joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b256c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b2594
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b25c4
test eax, 0x410
sete bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401b267c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x74
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a7acb
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14008ddb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401b2656
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a7acb
cmp byte [rsp + 0x57], 0
jns 0x1401b2672
mov rcx, qword [rsp + 0x40]
call fcn.1400c9cac
lea rcx, [rsp + 0x58]
call fcn.1401412f0
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ccfe0
xor eax, eax
jmp 0x1401b25b9

Function at 0x1401b6e10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x14029b170]
test rax, rax
je 0x1401b6f11
cmp eax, 2
jne 0x1401b6e96
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401b6ef5
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.1400a7acb
mov rcx, rsi
call fcn.140001c60
jmp 0x1401b6ef5
mov eax, 1
lock xadd qword [0x14029b1a8], rax
test rax, rax
jle 0x1401b6eb6
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14029b128], eax
mov qword [0x14029b120], rsi
mov rcx, qword [0x140292810]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ccfe0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14029b170]
test rax, rax
je 0x1401b6f18
jmp 0x1401b6e3e
Function at 0x1401f46e6
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14029beb8]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401f4973
mov rax, qword [0x14029beb0]
test rax, rax
jne 0x1401f4809
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x140257270]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401f49ba
test al, al
jne 0x1401f48a2
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1400a7acb
mov rcx, rsi
call fcn.140001c60
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call rax
test eax, eax
jne 0x1401f487f
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f4741
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x40]
lea rdx, [0x14025f5eb]
mov r8d, 0xe
call fcn.1400a7acb
mov rcx, rbx
call fcn.1401412f0
jmp 0x1401f4741
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x1401f4748
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401f477d
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x1401f48bc
call fcn.1401f520c
jmp 0x1401f48c1
call fcn.1401f4be3
test al, al
jne 0x1401f490e
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1401f47dd
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401f3e47
mov sil, 1
test al, al
jne 0x1401f47ec
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1401f47dd
lea rcx, [0x14029beb8]
call fcn.1400c9d58
cmp dword [0x14029beb8], 0xffffffff
jne 0x1401f4731
lea rcx, [0x14025755e]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1401420ab
mov qword [0x14029beb0], rax
lea rcx, [0x14029beb8]
call fcn.1400c9cf8
jmp 0x1401f4731
Function at 0x140208290
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.1400cf750
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1402082d2
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1402082c6

Function at 0x140216e4b
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
mov r12, r9
mov rbp, r8
mov rbx, rdx
mov r13, rcx
mov r14, qword [rsp + 0x3a0]
mov r15, qword [rsp + 0x398]
mov rdi, qword [rsp + 0x390]
mov esi, dword [rsp + 0x380]
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x88], rdx
call fcn.1400b4cb0
test al, al
je 0x140216f0e
call fcn.14014f9f6
lea rcx, [rax + 8]
call fcn.1402255ca
test al, al
je 0x140216f0e
mov rax, qword [rsp + 0x388]
mov ecx, dword [rsp + 0x378]
mov r9, qword [rsp + 0x370]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
mov rcx, rbx
mov rdx, rbp
mov r8, r12
call r13
mov esi, 1
test eax, eax
jne 0x140216f55
call fcn.14014f9f6
lea rcx, [rax + 8]
call fcn.140224334
xor esi, esi
test al, al
je 0x140216f55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.1401e6b08
test al, al
je 0x140216f4b
call fcn.1401e6a17
test rax, rax
jne 0x140216f7b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rax
mov qword [rsp + 0x80], 0
lea rdi, [rsp + 0xf0]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400cf750
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x140216fc1
mov qword [rsp + 0x80], rdi
movaps xmm0, xmmword [0x140257270]
lea rbx, [rsp + 0x70]
movaps xmmword [rbx], xmm0
mov rcx, rbx
mov rdx, rsi
call fcn.14022433c
lea rsi, [0x140279ba0]
lea rax, [rsp + 0x98]
mov ecx, 0xb
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
movabs rcx, 0xaaaaaaaa00000018
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
mov qword [rdx + 8], r14
mov ecx, dword [r15 + 0x3c]
lea rdi, [rsp + 0x5c]
mov dword [rdi], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x380]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x390]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x88]
lea r8, [rsp + 0x90]
lea r9, [rsp + 0x80]
mov rcx, rbx
call fcn.1402255ce
mov edi, eax
test eax, eax
jne 0x140217080
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [rsp + 0xa0], 0
sete sil
test edi, edi
jne 0x140216f4b
jmp 0x140216f55
Function at 0x140218128
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x34]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1402181d6
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x28]
mov qword [rbp], rax
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
mov r15, qword [rbp]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1402181d6
test r14d, r14d
setne al
cmp r15, rsi
sete sil
and sil, al
jmp 0x1402181d8
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140229040
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x14022912a
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x140229148
mov eax, dword [rsi + 0x9c]
test al, 0x10
je 0x14022914d
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x1402290ad
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14022912a
lea r14, [rsi + 0x88]
movabs r15, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x30]
mov edi, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov rdx, r14
call qword [rax + 0x20]
mov ebp, eax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub rbx, rcx
mov edx, 1
mov r8, rbx
call fcn.1400cb76c
cmp rax, rbx
jne 0x14022912a
cmp ebp, 1
je 0x1402290c8
cmp ebp, 2
je 0x14022912a
mov rcx, qword [rsi + 0x78]
call fcn.1400cb7f0
test eax, eax
jne 0x14022912a
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14014ef75
test al, 8
je 0x140229128
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x30], rax
cmp byte [rsi + 0xa2], 0
je 0x14022918e
mov rdi, qword [rsi + 0x20]
sub rdi, qword [rsi + 0x18]
xor ebx, ebx
neg edi
mov rcx, qword [rsi + 0x78]
mov edx, edi
mov r8d, 1
call fcn.1400dccb8
test eax, eax
je 0x1402291b6
mov edi, 0xffffffff
jmp 0x14022912a
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r9, qword [rsi + 0x48]
mov rdi, qword [rsi + 0x50]
sub rdi, r9
test eax, eax
jle 0x1402291f0
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rdi, rcx
jmp 0x14022916e
test bl, bl
je 0x1402291c6
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x9c], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x140229128
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x14022916e
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov rbp, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [rbp + 0x38]
mov eax, eax
add rdi, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rdi, rax
mov bl, 1
jmp 0x140229170
Function at 0x140229540
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rcx + 0x78], 0
je 0x1402296d4
mov esi, edx
mov rdi, rcx
call fcn.140229710
mov byte [rsp + 0x5f], 0xaa
mov rbp, qword [rdi + 0x28]
mov rbx, qword [rdi + 0x30]
mov r12, qword [rdi + 0x38]
cmp esi, 0xffffffff
je 0x140229601
test rbx, rbx
je 0x1402296de
mov byte [rbx], sil
mov rcx, qword [rdi + 0x28]
mov rbx, qword [rdi + 0x30]
inc rbx
mov qword [rdi + 0x30], rbx
sub rbx, rcx
je 0x1402295d9
cmp byte [rdi + 0xa2], 0
je 0x140229606
mov r9, qword [rdi + 0x78]
mov edx, 1
mov r8, rbx
call fcn.1400cb76c
cmp rax, rbx
jne 0x1402296d4
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x38], r12
xor edi, edi
cmp esi, 0xffffffff
cmovne edi, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbp
jmp 0x1402295a5
mov rax, qword [rdi + 0x40]
lea r13, [rsp + 0x50]
mov qword [r13], rax
lea r14, [rdi + 0x88]
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x140229709
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x60]
add rdx, rax
mov r8, qword [rdi + 0x28]
mov r9, qword [rdi + 0x30]
mov rbx, qword [rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 0x28]
cmp qword [rsp + 0x48], rcx
je 0x1402296d4
mov r15d, eax
cmp eax, 3
je 0x1402296f9
cmp r15d, 1
ja 0x1402296d4
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x40]
mov r9, qword [rdi + 0x78]
sub rbx, rcx
mov edx, 1
mov r8, rbx
call fcn.1400cb76c
cmp rax, rbx
jne 0x1402296c0
cmp r15d, 1
jne 0x1402296c0
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rsp + 0x48]
mov qword [rdi + 0x28], rdx
mov qword [rdi + 0x38], rcx
cmp rax, rbx
jne 0x1402296d4
cmp r15d, 1
je 0x14022961a
jmp 0x1402295cd
mov edi, 0xffffffff
jmp 0x1402295e1
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x5f]
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x38], rax
jmp 0x140229593
mov rbx, qword [rdi + 0x30]
mov r9, qword [rdi + 0x78]
sub rbx, rcx
jmp 0x1402295b7
call fcn.14014ef75
int3

Function at 0x140229bb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140229be7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140229bc1
ret

Function at 0x140229c40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140229c78
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140229c51
ret
Function at 0x1400a8090
Capabilities:
Get keyboard layout

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13d, edx
mov r14, rcx
xor sil, sil
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov rbp, rbx
mov eax, 8
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140260580
mov r12, rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r15d, r15d
mov edi, r15d
test ebx, ebx
jle 0x1400a81ad
test sil, sil
jne 0x1400a81ad
mov rax, qword [r12 + rdi*8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x98]
lea r8, [0x14086a010]
xor edx, edx
mov ecx, r13d
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
jne 0x1400a814d
mov word [rsp + 0x98], r15w
jmp 0x1400a81a1
movzx eax, word [rsp + 0x98]
test ax, ax
je 0x1400a81a1
movzx ecx, ax
call qword [sym.imp.Qt5Core.dll_public:_static_unsigned_int___cdecl_QChar::toUpper_unsigned_int_]
movzx edx, ax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Gui.dll_public:_void___cdecl_QKeySequence::constructor_int__int__int__int____ptr64]
mov rbx, rax
mov rcx, qword [r14 + 0x10]
call fcn.1400ac9d0
mov rdx, rbx
mov rcx, rax
call fcn.14003c870
movzx esi, al
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Gui.dll_public:_void___cdecl_QKeySequence::destructor_void____ptr64]
inc rdi
cmp rdi, rbp
jl 0x1400a8105
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
movzx eax, sil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a81e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rsi, rcx
xor r12d, r12d
mov rcx, qword [rax + 0x10]
mov rdi, r8
mov rbp, rdx
cmp dword [rcx + 0x3dc], r12d
je 0x1400a8262
movzx ebx, byte [rcx + 0x3d8]
mov ecx, 0x90
and bl, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r12d
test ax, ax
movzx eax, bl
setne cl
xor ecx, eax
je 0x1400a8262
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x10]
dec dword [rcx + 0x3dc]
mov eax, dword [rdi]
mov dword [rbp + rax*4], 0x45
inc dword [rdi]
mov eax, dword [rdi]
mov dword [rbp + rax*4], SetErrorInfo
inc dword [rdi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x3e0], r12d
je 0x1400a82ee
movzx ebx, byte [rcx + 0x3d8]
mov ecx, SafeArrayGetElement
shr bl, 1
and bl, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
movzx eax, bl
setne r12b
xor r12d, eax
je 0x1400a82ee
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x10]
dec dword [rcx + 0x3e0]
mov eax, dword [rdi]
mov dword [rbp + rax*4], 0x3a
inc dword [rdi]
mov eax, dword [rdi]
mov dword [rbp + rax*4], 0xba
inc dword [rdi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0x10]
test byte [rcx + 0x3d8], 2
je 0x1400a82ee
test byte [rsi + 0x62], 1
jne 0x1400a82ee
mov eax, dword [rdi]
mov dword [rbp + rax*4], reloc.OLEAUT32.dll_SafeArrayCreateVectorEx
inc dword [rdi]
mov eax, dword [rdi]
mov dword [rbp + rax*4], 0xaa
inc dword [rdi]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1401a6050
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov esi, edx
mov rdi, rcx
mov dword [rsp + 0x80], 0
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
mov dword [rsp + 0x80], 1
lea eax, [rsi - 0x13]
cmp eax, 0x92
ja case.0x1401a60ac.20
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1a61dc]
mov ecx, dword [rdx + rax*4 + 0x1a61c4]
add rcx, rdx
jmp rcx
mov ebx, 0x450000
jmp 0x1401a60eb
mov ebx, 0x360000
jmp 0x1401a60eb
mov ebx, 0x11d0000
jmp 0x1401a60eb
mov ebx, 0x1380000
jmp 0x1401a60eb
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
bts ebx, 8
jmp 0x1401a60e8
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
shl ebx, 0x10
mov ecx, 0x200
call fcn.140260580
mov rbp, rax
mov r8d, 0x100
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x1401a6138
or r8d, 0xffffffff
mov rdx, rbp
lea rcx, [rsp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf16_unsigned_short_int_const____ptr64__int_]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x88]
jmp 0x1401a61a7
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, str._key__1_
lea rcx, [rsp + 0x30]
call fcn.1401a6000
mov rbx, rax
mov dl, 0x20
lea rcx, [rsp + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx ecx, word [rax]
mov word [rsp + 0x28], cx
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
mov r8d, esi
lea rdx, [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_int__int__int__class_QChar____ptr64]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, rbp
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401a63a0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, ecx
sub ecx, 0x10
mov ebx, edx
je 0x1401a640f
dec ecx
je 0x1401a63e8
dec ecx
jne 0x1401a63df
xor edx, edx
lea ecx, [rdx + 0x12]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
sar ebx, 0x10
and ebx, 0x1ff
cmp ebx, eax
setne cl
lea eax, [rcx + 0xa4]
add rsp, 0x20
pop rbx
ret
mov eax, r8d
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
sar ebx, 0x10
and ebx, 0x1ff
cmp ebx, eax
setne cl
lea eax, [rcx + 0xa2]
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
sar ebx, 0x10
and ebx, 0x1ff
cmp ebx, eax
setne cl
lea eax, [rcx + 0xa0]
add rsp, 0x20
pop rbx
ret

Function at 0x14023c250
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QFileInfo::absolutePath_void____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::destructor_void____ptr64]
movzx eax, bl
add rsp, 0x40
pop rbx
ret