joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a124
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov r15d, r9d
mov r13, r8
mov rsi, rdx
mov r14, rcx
test r9d, r9d
je 0x10003c41f
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10003c41f
lea r12d, [rax + 1]
mov edi, r12d
jmp 0x10002a17b
and dword [rsp + 0x68], 0
mov byte [rsp + 0x6c], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
test edi, edi
je 0x10002a23c
mov byte [rsp + 0x6c], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x68], eax
cmp eax, 0xffffffff
je 0x10002a201
lea rcx, [rsp + 0x70]
call fcn.100006004
xor r9d, r9d
lea r8d, [r9 + 0x20]
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.10000ece8
test eax, eax
je 0x10002a1f7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
movzx ecx, byte [rsp + 0x6c]
test eax, eax
cmovne ecx, r12d
mov byte [rsp + 0x6c], cl
lea rcx, [rsp + 0x70]
call fcn.10000ecdc
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, r12d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1000467c3
test r15d, r15d
je 0x10002a24c
mov rdx, r14
mov rcx, r13
call fcn.10002aaa8
test edi, edi
je 0x10003c42a
mov r8d, 3
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
test eax, eax
je 0x10002a2ac
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.10002a5d0
cmp qword [rsp + 0x50], 0
je 0x10002a2ac
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 4]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
jmp 0x10002a2ac
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10002a2bd
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x10002a2bf
mov eax, edi
lea r11, [rsp + 0x90]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor edi, edi
lea r12d, [rdi + 1]
jmp 0x10002a17b
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x10002a2ac
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000467d3
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x58], 0
jmp 0x10002a23c
Function at 0x10002a5d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov r13, rcx
cmp byte [rcx + 0xc], 0
je 0x10002a6ab
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x10002a6ab
mov ebx, dword [r13 + 8]
xor r15d, r15d
test bl, 0x10
jne 0x10003d5e6
mov r14d, 1
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10003d601
mov r12d, ebx
xor r12d, esi
bt r12d, 0xe
jb 0x10003d620
lea rcx, [rsp + 0x50]
call fcn.100006004
nop
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.10000ece8
xor edi, edi
cmp eax, edi
je 0x10002a6a0
cmp r15d, edi
jne 0x10002a695
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp eax, edi
je 0x10003d645
bt r12d, 0xb
jb 0x10003d664
lea rcx, [rsp + 0x50]
call fcn.10000ecdc
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test al, 0x10
jne 0x10002a625
lea r14d, [r15 + 1]
mov r15d, r14d
and ebx, 0xffffffef
bts ebx, 7
jmp 0x10002a62b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1000885ac
nop
jmp 0x10002a63e
bt ebx, 0xe
jae 0x10003d634
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
jmp 0x10002a64f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop
jmp 0x10002a64f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, edi
cmovle ecx, eax
call fcn.1000885ac
nop
jmp 0x10002a695
shr ebx, 0xb
and bx, r14w
mov word [rsp + 0xa0], bx
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 2
lea r8, [rsp + 0xa0]
mov edx, 0x9c040
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
jmp 0x10002a6a0
Function at 0x1000362ec
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [0x1000cc598]
call fcn.1000034b0
xor ebp, ebp
mov dword [0x1000cc79c], ebp
mov dword [0x1000cc798], ebp
cmp qword [0x1000d05a8], rbp
jne 0x100040239
mov rdi, qword [0x1000cc528]
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rax
call fcn.100002978
cmp rax, rsi
je 0x100040264
cmp dword [rdi + 0x24], ebp
jne 0x100040264
cmp dword [rdi + 0x18], ebp
jne 0x100040250
mov rax, qword [0x1000cc528]
cmp dword [rax + 0x44], 0x259
je 0x100040250
cmp dword [rax + 0x44], 0x25a
je 0x100040250
cmp dword [rax + 0x44], 0x25b
je 0x100040250
mov rax, qword [rdi]
mov edx, 5
mov rcx, rdi
call qword [rax + 0xd0]
cmp al, bpl
jne 0x100040250
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bp
jge 0x1000402c2
mov dword [0x1000cc4c8], 1
call fcn.10000176c
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rsi
call fcn.100059130
mov dword [0x1000cc4c8], 1
jmp 0x1000363c0
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x80]
jmp 0x10003639d
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], ebp
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov edx, 0x400
mov rcx, rsi
call fcn.100004ee8
mov edx, 0x7f16
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [0x1000cc528]
mov rax, qword [rcx]
call qword [rax + 0x108]
cmp eax, ebp
je 0x1000402b3
mov rcx, rsi
call fcn.100059c54
mov dword [0x1000cc4c8], 1
jmp 0x10003639d
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bp
jl 0x1000363b1
jmp 0x1000363bb

Function at 0x100036a14
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x10
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x10004d27e
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, dword [rdi]
mov eax, dword [rdi + 4]
sub eax, dword [rbx + 4]
cdq
mov ecx, eax
mov eax, r8d
sub eax, dword [rbx]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
cmovl ecx, eax
cmp dword [rbx], r8d
jge 0x10004d2aa
sub r8d, ecx
mov dword [rbx], r8d
jmp 0x10004d2b0
lea eax, [rcx + r8]
mov dword [rbx], eax
mov eax, dword [rdi + 4]
cmp dword [rbx + 4], eax
jge 0x10004d2bc
sub eax, ecx
jmp 0x10004d2be
add eax, ecx
mov dword [rbx + 4], eax
jmp 0x100036a3d
Function at 0x10005411c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
lea r8, [rax + 0x10]
lea edi, [rbx + 2]
lea edx, [rbx + 0xe]
mov ecx, 0x400
mov r9d, edi
mov ebp, ebx
mov dword [rax + 0x10], 0x2e
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r11, qword [rsi]
cmp dword [r11 - 8], ebx
je 0x1000541da
movzx edx, word [rsp + 0x48]
mov rcx, rsi
call fcn.100088660
lea edx, [rbx + 1]
mov rcx, rsi
mov r12d, eax
call fcn.10000bfa4
mov rcx, rax
mov rsi, rax
call qword [sym.imp.msvcrt.dll__wtoi]
mov ebp, eax
imul ebp, ebp, 0x3e8
cmp r12d, ebx
jl 0x1000541da
lea ecx, [r12 + 1]
movsxd rdx, ecx
lea rsi, [rsi + rdx*2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jle 0x1000541af
mov word [rsi + 4], bx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wtoi]
mov rcx, rsi
lea ebx, [rax + rax*4]
add ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jge 0x1000541da
sub edi, eax
mov ecx, edi
sub rcx, 1
lea eax, [rbx + rbx*4]
lea ebx, [rax + rax]
jne 0x1000541ce
lea eax, [rbx + rbp]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x1000541f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
add r8d, 5
mov rdi, rdx
mov eax, 0x10624dd3
mov r9d, 2
mov ecx, 0x400
mov dword [rsp + 0x50], 0x2e
mul r8d
mov ebx, edx
shr ebx, 6
mov eax, ebx
imul eax, eax, 0x3e8
sub r8d, eax
mov eax, 0xcccccccd
mul r8d
lea r8, [rsp + 0x50]
mov esi, edx
lea edx, [r9 + 0xc]
shr esi, 3
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, 0x18
mov rcx, rdi
call fcn.10008866c
mov r9d, ebx
mov edx, 0x18
test esi, esi
je 0x10005428d
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], esi
lea r8, str._u_s_02u
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1000016a0
jmp 0x10005429c
lea r8, [0x1000adc5c]
mov rcx, rax
call fcn.1000016a0
or edx, 0xffffffff
mov rcx, rdi
call fcn.10000bfb0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x100057334
Capabilities:
Log keystrokes via polling

Disassembly:
test rdx, rdx
je 0x100057409
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x10
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1000573fb
mov eax, dword [rdi + 8]
mov ecx, 5
dec eax
cmp eax, ecx
jbe 0x1000573ed
mov r8d, dword [rbx + 0x10]
mov edx, dword [rbx + 8]
cmp r8d, edx
jle 0x10005739f
mov eax, dword [rbx + 0xc]
cmp dword [rbx + 0x14], eax
jle 0x10005738f
mov ecx, 4
jmp 0x1000573ea
cmp r8d, edx
jle 0x10005739f
mov eax, dword [rbx + 0xc]
cmp dword [rbx + 0x14], eax
jl 0x1000573ea
cmp r8d, edx
jge 0x1000573b0
mov eax, dword [rbx + 0xc]
cmp dword [rbx + 0x14], eax
jle 0x1000573b0
mov ecx, 6
jmp 0x1000573ea
cmp edx, r8d
jle 0x1000573c7
mov eax, dword [rbx + 0xc]
cmp dword [rbx + 0x14], eax
jge 0x1000573c4
mov ecx, 3
jmp 0x1000573ea
cmp edx, r8d
je 0x1000573d6
mov eax, dword [rbx + 0xc]
mov ecx, 1
mov dword [rbx + 0x14], eax
jmp 0x1000573ea
mov eax, dword [rbx + 0x14]
cmp dword [rbx + 0xc], eax
je 0x1000573e8
mov ecx, 2
mov dword [rbx + 0x10], edx
jmp 0x1000573ea
xor ecx, ecx
mov dword [rdi + 8], ecx
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x1000573ff
and dword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100057a1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rcx + 0x38]
and dword [0x1000cc4e0], 0
mov r12, rcx
mov ecx, dword [r8 + 0x10]
inc ebx
mov eax, 4
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov ecx, dword [r8 + 0x14]
mov rsi, rdx
mov dword [rsp + 0x3c], ecx
mov dword [rsp + 0x34], ecx
mov ecx, dword [r8 + 0x20]
mov r14, r8
and ebx, 0xfffffffe
cmp ebx, eax
mov dword [r12 + 0x70], ecx
mov dword [rsp + 0x20], ecx
cmovl ebx, eax
xor r8d, r8d
mov r9d, 1
mov eax, ebx
mov rcx, r12
cdq
sub eax, edx
mov rdx, qword [rsi + 0x80]
mov rdx, qword [rdx + 0x18]
sar eax, 1
mov r15d, eax
imul eax, r15d
cmp dword [r14 + 0x18], r8d
mov dword [rsp + 0x88], eax
mov rax, qword [r12]
sete r8b
call qword [rax + 0x100]
xor ebp, ebp
lea r12d, [rbx + 1]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x90], rax
call qword [sym.imp.msvcrt.dll_rand]
mov edi, dword [rsp + 0x90]
cdq
idiv r12d
sub edx, r15d
add edi, edx
call qword [sym.imp.msvcrt.dll_rand]
mov ebx, dword [rsp + 0x94]
cdq
idiv r12d
mov eax, edi
sub eax, dword [r14 + 0x10]
imul eax, eax
sub edx, r15d
add ebx, edx
mov ecx, ebx
sub ecx, dword [r14 + 0x14]
imul ecx, ecx
add eax, ecx
cmp eax, dword [rsp + 0x88]
jg 0x100057ac0
mov rcx, qword [rsi + 0x80]
mov eax, 1
mov r8d, ebx
mov rcx, qword [rcx + 0x18]
mov edx, edi
mov r9d, eax
mov dword [rsp + 0x28], 0xf00021
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_PatBlt]
cmp edi, dword [rsp + 0x30]
jge 0x100057b4b
mov dword [rsp + 0x30], edi
jmp 0x100057b5b
mov eax, dword [rsp + 0x38]
lea ecx, [rdi + 1]
cmp ecx, eax
cmovg eax, ecx
mov dword [rsp + 0x38], eax
cmp ebx, dword [rsp + 0x34]
jge 0x100057b67
mov dword [rsp + 0x34], ebx
jmp 0x100057b77
mov eax, dword [rsp + 0x3c]
lea ecx, [rbx + 1]
cmp ecx, eax
cmovg eax, ecx
mov dword [rsp + 0x3c], eax
inc ebp
cmp ebp, 0xa
jl 0x100057ac0
mov r12, qword [rsp + 0x80]
mov rdx, qword [rsi + 0x80]
xor r8d, r8d
cmp dword [r14 + 0x18], r8d
mov eax, dword [r12 + 0x70]
mov r10, qword [r12]
mov rdx, qword [rdx + 0x18]
sete r8b
mov rcx, r12
xor r9d, r9d
mov dword [rsp + 0x20], eax
call qword [r10 + 0x100]
lea rcx, [0x1000cc6d0]
lea r8, [rsp + 0x30]
mov rdx, rcx
call qword [sym.imp.USER32.dll_UnionRect]
mov rcx, qword [rsi + 0x80]
lea rdx, [rsp + 0x30]
call fcn.1000033e0
cmp qword [0x1000cc580], 0
je 0x100057bfb
mov rcx, qword [rsi + 0x80]
lea rdx, [rsp + 0x30]
call fcn.100009260
mov rcx, qword [0x1000cc598]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100057c19
lea rcx, [r14 + 0x10]
call fcn.100005138
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000596ac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
lea rdx, [0x1000d1f40]
lea rcx, [0x1000cd5c0]
call fcn.100055238
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1000051c0
mov r8, qword [rsp + 0x40]
mov qword [0x1000cc788], r8
mov qword [0x1000cc780], r8
mov qword [0x1000cc790], r8
cmp ebx, 0x100
je 0x100059719
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.100002978
mov edx, dword [0x1000cd67c]
mov ebx, 1
mov eax, edx
neg eax
sbb ecx, ecx
xor esi, esi
neg ecx
add ecx, ebx
mov dword [0x1000cc4c0], ecx
cmp dword [0x1000cd660], esi
je 0x100059745
call fcn.10003aed0
jmp 0x10005975b
cmp edx, esi
jne 0x10005975b
mov edx, dword [0x1000cc490]
lea rcx, [0x1000cd5c0]
call fcn.1000334d4
mov eax, dword [0x1000cc790]
mov rcx, qword [0x1000cd6a8]
mov dword [0x1000cd6b8], esi
sub eax, dword [0x1000cd6a8]
shr rcx, 0x20
mov dword [0x1000cd6bc], esi
mov dword [rsp + 0x48], eax
mov eax, dword [0x1000cc794]
sub eax, ecx
mov rcx, rdi
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x48]
mov qword [0x1000cd694], rax
call fcn.1000325b4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x1000597eb
cmp dword [0x1000cd660], esi
je 0x1000597e2
mov dword [0x1000cd660], esi
mov dword [0x1000cd668], ebx
mov dword [0x1000cd674], ebx
mov rsi, qword [rsp + 0x38]
mov dword [0x1000cc4dc], ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, ebx
call fcn.100004584
jmp 0x1000597c6
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x1000597c6
call fcn.1000014a0
cmp dword [0x1000cd668], esi
je 0x10005980f
mov ecx, ebx
call fcn.100004584
mov rcx, qword [rdi + 0x80]
call fcn.10000903c
mov dword [0x1000cd678], ebx
mov dword [0x1000cd660], esi
mov dword [0x1000cd668], ebx
jmp 0x1000597cc

Function at 0x10005ee30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, word [rcx + 0x3bc]
mov rdi, rcx
test al, 8
je 0x10005eeed
test al, 0x10
jne 0x10005ee73
mov ebx, dword [rcx + 0x6e0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xea60
ja 0x10005ee73
mov eax, 0xfff7
and word [rdi + 0x3bc], ax
jmp 0x10005eeed
cmp dword [rdi + 0x3e0], 0
je 0x10005eeed
test byte [rdi + 0x3bc], 0x10
lea rax, [rdi + 0x6e8]
lea rcx, [rdi + 0x6f0]
cmovne rcx, rax
xor r8d, r8d
mov edx, 0x2010
mov rcx, qword [rcx]
call fcn.100088ba0
cmp eax, 1
jne 0x10005eec2
mov eax, 0xffe7
and word [rdi + 0x3bc], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x6e0], eax
mov rcx, qword [rdi + 0x40]
mov rcx, qword [rcx + 0x1b0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10005eeed
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x1b0]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000725b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rdx
mov r8, rdx
mov rdx, qword [rdx + 0x18]
lea rcx, [0x1000ac9d0]
call qword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov ebx, eax
test eax, eax
je 0x1000725ef
lea rcx, str.CoMarshalInterThreadInterfaceInStream_HRESULT_08x_n
mov edx, eax
call fcn.100071630
jmp 0x100072634
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x100072603
and qword [rdi + 0x18], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, qword [rdi + 0x20]
lea r8, [rdi + 8]
lea rcx, [0x1000ac9c0]
call qword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov ebx, eax
test eax, eax
jne 0x1000725df
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x100072632
and qword [rdi + 0x20], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
test ebx, ebx
je 0x10007263f
mov eax, ebx
jmp 0x100072745
lea rax, [rsp + 0x80]
lea r8, [0x100072758]
mov r9, rdi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x1000726ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateThread_LastError_08x_n
mov edx, eax
call fcn.100071630
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x100072745
xor ebx, ebx
lea rdi, [0x1000cd6e0]
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
mov rcx, rdi
test eax, eax
je 0x1000726e2
call fcn.1000012e0
mov rcx, rdi
call fcn.100088ff0
jmp 0x1000726b4
mov edx, ebx
call fcn.1000027e0
inc ebx
test eax, eax
jne 0x1000726b4
lea rdx, [rsp + 0x88]
lea ecx, [rax + 1]
mov r9d, 0x4ff
or r8d, 0xffffffff
xor ebx, ebx
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
test eax, eax
jne 0x1000726b4
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x100078c34
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, dword [rcx + 0x28]
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100078c5b
xor eax, eax
cmp ebx, eax
sete al
mov ebx, eax
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x100079360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r12, rdx
mov edx, dword [r8 + 0x14]
mov rdi, rcx
xor ecx, ecx
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor r13d, r13d
cmp rax, r13
mov ebx, r13d
mov rsi, rax
setne bl
cmp ebx, r13d
je 0x1000794dd
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x20]
movzx r9d, word [rbp + 8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, eax
cmp eax, r13d
je 0x1000794dd
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, r13d
cmp rax, 0xffffffffffffffff
mov rdi, rax
setne bl
cmp ebx, r13d
je 0x1000794bc
mov ecx, dword [rbp]
mov edx, dword [rbp + 0x20]
mov eax, 0x4d42
mov word [rsp + 0x40], ax
mov eax, dword [rbp + 0x14]
lea r9, [rsp + 0x80]
add eax, ecx
lea r8d, [r13 + 0xe]
mov word [rsp + 0x46], r13w
lea eax, [rax + rdx*4 + 0xe]
mov word [rsp + 0x48], r13w
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x42], eax
lea eax, [rcx + rdx*4 + 0xe]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0x4a], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp eax, r13d
je 0x1000794bc
mov r8d, dword [rbp + 0x20]
lea r9, [rsp + 0x80]
mov rdx, rbp
lea r8d, [r8*4 + 0x28]
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp eax, r13d
je 0x1000794bc
mov r8d, dword [rbp + 0x14]
lea r9, [rsp + 0x80]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x1000794dd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, r13d
je 0x1000794da
cmp ebx, r13d
mov ebx, 1
jne 0x1000794dd
mov ebx, r13d
cmp rsi, r13
je 0x1000794eb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x10007f000
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x10
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10007f0c8
mov ecx, dword [rdi]
xor r8d, r8d
mov r10d, 0x96e
mov eax, ecx
sub eax, dword [rbx]
cdq
mov r9d, eax
xor r9d, edx
sub r9d, edx
cmp r9d, r8d
je 0x10007f05e
mov eax, dword [rdi + 4]
sub eax, dword [rbx + 4]
cdq
xor eax, edx
sub eax, edx
imul eax, eax, 0x3e8
cdq
idiv r9d
jmp 0x10007f061
mov eax, r10d
cmp eax, r10d
mov r11d, 0x2d
jl 0x10007f072
lea r8d, [r11 + 0x2d]
jmp 0x10007f07b
cmp eax, 0x19e
cmovge r8d, r11d
mov r10d, dword [rdi + 4]
mov eax, r10d
sub eax, dword [rbx + 4]
cdq
xor eax, edx
sub eax, edx
add eax, r9d
cdq
sub eax, edx
sar eax, 1
mov edx, eax
cmp r8d, r11d
je 0x10007f0a9
cmp r8d, 0x5a
je 0x10007f0a5
mov dword [rbx + 4], r10d
jmp 0x10007f0c8
mov dword [rbx], ecx
jmp 0x10007f0c8
cmp dword [rbx], ecx
jge 0x10007f0b3
sub ecx, eax
mov dword [rbx], ecx
jmp 0x10007f0b7
add eax, ecx
mov dword [rbx], eax
mov eax, dword [rdi + 4]
cmp dword [rbx + 4], eax
jge 0x10007f0c3
sub eax, edx
jmp 0x10007f0c5
add eax, edx
mov dword [rbx + 4], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100081188
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp rax, qword [rcx + 0x1f8]
je 0x1000811c4
cmp rax, qword [rcx + 0x278]
je 0x1000811c4
cmp rax, qword [rcx + 0x358]
je 0x1000811c4
cmp rax, qword [rcx + 0x438]
jne 0x1000811e1
call fcn.100080ffc
mov rcx, qword [rbx + 0xc0]
mov r9, rdi
xor r8d, r8d
mov edx, 0x407
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x100
xor esi, esi
cmp dword [rdi + 8], eax
jne 0x10008123e
cmp qword [rdi + 0x10], 9
jne 0x100081214
lea ecx, [rsi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
mov r8d, esi
lea edx, [rsi + 9]
cmp ax, si
mov rcx, rbx
setl r8b
call fcn.1000817c8
jmp 0x100081232
cmp dword [rdi + 8], eax
jne 0x10008123e
cmp qword [rdi + 0x10], 0x1b
jne 0x10008123e
mov rcx, qword [rbx + 0x488]
mov edx, 2
mov rax, qword [rcx]
call qword [rax + 8]
cmp al, sil
je 0x10008123e
mov eax, 1
jmp 0x10008127c
call fcn.1000011a0
cmp rax, rsi
je 0x100081259
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xf8]
mov rcx, rax
jmp 0x10008125c
mov rcx, rsi
cmp rcx, rsi
je 0x100081271
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x130]
cmp eax, esi
jne 0x10008127c
mov rdx, rdi
mov rcx, rbx
call fcn.10008b804
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret