joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b480
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r14
push r15
sub rsp, 0x58
mov rsi, qword [rcx + 0x20]
movsxd rax, dword [rcx + 0x30]
xor r14b, r14b
lea r15, [rsi + rax*8]
mov rbp, rcx
cmp rsi, r15
je 0x18002b60b
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], r13
mov ebp, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r13d, [rbp - 0xf]
mov qword [rsp + 0x48], rdi
mov rbx, qword [rsi]
test byte [rbx + 0x28], 0x70
je 0x18002b5e2
call fcn.1800459a0
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0
mov ecx, 2
shr eax, 0xf
test r13b, al
cmovne edi, ebp
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test r13b, al
je 0x18002b501
or edi, 0x20
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test r13b, al
je 0x18002b517
or edi, 0x40
mov eax, dword [0x1804236f0]
and eax, 0xffffff8f
or eax, edi
mov dword [rsp + 0x88], eax
mov dword [0x1804236f0], eax
test al, 0x70
je 0x18002b5e2
cmp dword [rbx + 0x14], r13d
je 0x18002b576
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rax, [rsp + 0x20]
movd xmm0, dword [rsp + 0x98]
movd xmm1, dword [rsp + 0x9c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x18002b591
movss xmm0, dword [rbx + 0x18]
movss xmm1, dword [rbx + 0x1c]
lea rax, [rsp + 0x28]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
movss xmm1, dword [rax]
movss xmm0, dword [rax + 4]
xor eax, eax
movss dword [rsp + 0x30], xmm1
addss xmm1, dword [rbx + 0x20]
movss dword [rsp + 0x34], xmm0
addss xmm0, dword [rbx + 0x24]
movss dword [rbx + 0x18], xmm1
movss dword [rbx + 0x1c], xmm0
mov rcx, qword [rbx + 8]
lock cmpxchg dword [rcx + 0x18], r13d
jne 0x18002b5de
mov rcx, qword [rbx + 8]
call fcn.1800bee10
test al, al
jne 0x18002b5de
mov rcx, qword [rbx + 8]
xor eax, eax
xchg dword [rcx + 0x18], eax
movzx r14d, r13b
add rsi, 8
cmp rsi, r15
jne 0x18002b4c2
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
test r14b, r14b
jne 0x18002b679
lea rcx, [0x1804234f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbp + 0xc], 0
jle 0x18002b66c
mov rcx, qword [0x180421b08]
test rcx, rcx
je 0x18002b665
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
test rdx, rdx
je 0x18002b63d
mov qword [rdx + 0x18], rax
jmp 0x18002b644
mov qword [rcx + 0x90], rax
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x18002b655
mov rax, qword [rbp + 0x10]
mov qword [rdx + 0x10], rax
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x10], 0
mov dword [rbp + 0xc], 0
lea rcx, [0x1804234f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x18002caf0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rsi, rdx
mov rdi, rcx
mov eax, dword [r8]
mov dword [rbp - 0x50], eax
mov eax, dword [r8 + 4]
mov dword [rbp - 0x4c], eax
mov rax, qword [0x180421b70]
test rax, rax
jne 0x18002cb4d
mov ecx, 0x168
call fcn.1800a103c
mov qword [rbp + 0x30], rax
test rax, rax
je 0x18002cb46
mov rcx, rax
call fcn.180168d20
nop
mov qword [0x180421b70], rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.180173210
test rax, rax
jne 0x18002ccd3
mov byte [rdi + 0x130], 1
call fcn.1800459a0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
mov ebx, 0
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmovne ebx, eax
lea ecx, [rax - 0xe]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18002cb9e
or ebx, 0x20
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18002cbb3
or ebx, 0x40
mov eax, dword [0x1804236f0]
and eax, 0xffffff8f
or eax, ebx
mov dword [0x1804236f0], eax
test al, 0x70
je 0x18002ccd3
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0
mov byte [rbp + 0x30], 0
mov rcx, qword [rdi + 0x110]
mov rax, qword [rcx]
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x38]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test al, al
je 0x18002cc37
cmp dword [rbp - 0x28], 0
je 0x18002cc37
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.18000a770
movzx eax, byte [rbp + 0x30]
mov byte [rbp - 8], al
lea rcx, [rbp - 0x20]
call fcn.180051dc0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
jmp 0x18002ccc1
lea rax, [0x1802bccc0]
mov qword [rbp + 0x38], rax
mov rcx, qword [rdi + 0x110]
mov rax, qword [rcx]
lea r8, [rbp + 0x38]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp + 0x38]
test al, al
je 0x18002cc9d
cmp byte [rcx], 0
je 0x18002cc9d
mov qword [rbp - 0x48], rcx
add rcx, 0xfffffffffffffff0
lea rbx, [0x1802bccb0]
cmp rcx, rbx
je 0x18002cc80
mov eax, 1
lock xadd dword [rcx], eax
lea rcx, [rbp - 0x48]
call fcn.180051e80
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
mov rcx, qword [rbp + 0x38]
jmp 0x18002cca4
lea rbx, [0x1802bccb0]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x18002ccc1
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18002ccc1
call fcn.1800a0c6c
nop
lea rcx, [rbp - 0x38]
call fcn.18000a800
mov rcx, qword [rbp - 0x38]
call fcn.1800a09c8
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002eb80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x118]
mov rbx, rcx
mov rcx, qword [rcx + 0xe8]
lea r8, [rsp + 0x30]
mov r9b, 1
mov dword [rsp + 0x30], eax
call fcn.180115b40
mov rcx, qword [rbx + 0xe8]
lea rdx, [rbx + 0xf8]
add rcx, 0x128
mov r8, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180153b10
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x180153c03
lea rcx, [rsp + 0x60]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180153c03
xor edi, edi
mov dword [rsp + 0x20], edi
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.18028d040
test rax, rax
je 0x180153b9a
lea rcx, [rax + 0xb8]
mov rdx, rax
call fcn.180025030
mov rdi, rax
mov qword [rsp + 0x78], rdi
test rdi, rdi
je 0x180153bae
mov eax, 1
lock xadd dword [rdi + 8], eax
mov ebx, dword [rsi + 0x20]
test rdi, rdi
je 0x180153beb
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180153beb
test ebx, ebx
jle 0x180153beb
mov eax, dword [rsi + 0x20]
dec ebx
cmp ebx, eax
jl 0x180153bd3
lea ebx, [rax - 1]
test ebx, ebx
js 0x180153beb
movsxd rax, ebx
mov rcx, qword [rsi + 0x10]
mov r8, rbp
mov rdx, r14
mov rcx, qword [rcx + rax*8]
call fcn.180054704
jmp 0x180153bb1
test rdi, rdi
je 0x180153c03
lock dec dword [rdi + 8]
jne 0x180153c03
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x18002f860
Capabilities:
Get file attributes

Disassembly:
test dl, dl
je 0x18002f936
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, rcx
mov qword [rsp + 0x38], rdi
call fcn.180107e20
lea rdx, [rbx + 0x78]
lea rcx, [rsp + 0x40]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
test al, 0x10
je 0x18002f8a4
cmp eax, 0xffffffff
lea eax, [rdi + 1]
jne 0x18002f8a6
mov eax, edi
mov byte [rbx + 0xa8], al
test al, al
je 0x18002f927
cmp qword [rbx + 0x98], rdi
jne 0x18002f91a
mov ecx, 0xb8
call fcn.1800a103c
test rax, rax
je 0x18002f8e5
mov rcx, qword [rbx + 0x88]
mov r8, qword [rbx + 0xb0]
mov rdx, qword [rcx + 0x50]
mov rcx, rax
call fcn.180153930
mov rdi, rax
mov rax, qword [rbx + 0x88]
lea rdx, [rbx + 0x78]
mov rcx, rdi
mov r9d, dword [rax + 0x60]
movzx r8d, byte [rax + 0x60]
shr r9d, 1
and r8b, 1
and r9b, 1
call fcn.180153680
mov r8b, 1
mov rdx, rdi
mov rcx, rbx
call fcn.18002f940
mov rax, qword [rbx + 0x70]
lea rcx, [rbx + 0x70]
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18002fe90
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180107610
mov rcx, qword [rbx + 0x80]
lea rdx, [rbx + 0x78]
add rcx, 0x148
add rsp, 0x20
pop rbx
jmp fcn.180153a10

Function at 0x1800353e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x50
mov edx, dword [rcx + 0x130]
mov r8d, dword [rcx + 0x134]
mov r9d, dword [rcx + 0x138]
mov rbx, rcx
mov ecx, dword [rcx + 0x13c]
mov dword [rsp + 0x30], edx
mov eax, dword [rbx + 0x150]
mov dword [rsp + 0x34], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], ecx
test eax, eax
jns 0x180035440
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
sub r8d, eax
call fcn.18004b660
mov edx, dword [rax]
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov ecx, dword [rax + 0xc]
jmp 0x180035450
jle 0x180035450
sub eax, dword [rbx + 0x14c]
add eax, ecx
test eax, eax
jle 0x180035450
sub ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1801719d0
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp fcn.180035530
Function at 0x180036380
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x48], rbp
movzx r15d, r9b
cmp byte [rax + 0x140], 0
mov esi, r8d
mov r14, rdx
mov rbx, rcx
je 0x180036424
test byte [0x1804235cc], 0x70
mov ebp, 1
jne 0x180036426
mov qword [rsp + 0x50], rdi
call fcn.1800459a0
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ecx, [rbp + 1]
mov edi, 0
shr eax, 0xf
test bpl, al
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmovne edi, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bpl, al
je 0x1800363f4
or edi, 0x20
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bpl, al
je 0x18003640a
or edi, 0x40
mov eax, dword [0x1804236f0]
and eax, 0xffffff8f
or eax, edi
mov rdi, qword [rsp + 0x50]
mov dword [0x1804236f0], eax
test al, 0x70
jne 0x180036426
xor ebp, ebp
mov rcx, qword [rbx + 0x20]
mov byte [rbx + 0x48], bpl
call fcn.1800348a0
mov rbp, qword [rsp + 0x48]
test al, al
jne 0x180036480
mov rcx, qword [rbx + 0x20]
mov eax, dword [rcx + 0x184]
add eax, 0xa
cmp esi, eax
jbe 0x18003651e
mov byte [0x180421b80], 1
mov rax, qword [rcx + 0xc8]
xor edx, edx
test rax, rax
je 0x1800364fe
mov rcx, rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp fcn.180033ee0
test r15b, r15b
je 0x180036514
mov rcx, qword [rbx + 0x20]
mov eax, dword [rcx + 0x180]
add eax, 0xfa
cmp esi, eax
jbe 0x180036514
cmp byte [rbx + 0x48], 0
jne 0x180036514
cmp byte [rsp + 0x60], 0
jne 0x180036514
mov eax, dword [r14]
lea rdx, [rsp + 0x40]
mov r8b, 1
mov dword [rsp + 0x40], eax
mov eax, dword [r14 + 4]
mov dword [rsp + 0x44], eax
call fcn.18016db70
mov rcx, qword [rbx + 0x20]
test al, al
je 0x1800364e0
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp fcn.180035ac0
cmp byte [rcx + 0x140], 0
jne 0x1800364f2
cmp byte [rcx + 0x142], 0
jne 0x18003651e
cmp byte [rsp + 0x68], 0
jne 0x18003651e
jmp 0x180036458
xor r8d, r8d
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp fcn.180033da0
mov rax, qword [rbx + 0x20]
mov dword [rax + 0x184], esi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x180042d80
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x180042dc1
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180042dc1
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x180042dba
mov rcx, qword [rcx + 0x10]
call fcn.18016c2e0
jmp 0x180042df3
mov rax, qword [0x180421b70]
test rax, rax
jne 0x180042deb
mov ecx, 0x168
call fcn.1800a103c
test rax, rax
je 0x180042de4
mov rcx, rax
call fcn.180168d20
mov qword [0x180421b70], rax
mov rcx, rax
call fcn.180168a80
mov rcx, rax
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x180042e03
mov rax, qword [rax + 0x10]
add rcx, 0x38
mov r11, qword [rcx]
lea rdx, [rdi + 0x20]
lea r10, [rdi + 0x18]
lea r9, [rdi + 0x10]
lea r8, [rdi + 8]
mov qword [rsp + 0x40], rax
mov eax, dword [rdi + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov rdx, rdi
call qword [r11 + reloc.OLEAUT32.dll_VariantClear]
mov rbx, rax
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x1800f9190]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x70]
mov rcx, rbx
call fcn.180171b70
mov rcx, rbx
cmp byte [rdi + 0x48], 0
je 0x180042e7d
call fcn.18016d290
mov dword [rdi + 0x30], eax
jmp 0x180042ecd
mov rsi, qword [rdi + 0x40]
xor edx, edx
call fcn.180171540
test al, al
jne 0x180042ecb
call fcn.180028090
mov rdi, rax
mov r8b, 1
mov rdx, rbx
mov rcx, rax
call fcn.1801678a0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.180167820
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x50]
mov r8b, 1
mov edx, 2
mov rcx, rbx
call fcn.180169c80
xor ebx, ebx
test rbx, rbx
je 0x180042edf
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800459a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
mov eax, 1
lea ecx, [rax + 0x10]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1800459d1
or ebx, 2
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1800459e6
or ebx, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x180045a10
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180045a10
and ebx, 0xfffffffd
or ebx, 4
mov eax, dword [0x1804236f0]
and eax, 0x70
or eax, ebx
mov dword [0x1804236f0], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180045ef0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov rdi, rcx
sub eax, 0x100
cmp eax, 1
ja 0x180046073
cmp qword [0x180421ba0], 0
mov rsi, qword [rcx]
je 0x180045f97
test rsi, rsi
je 0x180046073
mov edx, 0xffffffeb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
call fcn.180008e00
cmp rbx, rax
jne 0x180046073
mov edx, 8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
test rax, rax
je 0x180046073
mov rcx, rax
cmp dword [rdi + 8], 0x100
mov rdx, qword [rdi + 0x10]
jne 0x180045f83
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800488f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180048780
test rsi, rsi
je 0x180046073
mov edx, 0xffffffeb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
call fcn.180008e00
cmp rbx, rax
je 0x180046001
mov edx, 5
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindow]
mov rsi, rax
test rax, rax
je 0x180046073
mov edx, 0xffffffeb
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
call fcn.180008e00
cmp rbx, rax
je 0x180046001
mov edx, 5
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindow]
mov rsi, rax
test rsi, rsi
je 0x180046073
mov edx, 0xffffffeb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
call fcn.180008e00
cmp rbx, rax
jne 0x180046073
mov edx, 8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
test rax, rax
je 0x180046073
mov rcx, qword [rax + 8]
mov rdx, qword [0x180421ba0]
cmp rdx, rcx
je 0x180046073
test rdx, rdx
je 0x18004605e
nop dword [rax]
mov rdx, qword [rdx + 0x18]
cmp rdx, rcx
je 0x180046073
test rdx, rdx
jne 0x180046050
mov r8b, 1
mov edx, 2
call fcn.180169c80
mov rcx, rbx
jmp 0x180045f62
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x1800488f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x190
mov rsi, rdx
mov rdi, rcx
call fcn.1800459a0
lea rax, [rsi - 0x10]
xor r15d, r15d
cmp rax, 0x95
ja case.0x18004893d.18
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x48b34]
mov r8d, dword [rcx + rax*4 + 0x48b28]
add r8, rcx
jmp r8
mov eax, dword [0x1804236f0]
cmp dword [0x180423678], eax
je 0x180048ad4
mov rcx, rdi
mov dword [0x180423678], eax
call fcn.180103450
jmp 0x180048ad4
mov dl, 1
mov rcx, rdi
call fcn.180103510
mov ecx, dword [0x1804236f0]
lea rdx, [rsp + 0x30]
mov dword [0x1804235cc], ecx
and ecx, 0xffffff8f
bts esi, 0x10
mov dword [rsp + 0x34], ecx
mov rcx, rdi
movzx ebx, al
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x38], r15d
call fcn.180103670
test al, al
jne 0x1800489ab
test bl, bl
je 0x180048ad4
mov al, 1
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret
mov dl, 1
mov rcx, rdi
call fcn.180103510
mov rdx, qword [rdi + 0x80]
mov r9d, 0x103
lea rcx, [rsp + 0x60]
lea r8d, [r9 - 1]
mov dword [rsp + 0x20], r15d
movzx ebp, al
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x180048acb
lea edx, [rax + 2]
mov ecx, esi
mov qword [rsp + 0x1b0], r14
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, esi
mov r14d, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, ebx
mov ecx, esi
mov dword [rsp + 0x28], r15d
mov word [rsp + 0x40], r15w
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x180048a7f
movzx edx, r15w
mov word [rsp + 0x40], dx
jmp 0x180048a84
movzx edx, word [rsp + 0x40]
mov eax, dword [0x1804236f0]
movzx ecx, r14w
mov dword [0x1804235cc], eax
and eax, 0xffffff8f
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
movzx eax, dx
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.180103670
mov r14, qword [rsp + 0x1b0]
test al, al
jne 0x1800489ab
test bpl, bpl
jmp 0x1800489a5
test bpl, bpl
jne 0x1800489ab
call fcn.180028090
mov r8d, r15d
mov ecx, dword [rax + 0x28]
dec ecx
js 0x180048b1f
mov rax, qword [rax + 0x18]
movsxd rcx, ecx
lea rdx, [rax + rcx*8]
nop
mov r9, qword [rdx]
cmp byte [r9 + 0x6c], r15b
je 0x180048b03
mov eax, r8d
inc r8d
test eax, eax
je 0x180048b15
sub rdx, 8
dec rcx
jns 0x180048af0
movzx eax, r15b
jmp 0x1800489ad
cmp qword [r9 + 0x48], r15
jne 0x1800489ab
movzx eax, r15b
jmp 0x1800489ad
Function at 0x180048bd0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call fcn.1800459a0
sar rbx, 0x10
lea eax, [rdi - 0x30]
mov esi, edi
movzx ecx, bl
cmp eax, 9
ja 0x180048c62
lea eax, [rcx - 0x47]
cmp eax, 0xb
ja case.0x180048c1d.74
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x48c9c]
add rcx, rdx
jmp rcx
add edi, 0x10030
mov eax, dword [0x1804236f0]
mov dword [0x1804235cc], eax
and eax, 0xffffff8f
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x24], eax
call fcn.180103670
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
test ecx, ecx
cmovne edi, ecx
cmp esi, 0x20
jae case.0x180048c1d.74
mov eax, dword [0x1804236f0]
mov ecx, 0
test al, 6
cmovne esi, ecx
jmp 0x180048c2b

Function at 0x18004a620
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rsi, eax
test eax, eax
jle 0x18004a6b9
xor ecx, ecx
call fcn.1800a09c8
mov rcx, rsi
shr rcx, 1
inc rcx
mov edx, 2
call fcn.1800a0a08
mov rbx, rax
mov qword [rsp + 0x30], rax
mov r9d, esi
mov r8, rax
mov edx, ebp
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.18001a640
nop
mov rcx, rbx
call fcn.1800a09c8
jmp 0x18004a6c3
lea rax, [0x1802bccc0]
mov qword [rdi], rax
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18004a6e0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
xor edi, edi
mov r15, r8
mov r12, rdx
mov r13, rcx
mov esi, edi
test r9b, 0x10
je 0x18004a7be
lea edx, [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x60], r14
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd r14, eax
test eax, eax
jle 0x18004a7b9
mov rcx, r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
call fcn.1800a0a4c
lea edx, [rdi + 0x10]
mov r9d, r14d
mov r8, rax
mov rcx, r15
mov rbx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test r14d, r14d
jle 0x18004a777
mov rdx, rbx
mov rcx, rbx
neg rdx
nop dword [rax + rax]
movzx eax, byte [rcx]
dec al
test al, 0xfd
je 0x18004a777
inc rcx
inc edi
lea rax, [rdx + rcx]
cmp rax, r14
jl 0x18004a760
movsxd rax, edi
mov esi, edi
cmp rax, r14
jge 0x18004a7a7
mov rdx, rbx
lea rcx, [rax + rbx]
neg rdx
nop dword [rax + rax]
movzx eax, byte [rcx]
dec al
test al, 0xfd
jne 0x18004a7a7
inc rcx
inc esi
lea rax, [rcx + rdx]
cmp rax, r14
jl 0x18004a790
mov rcx, rbx
call fcn.1800a09c8
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
mov edx, dword [r13]
cmp edi, esi
mov ecx, edi
lea eax, [rdx + rdi]
cmovl ecx, esi
add ecx, edx
mov dword [r12], eax
cmp eax, ecx
cmovl eax, ecx
mov dword [r12 + 4], eax
mov rax, r12
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret