joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a540
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
xor r8d, r8d
mov rcx, rax
xor edx, edx
call fcn.1400ca870
mov edi, eax
bt eax, 0x12
jae 0x14004a57e
mov rcx, rbx
call fcn.14004aae0
test al, al
je 0x14004a57e
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
bt edi, 0x13
jae 0x14004a590
mov rcx, rbx
call fcn.14004aa60
test al, al
jne 0x14004a571
bt edi, 0x14
jae 0x14004a5a2
mov rcx, rbx
call fcn.14004aba0
test al, al
jne 0x14004a571
bt edi, 0x16
jae 0x14004a5c2
lea rcx, [0x14004af30]
mov rdx, rbx
mov byte [rbx + 0x28], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbx + 0x28], 0
jne 0x14004a571
bt edi, 0x15
jae 0x14004a5d4
mov rcx, rbx
call fcn.14004acc0
test al, al
jne 0x14004a571
mov rbx, qword [rsp + 0x30]
test edi, 0x1800000
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x14004aa60
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call fcn.1401023d0
cmp eax, 0xa
jl 0x14004aacd
mov rcx, rbx
call fcn.14004ada0
mov dword [rbx + 0x1c], eax
cmp eax, 0xffffffff
je 0x14004aacd
lea rcx, [0x14004ae30]
mov rdx, rbx
mov word [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x20], 0
je 0x14004aab2
mov al, 1
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x18], 0
je 0x14004aacd
movsxd rax, dword [rbx + 0x1c]
lea rcx, [0x14022faaa]
shl rax, 4
cmp byte [rax + rcx], 0
jne 0x14004aaaa
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14004aae0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x238
xor ecx, ecx
call fcn.1401023d0
cmp eax, 0xb
jge 0x14004aafd
xor al, al
add rsp, 0x238
ret
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x230], rbx
mov word [rsp + 0x20], ax
call fcn.14010a9a0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x104
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x20], 0
je 0x14004ab83
mov rdx, qword [str.NativeHWNDHost]
mov rcx, rbx
call fcn.1401073e0
test al, al
je 0x14004ab83
mov rcx, qword [str.Charm_Bar]
lea rdx, [rsp + 0x20]
mov r8d, 0x208
call fcn.14010e2f0
test eax, eax
jne 0x14004ab83
mov al, 1
mov rbx, qword [rsp + 0x230]
add rsp, 0x238
ret
xor al, al
mov rbx, qword [rsp + 0x230]
add rsp, 0x238
ret
Function at 0x14004ada0
Capabilities:
Get keyboard layout

Disassembly:
mov r11, rsp
sub rsp, 0x78
xor eax, eax
lea rdx, [r11 - 0x58]
xor ecx, ecx
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r8d, dword [reloc.OLEAUT32.dll_SysStringLen]
mov rdx, rax
xor eax, eax
shr edx, 0x10
test r8d, r8d
jle 0x14004ae21
lea rcx, [0x14022faa8]
cmp dx, word [rcx]
je 0x14004ae24
inc eax
add rcx, 0x10
cmp eax, r8d
jl 0x14004ae11
or eax, 0xffffffff
add rsp, 0x78
ret

Function at 0x14004c4a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov r12, rdx
mov r13, rcx
call fcn.140004e20
mov rcx, rax
xor r15d, r15d
mov r8d, r15d
test rax, rax
setne r8b
test r8d, r8d
jne 0x14004c4f7
mov ecx, 0x80004005
call fcn.140007d40
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x1e0], rbx
mov r14d, r15d
or rsi, 0xffffffffffffffff
cmp dword [r13 + 0x20], r15d
jbe 0x14004c8e8

Function at 0x14004d000
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [rsp + 0x70]
mov rbx, rcx
mov dword [rcx + 0x28e8], 1
mov qword [rcx + 0x2978], rax
movzx eax, word [rsp + 0x78]
mov dword [rcx + 0x2974], 2
mov word [rcx + 0x2980], ax
mov ecx, 0x14
mov edi, r9d
mov r14, r8
movzx esi, dx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, 0x10
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [rbx + 0x28e4], eax
je 0x14004d089
xor ecx, ecx
test edi, edi
cmove eax, ecx
mov dword [rbx + 0x28e4], eax
mov ecx, dword [rbx + 0x28e0]
test ecx, ecx
jne 0x14004d09d
test edi, edi
jne 0x14004d09d
cmp si, 0xd
je 0x14004d0eb
movzx eax, si
add eax, 0xffffffa5
cmp eax, 2
jbe 0x14004d0eb
cmp dword [rbx + 0x59a0], 0
je 0x14004d0eb
cmp ecx, 0x100
je 0x14004d0eb
mov edx, dword [rbx + 0x28e4]
mov dword [rsp + 0x30], 1
lea rcx, [rbx + 0x28c0]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edx
mov r9d, edi
movzx edx, si
mov r8, r14
call fcn.14004b4f0
mov eax, 1
jmp 0x14004d0ed
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14004d4f0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rsi, r9
mov edi, r8d
mov r15, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov r8d, 0xfff
movzx r10d, ax
movzx r14d, ax
mov eax, 0x412
and r10w, r8w
mov rcx, rbp
cmp r10w, ax
sete dl
and rcx, r8
cmp rcx, rax
sete cl
cmp edi, 0x100
ja 0x14004d584
je 0x14004d5b4
mov eax, edi
sub eax, 0x7b
je 0x14004d5f9
cmp eax, 0xc
jne 0x14004d6e4
mov eax, dword [rbx + 0x59a0]
neg eax
sbb rax, rax
and eax, 4
or rax, 3
jmp 0x14004d657
cmp edi, 0x105
ja 0x14004d6c7
je 0x14004d67b
mov eax, edi
sub eax, 0x101
je 0x14004d67b
dec eax
je 0x14004d652
cmp eax, 2
jne 0x14004d6e4
cmp dword [rbx + 0x59a0], 0
jne 0x14004d5fd
lea rax, [rsi - 9]
test rax, 0xfffffffffffffffb
jne 0x14004d5fd
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, r15
shr eax, 0xf
and eax, 1
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
lea edx, [r9 + 0x28]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x14004d657
mov r8d, 1
movzx edx, si
mov rcx, rbx
call fcn.14004cf40
test eax, eax
je 0x14004d652
mov r8, qword [rsp + 0x70]
mov r9d, 1
movzx edx, si
mov rcx, rbx
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rbp
call fcn.14004d000
test eax, eax
je 0x14004d670
mov r9d, dword [rbx + 0x28e0]
mov r8d, 1
dec r9d
movzx edx, si
mov rcx, rbx
call fcn.14004d7c0
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14004d652
mov r8, qword [rsp + 0x70]
test cl, cl
jne 0x14004d688
test dl, dl
je 0x14004d69b
cmp rsi, 0xe5
jne 0x14004d69b
mov eax, 0x80000000
test rax, r8
jne 0x14004d652
xor r9d, r9d
movzx edx, si
mov rcx, rbx
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rbp
call fcn.14004d000
test eax, eax
je 0x14004d670
mov r9d, dword [rbx + 0x28e0]
dec r9d
xor r8d, r8d
jmp 0x14004d647
mov eax, edi
sub eax, 0x106
je 0x14004d652
sub eax, 0xb
je 0x14004d652
cmp eax, 0xf4
je 0x14004d5f9
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbx + 0x5998]
mov r9, rsi
mov r8d, edi
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x14004d657
Function at 0x14004d7c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x240
lea rbp, [rcx + 0x28c0]
mov rbx, rcx
mov edi, r9d
mov rcx, rbp
mov r14d, r8d
movzx esi, dx
call fcn.14004c350
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
mov r15d, eax
call fcn.14010a9a0
lea rcx, [rdi + 0xde]
lea rdx, [rsp + 0x30]
lea r9, [rcx + rcx*2]
mov r8d, 0x104
add r9, r9
mov ecx, dword [rbx + r9*8]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
movzx edx, si
mov rcx, rbp
call fcn.14004c350
test eax, eax
jle 0x14004d850
test r14d, r14d
je 0x14004d84a
inc dword [rbp + 0x30c8]
jmp 0x14004d850
dec dword [rbp + 0x30c8]
test r15d, r15d
je 0x14004d90e
cmp word [rsp + 0x30], 0
je 0x14004d95e
lea rsi, [0x140159ffc]
mov eax, 0x7b
xor edi, edi
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14004d880
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x14004d8ee
nop dword [rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14004d8c0
lea rax, [0x14015a000]
cmp r14d, 1
lea rdx, str._UP
cmove rdx, rax
mov rcx, rbx
call fcn.14004d990
jmp 0x14004d95e
cmp r14d, 1
jne 0x14004d95e
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x14004d95e
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14004d930
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14004fcf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14004fd1e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140050150
cmp byte [0x1402ad5e0], 0
jne 0x14004fd69
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004fd59
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1402ad5e0], 1
mov qword [0x1402ad5d8], rax
jmp 0x14004fd70
mov rax, qword [0x1402ad5d8]
mov byte [0x1402ad5e0], 1
jmp 0x14004fd70
mov rax, qword [0x1402ad5d8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14004fd8f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400501c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400501df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400501df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400501df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140050010
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.14004ff10
mov ebx, eax
test eax, eax
jne 0x140050120
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x290]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x280], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400500fa
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140050010
mov ebx, eax
test eax, eax
jne 0x140050120
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x290]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x280], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400500a0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005010f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.14004fcf0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140050130
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x140050150
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14004fd1e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140050150
cmp byte [0x1402ad5e0], 0
jne 0x14004fd69
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004fd59
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1402ad5e0], 1
mov qword [0x1402ad5d8], rax
jmp 0x14004fd70
mov rax, qword [0x1402ad5d8]
mov byte [0x1402ad5e0], 1
jmp 0x14004fd70
mov rax, qword [0x1402ad5d8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14004fd8f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400501c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400501df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400501df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400501df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400619d0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x428
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140061af2
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140061af2
lea rdx, str.Netscape
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
je 0x140061a25
mov eax, 1
add rsp, 0x428
ret
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
lea rdx, str.Opera
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
call fcn.1401009c0
test rax, rax
je 0x140061af2
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x140061af2
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.14010e42c
test rax, rax
jne 0x140061a18
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.14010e42c
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x428
ret
xor eax, eax
add rsp, 0x428
ret

Function at 0x1400648d0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
xor edx, edx
xor edi, edi
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
test eax, eax
je 0x14006492a
cmp ebx, 0xa3
je 0x140064913
cmp ebx, 0xa5
je 0x140064913
cmp ebx, 0x2e
ja 0x140064918
movabs rdx, 0x61fe00000000
bt rdx, rbx
jae 0x140064918
mov edi, 0x1000000
shl ecx, 0x10
or ecx, edi
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140065170
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.140065540
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140065208
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400651f0
jmp 0x1400652d3
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400d38f0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140065240
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14004daa0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140065261
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140065277
add rbx, 2
test eax, eax
jne 0x140065264
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x14006528e
mov rcx, qword [rsp + 0x58]
call fcn.14010a7dc
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x1400652d3
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x1400652c0
cmp r8, 8
jb 0x1400652e1
mov rcx, r9
call fcn.14010a7dc
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140065300
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.140065540
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140065398
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x140065380
jmp 0x140065463
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400d38f0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400653d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14004daa0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x1400653f1
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140065407
add rbx, 2
test eax, eax
jne 0x1400653f4
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x14006541e
mov rcx, qword [rsp + 0x58]
call fcn.14010a7dc
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x140065463
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x140065450
cmp r8, 8
jb 0x140065471
mov rcx, r9
call fcn.14010a7dc
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140070200
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [r9]
xor esi, esi
mov r14, r9
mov ebp, r8d
mov rdi, rdx
test rcx, rcx
je 0x140070262
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000302
call qword [rax + 0x18]
cmp dword [rsp + 0x58], esi
je 0x140070262
mov rcx, qword [r14]
test rcx, rcx
je 0x14007025a
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000313
call qword [rax + 0x18]
mov esi, dword [rsp + 0x58]
shr esi, 0x16
and esi, 1
jmp 0x14007027c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14007027c
mov esi, 1
test rdi, rdi
je 0x14007040d
cmp dword [rbx + 0x90], 0
je 0x14007040d
mov eax, dword [rbx + 0x54]
test al, al
js 0x14007040d
bt eax, 0xe
jb 0x14007040d
mov rcx, rdi
call fcn.1400cb030
test eax, eax
je 0x14007040d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400ca870
bt eax, 0xa
jb 0x14007040d
test ebp, ebp
je 0x14007040d
test esi, esi
je 0x140070370
cmp dword [rbx + 0xec], 0
jne 0x14007040d
lea rcx, [0x1402ae518]
mov r8d, 1
mov rdx, rdi
call fcn.140015b20
mov ecx, dword [rbx + 0x10]
lea eax, [rcx - 1]
test eax, 0xfffffffa
jne 0x14007040d
cmp ecx, 2
je 0x14007040d
mov rcx, rdi
call fcn.14000f3f0
mov rdx, qword [rax + 0xf88]
mov rax, qword [rdx]
cmp rax, rdx
je 0x140070343
test byte [rax + 0x10], 0x10
jne 0x14007040d
mov rax, qword [rax]
cmp rax, rdx
jne 0x140070331
mov r8d, dword [rbx + 0x54]
lea rcx, [0x1402ae518]
mov r9d, 6
mov rdx, rdi
mov qword [rsp + 0x20], rdi
call fcn.140015780
mov dword [rbx + 0xec], 1
jmp 0x14007040d
cmp dword [rbx + 0xec], 0
je 0x14007040d
lea rcx, [0x1402ae518]
mov r8d, 1
mov rdx, rdi
call fcn.140015b20
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x1400703ea
mov rcx, rdi
call fcn.1400cad30
mov rcx, rdi
mov esi, eax
call fcn.14000f3f0
mov rdx, qword [rax + 0xf88]
mov rcx, qword [rdx]
cmp rcx, rdx
je 0x1400703cd
nop dword [rax + rax]
test dword [rcx + 0x10], esi
jne 0x14007040d
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x1400703c0
mov r8d, dword [rbx + 0x54]
lea rcx, [0x1402ae518]
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rdi
call fcn.140015780
jmp 0x140070403
add eax, 0xfffffffb
cmp eax, 1
ja 0x14007040d
mov r9d, ebp
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140070600
mov dword [rbx + 0xec], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret