joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054c08
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140054c8f
mov rsi, rbx
cmp word [rax], bp
je 0x140054c4e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140054c38
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140054c34
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004ce78
mov rdi, rax
test rax, rax
je 0x140054c7c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140039c70
mov rbp, rdi
xor ecx, ecx
call fcn.14004ce3c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140057820
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14004ca64
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400578c1
cmp ebx, dword [rsp + 0x30]
je 0x1400578ba
test esi, esi
je 0x1400578ba
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140057895
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400578a2
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14005787f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400578a6
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400578c3
mov eax, 1
jmp 0x1400578c3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005970c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14007f058]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140059756
call fcn.140044af4
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140044b14
mov dword [rax], SafeArrayDestroy
call fcn.14003e504
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140037b10
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140059761
lea eax, [rbx + 1]
jmp 0x140059743
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140059741
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140059743

Function at 0x14005bb80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005bba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005bba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140877058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408771df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140877089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087706f
add dl, dl
jne 0x140877096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408770f6
xor eax, eax
add dl, dl
jne 0x1408770a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408771ad
add dl, dl
jne 0x1408770b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408770c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408770d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408770dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408770ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14087707e
mov eax, 1
add dl, dl
jne 0x140877106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140877113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408770fb
sub eax, ebx
mov ebx, 1
jne 0x14087714c
mov ecx, 1
add dl, dl
jne 0x14087712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140877123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140877168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140877175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087715d
cmp eax, 0x7d00
jae 0x14087719b
cmp eax, 0x500
jb 0x140877196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087707e
cmp eax, 0x7f
ja 0x14087719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408771d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14087707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180019880
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x50]
call fcn.18001b3f0
movzx eax, al
test eax, eax
je 0x180019a64
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x2e8]
cmp qword [rcx], rax
je 0x1800198e4
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x2e8]
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x180019a64
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0x100
je 0x180019904
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0x104
jne 0x180019a64
mov rax, qword [rsp + 0x58]
cmp qword [rax + 0x10], 0xd
jne 0x180019a64
lea rcx, [rsp + 0x28]
call fcn.180019670
mov rcx, qword [rsp + 0x50]
add rcx, 0x2e8
call fcn.180019ad0
mov dword [rsp + 0x24], eax
mov ebx, dword [rsp + 0x24]
add ebx, 1
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.18001a980
mov rcx, qword [rsp + 0x50]
add rcx, 0x2e8
mov r8d, ebx
mov rdx, rax
call fcn.180019aa0
mov edx, 0xffffffff
lea rcx, [rsp + 0x28]
call fcn.18001aab0
lea rcx, [rsp + 0x28]
call fcn.180019bf0
lea rcx, [rsp + 0x28]
call fcn.180019b40
lea rcx, [rsp + 0x28]
call fcn.180019af0
test eax, eax
jne 0x180019a52
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0x104
jne 0x1800199bc
lea rcx, [rsp + 0x28]
call fcn.180019b30
mov r8b, 1
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.18001b430
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x180019a38
lea rcx, [rsp + 0x30]
call fcn.180019670
lea rcx, [rsp + 0x28]
call fcn.180019b30
mov r8, rax
lea rdx, str.http:__www._s.com
lea rcx, [rsp + 0x30]
call fcn.180019d00
lea rcx, [rsp + 0x30]
call fcn.180019b30
mov rcx, qword [rsp + 0x50]
add rcx, 0x2e8
mov rdx, rax
call fcn.180019a70
lea rcx, [rsp + 0x30]
call fcn.180019b30
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.18001b430
lea rcx, [rsp + 0x30]
call fcn.180019790
jmp 0x180019a52
lea rcx, [rsp + 0x28]
call fcn.180019b30
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.18001b430
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.180019790
mov eax, dword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret

Function at 0x180019aa0
Capabilities:
Get graphical window text

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextW]
add rsp, 0x28
ret
Function at 0x18001def0
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x1800ec5c8]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x30], 0
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x110
rep stosb byte [rdi], al
mov dword [rsp + 0x30], VarUI4FromDisp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
je 0x18001df67
cmp dword [rsp + 0x34], 5
jae 0x18001df5a
cmp dword [rsp + 0x34], 4
jne 0x18001df67
cmp dword [rsp + 0x38], 0x5a
jb 0x18001df67
mov dword [rsp + 0x154], 0
jmp 0x18001df72
mov dword [rsp + 0x154], 1
mov al, byte [rsp + 0x154]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.180053f80
add rsp, 0x160
pop rdi
ret

Function at 0x18001ee80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x18001ee98
xor eax, eax
test eax, eax
jne 0x18001ee98
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x18001ef00
mov eax, dword [rsp + 0x38]
jmp 0x18001ef83
cmp dword [rsp + 0x30], 1
je 0x18001ef15
cmp dword [rsp + 0x30], 2
je 0x18001ef15
mov eax, 0xd
jmp 0x18001ef83
cmp qword [rsp + 0x60], 0
je 0x18001ef69
cmp dword [rsp + 0x34], 0
je 0x18001ef5f
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
test rdx, rdx
jne 0x18001ef56
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rcx*2 - 2]
test eax, eax
je 0x18001ef5d
mov eax, 0xd
jmp 0x18001ef83
jmp 0x18001ef69
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax], cx
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x48
ret
Function at 0x180025330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov r8d, 2
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x180025c60
Capabilities:
Capture webcam image

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, dword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x419
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x28
ret
Function at 0x180028970
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.18001b9f0
test eax, eax
jne 0x180028997
xor eax, eax
jmp 0x180028b7e
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x60]
call fcn.180028b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x180028aef
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x1800289d2
mov dword [rsp + 0x3c], 1
jmp 0x1800289da
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x28], al
mov rax, qword [rsp + 0x68]
cmp dword [rax + 8], 0x100
jne 0x180028aef
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 9
jne 0x180028aef
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x180028aef
cmp dword [rsp + 0x20], 1
jle 0x180028ae7
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x9c]
mov dword [rsp + 0x2c], eax
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x180028a46
mov dword [rsp + 0x40], 1
jmp 0x180028a4e
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x38], al
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x180028a89
cmp dword [rsp + 0x2c], 0
jle 0x180028a74
mov eax, dword [rsp + 0x2c]
sub eax, 1
mov dword [rsp + 0x44], eax
jmp 0x180028a7f
mov eax, dword [rsp + 0x20]
sub eax, 1
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x2c], eax
jmp 0x180028aba
cmp dword [rsp + 0x2c], 0
jl 0x180028aaa
mov eax, dword [rsp + 0x20]
sub eax, 1
cmp dword [rsp + 0x2c], eax
jge 0x180028aaa
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x48], eax
jmp 0x180028ab2
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x2c], eax
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x60]
call fcn.180028bd0
mov r11, qword [rsp + 0x60]
mov qword [rsp + 0x30], r11
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x9c]
mov rcx, qword [rsp + 0x30]
call fcn.180034970
mov dword [rsp + 0x24], 1
cmp dword [rsp + 0x24], 0
jne 0x180028b36
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0xe0]
shr al, 6
and al, 1
movzx eax, al
test eax, eax
je 0x180028b36
mov rax, qword [rsp + 0x68]
cmp dword [rax + 8], 0x100
jne 0x180028b36
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x1b
jne 0x180028b36
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [rsp + 0x24], 1
cmp dword [rsp + 0x24], 0
jne 0x180028b7a
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x9c], 0xffffffff
je 0x180028b7a
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x9c]
mov rcx, qword [rsp + 0x60]
call fcn.180029080
mov r9, qword [rsp + 0x68]
xor r8d, r8d
mov edx, 0x37f
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
add rsp, 0x58
ret
Function at 0x18002ec00
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x1800ec5c8]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x30], VarUI4FromDisp
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x110
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
je 0x18002ec61
cmp dword [rsp + 0x34], 6
jb 0x18002ec61
mov dword [rsp + 0x154], 1
jmp 0x18002ec6c
mov dword [rsp + 0x154], 0
mov al, byte [rsp + 0x154]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.180053f80
add rsp, 0x160
pop rdi
ret
Function at 0x18002ef10
Capabilities:
Set global application hook

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov r9, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call fcn.180039780
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.180038af0
mov rcx, qword [rsp + 0xc0]
add rcx, 8
lea rdx, [rsp + 0x38]
call fcn.180020cf0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180022640
lea rcx, [rsp + 0x30]
call fcn.18001b9a0
mov rcx, qword [rsp + 0xc0]
add rcx, 0xa0
mov rdx, rax
call fcn.180037a00
mov rcx, qword [rsp + 0xc0]
add rcx, 8
mov edx, 0x20
call fcn.180036fd0
mov rcx, qword [rsp + 0xc0]
add rcx, 8
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
call fcn.180037000
lea rcx, [rsp + 0x20]
call fcn.18002f200
lea rcx, [rsp + 0x20]
call fcn.18002f230
test eax, eax
jge 0x18002f017
mov qword [rsp + 0x78], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.18002f2a0
mov rax, qword [rsp + 0x78]
jmp 0x18002f1f8
cmp qword [0x1800edac8], 0
jne 0x18002f070
mov ecx, 0x18
call fcn.180053e48
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x18002f055
mov rcx, qword [rsp + 0x80]
call fcn.180044840
mov qword [rsp + 0x98], rax
jmp 0x18002f061
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x98]
mov qword [0x1800edac8], rax
cmp qword [0x1800edac8], 0
je 0x18002f173
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1800edac8]
call fcn.1800449b0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x18002f160
mov ecx, 0x10
call fcn.180053e48
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x18002f0de
mov rcx, qword [rsp + 0x88]
call fcn.18002f2c0
mov qword [rsp + 0xa0], rax
jmp 0x18002f0ea
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
call fcn.1800252c0
mov r9d, dword [rsp + 0x58]
mov r8, rax
lea rdx, [0x1800380e0]
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x50], 0
je 0x18002f15e
cmp qword [rsp + 0x60], 0
je 0x18002f15e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1800edac8]
call fcn.1800448a0
mov dword [rsp + 0x68], eax
jmp 0x18002f173
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 8]
add ecx, 1
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], ecx
lea rcx, [rsp + 0x20]
call fcn.18002f250
mov rcx, qword [rsp + 0xc0]
add rcx, 8
call fcn.18002f270
and eax, 0x400000
test eax, eax
je 0x18002f1a1
mov byte [rsp + 0xa8], 1
jmp 0x18002f1a9
mov byte [rsp + 0xa8], 0
movzx edx, byte [rsp + 0xa8]
and dl, 1
shl dl, 6
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax + 0xf1]
and cl, 0xbf
or cl, dl
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0xf1], cl
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x20]
call fcn.18002f2a0
mov rax, qword [rsp + 0x90]
add rsp, 0xb8
ret
Function at 0x180031120
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x118], 0x12
je 0x180031185
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x118], 0x79
jne 0x180031173
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
test eax, eax
je 0x180031185
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x118], 0x20
jne 0x18003128c
cmp qword [rsp + 0x50], 0xf100
jne 0x18003128c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_GetFocus]
mov r11, rax
mov rax, qword [rsp + 0x40]
cmp r11, qword [rax + 8]
jne 0x1800311de
mov rcx, qword [rsp + 0x20]
call fcn.1800392f0
mov rcx, qword [rsp + 0x40]
add rcx, 8
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov edx, 0x448
call fcn.18001f6a0
jmp 0x18003128c
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x118], 0x20
je 0x180031273
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0xf0]
shr al, 6
and al, 1
movzx eax, al
test eax, eax
jne 0x180031273
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0xf1]
shr al, 1
and al, 1
movzx eax, al
test eax, eax
je 0x18003125b
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0xf1]
shr al, 2
and al, 1
movzx eax, al
test eax, eax
jne 0x18003125b
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0xf1]
shr al, 3
and al, 1
movzx eax, al
test eax, eax
je 0x18003125b
mov dl, 1
mov rcx, qword [rsp + 0x40]
call fcn.180039400
mov rcx, qword [rsp + 0x20]
call fcn.180039290
mov r11, qword [rsp + 0x60]
mov dword [r11], 1
jmp 0x18003128c
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x118], 0x20
je 0x18003128c
mov rax, qword [rsp + 0x60]
mov dword [rax], 1
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0xf0]
and cl, 0xbf
mov rax, qword [rsp + 0x40]
mov byte [rax + 0xf0], cl
xor eax, eax
add rsp, 0x38
ret
Function at 0x180034300
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x180034332
mov dword [rsp + 0x48], 1
jmp 0x18003433a
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x20], al
cmp qword [rsp + 0x70], 0x79
jne 0x1800343d0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1800343d0
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x9c], 0xffffffff
je 0x1800343ce
mov dword [rsp + 0x28], 0
lea rdi, [rsp + 0x2c]
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x60]
add rcx, 0x48
lea r8, [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x9c]
call fcn.180037690
mov edx, dword [rsp + 0x28]
mov dword [rsp + 0x38], edx
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x9c]
mov rcx, qword [rsp + 0x40]
call fcn.18003a330
jmp 0x1800343de
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x18004f1c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x4d0
mov rax, qword [0x1800ec5c8]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
call fcn.180021550
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x78]
call fcn.1800238b0
mov rdx, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x50]
call fcn.18004f580
lea rcx, [rsp + 0x90]
call fcn.180052ad0
mov edx, 0x400
mov rcx, qword [rsp + 0x4e8]
call fcn.18004eed0
mov qword [rsp + 0x38], rax
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x18004f268
call fcn.18003f300
mov dword [rsp + 0x4b0], eax
jmp 0x18004f411
mov r8, qword [rsp + 0x4f8]
mov rdx, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
jne 0x18004f2a7
call fcn.18003f300
mov dword [rsp + 0x4b0], eax
jmp 0x18004f411
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x4b8], rax
cmp qword [rsp + 0x4b8], 0
jne 0x18004f2de
call fcn.18003f300
mov dword [rsp + 0x4b0], eax
jmp 0x18004f411
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
add eax, 1
cmp eax, dword [rsp + 0x60]
jae 0x18004f33d
mov dword [rsp + 0x4c0], 0x8007000e
lea rcx, [rsp + 0x90]
call fcn.180052af0
lea rcx, [rsp + 0x78]
call fcn.1800238d0
mov eax, dword [rsp + 0x4c0]
jmp 0x18004f450
mov eax, dword [rsp + 0x60]
add eax, 1
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.180052b30
lea rcx, [rsp + 0x90]
call fcn.180052b20
test rax, rax
jne 0x18004f375
mov dword [rsp + 0x4b0], 0x8007000e
jmp 0x18004f411
lea rcx, [rsp + 0x90]
call fcn.180052b20
mov rbx, rax
call fcn.180021550
mov ecx, eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x4a0], eax
cmp dword [rsp + 0x4a0], 0
jne 0x18004f3ca
call fcn.18003f300
mov dword [rsp + 0x4b0], eax
jmp 0x18004f411
lea rcx, [rsp + 0x90]
call fcn.180052b20
mov r11, rax
mov ecx, dword [rsp + 0x4a0]
xor eax, eax
mov word [r11 + rcx*2], ax
lea rcx, [rsp + 0x90]
call fcn.180052b20
mov r8d, dword [rsp + 0x500]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18004f5b0
mov dword [rsp + 0x4b0], eax
cmp qword [rsp + 0x48], 0
je 0x18004f424
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x4b0]
mov dword [rsp + 0x4c4], eax
lea rcx, [rsp + 0x90]
call fcn.180052af0
lea rcx, [rsp + 0x78]
call fcn.1800238d0
mov eax, dword [rsp + 0x4c4]
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.180053f80
add rsp, 0x4d0
pop rbx
ret