joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180099cd0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1800f1280]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov qword [rcx], rsi
mov rbx, rcx
mov qword [rcx + 8], rsi
xor edx, edx
mov ecx, 4
mov ebp, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180099dfa
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180099df1
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180099dd4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180099dd4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180099dd4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180099d92
mov dword [rbx + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800f2030]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180099df1
jmp 0x180099dc7
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180099dc7
mov rcx, qword [0x1800f2030]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180099df1
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180099d40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180099e55
cmp dword [rbx + 0xc], esi
jbe 0x180099e55
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180099e4e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.18009a380
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180099e10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18009bd90
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18009a530
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x18009a5a1
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x18009a58a
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov ecx, 0x5a
mov r8d, dword [r8 + rbx*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18009a57e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18009a550
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800f2030]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009a660
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18009a6a0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800f8600]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18009a6de
cmp rsi, r14
jb 0x18009a6d6
cmp rsi, r15
jae 0x18009a6d6
cmp qword [rsi + 8], 0
jne 0x18009a8a7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18009a6c1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18009a772
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18009a769
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009a769
cmp dword [rsp + 0x70], 0x10000
je 0x18009a7eb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x18009a769
sub rbx, rbp
cmp rbx, r14
jae 0x18009a730
test rsi, rsi
jne 0x18009a850
cmp rdi, r15
ja 0x18009a88f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18009a88f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009a88f
cmp dword [rsp + 0x70], 0x10000
je 0x18009a821
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18009a7a2
jmp 0x18009a88f
test rbx, rbx
je 0x18009a769
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18009a850
cmp rbx, r14
jae 0x18009a710
jmp 0x18009a772
test rdi, rdi
je 0x18009a88f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18009a850
cmp rdi, r15
jbe 0x18009a780
jmp 0x18009a88f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18009a860
mov rax, qword [0x1800f8600]
mov qword [rsi], rax
mov qword [0x1800f8600], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x18009b4a4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18009b4de
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18009b4e3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18009b52c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800b58b0]
cmp byte [rcx + rax], 0
je 0x18009b52c
dec r8
sub rdx, 1
jne 0x18009b512
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180035130
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov ebx, edx
mov rdi, rcx
cmp qword [0x18048a410], 0
jne 0x18003515f
xor eax, eax
jmp 0x180035470
cmp byte [0x18048a81d], 0
jne 0x180035158
mov qword [rsp + 0x50], 0
mov dl, 1
call fcn.1800368c0
test rax, rax
jne 0x180035187
mov eax, 1
jmp 0x180035470
mov rcx, qword [0x18048a410]
test ebx, ebx
jne 0x1800351da
call fcn.180045750
mov rbx, rax
call fcn.180037840
test rbx, rbx
je 0x1800351cc
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1800351cc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx]
mov edx, 6
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x18048a410]
call fcn.1800455e0
jmp 0x18003523d
call fcn.180044fe0
mov rcx, qword [0x18048a410]
call fcn.180045750
test rax, rax
je 0x18003523d
mov rbx, qword [rax + 0x20]
test rbx, rbx
je 0x18003523d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x90], ax
and al, 1
mov r9, qword [rbx]
movzx r8d, al
mov edx, 1
mov rcx, rbx
call qword [r9 + 0x70]
mov rdx, rbx
mov rcx, rdi
call fcn.1800376f0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rdi, rdi
je 0x18003524b
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmUnlockIMC]
jmp 0x18003546b
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1800423b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
call fcn.180042590
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x180042401
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x71], 1
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x72], 0
jmp 0x1800424c2
cmp dword [rsp + 0x20], 3
jne 0x180042438
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x88]
cmp dword [rsp + 0x20], eax
je 0x18004242a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x84], eax
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x72], 1
jmp 0x1800424c2
cmp dword [rsp + 0x20], 1
jne 0x18004246e
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x48]
cmp dword [rsp + 0x24], eax
jne 0x180042458
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x72], 0
jmp 0x18004246c
mov rcx, qword [rsp + 0x40]
call fcn.1800410b0
mov rcx, qword [rsp + 0x40]
call fcn.1800424f0
jmp 0x1800424c2
cmp dword [rsp + 0x20], 2
jne 0x1800424c2
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x71]
test eax, eax
je 0x18004248e
mov rcx, qword [rsp + 0x40]
call fcn.1800410b0
jmp 0x1800424b0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x88]
cmp dword [rsp + 0x20], eax
je 0x1800424b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x84], eax
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x71], 0
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x72], 1
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 0x88], ecx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x38
ret
Function at 0x180070750
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x24], ax
movsx eax, word [rsp + 0x24]
and eax, 1
test eax, eax
je 0x18007077c
mov byte [rsp + 0x20], 1
jmp 0x180070781
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rsp + 0x20]
mov byte [rax + 0xbe], cl
add rsp, 0x38
ret
Function at 0x180076700
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1800768dd
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r14, rax
test rax, rax
je 0x1800768dd
mov rcx, qword [rdi + 0x18]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov r15, rax
test rax, rax
je 0x1800768dd
mov qword [rsp + 0x50], 0
mov rbx, qword [rdi + 0x10]
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x180076780
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
nop
test rbx, rbx
je 0x1800768cf
sub esi, 1
je 0x1800768ad
sub esi, 4
je 0x180076847
sub esi, 9
je 0x18007680a
sub esi, 1
je 0x1800767db
cmp esi, 4
jne 0x1800768cf
mov rcx, qword [rdi + 0xf0]
test rcx, rcx
je 0x1800768cf
mov rax, qword [rcx]
call qword [rax + 0x48]
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0xb]
mov rcx, rbp
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1800768cf
mov edx, 0xf
mov rcx, rbp
call qword [sym.imp.USER32.dll_KillTimer]
cmp byte [rdi + 0x120], 0
je 0x1800768cf
mov rcx, rdi
call fcn.180077cb0
mov byte [rdi + 0x120], 0
jmp 0x1800768cf
mov edx, 0xe
mov rcx, rbp
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x28]
test rax, rax
je 0x1800768cf
lea rcx, [rax - 0x80]
test rcx, rcx
je 0x1800768cf
sub rcx, 0xffffffffffffff80
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1800768cf
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov r9, qword [rbx]
movzx r8d, al
mov edx, 1
mov rcx, rbx
call qword [r9 + 0x70]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0xe0]
test al, al
je 0x180076889
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x80]
jmp 0x1800768cf
cmp byte [rdi + 0xe8], 0
je 0x1800768cf
lea rcx, [rdi + 0x80]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x1800768cf
mov rdi, qword [r15]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
mov edx, eax
mov rcx, r15
call qword [rdi]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_KillTimer]
nop
test rbx, rbx
je 0x1800768dd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180077b40
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movzx esi, dl
mov rdi, rcx
cmp byte [rcx + 0x120], 0
jne 0x180077c99
mov qword [rax + 8], 0
mov rbx, qword [rcx + 0x10]
mov qword [rax + 8], rbx
test rbx, rbx
je 0x180077b89
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
nop
test rbx, rbx
je 0x180077c8b
xorps xmm0, xmm0
movdqa xmm1, xmmword [0x180397e80]
mov r8d, 3
test sil, sil
je 0x180077bdd
movdqu xmmword [rsp + 0x38], xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov byte [rsp + 0x28], 0
lea rdx, [0x1803753a0]
lea rcx, [rsp + 0x28]
call fcn.180037c20
nop
lea rcx, [rsp + 0x28]
call fcn.180170b40
nop
lea rcx, [rsp + 0x28]
jmp 0x180077c10
movdqu xmmword [rsp + 0x58], xmm0
movdqu xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x48], 0
lea rdx, [0x18037539c]
lea rcx, [rsp + 0x48]
call fcn.180037c20
nop
lea rcx, [rsp + 0x48]
call fcn.180170b40
nop
lea rcx, [rsp + 0x48]
call fcn.180037bc0
mov rcx, qword [0x18048a410]
test rcx, rcx
je 0x180077c26
call fcn.180045ba0
mov byte [rdi + 0x120], 1
mov byte [rdi + 0x121], sil
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x28]
test rax, rax
je 0x180077c56
lea rcx, [rax - 0x80]
test rcx, rcx
je 0x180077c56
sub rcx, 0xffffffffffffff80
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180077c75
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd31
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
test rbx, rbx
je 0x180077c99
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180077cb0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov edi, 8
xor ebp, ebp
mov qword [r11 - 0x48], rbp
mov qword [r11 - 0x40], rbp
mov qword [r11 - 0x48], rbp
mov qword [r11 - 0x40], 7
mov word [rsp + 0x30], bp
lea ecx, [rdi + 5]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x180077eae
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180077ebc
lea ecx, [rdi + 5]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x180077d4b
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x180077ebc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rax
test rax, rax
je 0x180077d3a
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], eax
mov edx, 0x12
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x50]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7fffffec]
test rax, rax
je 0x180077db3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x180077db3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x180077d90
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180077de2
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180033930
cmp qword [rsp + 0x40], 0
je 0x180077ea5
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r9, qword [rsp + 0x30]
mov r8, rbp
mov rcx, r9
call fcn.1801db260
test rax, rax
je 0x180077e56
nop dword [rax]
movzx edx, word [r9 + r8*2]
cmp dx, 0x60
jbe 0x180077e44
lea ecx, [rdx - 0x7b]
cmp cx, 3
ja 0x180077e4e
sub dx, 0x41
cmp dx, 0x19
ja 0x180077e9c
inc r8
cmp r8, rax
jb 0x180077e30
mov qword [rsp + 0x20], rbp
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x180077e72
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
nop
test rbx, rbx
je 0x180077e8a
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x110]
mov edi, eax
test rbx, rbx
je 0x180077eaa
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
mov edx, edi
jmp 0x180077eb3
mov edi, 1
mov edx, edi
jmp 0x180077eb3
mov edi, 5
mov edx, edi
jmp 0x180077eb3
mov edx, 5
mov rcx, rsi
call fcn.180077ef0
nop
lea rcx, [rsp + 0x30]
call fcn.1800338a0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18007e370
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, r8
mov rbx, rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
jne 0x18007e3c1
xor al, al
jmp 0x18007e579
mov edx, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_GetAncestor]
mov rsi, rax
test rax, rax
je 0x18007e3ba
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xa0]
call fcn.18029c350
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rsp + 0xa0]
mov rbp, 0xffffffffffffffff
mov r8, rbp
inc r8
cmp word [rax + r8*2], r14w
jne 0x18007e415
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.180033930
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x18007e577
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x18007e577
cmp qword [rbx + 0x18], 8
jb 0x18007e453
mov rbx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18007e460
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8, rbp
call fcn.1800805a0
mov rbx, rax
cmp rax, rbp
je 0x18007e577
lea rcx, [rsi + rax]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r14w
mov rax, qword [rdi + 0x10]
cmp rax, rcx
jb 0x18007e5a1
sub rax, rcx
cmp rax, 0xffffffffffffffff
cmovb rbp, rax
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x18007e4c2
mov rax, qword [rdi]
lea rdx, [rax + rcx*2]
mov r8, rbp
lea rcx, [rsp + 0x58]
call fcn.180033930
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], r14w
cmp qword [rdi + 0x10], rbx
cmovb rbx, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18007e50e
mov rdx, qword [rdi]
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.180033930
mov ebx, 3
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.1800804c0
nop
mov rdx, rax
mov rcx, rdi
call fcn.1800379a0
nop
lea rcx, [rsp + 0x80]
call fcn.1800338a0
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x38]
call fcn.1800338a0
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x58]
call fcn.1800338a0
mov al, 1
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180053190
nop
int3
Function at 0x1800848d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r12d, r9d
mov esi, r8d
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0x70], rbp
jne 0x18008490d
xor al, al
jmp 0x180084af0
mov rcx, qword [0x18048a410]
test rcx, rcx
je 0x180084906
call fcn.180045750
mov rbx, rax
test rax, rax
je 0x180084906
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18006a330
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180084ab3
mov rax, qword [rcx]
call qword [rax]
mov r15, rax
test rax, rax
je 0x180084ab3
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x30]
mov r14, rax
test rax, rax
je 0x180084ab3
mov qword [rsp + 0x90], rbp
mov rbx, qword [rbx + 0x20]
mov qword [rsp + 0x90], rbx
test rbx, rbx
je 0x180084998
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
nop
test rbx, rbx
je 0x180084aa0
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x28]
test al, al
jne 0x180084aa0
lea rcx, [rdi + 0x79]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x180084aa0
movzx ebp, byte [rsp + 0xb0]
cmp esi, 0x14
je 0x180084a00
mov rcx, rsi
test bpl, bpl
je 0x1800849f1
lea rdx, [rsi + rdi]
movzx eax, byte [rdx + 0x79]
test al, al
js 0x1800849ec
or al, 0x80
mov byte [rdx + 0x79], al
jmp 0x180084a00
test bpl, bpl
jne 0x180084a00
movzx eax, byte [rcx + rdi + 0x79]
test al, al
jns 0x180084a00
and al, 0x7f
mov byte [rcx + rdi + 0x79], al
shr r12d, 0x10
and r12d, 0x1ff
lea r8, [rdi + 0x79]
mov edx, r12d
mov ecx, esi
call fcn.18004b430
movzx r13d, ax
mov dword [rsp + 0x98], 0
lea r9, [rsp + 0x98]
lea r8, [rdi + 0x79]
mov edx, r12d
mov ecx, esi
call fcn.18004b520
mov esi, eax
mov r10, qword [r15]
movzx r9d, bpl
mov r8d, eax
mov r14d, dword [rsp + 0x98]
mov edx, r14d
mov rcx, r15
call qword [r10 + 0x90]
test al, al
je 0x180084a68
mov sil, 1
jmp 0x180084aa3
lea rdx, [0x180333460]
mov rcx, qword [rdi + 0x70]
call fcn.180085b80
test eax, eax
setne al
mov r10, qword [rbx]
mov byte [rsp + 0x28], al
mov word [rsp + 0x20], r13w
movzx r9d, bpl
mov r8d, esi
mov edx, r14d
mov rcx, rbx
call qword [r10 + 0x48]
movzx esi, al
jmp 0x180084aa3
xor sil, sil
test rbx, rbx
je 0x180084ab6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180084ab6
xor sil, sil
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x180084aec
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x180084aec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x180084aec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movzx eax, sil
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret