joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a58d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov r14, rdx
mov rdi, rcx
movzx ebx, byte [rcx + 0x7c8]
test bl, bl
je 0x1400a5b03
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400a591d
movzx ebx, byte [rdi + 0x7cb]
test bl, bl
je 0x1400a5b03
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400a5939
cmp byte [rdi + 0x664], 0
sete bl
test bl, bl
je 0x1400a5b03
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400a5b03
cmp byte [rdi + 0x838], 0
jne 0x1400a5b03
mov r12d, dword [r14 + 4]
mov r15d, dword [r14]
mov dword [rsp + 0x178], r15d
mov dword [rsp + 0x17c], r12d
xor r9d, r9d
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x178]
lea rcx, [rdi + 0x1e8]
call fcn.1400b5260
mov rbp, rax
xor eax, eax
mov esi, eax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x900]
test al, al
je 0x1400a59fe
mov rcx, qword [rdi + 0x7e8]
test rcx, rcx
je 0x1400a59fe
mov rax, qword [rcx]
call qword [rax + 0x308]
test al, al
je 0x1400a59fe
mov rcx, qword [rdi + 0x7e8]
test rcx, rcx
je 0x1400a59fe
mov dword [rsp + 0x170], r15d
mov dword [rsp + 0x174], r12d
mov r8d, 1
lea rdx, [rsp + 0x170]
call fcn.1400da540
test eax, eax
cmovns esi, eax
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm1
movups xmmword [rsp + 0x30], xmm1
test rbp, rbp
je 0x1400a5ac1
cmp byte [rdi + 0x838], 0
jne 0x1400a5ac1
mov r9d, esi
mov r8, rbp
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400a86d0
mov rax, qword [rdi + 0x1e8]
mov rdx, rbp
lea rcx, [rdi + 0x1e8]
call qword [rax + 0x68]
mov r8d, eax
mov r9d, esi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400a2170
nop
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x68], xmm0
mov rax, qword [rdi]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [rax + 0x960]
mov rax, qword [rdi + 0x1e8]
lea rcx, [rdi + 0x1e8]
call qword [rax + pe_nt_image_headers64]
mov r8, rax
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400a2470
test rax, rax
je 0x1400a5ab2
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400a4c20
movups xmm1, xmmword [rsp + 0x20]
mov rcx, qword [r14]
mov rdx, rcx
shr rdx, 0x20
movd eax, xmm1
cmp ecx, eax
jl 0x1400a5b03
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp ecx, eax
jge 0x1400a5b03
cmp edx, dword [rsp + 0x34]
jl 0x1400a5b03
movzx eax, bl
psrldq xmm1, 0xc
movd ecx, xmm1
cmp edx, ecx
mov ecx, 0
cmovl eax, ecx
jmp 0x1400a5b06
movzx eax, bl
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b6f40
Capabilities:
Log keystrokes via polling

Disassembly:
cmp qword [rcx + 0x710], 0
je 0x1400b6f4d
xor al, al
ret
jmp fcn.1400b9130
Function at 0x1400b72e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400b7408
cmp byte [rbx + 0x39], 0
jne 0x1400b7408
lea rsi, vtable.JRWndPtr.0
mov qword [rbp - 0x38], rsi
xor edi, edi
mov qword [rbp - 0x30], rdi
mov dword [rbp - 0x28], edi
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.140062d90
lea rax, [rbp - 0x38]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14000a770
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1400867b0
nop
mov qword [rbp - 0x38], rsi
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400b737c
cmp dword [rbp - 0x28], 1
jne 0x1400b737c
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
call qword [rax + 0x608]
mov rcx, qword [rbp - 0x30]
cmp dword [rbp - 0x28], 2
jne 0x1400b7396
test rcx, rcx
je 0x1400b7396
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x2e8]
nop
mov dword [rbp + 0x30], 0xffffffff
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x40], rax
lea rcx, [rbx + 0x1e8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x40]
call qword [rax + 0x1f8]
mov rsi, rax
test rax, rax
je 0x1400b7408
cmp dword [rbp + 0x30], 0
jl 0x1400b7408
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + 0x128]
mov ecx, dword [rsi + 0x68]
shr ecx, 1
test cl, 1
cmove rdi, rsi
mov r8d, dword [rbp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.1400b7470
mov al, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b90d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x1e8
mov rax, qword [rcx]
call qword [rax + 0xb0]
test al, al
jne 0x1400b9119
cmp dword [rbx + 0x648], 0xffffffff
jne 0x1400b9119
mov ecx, 0x11
xor bl, bl
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 1
test al, 1
movzx eax, bl
cmovne eax, ecx
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400baeb0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0xdb], 0
je 0x1400baed6
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400baed6
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1400bb2c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x644], 0
mov rsi, r8
movsx edi, dx
mov rbx, rcx
jne 0x1400bb380
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400bb327
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400bb327
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x840]
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
movzx edx, di
and al, 1
mov rcx, rbx
movzx r8d, al
call fcn.1400ba130
mov rcx, rbx
test al, al
je 0x1400bb366
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x700]
mov eax, dword [rsi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
movzx edx, di
mov eax, dword [rsi + 4]
mov dword [rsp + 0x34], eax
call fcn.140067510
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bc2b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
mov rbx, rdx
mov dword [rsp + 0x30], eax
mov rdi, rcx
mov eax, dword [rdx + 4]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], eax
call fcn.140066e20
mov eax, dword [rbx]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov rcx, rdi
mov eax, dword [rbx + 4]
mov dword [rsp + 0x34], eax
call fcn.1400bd3f0
mov rbx, qword [rdi + 0x658]
test rbx, rbx
je 0x1400bc323
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea rcx, [rdi + 0x1e8]
and al, 1
mov r9b, 1
movzx r8d, al
mov rdx, rbx
call fcn.1400b21a0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bc3e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x28
mov rbx, rcx
mov r14, rdx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400bc411
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x560]
mov eax, dword [rbx + 0x4c]
lea r15, [rbx + 0x1e8]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x68]
mov eax, dword [rbx + 0x50]
xor r9d, r9d
mov dword [rsp + 0x6c], eax
xor r8d, r8d
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x1f8]
mov ecx, dword [r14]
lea r8, [rsp + 0x60]
mov r10, qword [r15]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], ecx
xor r9d, r9d
mov ecx, dword [r14 + 4]
mov rdi, rax
mov dword [rsp + 0x74], ecx
mov rcx, r15
mov dword [rsp + 0x60], 0
call qword [r10 + 0x1f8]
xor bpl, bpl
mov rsi, rax
test rax, rax
je 0x1400bc4a8
mov ecx, dword [r14]
lea r9, [rsp + 0x78]
mov r10, qword [rbx]
mov rdx, rax
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x78], ecx
mov ecx, dword [r14 + 4]
mov dword [rsp + 0x7c], ecx
mov rcx, rbx
call qword [r10 + 0x820]
movzx ebp, al
cmp rsi, rdi
je 0x1400bc4cc
mov rdx, rdi
mov rcx, rbx
call fcn.1400ad2f0
mov rdx, rsi
mov rcx, rbx
call fcn.1400ad2f0
lea rdi, [rbx + 0x666]
jmp 0x1400bc4e8
lea rdi, [rbx + 0x666]
test bpl, bpl
jne 0x1400bc4dd
cmp byte [rdi], bpl
je 0x1400bc4e8
mov rdx, rsi
mov rcx, rbx
call fcn.1400ad2f0
mov rax, qword [r15]
lea rdx, [rsp + 0x68]
mov byte [rdi], bpl
xor r9d, r9d
mov edi, dword [r14]
xor r8d, r8d
mov esi, dword [r14 + 4]
mov rcx, r15
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], esi
call qword [rax + 0x1f8]
cmp qword [rbx + 0x4f0], 0
je 0x1400bc55a
cmp byte [rbx + 0x4e8], 0
je 0x1400bc55a
lea rcx, [rbx + 0x500]
xor r8d, r8d
mov rdx, rax
call fcn.1400aea60
test rax, rax
je 0x1400bc55a
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x1400bc55a
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], esi
call qword [rax + 0x40]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], edi
mov rcx, rbx
mov dword [rsp + 0x6c], esi
call fcn.1400758d0
add rsp, 0x28
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c2d90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
mov rdi, rdx
mov dword [rsp + 0x30], eax
mov rsi, rcx
mov eax, dword [rdx + 4]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], eax
call fcn.1400b7d90
mov ebx, dword [rdi]
lea rdx, [rsp + 0x30]
mov edi, dword [rdi + 4]
mov rcx, rsi
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x30], ebx
call fcn.140066e20
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov rcx, rsi
mov dword [rsp + 0x34], edi
call fcn.1400bd3f0
mov rbx, qword [rsi + 0x658]
test rbx, rbx
je 0x1400c2e1d
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea rcx, [rsi + 0x1e8]
and al, 1
mov r9b, 1
movzx r8d, al
mov rdx, rbx
call fcn.1400b21a0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c3e10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movzx ebx, byte [rcx + 0x7c8]
mov rdi, rcx
test bl, bl
je 0x1400c3e6c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400c3e45
movzx ebx, byte [rdi + 0x7cb]
test bl, bl
je 0x1400c3e6c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400c3e6c
cmp byte [rdi + 0x664], 0
sete al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d1000
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
movsxd rdx, dword [rax - 0x10]
add rdx, rdx
cmp rdx, 0x10000000
jbe 0x1400d1024
xor al, al
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
xor ecx, ecx
xor bpl, bpl
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400d10e5
mov qword [rsp + 0x40], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rax, qword [rdi]
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rdx, ecx
mov ecx, 0x2000
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x1400d10cd
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, qword [rdi]
mov rcx, rax
mov rbx, rax
movsxd r8, dword [rdx - 0x10]
add r8, r8
call fcn.1401535f0
mov rcx, qword [rdi]
xor eax, eax
movsxd rdx, dword [rcx - 0x10]
mov rcx, rsi
mov word [rbx + rdx*2], ax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x1400d10ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400d10cd
mov bpl, 1
mov edx, 1
mov rcx, rdi
call fcn.1400d2280
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x40]
movzx eax, bpl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d18f0
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov r14, rcx
xor bl, bl
call fcn.1400373b0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400d1a99
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x30]
lea ecx, [rsi + 0xd]
call fcn.1400d2360
test al, al
je 0x1400d198e
mov byte [rsp + 0x20], 1
mov r9d, 0x4000
mov r8b, 1
lea edx, [rsi + 2]
lea rcx, [rsp + 0x30]
call fcn.1400561b0
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400d1974
cmp qword [rsp + 0x40], rsi
jle 0x1400d1974
mov rsi, rdi
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
call fcn.14003bb00
mov bl, 1
jmp 0x1400d1a85
lea rdx, [rsp + 0x30]
mov ecx, 0xd
call fcn.1400d2360
test al, al
je 0x1400d1a80
mov byte [rsp + 0x20], 1
mov r9d, 0x4000
mov r8b, 1
mov ebp, 1
mov edx, ebp
lea rcx, [rsp + 0x30]
call fcn.1400561b0
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400d1a74
cmp qword [rsp + 0x40], 0
jle 0x1400d1a74
test rdi, rdi
je 0x1400d1a74
mov rbx, rdi
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x1400d19f0
sub ebx, edi
dec ebx
test ebx, ebx
jle 0x1400d1a74
xor r9d, r9d
movzx r8d, bpl
mov edx, ebx
mov rcx, r14
call fcn.140037200
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rcx, eax
mov rdx, qword [r14]
cmp ecx, 0xffffffff
jne 0x1400d1a57
test rdx, rdx
je 0x1400d1a5d
mov rcx, rdx
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400d1a40
sub rcx, rdx
sar rcx, 1
lea esi, [rcx - 1]
jmp 0x1400d1a5d
mov word [rdx + rcx*2], si
mov esi, ecx
mov dword [rdx - 0x10], esi
mov eax, dword [rdx - 8]
cmp eax, 0xffffffff
jne 0x1400d1a6b
xchg dword [rdx - 8], ebp
mov rdi, qword [rsp + 0x30]
mov bl, 1
jmp 0x1400d1a85
mov rcx, r14
call fcn.1400373b0
mov bl, 1
jmp 0x1400d1a85
mov rdi, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
test rdi, rdi
je 0x1400d1a99
mov rcx, rdi
call fcn.140017d60
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400d2280
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15d, edx
xor bpl, bpl
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
call fcn.140058520
mov rsi, rax
test rax, rax
je 0x1400d2335
mov rbx, rax
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x1400d22c2
sub ebx, esi
movsxd rdx, ebx
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x1400d2335
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
movsxd rbx, ebx
lea r8, [rbx - 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401535f0
mov byte [rbx + rdi - 1], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x1400d2332
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400d2335
mov bpl, 1
test rsi, rsi
je 0x1400d2342
mov rcx, rsi
call fcn.140017d60
movzx eax, bpl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400d2360
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x30
mov rbp, rdx
mov qword [rdx + 8], 0
mov ebx, ecx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400d2427
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x1400d2421
mov rcx, rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1400d2411
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rdi, rax
test rax, rax
jle 0x1400d23f1
mov r9d, 0x4000
mov byte [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.1400561b0
test rax, rax
je 0x1400d23f1
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1401535f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdi, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rbp
ret
Function at 0x1400d3b90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov r15, rdx
mov rbx, rcx
xor ecx, ecx
mov dword [r8], ecx
mov dword [r9], ecx
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], ecx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140062d90
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d3c12
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x488]
movups xmm0, xmmword [rax]
mov rcx, qword [rsp + 0x38]
movq r13, xmm0
mov r12, r13
shr r12, 0x20
psrldq xmm0, 8
movq r14, xmm0
mov rbp, r14
shr rbp, 0x20
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x1400d3c5a
cmp dword [rsp + 0x40], 1
jne 0x1400d3c5a
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x608]
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], 2
jne 0x1400d3c75
test rcx, rcx
je 0x1400d3c75
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x2e8]
nop
mov rcx, rbx
cmp byte [rbx + 0x1f0], 0
je 0x1400d3cef
mov eax, dword [r15]
sub eax, dword [rbx + 0x250]
mov dword [rsi], eax
mov dword [rdi], 1
call fcn.1400d27c0
cmp dword [r15], eax
jl 0x1400d3d0c
mov rcx, rbx
call fcn.1400d27c0
sub r14d, r13d
sub r14d, eax
cmp dword [r15], r14d
jge 0x1400d3d27
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400d3ce1
mov ecx, dword [rsi]
test ecx, ecx
js 0x1400d3cdb
mov eax, dword [rbx + 0x258]
sub eax, dword [rbx + 0x250]
cmp ecx, eax
jle 0x1400d3d70
mov dword [rdi], 2
mov eax, dword [rbx + 0x258]
sub eax, dword [rbx + 0x250]
jmp 0x1400d3d69
mov eax, dword [r15 + 4]
sub eax, dword [rbx + 0x254]
mov dword [rsi], eax
mov dword [rdi], 1
call fcn.1400d27c0
cmp dword [r15 + 4], eax
jge 0x1400d3d14
mov dword [rdi], 3
jmp 0x1400d3d70
mov rcx, rbx
call fcn.1400d27c0
sub ebp, r12d
sub ebp, eax
cmp dword [r15 + 4], ebp
jl 0x1400d3d2f
mov dword [rdi], 4
jmp 0x1400d3d70
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400d3d5d
mov ecx, dword [rsi]
test ecx, ecx
js 0x1400d3d57
mov eax, dword [rbx + 0x25c]
sub eax, dword [rbx + 0x254]
cmp ecx, eax
jle 0x1400d3d70
mov dword [rdi], 2
mov eax, dword [rbx + 0x25c]
sub eax, dword [rbx + 0x254]
cdq
sub eax, edx
sar eax, 1
mov dword [rsi], eax
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400d9630
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
cmp dword [rdx + 8], 0x100
jne case.0x1400d9684.10
mov edi, 0xffffffff
cmp qword [rdx], 0
je 0x1400d965d
mov edi, dword [rdx + 0x10]
lea eax, [rdi - 9]
cmp eax, 0x1f
ja case.0x1400d9684.10
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xd9840]
mov ecx, dword [rdx + rax*4 + 0xd982c]
add rcx, rdx
jmp rcx
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.140084670
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400d96b4
mov rax, qword [rcx]
mov edx, 9
call qword [rax + 0x5a8]
test al, al
je 0x1400d96b4
xor dil, dil
jmp 0x1400d96e9
movsxd rsi, edi
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x328]
xor dil, dil
test al, al
je 0x1400d96e9
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400d96e9
mov rax, qword [rcx]
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
call qword [rax]
movzx edi, al
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400d9719
cmp dword [rsp + 0x30], 1
jne 0x1400d9719
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x608]
mov rcx, qword [rsp + 0x28]
cmp dword [rsp + 0x30], 2
jne 0x1400d9735
test rcx, rcx
je 0x1400d9735
mov r8, qword [rcx]
mov edx, 1
call qword [r8 + 0x2e8]
nop
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rbx + 0x2e0], 1
jne 0x1400d97ec
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rbx + 0x2e0], 1
je case.0x1400d9684.10
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je case.0x1400d9684.10
jmp 0x1400d97ec
mov eax, dword [rbx + 0x2e0]
cmp eax, 6
ja case.0x1400d9684.10
mov ecx, 0x65
bt ecx, eax
jae case.0x1400d9684.10
mov rax, qword [rbx + 0x348]
test rax, rax
je 0x1400d97ec
cmp byte [rax + 0x544], 0
jne case.0x1400d9684.10
mov rcx, qword [rax + 0x4b8]
test rcx, rcx
je 0x1400d97d6
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400d97d6
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x3c8]
test al, al
jne case.0x1400d9684.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x1400d9684.10
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x328]
test al, al
je 0x1400d9818
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400d9818
mov rax, qword [rcx]
movsxd r9, edi
xor r8d, r8d
mov rdx, rbx
call qword [rax]
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d9d60
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x2e4], 2
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov dl, 1
test al, 1
mov rcx, rbx
mov rax, qword [rbx]
mov r8, qword [rax + 0x328]
je 0x1400d9dbe
call r8
test al, al
je 0x1400d9de6
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400d9de6
mov rax, qword [rcx]
mov r9d, 0xd
xor r8d, r8d
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp qword [rax]
call r8
test al, al
je 0x1400d9de6
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400d9de6
mov rax, qword [rcx]
xor r9d, r9d
mov rdx, rbx
lea r8d, [r9 + 1]
add rsp, 0x20
pop rbx
jmp qword [rax]
add rsp, 0x20
pop rbx
ret