joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3f98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1400a3fc3
call fcn.14001501c
int3
test rbx, rbx
jne 0x1400a3fce
call fcn.14001501c
int3
test r9, r9
jne 0x1400a3fd9
call fcn.14001501c
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a405c
cmp dword [rsp + 0x48], 3
jne 0x1400a405c
test eax, eax
jne 0x1400a405c
cmp dword [rdi], eax
je 0x1400a405c
mov ecx, dword [rdi]
call fcn.1400097cc
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a4050
cmp dword [rsp + 0x48], 3
jne 0x1400a4050
test eax, eax
jne 0x1400a4050
mov eax, 1
jmp 0x1400a405e
mov rcx, qword [rbx]
call fcn.140009818
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a4168
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
cmp eax, ecx
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400a4184
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140253530]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1400a4291
test rcx, rcx
je 0x1400a41f9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov dword [rsp + 0x50], edi
xor edi, edi
mov qword [rsp + 0x48], rcx
cmp ebx, edi
jmp 0x1400a422b
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400a4184
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, edi
jne 0x1400a4293
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x1400a4213
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x1400a4279
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.1400a3a44
mov rcx, qword [rsp + 0x48]
mov ebx, eax
jmp 0x1400a4293
xor edi, edi
cmp rcx, rdi
je 0x1400a429e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140184d90
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a4494
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov r12, rcx
cmp rdx, rbx
jne 0x1400a44bc
call fcn.14001501c
int3
mov rcx, r8
call fcn.1400087c0
mov rcx, qword [r12 + 8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x78], ebx
mov edi, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1400a4515
cmp dword [rsp + 0x68], 1
je 0x1400a4505
cmp dword [rsp + 0x68], 2
jne 0x1400a4515
mov edi, dword [rsp + 0x78]
mov eax, ebx
shr edi, 1
mov dword [rsp + 0x30], edi
cmp eax, ebx
je 0x1400a4519
xor eax, eax
jmp 0x1400a458e
cmp edi, ebx
jne 0x1400a4524
mov eax, 1
jmp 0x1400a458e
lea r8d, [rdi + 1]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r8
cmovo rax, rcx
mov rcx, rax
call fcn.1400097cc
lea r9, [rsp + 0x30]
lea rcx, [r12 + 8]
mov r8, rax
mov rdx, rsi
mov rdi, rax
call fcn.1400a3b78
mov esi, ebx
cmp eax, ebx
sete sil
cmp esi, ebx
je 0x1400a4584
cmp rdi, rbx
je 0x1400a4576
mov rcx, rdi
call fcn.140186914
mov ebx, eax
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call fcn.140008840
mov rcx, rdi
call fcn.140009818
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bf0f4
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.140008700
nop
cmp rbx, 0xffffffff80000000
jne 0x1400bf180
call fcn.14005a75c
cmp eax, 1
jne 0x1400bf180
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.140009310
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400089c0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400bf179
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400bf1b7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400bf1cc
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.140008700
nop
cmp rbx, 0xffffffff80000000
jne 0x1400bf258
call fcn.14005a75c
cmp eax, 1
jne 0x1400bf258
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.140009310
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400089c0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400bf251
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400bf297
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d51dc
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
cmp r8, 0x20
jne 0x1400d526c
mov rcx, qword [rcx + 0x40]
lea rdx, [rax - 0x28]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r11d, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
add r11d, 4
add eax, 0x17
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x64], eax
call fcn.1400d494c
mov rcx, rbx
call fcn.1400d50d0
mov rcx, qword [rbx + 0x40]
mov edx, 2
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
xor esi, esi
cmp dword [rcx + 0x418], esi
jne 0x1400d528b
cmp r8, 0x79
je 0x1400d5282
cmp r8, 0x12
jne 0x1400d5287
mov esi, 1
mov eax, esi
jmp 0x1400d5253
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r13w, ax
shr r13d, 0xf
and r13d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
and r11d, 1
cmp rdi, 0x12
je 0x1400d52c9
cmp rdi, 0x79
jne 0x1400d5242
cmp qword [0x140259f88], rsi
jne 0x1400d5251
test byte [rbx + 0x430], 2
jne 0x1400d5251
cmp rdi, 0x12
je 0x1400d5305
cmp rdi, 0x79
jne 0x1400d5251
cmp r13d, esi
jne 0x1400d5251
cmp r11d, esi
jne 0x1400d5251
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14001bcf8
cmp rax, rbx
jne 0x1400d532a
bt r12, 0x1e
jb 0x1400d532a
cmp rdi, 0x79
jne 0x1400d533a
mov rcx, rbp
jmp 0x1400d5333
cmp rdi, 0x79
jne 0x1400d533a
mov rcx, rbx
call fcn.14001259c
jmp 0x1400d5359
cmp dword [rbx + 0x3d4], esi
jge 0x1400d5359
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, 0xc8
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
jmp 0x1400d5253
Function at 0x1400e44cc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0xe8]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x4092
call fcn.1401634e4
lea r8, [rbx + 0x190]
mov edx, 0x4091
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x238]
mov edx, 0x4093
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x2e0]
mov edx, 0x4074
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x388]
mov edx, 0x407d
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x430]
mov edx, 0x407c
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x5e8]
mov edx, 0x407e
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x690]
mov edx, 0x4074
mov rcx, rdi
call fcn.14016373c
lea r8, [rbx + 0x698]
mov edx, 0x40db
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c
Function at 0x1400e6340
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
or edi, 0xffffffff
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov dword [rcx + 0xcc], r12d
cmp dword [rcx + 0xc0], r12d
je 0x1400e63d2
cmp r8d, r12d
jne 0x1400e63d2
cmp dword [rcx + 0xc4], r12d
jne 0x1400e63d2
cmp dword [rcx + 0x24], r12d
je 0x1400e63c8
cmp dword [rcx + 0x24], edi
je 0x1400e63c8
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbx + 0x100]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rbx + 0xcc], eax
cmp eax, r12d
jne 0x1400e63d2
xor eax, eax
jmp 0x1400e6552
mov dword [rcx + 0xcc], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1d8]
cmp eax, r12d
je 0x1400e6419
cmp esi, r12d
jne 0x1400e6419
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbx + 0x110]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, r12d
jne 0x1400e63c1
cmp dword [rbx + 0xcc], r12d
jne 0x1400e643f
cmp dword [rbx + 0x24], r12d
jbe 0x1400e643f
cmp dword [rbx + 0x24], edi
je 0x1400e643f
cmp dword [rbx + 0xc0], r12d
jne 0x1400e643f
cmp dword [rbx + 0xd8], r12d
je 0x1400e63c1
mov rdx, qword [rbx + 0x78]
lea rcx, str.CMFCMenuBar
call fcn.14005a468
mov rdi, rax
mov rax, qword [rbx + 0xb8]
cmp rax, r12
je 0x1400e6489
mov dword [rax + 0x1a8], r12d
mov rcx, qword [rbx + 0xb8]
mov rdx, qword [rcx]
call qword [rdx + 0xc0]
mov qword [rbx + 0xb8], r12
cmp rdi, r12
je 0x1400e6507
xor edx, edx
jmp 0x1400e64ff
mov rdx, qword [rbx + 0x78]
lea rcx, str.CMFCPopupMenuBar
call fcn.14005a468
cmp esi, r12d
je 0x1400e64bf
cmp rax, r12
je 0x1400e64bf
cmp dword [0x140258fb8], r12d
jne 0x1400e64bf
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1400c2864
jmp 0x1400e64f7
cmp rdi, r12
je 0x1400e64df
xor edx, edx
mov rcx, rdi
call fcn.14002e400
cmp rax, r12
je 0x1400e64df
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xb0]
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
call qword [rax + 0x190]
cmp eax, r12d
je 0x1400e63c1
cmp rdi, r12
je 0x1400e6507
mov rdx, rbx
mov rcx, rdi
call fcn.140031cb8
cmp qword [rbx + 0x78], r12
je 0x1400e654d
movdqu xmm0, xmmword [rbx + 0x60]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.14000fb2c
lea rcx, [rsp + 0x20]
mov edx, dword [rax + 0xfc]
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
mov rcx, qword [rbx + 0x78]
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
mov r9d, 0x401
xor r8d, r8d
call qword [sym.imp.USER32.dll_RedrawWindow]
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ec788
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
cmp ax, si
jge 0x1400ec7ac
xor eax, eax
jmp 0x1400ec841
mov rbx, qword [rdi + 0x208]
cmp rbx, rsi
jne 0x1400ec7db
mov rcx, qword [rdi + 0xf0]
call fcn.14001bd3c
lea rcx, vtable.CGlobalUtils.0
mov rdx, rax
call fcn.1400ccc48
mov rbx, rax
cmp rax, rsi
je 0x1400ec83c
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov r8, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], rsi
call fcn.140053344
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_IsRectEmpty]
cmp eax, esi
je 0x1400ec83c
cmp dword [rsp + 0x68], esi
je 0x1400ec7a5
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400ecd44
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0xcd], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400ece15
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.14001bcf8
cmp qword [rbx + 0xf8], 0
jne 0x1400ecd84
mov qword [rbx + 0xf8], rdi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov byte [rbx + 0xcd], 1
call qword [rax + 0x3c8]
lea rcx, [rbx + 0x190]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x310]
test al, 1
je 0x1400ecde5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x310]
test al, al
js 0x1400ecde5
call fcn.14005b1a4
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, [rbx + 0x138]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 0x208]
test rcx, rcx
jne 0x1400ece10
lea rcx, vtable.CGlobalUtils.0
mov rdx, rbx
call fcn.1400ccc48
mov rcx, rax
call fcn.14005510c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f8808
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 8]
mov rbx, rcx
mov ecx, 0x104
mov rdi, rdx
cmp eax, ecx
ja 0x1400f89aa
je 0x1400f89d0
cmp eax, 0xa1
jb 0x1400f8a1f
cmp eax, 0xa2
jbe 0x1400f89d0
cmp eax, 0xa3
jbe 0x1400f8a1f
cmp eax, 0xa5
jbe 0x1400f89d0
cmp eax, 0xa6
jbe 0x1400f8a1f
cmp eax, 0xa8
jbe 0x1400f89d0
cmp eax, 0x100
jne 0x1400f8a1f
cmp dword [rbx + 0xec], 0xffffffff
je 0x1400f89d0
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1400f89d0
mov rax, qword [rdi + 0x10]
sub rax, 0x21
je 0x1400f8952
cmp rax, 1
jne 0x1400f89d0
mov ecx, dword [rbx + 0xec]
lea edi, [rcx + 1]
add ecx, dword [rbx + 0xe8]
cmp edi, ecx
jge 0x1400f8948
mov eax, edi
mov rcx, rbx
cdq
idiv dword [rbx + 0xe8]
mov rax, qword [rbx]
mov esi, edx
call qword [rax + 0x4a8]
test eax, eax
jne 0x1400f8900
mov eax, dword [rbx + 0xe8]
inc edi
add eax, dword [rbx + 0xec]
cmp edi, eax
jl 0x1400f88d1
jmp 0x1400f8948
mov r8, qword [rbx]
mov edx, esi
mov rcx, rbx
mov dword [rbx + 0x314], 1
call qword [r8 + 0x3d8]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x3d0]
mov rcx, rax
call fcn.14001259c
mov r11, qword [rbx]
mov edx, dword [rbx + 0xec]
mov rcx, rbx
call qword [r11 + 0x490]
and dword [rbx + 0x314], 0
mov eax, 1
jmp 0x1400f8a2a
mov ecx, dword [rbx + 0xec]
mov eax, dword [rbx + 0xe8]
lea edi, [rax + rcx - 1]
cmp edi, ecx
jle 0x1400f8948
mov eax, edi
mov rcx, rbx
cdq
idiv dword [rbx + 0xe8]
mov rax, qword [rbx]
mov esi, edx
call qword [rax + 0x4a8]
test eax, eax
jne 0x1400f898d
dec edi
cmp edi, dword [rbx + 0xec]
jg 0x1400f8966
jmp 0x1400f8948
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
mov dword [rbx + 0x314], 1
call qword [rax + 0x3d8]
jmp 0x1400f8919
cmp eax, 0x200
jb 0x1400f8a1f
cmp eax, 0x202
jbe 0x1400f89d0
cmp eax, 0x203
jbe 0x1400f8a1f
cmp eax, 0x205
jbe 0x1400f89d0
add eax, 0xfffffdf9
cmp eax, 1
ja 0x1400f8a1f
mov rcx, qword [rbx + 0x158]
mov esi, 0x407
test rcx, rcx
je 0x1400f89fa
cmp qword [rcx + 0x40], 0
je 0x1400f89fa
mov rcx, qword [rcx + 0x40]
mov r9, rdi
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x150]
test rcx, rcx
je 0x1400f8a1f
cmp qword [rcx + 0x40], 0
je 0x1400f8a1f
mov rcx, qword [rcx + 0x40]
mov r9, rdi
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rdi
mov rcx, rbx
call fcn.140100698
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140104424
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov ebx, ecx
xor edi, edi
cmp dword [0x14024e82c], edi
je 0x140104534
cmp dword [0x140250e44], 0xfffffffe
jne 0x140104519
cmp ecx, 0xffffffff
je 0x140104534
mov eax, dword [0x14025bfd0]
test al, 1
jne 0x1401044b1
or eax, 1
mov dword [0x14025bfd0], eax
xor edx, edx
lea rcx, [0x14025bf98]
call fcn.14010e600
nop
lea rax, vtable.CCriticalSection.0
mov qword [0x14025bf98], rax
lea rcx, [0x14025bf98]
call fcn.14003f698
cmp eax, edi
jne 0x1401044a4
call fcn.140014fd4
nop
lea rcx, [0x1401ba1fc]
call fcn.140184f94
nop
lea rcx, [0x14025bf98]
call fcn.14003f6b8
cmp qword [0x14025bf90], rdi
je 0x1401044cc
call fcn.14001501c
int3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401043c0]
call fcn.14018a274
mov qword [0x14025bf90], rax
cmp rax, rdi
jbe 0x140104503
cmp rax, 0xffffffffffffffff
je 0x140104503
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x140250e44], ebx
jmp 0x14010450a
mov qword [0x14025bf90], rdi
lea rcx, [0x14025bfa8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140104534
mov dword [0x140250e44], ecx
mov rax, qword [0x14025bf90]
cmp ecx, 0xffffffff
cmove rax, rdi
mov qword [0x14025bf90], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1401065e4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, rcx
xor edx, edx
lea rcx, [rax - 0x30]
call fcn.14002a4f8
nop
mov edi, dword [0x14025a7b0]
mov esi, dword [0x14025a7b4]
lea rcx, [rsp + 0x48]
call fcn.140029970
nop
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002a36c
and qword [rsp + 0x30], 0
lea r14, vtable.CBitmap.0
mov qword [rsp + 0x28], r14
mov r8d, esi
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14002a708
test eax, eax
jne 0x1401066b4
or r8d, 0xffffffff
xor edx, edx
mov ecx, 0x3e8a
call fcn.14000d8e8
nop
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.140010b44
nop
lea rcx, [rsp + 0x48]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x68]
call fcn.14002a55c
xor eax, eax
jmp 0x140106829
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14002a7dc
mov rbx, rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], esi
mov r8, qword [0x14025a6c0]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_FillRect]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1401062a8
test rbx, rbx
jne 0x14010670a
xor edx, edx
jmp 0x14010670e
mov rdx, qword [rbx + 8]
mov rcx, qword [rsp + 0x50]
call fcn.14002a7dc
call fcn.1400171f0
mov rcx, rax
test rax, rax
je 0x140106730
mov rax, qword [rax]
call qword [rax + 0xe8]
jmp 0x140106732
xor eax, eax
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14010677d
or r8d, 0xffffffff
xor edx, edx
mov ecx, 0x3e8a
call fcn.14000d8e8
nop
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.140010b44
nop
lea rcx, [rsp + 0x48]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x68]
call fcn.14002a55c
xor eax, eax
jmp 0x140106829
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1401067c7
or r8d, 0xffffffff
xor edx, edx
mov ecx, 0x3e8a
call fcn.14000d8e8
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.140010b44
nop
lea rcx, [rsp + 0x48]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x68]
call fcn.14002a55c
xor eax, eax
jmp 0x140106829
lea rcx, [rsp + 0x28]
call fcn.14002a744
mov rdx, rax
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x1401067f4
or r8d, 0xffffffff
xor edx, edx
mov ecx, 0x3e8a
call fcn.14000d8e8
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.140010b44
nop
lea rcx, [rsp + 0x48]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x68]
call fcn.14002a55c
mov eax, 1
jmp 0x140106829
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14011576c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13, rdx
mov rdi, rcx
mov qword [rax + 8], rbx
mov rax, qword [rcx]
call qword [rax + 0x320]
mov edx, dword [0x14024e9b0]
lea r8, [rsp + 0x50]
test al, 0x80
lea eax, [rbx - 1]
mov rcx, rdi
cmovne edx, eax
mov rax, qword [rdi]
call qword [rax + 0x520]
mov rdx, qword [rsp + 0x50]
lea rcx, str.CDockablePane
mov r12d, eax
call fcn.14005a468
mov rsi, rax
cmp rax, rdi
je 0x140115871
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, bx
jl 0x140115871
cmp rsi, rbx
je 0x140115812
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8 + 0x400]
lea rcx, str.CMultiPaneFrameWnd
mov rdx, rax
call fcn.14005a468
mov rbp, rax
jmp 0x140115815
mov rbp, rbx
cmp r12d, 2
jne 0x14011588c
cmp rbp, rbx
je 0x140115855
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x330]
test al, 0x40
je 0x140115871
cmp qword [rsp + 0x50], rbx
je 0x140115855
mov rax, qword [rbp]
mov rdx, rdi
mov rcx, rbp
call qword [rax + 0x448]
cmp eax, ebx
mov rax, rdi
sete bl
mov dword [r13], ebx
jmp 0x140115873
mov rax, qword [rdi]
mov r9d, 5
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x3a0]
mov dword [r13], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
cmp r12d, 3
jne 0x140115871
cmp rsi, rbx
je 0x140115871
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x2b8]
cmp eax, ebx
je 0x140115871
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x2c8]
cmp eax, ebx
je 0x140115871
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x430]
mov r11, qword [rdi]
lea r9d, [r12 - 2]
lea r8d, [r12 + 2]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [r11 + 0x650]
cmp rax, rbx
setne bl
mov dword [r13], ebx
jmp 0x140115873