joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400476b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rdx
mov qword [rax + 8], rbx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x370]
mov edx, dword [0x1402d08e4]
lea r8, [rsp + 0x50]
or ecx, 0xffffffff
and al, 0x80
mov rax, qword [rdi]
cmovne edx, ecx
mov rcx, rdi
call qword [rax + 0x568]
mov rdx, qword [rsp + 0x50]
lea rcx, str.CDockablePane
mov ebp, eax
call fcn.140029da8
mov rsi, rax
cmp rax, rdi
je 0x1400477b0
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400477b0
test rsi, rsi
je 0x140047755
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8 + 0x450]
mov rdx, rax
lea rcx, str.CMultiPaneFrameWnd
call fcn.140029da8
mov r14, rax
jmp 0x140047758
mov r14, rbx
cmp ebp, 2
jne 0x1400477cb
test r14, r14
je 0x140047795
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x380]
test al, 0x40
je 0x1400477b0
cmp qword [rsp + 0x50], rbx
je 0x140047795
mov rax, qword [r14]
mov rdx, rdi
mov rcx, r14
call qword [rax + 0x498]
test eax, eax
mov rax, rdi
sete bl
mov dword [r15], ebx
jmp 0x1400477b2
mov rax, qword [rdi]
mov r9d, 5
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x3f0]
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
cmp ebp, 3
jne 0x1400477b0
test rsi, rsi
je 0x1400477b0
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x308]
test eax, eax
je 0x1400477b0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x318]
test eax, eax
je 0x1400477b0
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x480]
mov rax, qword [rdi]
lea r9d, [rbp - 2]
lea r8d, [rbp + 2]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x698]
test rax, rax
setne bl
mov dword [r15], ebx
jmp 0x1400477b2
Function at 0x14004a024
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rsi, rcx
mov edx, dword [0x1402e367c]
mov rdi, r8
mov ecx, 4
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x1402ddb18], eax
jle 0x14004a0ab
lea rcx, [0x1402ddb18]
call fcn.1401cf584
cmp dword [0x1402ddb18], 0xffffffff
jne 0x14004a0ab
call fcn.1400256ec
mov rcx, rax
test rax, rax
je 0x14004a17a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x140209374]
mov qword [0x1402ddb10], rax
call fcn.1401cf970
lea rcx, [0x1402ddb18]
call fcn.1401cf524
test rdi, rdi
je 0x14004a185
mov rax, qword [rsi + 0x4b8]
test rax, rax
je 0x14004a168
cmp qword [rax + 0x40], 0
je 0x14004a168
test rax, rax
je 0x14004a0d8
mov rax, qword [rax + 0x40]
cmp qword [rdi], rax
jne 0x14004a168
mov rax, qword [rdi + 8]
sub rax, 1
je 0x14004a12f
sub rax, 1
je 0x14004a0fe
cmp rax, 1
jne 0x14004a168
mov ebx, 0x428e
jmp 0x14004a134
mov ecx, 0x11
mov ebx, 0x3ea1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14004a134
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x680]
test eax, eax
je 0x14004a134
mov ebx, 0x3ea4
jmp 0x14004a134
mov ebx, 0x3ea0
mov ecx, ebx
call fcn.1400254b4
test rax, rax
je 0x14004a18b
mov r8d, ebx
lea rcx, [0x1402ddb10]
mov rdx, rax
call fcn.140002e40
test eax, eax
je 0x14004a18b
mov rax, qword [0x1402ddb10]
mov qword [rdi + 0x18], rax
mov eax, 1
jmp 0x14004a16a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140003220
int3
call fcn.1400251b0
int3
call fcn.1400251b0
int3

Function at 0x14004ce74
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402ddb28]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402d924c]
test eax, eax
je 0x14004cebf
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402d924c]
test eax, eax
jne 0x14004cec8
call fcn.140022f2c
test eax, eax
je 0x14004cee4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402d0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14004ceec
xor eax, eax
jmp 0x14004cf49
test rbx, rbx
jne 0x14004cf0c
lea rcx, str.ImageList_Destroy
call fcn.140022970
mov rbx, rax
test rax, rax
je 0x14004cf17
mov qword [0x1402ddb28], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14004cf2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14004cf2e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14004cf47
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14004cf60
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x1402ddb30]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x1402d924c]
test eax, eax
je 0x14004cfbd
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402d924c]
test eax, eax
jne 0x14004cfc6
call fcn.140022f2c
test eax, eax
je 0x14004cfe2
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1402d0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x14004cfed
xor eax, eax
jmp 0x14004d078
test rbx, rbx
jne 0x14004d00d
lea rcx, str.ImageList_LoadImageW
call fcn.140022970
mov rbx, rax
test rax, rax
je 0x14004d044
mov qword [0x1402ddb30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14004d05a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14004d05c
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14004d075
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140070784
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402d18f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.140053c7c
nop
lea rax, vtable.CWinApp.0
mov qword [rbx], rax
xor esi, esi
test rdi, rdi
je 0x1400707e5
mov rcx, rdi
call fcn.1401e3118
mov qword [rbx + 0xa0], rax
jmp 0x1400707ec
mov qword [rbx + 0xa0], rsi
call fcn.14004e0d4
mov rdi, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140070806
call fcn.1400251b0
int3
lea rcx, [rax + 0xc0]
lea rdx, [0x14004e1cc]
call fcn.1400ef584
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14007082b
call fcn.1400251b0
int3
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov qword [rdi + 8], rbx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x108], esi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0xe8], rsi
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0x140], rsi
mov dword [rbx + 0xc0], esi
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0x138], 0x200
mov dword [rbx + 0x14c], esi
mov dword [rbx + 0x150], 0x493e0
mov edi, 1
mov dword [rbx + 0x154], edi
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jne 0x14007091a
cmp dword [rsp + 0x38], edi
jae 0x14007091e
cmp dword [rsp + 0x34], 6
mov eax, esi
jbe 0x140070920
mov eax, edi
mov dword [rbx + 0x158], eax
mov dword [rbx + 0x15c], esi
mov qword [rbx + 0x168], rsi
mov qword [rbx + 0x170], rsi
mov dword [rbx + 0x160], edi
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401cf0f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140073fac
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r9
mov r14, r8
and qword [r9], 0
mov rbx, qword [rbp + 0x40]
and dword [rbx], 0
cmp qword [rcx + 0xb0], 0
je 0x14007408b
xor r8d, r8d
call fcn.14007444c
mov rdi, rax
test rax, rax
je 0x140074166
mov qword [rbp - 0x18], rax
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [rbx], ecx
test eax, eax
jne 0x14007406f
call fcn.1400182e0
mov qword [rsi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007406f
lea ebx, [rax + 1]
jmp 0x14007407d
mov rcx, qword [rsi]
call fcn.1400182e8
and qword [rsi], 0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140074164
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rbp + 0x38]
call qword [rax + 0x108]
nop
mov rax, qword [rbp + 0x38]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x1400740b8
xor ebx, ebx
jmp 0x14007414a
mov rdi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.1400182e0
mov qword [rsi], rax
xor edx, edx
lea ebx, [rdx + 1]
test rdi, rdi
jle 0x140074146
xor r9d, r9d
mov r10d, ebx
test r10, r10
js 0x14007413b
mov rax, qword [rbp + 0x38]
lea ecx, [rdx + 1]
cmp ecx, dword [rax - 0x10]
jg 0x14007413b
movzx r8d, word [r9 + rax + 2]
test edx, edx
js 0x140074130
cmp edx, dword [rax - 0x10]
jg 0x140074130
sub r8b, bl
shl r8b, 4
sub r8b, 0x41
add r8b, byte [r9 + rax]
mov eax, edx
test edx, edx
jns 0x14007410f
lea eax, [rbx + rdx]
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsi]
mov byte [rcx + rax], r8b
add edx, 2
add r10, 2
add r9, 4
movsxd rax, edx
cmp rax, rdi
jl 0x1400740d7
jmp 0x140074146
mov ecx, 0x80070057
call fcn.140003220
int3
mov ecx, 0x80070057
call fcn.140003220
int3
mov rax, qword [rbp + 0x38]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140074164
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14007417c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1400741f6
xor r8d, r8d
call fcn.14007444c
mov rsi, rax
test rax, rax
jne 0x1400741b2
mov eax, edi
jmp 0x14007420c
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1400741ae
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140074824
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x1400748a6
xor r8d, r8d
call fcn.14007444c
mov rsi, rax
test rax, rax
je 0x140074934
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x140074934
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400182e0
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14007490a
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x1400748df
lea eax, [r8 + r8]
mov r9, r14
mov word [r14 + rax*2], di
mov r8, r12
mov rax, qword [rsi]
mov rdx, r15
mov rcx, rsi
call qword [rax + 0x110]
mov rcx, r14
mov ebx, eax
call fcn.1400182e8
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400757cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x14007583e
call fcn.14004e0d4
mov r8d, 0xf0
mov rdx, rsi
mov r15, qword [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14007583e
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140075887
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov esi, 1
test rdi, rdi
je 0x14007586c
mov r10, qword [r12]
mov r9, r14
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call qword [r10 + 0x40]
mov esi, eax
test rbx, rbx
je 0x14007586c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140075885
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x140]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400783dc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1402d18f8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], r8
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.140011b10
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
cmp rsi, 0xffffffff80000000
jne 0x140078494
call fcn.14004e150
cmp eax, 1
jne 0x140078494
lea r8, [rsp + 0x30]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x58]
call fcn.14007829c
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140017d30
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140078483
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, 0xffffffff80000001
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
test rdi, rdi
je 0x1400784be
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2001f
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14007466c
jmp 0x1400784d8
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400785c3
mov r9d, 0x104
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test eax, eax
jne 0x14007857f
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140003330
nop
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.1400783dc
mov edi, eax
test eax, eax
setne bl
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140078550
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140078560
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140078584
mov rbx, qword [rsp + 0x30]
jmp 0x1400784e2
mov rax, qword [rsp + 0x38]
cmp edi, 0x103
je 0x140078594
cmp edi, 0x3f2
jne 0x1400785b7
test rax, rax
je 0x1400785a9
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140078840
jmp 0x1400785b5
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400785dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401cf0f0
add rsp, 0x2a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140078840
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400788a3
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400788b7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400788b7
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x1400788bc
cmp dword [rcx + 8], 0
je 0x1400788b7
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400788bc
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140086e2c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbp, rdx
mov rbx, rcx
jne 0x140086f14
xor edx, edx
call fcn.14003037c
xor r15d, r15d
mov rcx, rbx
test rax, rax
je 0x140086e76
mov rdx, rbp
call fcn.140052c78
jmp 0x140086f1f
call fcn.140030374
mov esi, eax
cmp dword [rbx + 0x1394], r15d
je 0x140086e8c
sub esi, dword [rbx + 0x1388]
mov r14d, dword [rbx + 0x1138]
test r14d, r14d
js 0x140086f14
cmp r14d, esi
jge 0x140086f14
mov edi, dword [rbp + 0x10]
cmp edi, 9
jne 0x140086eba
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x27
mov rcx, rbx
call fcn.1400233ec
bt eax, 0x16
jae 0x140086edc
mov eax, 0x25
cmp edi, eax
jne 0x140086ed6
lea edi, [rax + 2]
jmp 0x140086edc
cmp edi, 0x27
cmove edi, eax
sub edi, 0xd
je 0x140086fd9
sub edi, 0xe
je 0x140086fb5
sub edi, 0xa
je 0x140086fa7
sub edi, 2
je 0x140086f55
mov rcx, rbx
cmp edi, 1
je 0x140086f38
mov rax, qword [rbx]
mov edx, dword [rbp + 0x10]
call qword [rax + 0x728]
test eax, eax
jne 0x140086f4e
mov rdx, rbp
mov rcx, rbx
call fcn.1400362cc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov edx, dword [rbx + 0x1138]
call fcn.14003023c
mov rdx, rax
mov rcx, rbx
call fcn.14002f850
mov eax, 1
jmp 0x140086f1f
inc dword [rbx + 0x1138]
mov eax, dword [rbx + 0x1138]
cmp eax, esi
cmovge eax, r15d
mov dword [rbx + 0x1138], eax
mov edx, r14d
mov rcx, rbx
call fcn.140030b28
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.140030b28
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x1138]
call qword [rax + 0x4b8]
jmp 0x140086f14
sub dword [rbx + 0x1138], 1
jns 0x140086f6d
lea eax, [rsi - 1]
jmp 0x140086f67
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c8]
mov dword [0x1402de688], r15d
jmp 0x140086f14
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14003023c
mov rdx, rax
mov rcx, rbx
call fcn.14002f850
test eax, eax
jne 0x140086f4e
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14003023c
mov rdx, rax
mov rcx, rbx
call fcn.1400364e0
jmp 0x140086f4e