joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b2d30
Capabilities:
Write clipboard data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, edi
call sub.KERNEL32.dll_MultiByteToWideChar
test eax, eax
je 0x1400b2ddb
movsxd r15, eax
lea rdx, [r15 + r15]
add rdx, 2
mov ecx, 0x42
call sub.KERNEL32.dll_GlobalAlloc
test rax, rax
je 0x1400b2ddb
mov r14, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x1400b2ddb
mov rsi, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, edi
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [rsi + r15*2], 0
mov rcx, r14
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, r14
call sub.USER32.dll_SetClipboardData
test rax, rax
je 0x1400b2e08
mov al, 4
jmp 0x1400b2dea
call sub.KERNEL32.dll_GetLastError
mov esi, eax
shl rsi, 0x18
xor edi, edi
xor eax, eax
shld rdi, rsi, 8
shl rsi, 8
movzx eax, al
or rax, rsi
mov rdx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
mov esi, eax
shl rsi, 0x18
xor edi, edi
mov rcx, r14
call sub.KERNEL32.dll_GlobalFree
jmp 0x1400b2de8
Function at 0x1400b3680
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r12, rdx
mov r14, rcx
mov rdi, qword [rcx]
add qword [rdx + 0x10], 8
mov r15, qword [rcx + 0x10]
mov qword [rsp + 0x20], r15
mov r8, qword [rdx + 0x40]
test r8, r8
je 0x1400b3737
mov esi, 8
mov r11d, 8
sub r11, r8
cmovae rsi, r11
xor r10d, r10d
xor eax, eax
cmp rsi, 3
seta al
mov ecx, r15d
cmova r10, rcx
lea rcx, [rax*4 + 1]
shl rax, 2
cmp rcx, rsi
jae 0x1400b36fe
movzx r9d, word [rsp + rax + 0x20]
lea ecx, [rax*8]
shl r9, cl
or r10, r9
or rax, 2
cmp rax, rsi
jae 0x1400b3713
movzx esi, byte [rsp + rax + 0x20]
shl eax, 3
mov ecx, eax
shl rsi, cl
or r10, rsi
lea ecx, [r8*8]
shl r10, cl
or r10, qword [r12 + 0x38]
mov qword [r12 + 0x38], r10
cmp r8, 8
jbe 0x1400b373c
add r8, 8
jmp 0x1400b3882
xor r11d, r11d
jmp 0x1400b379a
mov rcx, qword [r12 + 0x30]
mov rsi, qword [r12 + 0x28]
mov rax, qword [r12 + 0x18]
add rax, rsi
rol rsi, 0xd
xor rcx, r10
xor rsi, rax
rol rax, 0x20
mov rbx, qword [r12 + 0x20]
add rbx, rcx
rol rcx, 0x10
xor rcx, rbx
add rax, rcx
rol rcx, 0x15
xor rcx, rax
add rbx, rsi
rol rsi, 0x11
mov qword [r12 + 0x30], rcx
xor rsi, rbx
rol rbx, 0x20
mov qword [r12 + 0x28], rsi
mov qword [r12 + 0x20], rbx
xor rax, r10
mov qword [r12 + 0x18], rax
mov r9d, 8
sub r9, r11
mov r8d, r9d
and r8d, 7
and r9, 0xfffffffffffffff8
cmp r11, r9
jae 0x1400b3828
mov rsi, qword [r12 + 0x30]
mov rbx, qword [r12 + 0x18]
mov rcx, qword [r12 + 0x20]
mov rax, qword [r12 + 0x28]
nop word [rax + rax]
add rbx, rax
rol rax, 0xd
mov rdx, qword [rsp + r11 + 0x20]
xor rax, rbx
rol rbx, 0x20
xor rsi, rdx
add rcx, rsi
rol rsi, 0x10
xor rsi, rcx
add rbx, rsi
rol rsi, 0x15
add rcx, rax
rol rax, 0x11
xor rax, rcx
rol rcx, 0x20
xor rsi, rbx
xor rbx, rdx
add r11, 8
cmp r11, r9
jb 0x1400b37d0
mov qword [r12 + 0x30], rsi
mov qword [r12 + 0x18], rbx
mov qword [r12 + 0x28], rax
mov qword [r12 + 0x20], rcx
cmp r8d, 4
jb 0x1400b383a
mov ebx, dword [rsp + r11 + 0x20]
mov eax, 4
jmp 0x1400b383e
xor eax, eax
xor ebx, ebx
mov rcx, rax
or rcx, 1
cmp rcx, r8
jae 0x1400b3864
lea rcx, [rax + r11]
movzx esi, word [rsp + rcx + 0x20]
lea ecx, [rax*8]
shl rsi, cl
or rbx, rsi
or rax, 2
cmp rax, r8
jae 0x1400b387d
add r11, rax
movzx edx, byte [rsp + r11 + 0x20]
shl eax, 3
mov ecx, eax
shl rdx, cl
or rbx, rdx
mov qword [r12 + 0x38], rbx
mov qword [r12 + 0x40], r8
shl r15, 4
je 0x1400b38da
add r15, rdi
lea rbx, [rsp + 0x20]
nop word cs:[rax + rax]
nop
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
mov r8d, 4
mov rcx, r12
mov rdx, rbx
call fcn.140009510
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov rcx, r12
mov rdx, rbx
call fcn.140009510
add rdi, 0x10
cmp rdi, r15
jne 0x1400b38a0
cmp dword [r14 + 0x18], 1
jne 0x1400b38ec
mov qword [rsp + 0x20], 1
jmp 0x1400b38f5
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, r12
call fcn.140009510
mov eax, dword [r14 + 0x1c]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r12
call fcn.140009510
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400b3940
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
mov eax, r8d
shr eax, 0x10
mov ecx, r8d
shr ecx, 0x18
movzx edx, bl
movabs rdi, 0xcbf29ce484222325
xor rdi, rdx
movabs rdx, 0x100000001b3
imul rdi, rdx
movzx ebp, bh
xor rbp, rdi
imul rbp, rdx
movzx edi, al
xor rdi, rbp
imul rdi, rdx
xor rdi, rcx
imul rdi, rdx
mov rax, rdi
shr rax, 0x39
mov r10, qword [r14]
mov r11, qword [r14 + 8]
mov rdx, r10
and rdx, rdi
movdqu xmm1, xmmword [r11 + rdx]
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb ecx, xmm2
xor r8d, r8d
test cx, cx
je 0x1400b3a19
bsf ax, cx
movzx eax, ax
add rax, rdx
and rax, r10
neg rax
lea rax, [rax + rax*8]
shl rax, 4
cmp dword [r11 + rax - 0x90], ebx
jne 0x1400b3a55
add r11, rax
mov rcx, r11
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov dword [rsi + 0x18], 1
mov dword [rsi + 0x1c], ebx
xor eax, eax
jmp 0x1400b3ae4
pcmpeqd xmm2, xmm2
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
test ax, ax
jne 0x1400b3acd
add rdx, r8
add rdx, 0x10
add r8, 0x10
and rdx, r10
movdqu xmm1, xmmword [r11 + rdx]
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm1
pmovmskb ecx, xmm3
test cx, cx
je 0x1400b3a1d
jmp 0x1400b39d8
lea r9d, [rcx - 1]
and r9d, ecx
pcmpeqd xmm2, xmm2
test r9w, r9w
je 0x1400b3a9d
lea eax, [r9 - 1]
and eax, r9d
bsf cx, r9w
movzx ecx, cx
add rcx, rdx
and rcx, r10
neg rcx
lea rbp, [rcx + rcx*8]
shl rbp, 4
lea rcx, [r11 + rbp]
mov r9d, eax
cmp dword [r11 + rbp - 0x90], ebx
je 0x1400b3a00
jmp 0x1400b3a60
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
test ax, ax
jne 0x1400b3acd
add rdx, r8
add rdx, 0x10
add r8, 0x10
and rdx, r10
movdqu xmm1, xmmword [r11 + rdx]
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm1
pmovmskb r9d, xmm3
jmp 0x1400b3a60
cmp qword [r14 + 0x10], 0
je 0x1400b3af5
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
mov dword [rsi + 0x18], ebx
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x28]
mov r8d, 1
mov rdx, r14
mov r9, r14
call fcn.1401938c0
jmp 0x1400b3ad4
Function at 0x1400b4290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r13b, r9b
mov r14d, r8d
mov rdi, rcx
mov qword [rbp - 0x10], rdx
mov dword [rbp - 0x20], r8d
mov byte [rbp - 0x1c], r9b
movabs rax, 0xcbf29ce484222325
mov qword [rbp - 0x28], rax
mov byte [rbp - 1], 1
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x28]
call fcn.1400cff80
mov rdx, qword [rbp - 0x28]
mov rcx, rdx
shr rcx, 0x39
mov r12, qword [rdi]
mov r10, qword [rdi + 8]
mov rsi, r12
and rsi, rdx
movdqu xmm1, xmmword [r10 + rsi]
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb ecx, xmm2
xor eax, eax
test cx, cx
je 0x1400b4449
mov qword [rbp - 0x18], rax
lea r9d, [rcx - 1]
and r9d, ecx
bsf cx, cx
movzx r11d, cx
add r11, rsi
mov al, byte [rbp - 0xe]
mov cl, byte [rbp - 0xd]
mov byte [rbp - 6], cl
mov cl, byte [rbp - 0xc]
mov byte [rbp - 5], cl
mov cl, byte [rbp - 0xb]
mov byte [rbp - 4], cl
mov cl, byte [rbp - 0xa]
mov byte [rbp - 3], cl
mov r15b, byte [rbp - 9]
movzx r8d, word [rbp - 0x10]
pcmpeqd xmm2, xmm2
mov byte [rbp - 2], al
and r11, r12
shl r11, 4
mov rcx, r10
sub rcx, r11
cmp al, byte [rcx - 0xe]
jne 0x1400b43fa
mov al, byte [rbp - 6]
cmp al, byte [rcx - 0xd]
jne 0x1400b43fa
mov al, byte [rbp - 5]
cmp al, byte [rcx - 0xc]
jne 0x1400b43fa
mov al, byte [rbp - 4]
cmp al, byte [rcx - 0xb]
jne 0x1400b43fa
mov al, byte [rbp - 3]
cmp al, byte [rcx - 0xa]
jne 0x1400b43fa
cmp r15b, 8
setne r11b
mov bl, byte [rcx - 9]
cmp bl, 8
setne al
xor al, r11b
jne 0x1400b43fa
cmp bl, 8
setne r11b
cmp r15b, 8
setne al
and al, r11b
cmp r15b, bl
setne bl
test bl, al
jne 0x1400b43fa
cmp r8w, word [rcx - 0x10]
je 0x1400b4431
jmp 0x1400b43fa
add rsi, rax
add rsi, 0x10
add rax, 0x10
mov qword [rbp - 0x18], rax
and rsi, r12
movdqu xmm1, xmmword [r10 + rsi]
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm1
pmovmskb r9d, xmm3
test r9w, r9w
jne 0x1400b4413
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
test ax, ax
mov rax, qword [rbp - 0x18]
jne 0x1400b4484
jmp 0x1400b43d5
lea eax, [r9 - 1]
and eax, r9d
bsf cx, r9w
movzx r11d, cx
add r11, rsi
mov r9d, eax
mov al, byte [rbp - 2]
jmp 0x1400b4369
mov rax, qword [rcx - 8]
mov rdx, rax
shr rdx, 0x20
and dl, 1
mov dword [rcx - 8], r14d
mov byte [rcx - 4], r13b
jmp 0x1400b44a9
pcmpeqd xmm2, xmm2
pcmpeqb xmm1, xmm2
pmovmskb ecx, xmm1
test cx, cx
jne 0x1400b4484
add rsi, rax
add rsi, 0x10
add rax, 0x10
and rsi, r12
movdqu xmm1, xmmword [r10 + rsi]
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm1
pmovmskb ecx, xmm3
test cx, cx
je 0x1400b444d
jmp 0x1400b4328
mov r8, qword [rbp - 0x10]
movzx eax, r13b
shl rax, 0x20
mov r9d, r14d
or r9, rax
mov byte [rbp - 1], 0
mov qword [rsp + 0x20], rdi
mov rcx, rdi
call fcn.1400e2270
mov dl, 2
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400c47b0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov r15, rcx
movabs r13, 0x100000001b3
mov rbx, qword [rcx]
mov rax, qword [rcx + 0x10]
movzx ebp, ah
mov ecx, eax
shr ecx, 0x10
movzx r8d, cl
mov edx, eax
shr edx, 0x18
mov rcx, rax
shr rcx, 0x20
mov r11, rax
shr r11, 0x28
mov r10, rax
shr r10, 0x30
mov r9, rax
shr r9, 0x38
movzx edi, al
xor rdi, qword [rsi]
imul rdi, r13
xor rdi, rbp
imul rdi, r13
xor rdi, r8
imul rdi, r13
xor rdi, rdx
imul rdi, r13
movzx ecx, cl
xor rcx, rdi
imul rcx, r13
movzx edx, r11b
xor rdx, rcx
imul rdx, r13
movzx ecx, r10b
xor rcx, rdx
imul rcx, r13
xor rcx, r9
imul rcx, r13
mov qword [rsi], rcx
test rax, rax
je 0x1400c48ae
lea rdx, [rax + rax*8]
lea r14, [rdx + rdx*2]
add r14, rax
add r14, rbx
mov edx, dword [rbx]
movzx eax, dh
mov rbp, rdx
movzx edi, dl
shr edx, 0x10
movzx edx, dl
shr rbp, 0x18
xor rdi, rcx
imul rdi, r13
xor rdi, rax
imul rdi, r13
xor rdi, rdx
imul rdi, r13
xor rdi, rbp
imul rdi, r13
mov qword [rsi], rdi
lea rcx, [rbx + 4]
mov rdx, rsi
call fcn.1400c49c0
add rbx, 0x1c
cmp rbx, r14
je 0x1400c48ae
mov rcx, qword [rsi]
jmp 0x1400c4860
movabs rdi, 0x1efac7090aef4a21
lea r14, [r15 + 0x30]
cmp byte [r15 + 0x18], 2
mov rax, qword [rsi]
jne 0x1400c48cf
imul rax, rdi
mov qword [rsi], rax
jmp 0x1400c48e6
lea rcx, [r15 + 0x18]
xor rax, 1
imul rax, rdi
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400c49c0
lea rbx, [r15 + 0x48]
cmp byte [r14], 2
mov rax, qword [rsi]
jne 0x1400c48fc
imul rax, rdi
mov qword [rsi], rax
jmp 0x1400c4912
xor rax, 1
imul rax, rdi
mov qword [rsi], rax
mov rcx, r14
mov rdx, rsi
call fcn.1400c49c0
cmp byte [rbx], 2
mov rax, qword [rsi]
jne 0x1400c4923
imul rax, rdi
mov qword [rsi], rax
jmp 0x1400c4939
xor rax, 1
imul rax, rdi
mov qword [rsi], rax
mov rcx, rbx
mov rdx, rsi
call fcn.1400c49c0
lea rcx, [r15 + 0x60]
lea rbx, [r15 + 0x68]
lea r12, [r15 + 0x70]
lea r14, [r15 + 0x78]
mov rdx, rsi
call fcn.1400d1010
mov rcx, rbx
mov rdx, rsi
call fcn.1400d1010
mov rcx, r12
mov rdx, rsi
call fcn.1400d1010
mov rcx, r14
mov rdx, rsi
call fcn.1400d1010
movzx eax, byte [r15 + 0x80]
mov rcx, qword [rsi]
movabs rdx, 0xc5527b8a51d3d2db
imul rdx, rcx
xor rcx, 1
imul rcx, rdi
xor rcx, rax
cmp rax, 2
cmovne rdx, rcx
imul rdx, r13
mov qword [rsi], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400c49c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbp, rdx
mov rbx, rcx
movabs rdi, 0x1efac7090aef4a21
movabs r15, 0x100000001b3
cmp byte [rcx], 1
jne 0x1400c4a32
mov rdx, qword [rbp]
xor rdx, 1
imul rdx, rdi
mov ecx, dword [rbx + 4]
movzx eax, ch
mov rbx, rcx
movzx edi, cl
shr ecx, 0x10
movzx ecx, cl
shr rbx, 0x18
xor rdi, rdx
imul rdi, r15
xor rdi, rax
imul rdi, r15
xor rdi, rcx
imul rdi, r15
xor rdi, rbx
imul rdi, r15
mov qword [rbp], rdi
jmp 0x1400c4af7
lea r14, [rbx + 1]
lea r8, [rbx + 0xc]
imul rdi, qword [rbp]
mov eax, dword [rbx + 4]
mov ecx, dword [rbx + 8]
movzx edx, ah
mov r9, rdx
mov rsi, rax
movzx edx, al
shr eax, 0x10
movzx eax, al
shr rsi, 0x18
xor rdx, rdi
imul rdx, r15
xor rdx, r9
imul rdx, r15
xor rdx, rax
imul rdx, r15
xor rdx, rsi
imul rdx, r15
movzx edi, ch
mov rax, rcx
movzx esi, cl
shr ecx, 0x10
movzx ecx, cl
shr rax, 0x18
xor rsi, rdx
imul rsi, r15
xor rsi, rdi
imul rsi, r15
xor rsi, rcx
imul rsi, r15
xor rsi, rax
imul rsi, r15
mov qword [rbp], rsi
mov rcx, r8
mov rdx, rbp
call fcn.1400d1010
mov ecx, dword [rbx + 0x14]
movzx eax, ch
mov rdx, rcx
movzx ebx, cl
shr ecx, 0x10
movzx ecx, cl
shr rdx, 0x18
xor rbx, qword [rbp]
imul rbx, r15
xor rbx, rax
imul rbx, r15
xor rbx, rcx
imul rbx, r15
xor rbx, rdx
imul rbx, r15
mov qword [rbp], rbx
mov rcx, r14
mov rdx, rbp
call fcn.1400d0fe0
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400cff80
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [rcx + 2]
xor r9, qword [rdx]
movabs r8, 0x1efac7090aef4a21
imul r9, r8
movzx eax, byte [rcx + 3]
xor rax, r9
imul rax, r8
movzx r9d, byte [rcx + 4]
xor r9, rax
imul r9, r8
movzx eax, byte [rcx + 5]
xor rax, r9
imul rax, r8
movzx r9d, byte [rcx + 6]
xor r9, rax
imul r9, r8
movzx r10d, byte [rcx + 7]
mov rax, r9
xor rax, 1
imul rax, r8
xor rax, r10
cmp r10, 8
cmove rax, r9
imul rax, r8
movzx r8d, word [rcx]
movzx ecx, r8b
shr r8, 8
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
xor rcx, r8
imul rcx, rax
mov qword [rdx], rcx
ret

Function at 0x1400d1010
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
movabs rbx, 0x1efac7090aef4a21
cmp dword [rcx], 1
mov rax, qword [rdx]
jne 0x1400d106b
xor rax, 1
imul rax, rbx
mov ebx, dword [rcx + 4]
movzx edi, bh
mov rsi, rbx
movzx ecx, bl
shr ebx, 0x10
movzx ebx, bl
shr rsi, 0x18
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
xor rcx, rdi
imul rcx, rax
xor rcx, rbx
imul rcx, rax
xor rcx, rsi
imul rcx, rax
jmp 0x1400d1072
imul rax, rbx
mov rcx, rax
mov qword [rdx], rcx
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400f48b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov bpl, 1
call fcn.1400f49d0
test al, al
je 0x1400f48d5
mov ecx, 0xa5
call sub.USER32.dll_GetKeyState
test ax, ax
setns bpl
mov ecx, 0x10
call sub.USER32.dll_GetKeyState
movzx esi, ax
shr esi, 0xf
lea edi, [rsi*4]
mov ecx, 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
lea ebx, [rsi*4 + 0x20]
cmovns ebx, edi
test bpl, bpl
cmove ebx, edi
mov ecx, 0x12
call sub.USER32.dll_GetKeyState
lea esi, [rbx + 0x100]
test ax, ax
cmovns esi, ebx
test bpl, bpl
cmove esi, ebx
mov ecx, 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x1400f494b
mov ecx, 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x1400f494b
and esi, 0xf7ff
jmp 0x1400f4951
or esi, 0x800
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400f4960
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, 0x100
mov edx, 1
call fcn.140001310
test rax, rax
je 0x1400f49b6
mov rdi, rax
mov rcx, rax
call sub.USER32.dll_GetKeyboardState
mov rax, rdi
add rax, 0x100
mov qword [rsi], rdi
mov qword [rsi + 8], 0x100
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], 0
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x100
mov edx, 1
call fcn.14019e1f0
ud2
Function at 0x1400f5420
Capabilities:
Log keystrokes

Disassembly:
push rsi
sub rsp, 0x20
xor eax, eax
test r8b, r8b
mov esi, 0xe000
cmove esi, eax
or esi, edx
cmp ecx, 0x10
je 0x1400f5457
cmp ecx, 0x11
je 0x1400f546c
cmp ecx, 0x12
jne 0x1400f547d
movzx ecx, r8b
or ecx, 0xa4
mov eax, 1
jmp 0x1400f54dc
mov ecx, esi
mov edx, 3
call sub.USER32.dll_MapVirtualKeyA
mov ecx, eax
mov eax, 1
jmp 0x1400f54dc
movzx ecx, r8b
or ecx, 0xa2
mov eax, 1
jmp 0x1400f54dc
mov eax, 1
cmp esi, 0xe01c
jg 0x1400f54a0
cmp esi, 0x45
je 0x1400f54b2
cmp esi, 0x46
jne 0x1400f54dc
mov ecx, 0x91
mov esi, 0x46
jmp 0x1400f54dc
cmp esi, 0xe01d
je 0x1400f54d0
cmp esi, 0xe046
je 0x1400f54c4
jmp 0x1400f54dc
cmp ecx, 0xff
je 0x1400f54c4
mov esi, 0x45
cmp ecx, 0x13
jne 0x1400f54dc
mov ecx, 0x13
mov esi, 0xe059
jmp 0x1400f54dc
mov esi, 0xe01d
cmp ecx, 0x13
jne 0x1400f54dc
xor eax, eax
shl rcx, 0x20
mov eax, eax
or rax, rcx
mov rdx, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400f54f0
Capabilities:
Log keystrokes

Disassembly:
push rsi
sub rsp, 0x20
mov eax, edx
shr eax, 0x10
movzx eax, al
xor r8d, r8d
test edx, 0x1000000
mov esi, 0xe000
cmove esi, r8d
or esi, eax
cmp ecx, 0x10
je 0x1400f5537
cmp ecx, 0x11
je 0x1400f5547
cmp ecx, 0x12
jne 0x1400f555b
and edx, 0x1000000
cmp rdx, 1
mov ecx, 0xa5
sbb ecx, 0
jmp 0x1400f55b9
mov ecx, esi
mov edx, 3
call sub.USER32.dll_MapVirtualKeyA
mov ecx, eax
jmp 0x1400f55b9
and edx, 0x1000000
cmp rdx, 1
mov ecx, 0xa3
sbb ecx, 0
jmp 0x1400f55b9
cmp si, 0x44
jg 0x1400f5574
movzx eax, si
cmp eax, 0xe01d
je 0x1400f558c
cmp eax, 0xe046
je 0x1400f55af
jmp 0x1400f55b9
cmp si, 0x45
je 0x1400f559d
cmp si, 0x46
jne 0x1400f55b9
mov ecx, 0x91
mov esi, 0x46
jmp 0x1400f55b9
mov esi, 0xe01d
cmp ecx, 0x13
jne 0x1400f55b9
mov edx, 0xa4
jmp 0x1400f55c0
cmp ecx, 0xff
je 0x1400f55af
mov esi, 0x45
cmp ecx, 0x13
jne 0x1400f55b9
mov ecx, 0x13
mov esi, 0xe059
call fcn.1400f4d40
mov edx, eax
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x1400f75e0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x48
movabs rax, 0x210000020001
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
movabs rax, 0x210000060001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x28]
mov edx, 2
mov r8d, 0x10
call sub.USER32.dll_RegisterRawInputDevices
cmp eax, 1
sete al
add rsp, 0x48
ret

Function at 0x1400f7ff0
Capabilities:
Log keystrokes

Disassembly:
push rsi
sub rsp, 0x70
mov rsi, rcx
mov ecx, 0x12
xor edx, edx
call sub.USER32.dll_MapVirtualKeyW
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 1
mov word [rsp + 0x28], 0xa4
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov dword [rsp + 0x48], 1
mov word [rsp + 0x50], 0xa4
mov word [rsp + 0x52], ax
mov dword [rsp + 0x54], 3
lea rdx, [rsp + 0x20]
mov ecx, 2
mov r8d, 0x28
call sub.USER32.dll_SendInput
mov rcx, rsi
call sub.USER32.dll_SetForegroundWindow
nop
add rsp, 0x70
pop rsi
ret
Function at 0x140128f20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
add qword [rdx + 0x10], 8
movzx ecx, byte [rcx]
mov qword [rsp], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x140128fc1
mov eax, 8
mov r11d, 8
sub r11, r9
cmovae rax, r11
xor r10d, r10d
xor r8d, r8d
cmp rax, 3
seta r8b
cmova r10, rcx
lea rcx, [r8*4 + 1]
shl r8, 2
cmp rcx, rax
jae 0x140128f88
movzx esi, word [rsp + r8]
lea ecx, [r8*8]
shl rsi, cl
or r10, rsi
or r8, 2
cmp r8, rax
jae 0x140128f9f
movzx eax, byte [rsp + r8]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or r10, rax
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rdx + 0x38]
mov qword [rdx + 0x38], r10
cmp r9, 8
jbe 0x140128fc6
add r9, 8
jmp 0x1401290fe
xor r11d, r11d
jmp 0x14012901c
mov rcx, qword [rdx + 0x30]
mov rsi, qword [rdx + 0x28]
mov r8, qword [rdx + 0x18]
add r8, rsi
rol rsi, 0xd
xor rcx, r10
xor rsi, r8
rol r8, 0x20
mov rax, qword [rdx + 0x20]
add rax, rcx
rol rcx, 0x10
xor rcx, rax
add r8, rcx
rol rcx, 0x15
xor rcx, r8
add rax, rsi
rol rsi, 0x11
mov qword [rdx + 0x30], rcx
xor rsi, rax
rol rax, 0x20
mov qword [rdx + 0x28], rsi
mov qword [rdx + 0x20], rax
xor r8, r10
mov qword [rdx + 0x18], r8
mov r8d, 8
sub r8, r11
mov r9d, r8d
and r9d, 7
and r8, 0xfffffffffffffff8
cmp r11, r8
jae 0x1401290a3
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
mov r10, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x28]
nop word cs:[rax + rax]
nop
add rax, rsi
rol rsi, 0xd
mov rdi, qword [rsp + r11]
xor rsi, rax
rol rax, 0x20
xor rcx, rdi
add r10, rcx
rol rcx, 0x10
xor rcx, r10
add rax, rcx
rol rcx, 0x15
add r10, rsi
rol rsi, 0x11
xor rsi, r10
rol r10, 0x20
xor rcx, rax
xor rax, rdi
add r11, 8
cmp r11, r8
jb 0x140129050
mov qword [rdx + 0x30], rcx
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x28], rsi
mov qword [rdx + 0x20], r10
cmp r9d, 4
jb 0x1401290b5
mov eax, dword [rsp + r11]
mov r8d, 4
jmp 0x1401290ba
xor r8d, r8d
xor eax, eax
mov rcx, r8
or rcx, 1
cmp rcx, r9
jae 0x1401290e0
lea rcx, [r8 + r11]
movzx esi, word [rsp + rcx]
lea ecx, [r8*8]
shl rsi, cl
or rax, rsi
or r8, 2
cmp r8, r9
jae 0x1401290fa
add r11, r8
movzx esi, byte [rsp + r11]
shl r8d, 3
mov ecx, r8d
shl rsi, cl
or rax, rsi
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x40], r9
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x140131e40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140131e7b
mov r15d, 8
sub r15, r11
cmp r15, r8
mov rax, r8
cmovb rax, r15
cmp rax, 4
jb 0x140131e83
mov r14d, dword [rdx]
mov r10d, 4
jmp 0x140131e89
xor r15d, r15d
jmp 0x140131f39
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x140131eac
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x140131ec3
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x140131ee3
add r11, r8
jmp 0x14013200e
mov rcx, qword [r9 + 0x30]
mov rdi, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rdi
rol rdi, 0xd
xor rcx, r14
xor rdi, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
xor rcx, rax
add rsi, rdi
rol rdi, 0x11
mov qword [r9 + 0x30], rcx
xor rdi, rsi
rol rsi, 0x20
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x140131fb3
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
nop dword [rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140131f60
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11d, 4
jb 0x140131fc5
mov eax, dword [rdx + r15]
mov r8d, 4
jmp 0x140131fca
xor r8d, r8d
xor eax, eax
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140131ff0
lea rcx, [r8 + r15]
movzx edi, word [rdx + rcx]
lea ecx, [r8*8]
shl rdi, cl
or rax, rdi
or r8, 2
cmp r8, r11
jae 0x14013200a
add r15, r8
movzx edx, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or rax, rdx
mov qword [r9 + 0x38], rax
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret