joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fa90
Capabilities:
Write clipboard data

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2c], 0
jne 0x14000facd
mov rcx, qword [rsp + 0x40]
call fcn.140010190
test eax, eax
jne 0x14000facd
lea rdx, [0x140269af0]
mov rcx, qword [rsp + 0x40]
call fcn.14000f910
jmp 0x14000fc21
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14000faf9
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.14000f9e0
lea rdx, [0x140269b38]
mov rcx, qword [rsp + 0x40]
call fcn.14000f910
jmp 0x14000fc21
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x14000fc15
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x18], 0
je 0x14000fbac
cmp dword [rsp + 0x48], 0xd
jne 0x14000fb51
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
movzx eax, word [rax]
test eax, eax
jne 0x14000fb3f
mov dword [rsp + 0x24], 1
jmp 0x14000fb47
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x28], eax
jmp 0x14000fb7b
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
movsx eax, byte [rax]
test eax, eax
jne 0x14000fb6b
mov dword [rsp + 0x2c], 1
jmp 0x14000fb73
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x28], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14000fbcf
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
jmp 0x14000fc15
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 8]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14000fbf6
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
jmp 0x14000fc15
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.14000f9e0
lea rdx, [0x140269ac8]
mov rcx, qword [rsp + 0x40]
call fcn.14000f910
jmp 0x14000fc21
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.14000f9e0
add rsp, 0x30
pop rdi
ret
Function at 0x14000ffa0
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
lea rdi, [rsp + 0x20]
mov ecx, SysStringByteLen
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x270]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x280], 0
je 0x14000fffa
mov rax, qword [rsp + 0x280]
mov dword [rax], 0
cmp dword [rsp + 0x278], 0xc000
jb 0x140010014
cmp dword [rsp + 0x278], 0xffff
jbe 0x14001004e
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0x20a
jae 0x140010035
jmp 0x14001003a
call fcn.1401357e0
xor eax, eax
mov rcx, qword [rsp + 0x250]
mov word [rsp + rcx + 0x30], ax
jmp 0x140010120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, str.Link_Source
lea rcx, [rsp + 0x30]
call fcn.1401a82a0
test eax, eax
je 0x1400100d5
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
je 0x1400100d5
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
je 0x1400100d5
lea rdx, str.Native
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
je 0x1400100d5
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
jne 0x1400100d9
xor eax, eax
jmp 0x14001012d
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
je 0x140010103
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x30]
call fcn.1401a7920
test eax, eax
jne 0x140010120
cmp qword [rsp + 0x280], 0
je 0x14001011c
mov rax, qword [rsp + 0x280]
mov dword [rax], 1
xor eax, eax
jmp 0x14001012d
mov ecx, dword [rsp + 0x278]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140269c70]
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140135520
add rsp, 0x260
pop rdi
ret

Function at 0x140010190
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x2c], 0
je 0x1400101af
mov eax, 1
jmp 0x140010231
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x1403213e8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400101dd
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x2c], 1
mov eax, 1
jmp 0x140010231
cmp dword [0x140319830], 0xffffffff
je 0x14001020c
cmp dword [0x140319830], 0
je 0x140010208
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x20]
mov ecx, dword [0x140319830]
sub ecx, eax
mov eax, ecx
cmp eax, 5
jg 0x14001020c
xor eax, eax
jmp 0x140010231
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400070b0
mov dword [0x140319840], 1
jmp 0x1400101b9
add rsp, 0x30
pop rdi
ret
Function at 0x140016d10
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add rsp, 0x20
pop rdi
ret

Function at 0x140019c90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x140019ce5
lea rax, str.mSocket____SOCKET__0_
mov qword [rsp + 0x28], rax
lea rax, [0x14026b078]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8db
lea rdx, [0x14026b0d0]
mov ecx, 2
call fcn.1401a71f0
cmp eax, 1
jne 0x140019ce5
int3
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x58], 0
je 0x140019d2a
lea rax, str._mCommandBuf.mFailed
mov qword [rsp + 0x28], rax
lea rax, [0x14026b0c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8dc
lea rdx, [0x14026b180]
mov ecx, 2
call fcn.1401a71f0
cmp eax, 1
jne 0x140019d2a
int3
mov dword [rsp + 0x30], 0
jmp 0x140019d3e
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x50]
jae 0x140019d7e
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x140019d7c
cmp qword [rsp + 0x58], 0
je 0x140019d75
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
xor eax, eax
jmp 0x140019e29
jmp 0x140019d34
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x48]
cmp qword [rax + 0x50], rcx
jne 0x140019db5
mov rax, qword [rsp + 0x50]
add rax, 0x40
mov rcx, rax
call fcn.1400165c0
test eax, eax
je 0x140019db5
lea rcx, [0x14026b200]
call fcn.1400167a0
jmp 0x140019e29
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x50]
mov rax, qword [rax + 0x48]
sub rax, rcx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
mov rdx, qword [rsp + 0x50]
add rcx, qword [rdx + 0x50]
xor r9d, r9d
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WSOCK32.dll_recv]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
jne 0x140019e0d
lea rcx, [0x14026b310]
call fcn.1400167a0
jmp 0x140019e29
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x50]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x50], rax
jmp 0x140019d32
add rsp, 0x40
pop rdi
ret
Function at 0x14001a120
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x30]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp dword [rax + 0x78], 0
je 0x14001a1a0
lea rax, str._mResponseBuf.mFailed
mov qword [rsp + 0x28], rax
lea rax, [0x14026b3e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x901
lea rdx, [0x14026b3f0]
mov ecx, 2
call fcn.1401a71f0
cmp eax, 1
jne 0x14001a1a0
int3
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x70]
add rax, 0x26
mov r8d, 0xa
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1401eb8d0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14001d240
inc rax
mov qword [rsp + 0x88], rax
lea r8, str.__xml_version_1.0__encoding_UTF_8___
lea rdx, [0x14026a1dc]
mov rcx, qword [rsp + 0x88]
call fcn.14001e810
cdqe
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x14001a299
mov rax, qword [rsp + 0xb0]
add rax, 0x60
mov r8d, 1
lea rdx, [0x14026a1fc]
mov rcx, rax
call fcn.14001a9c0
test eax, eax
jne 0x14001a299
xor r9d, r9d
mov rax, qword [rsp + 0xb0]
mov r8d, dword [rax + 0x70]
mov rax, qword [rsp + 0xb0]
mov rdx, qword [rax + 0x60]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x14001a2a7
lea rcx, [0x14026b4b0]
call fcn.1400167a0
jmp 0x14001a2bd
mov rax, qword [rsp + 0xb0]
add rax, 0x60
mov rcx, rax
call fcn.140015150
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14026cda0]
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140135520
add rsp, 0xa0
pop rdi
ret
Function at 0x14001e430
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
jmp 0x14001e471
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax]
test eax, eax
je 0x14001e496
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x14001e494
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
jmp 0x14001e464
cmp dword [rsp + 0x30], 3
je 0x14001e4a1
xor eax, eax
jmp 0x14001e4cb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14001e4bb
xor eax, eax
jmp 0x14001e4cb
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x20]
mov dword [rax], ecx
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x14001e4e0
Capabilities:
Resolve dns

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
mov qword [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001e600
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x14001e5df
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x14001e5df
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14001e586
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001e5df
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.14001e350
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax], 0
jne 0x14001e5cc
mov eax, 8
jmp 0x14001e655
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x20], rax
jmp 0x14001e578
mov r9d, 0x400
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call fcn.1401f63e0
xor eax, eax
jmp 0x14001e655
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x2af9
je 0x14001e634
cmp dword [rsp + 0x38], 0x2afa
je 0x14001e63b
cmp dword [rsp + 0x38], 0x2afb
je 0x14001e642
cmp dword [rsp + 0x38], 0x2afc
je 0x14001e649
jmp 0x14001e650
mov eax, 0x2af9
jmp 0x14001e655
mov eax, 0x2afa
jmp 0x14001e655
mov eax, 0x2afb
jmp 0x14001e655
mov eax, 0x2af9
jmp 0x14001e655
mov eax, 0x2af9
add rsp, 0x40
pop rdi
ret
Function at 0x140021b10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x4080
call fcn.1401354c0
sub rsp, rax
lea rdi, [rsp + 0x40]
mov ecx, 0x1010
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4090]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x4078], rax
cmp qword [rsp + 0x40b0], 0
jne 0x140021b7e
mov rax, qword [rsp + 0x4090]
mov rax, qword [rax + 0x6b0]
mov qword [rsp + 0x40b0], rax
cmp qword [rsp + 0x40b0], 0
je 0x140021b9e
mov rax, qword [rsp + 0x40b0]
movzx eax, word [rax + 2]
mov dword [rsp + 0x4070], eax
jmp 0x140021bb3
mov rax, qword [rsp + 0x4090]
mov eax, dword [rax + 0x2d0]
mov dword [rsp + 0x4070], eax
mov eax, dword [rsp + 0x4070]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x40b0], 0
je 0x140021bdd
mov rax, qword [rsp + 0x40b0]
mov eax, dword [rax + 4]
mov dword [rsp + 0x4074], eax
jmp 0x140021bf2
mov rax, qword [rsp + 0x4090]
mov eax, dword [rax + 0x2d4]
mov dword [rsp + 0x4074], eax
movzx eax, word [rsp + 0x4074]
mov word [rsp + 0x44], ax
cmp dword [rsp + 0x4098], 0
jne 0x140021c0e
jmp 0x140021cde
movzx eax, word [rsp + 0x44]
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x40a8]
mov r8, qword [rsp + 0x40a0]
mov edx, 0x2000
lea rcx, [rsp + 0x60]
call fcn.14001fc90
mov dword [rsp + 0x4064], eax
cmp dword [rsp + 0x4098], 3
jne 0x140021c79
lea r9, [0x14026e3e4]
mov r8d, dword [rsp + 0x4064]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x4090]
call fcn.1400217d0
jmp 0x140021c9c
lea rdx, [rsp + 0x60]
lea rcx, [0x1403212d0]
call fcn.140017e80
movzx eax, al
test eax, eax
jne 0x140021c9c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsp + 0x4098], 2
jne 0x140021cde
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x40b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40a8]
mov r8d, 1
mov rdx, qword [rsp + 0x40a0]
lea rcx, [0x1403219f0]
call fcn.140021e80
mov rcx, rsp
lea rdx, [0x14026efc0]
call fcn.140134a00
mov rcx, qword [rsp + 0x4078]
xor rcx, rsp
call fcn.140135520
add rsp, 0x4080
pop rdi
ret
Function at 0x140036980
Capabilities:
Log keystrokes via polling

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
push rdi
sub rsp, 0x30
movzx eax, word [rsp + 0x40]
cmp eax, 0xa
jne 0x1400369aa
mov al, 0xd
jmp 0x140036b1a
mov rdx, qword [rsp + 0x50]
movzx ecx, word [rsp + 0x40]
call qword [sym.imp.USER32.dll_VkKeyScanExW]
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
and rax, 0xff
mov byte [rsp + 0x24], al
movsx rax, word [rsp + 0x20]
shr rax, 8
and rax, 0xff
mov byte [rsp + 0x25], al
movsx eax, byte [rsp + 0x25]
cmp eax, 0xffffffff
jne 0x140036a4e
movzx eax, byte [rsp + 0x24]
cmp eax, 0xff
jne 0x140036a4e
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x140036a10
movzx ecx, word [rsp + 0x40]
call fcn.14003edd0
test eax, eax
jne 0x140036a17
xor al, al
jmp 0x140036b1a
movzx ecx, word [rsp + 0x40]
call fcn.1400349f0
mov byte [rsp + 0x24], al
movzx ecx, word [rsp + 0x40]
call fcn.1400237c0
test eax, eax
je 0x140036a3d
mov dword [rsp + 0x28], 1
jmp 0x140036a45
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x25], al
movsx eax, byte [rsp + 0x25]
and eax, 0x38
test eax, eax
je 0x140036a61
xor al, al
jmp 0x140036b1a
cmp qword [rsp + 0x48], 0
je 0x140036b15
movsx eax, byte [rsp + 0x25]
and eax, 6
cmp eax, 6
jne 0x140036a8e
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 8
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
jmp 0x140036ae8
movsx eax, byte [rsp + 0x25]
and eax, 2
test eax, eax
je 0x140036abb
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
and eax, 3
test eax, eax
jne 0x140036abb
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 1
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
movsx eax, byte [rsp + 0x25]
and eax, 4
test eax, eax
je 0x140036ae8
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
and eax, 0xc
test eax, eax
jne 0x140036ae8
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 4
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
movsx eax, byte [rsp + 0x25]
and eax, 1
test eax, eax
je 0x140036b15
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
and eax, 0x30
test eax, eax
jne 0x140036b15
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 0x10
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
movzx eax, byte [rsp + 0x24]
add rsp, 0x30
pop rdi
ret

Function at 0x1400372f0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call fcn.140037200
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
add rsp, 0x20
pop rdi
ret
Function at 0x140037440
Capabilities:
Log keystrokes via polling

Disassembly:
mov byte [rsp + 8], cl
push rdi
sub rsp, 0x30
cmp qword [0x140321418], 0
je 0x140037468
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140037468
movzx eax, byte [0x1403213bd]
jmp 0x140037630
mov byte [rsp + 0x20], 0
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003748e
movzx eax, byte [rsp + 0x20]
or eax, 0x10
mov byte [rsp + 0x20], al
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400374af
movzx eax, byte [rsp + 0x20]
or eax, 0x20
mov byte [rsp + 0x20], al
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400374d0
movzx eax, byte [rsp + 0x20]
or eax, 1
mov byte [rsp + 0x20], al
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400374f1
movzx eax, byte [rsp + 0x20]
or eax, 2
mov byte [rsp + 0x20], al
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140037512
movzx eax, byte [rsp + 0x20]
or eax, 4
mov byte [rsp + 0x20], al
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140037533
movzx eax, byte [rsp + 0x20]
or eax, 8
mov byte [rsp + 0x20], al
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140037554
movzx eax, byte [rsp + 0x20]
or eax, 0x40
mov byte [rsp + 0x20], al
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140037576
movzx eax, byte [rsp + 0x20]
bts eax, 7
mov byte [rsp + 0x20], al
cmp qword [0x140321418], 0
je 0x14003762b
movzx eax, byte [0x1403213bd]
movzx ecx, byte [rsp + 0x20]
not ecx
and eax, ecx
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14003762b
movzx eax, byte [rsp + 0x21]
not eax
movzx ecx, byte [0x1403213bf]
and ecx, eax
mov eax, ecx
mov byte [0x1403213bf], al
movzx eax, byte [rsp + 0x21]
not eax
movzx ecx, byte [0x1403213bd]
and ecx, eax
mov eax, ecx
mov byte [0x1403213bd], al
movzx eax, byte [rsp + 0x21]
not eax
movzx ecx, byte [0x1403213be]
and ecx, eax
mov eax, ecx
mov byte [0x1403213be], al
movzx edx, byte [0x1403213bf]
lea rcx, [0x140321420]
call fcn.140036520
cmp qword [0x140322240], 0
je 0x14003762b
mov rax, qword [0x140322240]
movzx eax, byte [rax + 0xc]
movzx ecx, byte [rsp + 0x21]
and eax, ecx
test eax, eax
je 0x14003762b
mov qword [0x140322240], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140038430
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x330
lea rdi, [rsp + 0x30]
mov ecx, 0xc0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x340]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x30], 0
xor edx, edx
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140038524
mov qword [rsp + 0x40], getservbyport
lea rdx, str.SYSTEMCurrentControlSetControlKeyboard_Layouts_
lea rcx, [rsp + 0x60]
call fcn.1401e8a70
lea rax, [rsp + 0xc4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x140038508
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x100]
lea r8, str.Layout_File
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call fcn.1400fc8a0
test eax, eax
je 0x140038508
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x340], rax
je 0x140038524
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rax, qword [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140135520
add rsp, 0x330
pop rdi
ret
Function at 0x14003b1f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov word [rsp + 8], cx
push rdi
sub rsp, 0xf0
lea rdi, [rsp + 0x30]
mov ecx, gethostbyaddr
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, word [rsp + 0x100]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0xd8], 0
cmp dword [0x140322308], 2
jne 0x14003b24f
mov dword [rsp + 0xdc], 1
jmp 0x14003b25a
mov dword [rsp + 0xdc], 0
movzx eax, byte [rsp + 0xdc]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14003b2bf
lea rax, [rsp + 0x48]
mov qword [rsp + 0x78], rax
movzx eax, word [rsp + 0x100]
and eax, 0xffffff80
test eax, eax
je 0x14003b2a3
mov eax, gethostbyaddr
mov rcx, qword [rsp + 0x78]
mov word [rcx], ax
mov rax, qword [rsp + 0x78]
add rax, 2
mov qword [rsp + 0x78], rax
movzx eax, word [rsp + 0x100]
mov r8d, 0xa
mov rdx, qword [rsp + 0x78]
mov ecx, eax
call fcn.1401ebb60
jmp 0x14003b2d4
mov byte [rsp + 0xd8], 1
movzx eax, word [rsp + 0x100]
mov word [rsp + 0x74], ax
mov dword [rsp + 0xc8], 0
jmp 0x14003b2f1
mov eax, dword [rsp + 0xc8]
inc eax
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0x108]
cmp dword [rsp + 0xc8], eax
jge 0x14003b41f
cmp dword [0x140322308], 0
jne 0x14003b39e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xc4], eax
mov eax, dword [0x140322198]
mov ecx, dword [rsp + 0xc4]
sub ecx, eax
mov eax, ecx
mov rcx, qword [0x14031a1e8]
cmp eax, dword [rcx + 0x88]
jbe 0x14003b39e
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x88]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003b384
mov dword [0x140319840], 0
mov edx, 1
mov ecx, 0xffffffff
call fcn.1400070b0
mov dword [0x140319840], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xc4]
mov dword [0x140322198], eax
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14003b3b3
lea rcx, [rsp + 0x48]
call fcn.14003abb0
jmp 0x14003b3db
cmp byte [rsp + 0xd8], 0
jne 0x14003b3c9
lea rcx, [0x140273a60]
call fcn.1401352a0
movzx edx, byte [rsp + 0x110]
movzx ecx, word [rsp + 0x74]
call fcn.14003cf90
cmp dword [0x140322308], 2
jne 0x14003b3fa
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x9c]
mov dword [rsp + 0xe0], eax
jmp 0x14003b40e
mov rax, qword [0x14031a1e8]
mov eax, dword [rax + 0x98]
mov dword [rsp + 0xe0], eax
mov ecx, dword [rsp + 0xe0]
call fcn.140036fe0
jmp 0x14003b2e1
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140134a00
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140135520
add rsp, 0xf0
pop rdi
ret