], cl
call qword [sym.imp.USER32.dll_GetFocus]
movzx edi, byte [rbx + 0x27c]
and dil, 1
test rax, rax
je 0x14006d6bc
mov rcx, qword [rbx + 0x40]
cmp rcx, rax
je 0x14006d6b8
mov rdx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x14006d6bc
mov al, 1
jmp 0x14006d6be
xor eax, eax
and byte [rbx + 0x27c], 0xfe
and al, 1
or byte [rbx + 0x27c], al
movzx eax, byte [rbx + 0x27c]
and al, 1
cmp dil, al
mov rdi, qword [rsp + 0x40]
jne 0x14006d6e9
test sil, sil
je 0x14006d769
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rax + 0x40]
mov edx, 0x85
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x2d0]
test eax, eax
je 0x14006d769
mov rcx, rbx
call fcn.140013ba8
lea rdx, str.CExtMiniDockFrameWnd
mov rcx, rax
mov rbx, rax
call fcn.14001b150
test eax, eax
je 0x14006d769
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14007a0d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
bt rcx, 0x1d
jae 0x14007a0e5
mov eax, 1
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rdi
lea rdi, [0x140260c08]
xor ebx, ebx
mov esi, 0x8000
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
jne 0x14007a130
inc ebx
add rdi, 4
cmp ebx, 9
jb 0x14007a102
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret

Function at 0x14007cc40
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x14007cca3
cmp qword [rcx + 0x30], 0
jne 0x14007cc75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x14007bed0]
lea ecx, [r8 + 7]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x30], rax
cmp qword [rbx + 0x38], 0
jne 0x14007ccd1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x14007c920]
lea ecx, [r8 + 2]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x38], rax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14007ccba
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x30], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14007ccd1
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x38], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400823f0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
xor r8d, r8d
lea rdx, [0x1402729a8]
lea rcx, [rsp + 0x48]
call fcn.14000a314
nop
or edx, 0xffffffff
lea rcx, [rsp + 0x48]
call fcn.14000a278
xor edx, edx
mov rcx, qword [0x1402729a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400824bd
lea rcx, [rsp + 0x38]
call fcn.1400788e0
lea r11, [rsp + 0x38]
mov qword [rbx], r11
lea rax, [rbx + 0x820]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1400814b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x818], rax
test rax, rax
je 0x1400824a6
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x818]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x38]
call fcn.14007bce0
jmp 0x1400824b3
mov rcx, qword [0x1402729a0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rsp + 0x38]
call fcn.14000a268
mov rcx, qword [rbx + 0x818]
test rcx, rcx
je 0x1400824cf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call fcn.14000a294
nop
lea rcx, [rsp + 0x48]
call fcn.14000a294
add rsp, 0x60
pop rbx
ret
Function at 0x1400ae9f0
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x1400aeb15
cmp qword [rcx + 0x70], 0
jne 0x1400aeb2c
mov eax, dword [rcx + 0x7c]
test al, 0x1f
je 0x1400aea3a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400add60]
lea ecx, [r8 + 7]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
test al, 0x20
je 0x1400aea65
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400ae010]
lea ecx, [r8 + 2]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
test al, 0x40
je 0x1400aea90
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400ae120]
lea ecx, [r8 + 3]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
test al, al
jns 0x1400aeabb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400ae280]
lea ecx, [r8 + 6]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
bt eax, 8
jae 0x1400aeae8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400ae3e0]
lea ecx, [r8 + 4]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
bt eax, 9
jae 0x1400aeb2c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x1400ae550]
lea ecx, [r8 + 0xc]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x70]
test rcx, rcx
je 0x1400aeb2c
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x70], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1400b1120
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx edi, r9b
movzx esi, r8b
mov rax, rdx
mov rbp, rcx
test r8b, r8b
jne 0x1400b1159
test r9b, r9b
jne 0x1400b1159
xor al, al
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rdx, rdx
jne 0x1400b1164
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400b1147
mov qword [rsp + 0x30], rbx
xor bl, bl
test dil, dil
je 0x1400b1199
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x50]
test ax, ax
je 0x1400b1199
movzx ecx, ax
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400b11ba
test sil, sil
je 0x1400b11bc
mov ecx, 2
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400b11ba
lea ecx, [rax + 8]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400b11bc
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b5a90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x158], rbx
movzx esi, r9b
movzx r12d, r8b
mov rbx, rdx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x18]
test r12b, r12b
jne 0x1400b5adb
test sil, sil
jne 0x1400b5adb
xor al, al
jmp 0x1400b5c6c
test rbx, rbx
jne 0x1400b5ae9
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400b5c6c
xor bl, bl
mov byte [rsp + 0x30], bl
test sil, sil
je 0x1400b5c0b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x50]
test ax, ax
je 0x1400b5c0b
movzx esi, ax
mov ecx, esi
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400b5c0b
mov ecx, esi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
je 0x1400b5c0b
mov edx, 2
mov r8d, 0x1000
lea rcx, [rsp + 0x50]
call fcn.14019e184
nop
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14019e200
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14019b408
mov qword [rsp + 0x20], 0
mov esi, 1
mov r9d, 0x1000
mov r8d, esi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.14001af2c
nop
mov rax, qword [rdi]
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call qword [rax + 0x28]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
movzx ebx, bl
test al, al
cmove ebx, esi
mov byte [rsp + 0x30], bl
lea rcx, [rsp + 0xc0]
call fcn.14001aed0
nop
jmp 0x1400b5bf0
lea rcx, [rsp + 0x50]
call fcn.14019e2f4
nop
lea rcx, [rsp + 0x50]
call fcn.14019e1c4
test bl, bl
jne 0x1400b5c64
jmp 0x1400b5c10
mov esi, 1
test r12b, r12b
je 0x1400b5c64
mov ecx, 2
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400b5c31
lea ecx, [rax + 8]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400b5c64
mov ecx, 2
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x1400b5c64
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1400b1b30
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x20]
movzx ebx, bl
test al, al
cmove ebx, esi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
mov rbx, qword [rsp + 0x158]
add rsp, 0x130
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bcc80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x140
mov qword [rsp + 0x58], 0xfffffffffffffffe
movzx eax, r9b
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
test r8b, r8b
jne 0x1400bccbd
test al, al
je 0x1400bced5
mov rax, qword [rcx]
call qword [rax + 0x90]
test al, al
je 0x1400bcd47
lea rcx, [rsp + 0x38]
call fcn.1400b1050
nop
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400b1070
lea rcx, [rsp + 0x38]
call fcn.1400b1090
test al, al
je 0x1400bcd01
lea rcx, [rsp + 0x38]
call fcn.1400b9830
xor al, al
jmp 0x1400bced5
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400ba860
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400b7520
movzx r9d, byte [rsp + 0x178]
movzx r8d, sil
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400bcc80
movzx ebx, al
lea rcx, [rsp + 0x38]
call fcn.1400b9830
mov al, bl
jmp 0x1400bced5
test rbx, rbx
jne 0x1400bcd55
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400bced5
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400bcd7d
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x1400bced5
xor bl, bl
mov byte [rsp + 0x30], bl
cmp byte [rsp + 0x178], bl
je 0x1400bce51
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x50]
mov word [rsp + 0x32], ax
test ax, ax
je 0x1400bce51
mov edx, 2
mov r8d, 0x1000
lea rcx, [rsp + 0xd0]
call fcn.14019e184
nop
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x60]
call fcn.14001af2c
nop
mov rax, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [rax + 0x28]
lea rcx, [rsp + 0x60]
call fcn.14001a1d0
lea rcx, [rsp + 0x60]
call fcn.14001aa40
lea rcx, [rsp + 0xd0]
call fcn.14019e2f4
movzx ecx, word [rsp + 0x32]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetClipboardData]
mov bl, 1
mov byte [rsp + 0x30], bl
lea rcx, [rsp + 0x60]
call fcn.14001aed0
nop
lea rcx, [rsp + 0xd0]
call fcn.14019e1c4
nop
jmp 0x1400bce53
xor esi, esi
cmp byte [rsp + 0x170], 0
je 0x1400bcecd
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x170], esi
mov qword [rsp + 0x38], rsi
mov rax, qword [rdi]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [rax + 0x70]
test al, al
je 0x1400bcecd
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1400b2d60
test rax, rax
je 0x1400bcec2
mov rdx, rax
mov ecx, 8
call qword [sym.imp.USER32.dll_SetClipboardData]
movzx ebx, bl
mov ecx, 1
test rax, rax
cmovne ebx, ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400bcf70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x110
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movzx r13d, r9b
mov rsi, r8
mov r12, rdx
mov r14, rcx
mov rdx, r8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400bcfd0
cmp byte [rsp + 0x150], al
je 0x1400bcfc9
call fcn.14000bd68
xor al, al
jmp 0x1400bd0b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test rdi, rdi
jne 0x1400bd00e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp byte [rsp + 0x150], dil
je 0x1400bd007
call fcn.14000bd68
xor al, al
jmp 0x1400bd0b6
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.14019b0f4
nop
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14019b1c4
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14019b408
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
call fcn.14001af2c
nop
mov byte [rsp + 0x20], 1
movzx r9d, byte [rsp + 0x150]
movzx r8d, r13b
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.1400b9f40
movzx edi, al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
lea rcx, [rsp + 0xa0]
call fcn.14001aed0
nop
lea rcx, [rsp + 0x50]
call fcn.14019b608
mov al, dil
jmp 0x1400bd0b6
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1401323d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x50
mov rdi, rcx
lea rcx, [r8 + 0x10]
mov rbx, r8
mov r12, rdx
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x140132607
movzx r9d, byte [rbx + 0x24]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r13
movzx eax, r9b
mov r13d, 0x10
and al, 1
test r9b, 4
movzx ebp, al
mov eax, 0
cmove ebp, eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], eax
movzx eax, r9b
test r9b, 4
je 0x14013247a
test bpl, bpl
jne 0x140132497
test al, 2
jne 0x140132497
test al, 8
je 0x140132459
test r13b, al
mov edx, 0x15
mov eax, 0xe
cmovne edx, eax
jmp 0x14013245e
mov edx, 0xe
mov rax, qword [rdi]
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
mov rcx, rdi
call qword [rax + 0x150]
mov dword [rsp + 0x84], eax
jmp 0x140132497
mov rax, qword [rdi]
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rdi
call qword [rax + 0x150]
mov dword [rsp + 0x84], eax
mov eax, dword [rbx + 0x10]
lea rcx, [rsp + 0x30]
mov dword [rcx], eax
mov eax, dword [rbx + 0x14]
mov dword [rcx + 4], eax
mov eax, dword [rbx + 0x18]
mov dword [rcx + 8], eax
mov eax, dword [rbx + 0x1c]
mov dword [rcx + 0xc], eax
mov edx, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
cmp edx, r9d
jle 0x1401324d1
mov eax, edx
mov edx, r9d
mov dword [rsp + 0x30], edx
mov r9d, eax
mov dword [rsp + 0x38], eax
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x3c]
cmp ecx, r8d
jle 0x1401324ef
mov eax, ecx
mov ecx, r8d
mov dword [rsp + 0x34], ecx
mov r8d, eax
mov dword [rsp + 0x3c], eax
test bpl, bpl
mov rbp, qword [rsp + 0x70]
jne 0x140132503
test byte [rbx + 0x24], 2
je 0x14013259f
test byte [rbx + 0x24], 2
mov rax, qword [rdi]
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
mov edx, 0x3e9
mov ecx, 0x7d3
cmovne edx, ecx
mov rcx, rdi
call qword [rax + 0x150]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov r8d, eax
call fcn.1400194c0
mov edx, 1
lea rcx, [rsp + 0x40]
movaps xmm5, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm5
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
movzx eax, byte [rbx + 0x24]
mov r11, qword [rdi]
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
and al, r13b
neg al
mov rcx, rdi
sbb edx, edx
add edx, 0x7d4
call qword [r11 + 0x150]
lea rdx, [rsp + 0x40]
mov rcx, r12
mov r9d, eax
mov r8d, eax
call fcn.14001984c
mov r8d, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
sub r9d, edx
test r9b, 1
je 0x1401325ae
inc edx
mov dword [rsp + 0x30], edx
sub r8d, ecx
test r8b, 1
je 0x1401325bd
inc ecx
mov dword [rsp + 0x34], ecx
movzx eax, byte [rbx + 0x24]
mov ecx, dword [rbx + 0x20]
test al, 8
je 0x1401325d3
test al, 0x20
jne 0x1401325d3
cmp ecx, 1
cmove ecx, r13d
mov rax, qword [rdi]
movsxd r9, ecx
lea rdx, [0x14026bd00]
mov r9, qword [rdx + r9*8]
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x1a8]
mov r13, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x14018b170
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 0x111
je 0x14018b1a7
cmp edx, 0x2ff
jbe 0x14018b1c5
cmp edx, 0x304
jmp 0x14018b1b3
movzx eax, r8w
add eax, 0xffff1ee0
cmp eax, 0xc
ja 0x14018b1c5
mov rax, qword [rcx]
call qword [rax + 0x2a8]
and byte [rax + 0x1d8], 0xbf
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400520c0
Function at 0x1401a77e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x48], 0
jne 0x1401a77fb
jmp 0x1401a78cb
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x20], rax
jne 0x1401a7860
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1401a72a0
jmp 0x1401a78cb
cmp qword [rsp + 0x20], 0
je 0x1401a78be
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x20], rax
jne 0x1401a78bc
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1401a72a0
jmp 0x1401a78cb
jmp 0x1401a7860
lea rcx, str.ERROR_RU_0x00000005
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x38
ret