joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55ebf0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
nop
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
call fcn.00410bc0
mov rcx, qword [rbp + 0x78]
call fcn.0055e0f0
mov byte [rbp + 0x83], al
cmp byte [rbp + 0x83], 0
jne 0x55ec63
lea rcx, [rbp + 0x78]
mov edx, 1
mov r8d, 1
call fcn.00411f90
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.0055fdd0
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
je 0x55edb6
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x90]
call fcn.0055e600
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0x54]
call fcn.0055ef20
test al, al
je 0x55ed96
lea rcx, [rbp + 0x70]
xor edx, edx
mov r8d, dword [rbp + 0x58]
add r8d, 1
call fcn.004107c0
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x55ed95
mov eax, dword [rbp + 0x58]
add eax, 1
mov dword [rbp + 0x88], eax
mov rcx, qword [rbp + 0x70]
call fcn.004118c0
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x84]
mov r8, rax
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0055e520
test al, al
je 0x55ed81
mov rcx, qword [rbp + 0x70]
call fcn.004118c0
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00411950
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.0055ebf0
sub dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0xffffffff
jne 0x55ecf5
nop
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x98]
call fcn.0055e600
mov rcx, qword [rbp + 0x90]
call sub.advapi32.dll_RegCloseKey
cmp byte [0x007a3834], 0
je 0x55ee15
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0055e5e0
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.004118c0
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0xc0]
mov r8d, dword [rax + 0x2c]
and r8d, 0x300
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0055e520
mov byte [rbp + 0x8f], al
jmp 0x55ee54
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0055e5e0
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.004118c0
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0055e520
mov byte [rbp + 0x8f], al
nop
lea rcx, [rbp + 0x40]
call fcn.004104c0
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.004105a0
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret

Function at 0x55eef0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.004118c0
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.0055e520
add rsp, 0x20
pop rbx
ret
Function at 0x560560
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
nop
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xb8]
call fcn.0055e600
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
lea rdx, [rbp + 0x64]
call fcn.0055ef20
test al, al
je 0x5606e0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
xor r9, r9
call fcn.005603e0
lea rcx, [rbp + 0x58]
xor edx, edx
mov r8d, dword [rbp + 0x70]
add r8d, 1
call fcn.004107c0
xor eax, eax
mov ebx, dword [rbp + 0x6c]
sub ebx, 1
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], ebx
jg 0x5606df
sub ebx, eax
add ebx, 1
mov eax, dword [rbp + 0x70]
add eax, 1
mov dword [rbp + 0x84], eax
mov rcx, qword [rbp + 0x58]
call fcn.004118c0
mov rcx, qword [rbp + 0xb8]
mov edx, dword [rbp + 0x80]
mov r8, rax
lea r9, [rbp + 0x84]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov rcx, qword [rbp + 0xb0]
mov rcx, qword [rcx + 0x50]
mov edx, eax
call fcn.0055e520
test al, al
je 0x5606cd
mov rcx, qword [rbp + 0x58]
call fcn.004118c0
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00411950
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x40]
call fcn.005603e0
add dword [rbp + 0x80], 1
sub ebx, 1
test ebx, ebx
jne 0x56062f
nop
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x88]
call fcn.0055e600
nop
lea rcx, [rbp + 0x40]
call fcn.004104c0
lea rcx, [rbp + 0x58]
call fcn.004104c0
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x56ce90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
xor r9, r9
sub edx, 1
mov ecx, r9d
cmp ecx, edx
jg 0x56ced0
sub edx, r9d
add edx, 1
mov ecx, eax
and cx, 0xf800
movzx ecx, cx
shr ecx, 0xb
shl eax, 5
or cx, ax
mov eax, ecx
movzx cx, byte [r8]
xor ax, cx
add r8, 1
sub edx, 1
test edx, edx
jne 0x56cea8
nop
ret
Function at 0x5adba0
Capabilities:
Encode data using base64

Disassembly:
push r13
push rdi
push rsi
push rbx
mov r10, rcx
mov r11, rdx
xor ecx, ecx
xor r9, r9
mov ebx, 1
mov esi, 3
mov eax, r8d
cdq
idiv esi
mov rsi, rax
mov eax, ebx
cmp eax, esi
jg 0x5adca6
sub esi, ebx
add esi, 1
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdi, byte [r10 + rax]
shr edi, 2
mov edi, edi
movzx rbx, byte [rbx + rdi]
mov byte [r11 + rdx], bl
mov edx, ecx
add edx, 1
movsxd rdx, edx
mov ebx, r9d
add ebx, 1
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx r13, byte [r10 + rdx]
shr r13d, 4
add eax, r13d
mov eax, eax
movzx rax, byte [rdi + rax]
mov byte [r11 + rbx], al
mov eax, ecx
add eax, 2
movsxd rax, eax
mov ebx, r9d
add ebx, 2
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdx, byte [r10 + rdx]
and dl, 0xf
movzx rdx, dl
add edx, edx
add edx, edx
movzx r13, byte [r10 + rax]
shr r13d, 6
add edx, r13d
mov edx, edx
movzx rdx, byte [rdi + rdx]
mov byte [r11 + rbx], dl
mov edx, r9d
add edx, 3
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 0x3f
movzx rax, al
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
add r9d, 4
add ecx, 3
sub esi, 1
test esi, esi
jne 0x5adbd2
nop
mov ebx, 3
mov eax, r8d
cdq
idiv ebx
mov rax, rdx
sub eax, 1
test eax, eax
je 0x5adcc9
sub eax, 1
test eax, eax
jne 0x5addc3
jmp 0x5add32
movsxd rcx, ecx
movsxd rax, r9d
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rbx, byte [r10 + rcx]
shr ebx, 2
mov ebx, ebx
movzx rdx, byte [rdx + rbx]
mov byte [r11 + rax], dl
mov eax, r9d
add eax, 1
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 3
movzx rcx, cl
shl ecx, 4
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 2
movsxd rax, eax
mov byte [r11 + rax], 0x3d
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
jmp 0x5addc3
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rsi, byte [r10 + rax]
shr esi, 2
mov esi, esi
movzx rbx, byte [rbx + rsi]
mov byte [r11 + rdx], bl
add ecx, 1
movsxd rcx, ecx
mov edx, r9d
add edx, 1
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx rsi, byte [r10 + rcx]
shr esi, 4
add eax, esi
mov eax, eax
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
mov eax, r9d
add eax, 2
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 0xf
movzx rcx, cl
add ecx, ecx
add ecx, ecx
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
mov eax, r8d
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x5adf20
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x10
mov rbp, rsp
mov r10, rcx
mov r11, rdx
xor edx, edx
xor r9, r9
xor eax, eax
mov ebx, 1
test r8d, r8d
jns 0x5adf45
add r8d, 3
sar r8d, 2
mov ecx, ebx
cmp ecx, r8d
jg 0x5ae085
sub r8d, ebx
add r8d, 1
mov ebx, 4
lea rcx, [rbp + 0xc]
movsxd rax, edx
movzx rax, byte [r10 + rax]
movzx rsi, al
cmp esi, 0x3d
jg 0x5adf92
cmp esi, 0x3d
je 0x5adfc3
sub esi, 0x2b
test esi, esi
je 0x5adfb9
sub esi, 4
test esi, esi
je 0x5adfbe
sub esi, 1
cmp esi, 0xa
jae 0x5adfc6
jmp 0x5adfb2
sub esi, 0x41
cmp esi, 0x1a
jb 0x5adfa4
sub esi, 0x20
cmp esi, 0x1a
jae 0x5adfc6
jmp 0x5adfab
sub al, 0x41
mov byte [rcx], al
jmp 0x5adfc6
add al, 0xb9
mov byte [rcx], al
jmp 0x5adfc6
add al, 4
mov byte [rcx], al
jmp 0x5adfc6
mov byte [rcx], 0x3e
jmp 0x5adfc6
mov byte [rcx], 0x3f
jmp 0x5adfc6
mov byte [rcx], 0xff
add edx, 1
add rcx, 1
sub ebx, 1
test ebx, ebx
jne 0x5adf64
nop
movsxd rax, r9d
movzx rcx, byte [rbp + 0xc]
add ecx, ecx
add ecx, ecx
movzx rbx, byte [rbp + 0xd]
shr ebx, 4
or cl, bl
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 1
movzx rcx, byte [rbp + 0xe]
cmp cl, 0xff
je 0x5ae02f
cmp byte [rbp + 0xf], 0xff
jne 0x5ae02f
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
add r9d, 1
jmp 0x5ae074
cmp cl, 0xff
je 0x5ae074
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
movsxd rax, eax
movzx rcx, byte [rbp + 0xe]
shl ecx, 6
or cl, byte [rbp + 0xf]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 3
add r9d, 2
add r9d, 1
sub r8d, 1
test r8d, r8d
jne 0x5adf5b
nop
lea rsp, [rbp + 0x10]
pop rbx
pop rsi
pop rbp
ret

Function at 0x5b1650
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9, r9
mov r10d, r8d
sub r10d, 1
mov eax, r9d
cmp eax, r10d
ja 0x5b1684
sub r10d, r9d
add r10d, 1
mov r8d, eax
lea r9, [rcx + r8]
movzx r8, byte [rdx + r8]
xor byte [r9], r8b
add eax, 1
sub r10d, 1
test r10d, r10d
jne 0x5b1669
nop
ret

Function at 0x5b3910
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
xor r8, r8
movzx r9, dl
sub r9d, 1
mov eax, r8d
cmp eax, r9d
ja 0x5b399b
sub r9d, r8d
add r9d, 1
mov edx, eax
add edx, edx
add edx, edx
mov r8d, edx
lea r10, [0x007754a4]
mov r11d, edx
movzx r11, byte [rcx + r11]
lea rbx, [0x007758a4]
mov esi, edx
add esi, 1
mov esi, esi
movzx rsi, byte [rcx + rsi]
mov r10d, dword [r10 + r11*4]
xor r10d, dword [rbx + rsi*4]
lea r11, [0x00775ca4]
mov ebx, edx
add ebx, 2
mov ebx, ebx
movzx rbx, byte [rcx + rbx]
xor r10d, dword [r11 + rbx*4]
lea r11, [0x007760a4]
add edx, 3
mov edx, edx
movzx rdx, byte [rcx + rdx]
xor r10d, dword [r11 + rdx*4]
mov dword [rcx + r8], r10d
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x5b392c
nop
pop rbx
pop rsi
ret
Function at 0x5b7da0
Capabilities:
Copy file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.004118c0
mov rdi, rax
mov rcx, rsi
call fcn.004118c0
mov rcx, rdi
mov rdx, rax
xor r8, r8
call sub.KERNEL32.DLL_CopyFileW
mov rcx, rbx
call fcn.00439530
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x62c440
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.00410690
nop
xor ecx, ecx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x62c52e
nop
mov dword [rbp + 0x3c], 0
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x62c48c
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.KERNEL32.DLL_GlobalAlloc
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.KERNEL32.DLL_GlobalLock
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x62c4ce
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.004118c0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.00409620
call sub.user32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call sub.user32.dll_SetClipboardData
nop
mov rcx, qword [rbp + 0x48]
call sub.KERNEL32.DLL_GlobalUnlock
jmp 0x62c526
nop
call sub.user32.dll_CloseClipboard
jmp 0x62c54b
mov rcx, qword [0x0042c188]
mov dl, 1
mov r8, qword [0x00795d38]
call fcn.004428e0
mov rcx, rax
call fcn.0040f620
nop
lea rcx, [rbp + 0x68]
call fcn.004104c0
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x634430
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x00634480]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x634450
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x634463
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x634476
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x6607f0
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
mov edx, 0xe
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
mov rdi, rax
mov rcx, rbx
xor edx, edx
mov r8d, edi
call fcn.004107c0
test edi, edi
je 0x660865
mov rcx, qword [rbx]
call fcn.004118c0
mov rcx, rsi
mov edx, 0xd
mov r8d, edi
add r8d, 1
movsxd r8, r8d
mov r9, rax
call sub.user32.dll_SendMessageW
sub edi, eax
test edi, edi
jle 0x660865
xor eax, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x660859
mov eax, dword [rcx - 4]
mov rcx, rbx
mov edx, eax
sub edx, edi
call fcn.00411b60
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x69b5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x0069b618]
mov eax, ecx
test ax, 4
je 0x69b5ca
or bx, 1
mov eax, ecx
test ax, 8
je 0x69b5d7
or bx, 4
mov eax, ecx
test ax, 1
je 0x69b5e4
or bx, 8
mov eax, ecx
test ax, 2
je 0x69b5f1
or bx, 0x10
test cx, 0x10
je 0x69b5fc
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69b60f
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x69b620
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x0069b66c]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69b643
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69b656
or si, 4
test ebx, 0x20000000
je 0x69b662
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6aacc0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6aaecd
mov rcx, qword [0x004cd738]
mov dl, 1
call fcn.0050a790
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.004104c0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6aaeb0
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.00709270
test al, al
je 0x6aae97
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006aaf38]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.0043a0e0
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x6aae97
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006aafa6]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6aae8a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004119b0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6aae8a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004119b0
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6aad73
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.0050a610
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.004104c0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6abfe0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007a4058]
cmp byte [rax + 0x159], 0
jne 0x6ac07e
cmp qword [0x007a4090], 0
jne 0x6ac025
call sub.KERNEL32.DLL_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x0078b988]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007a4090], rax
cmp qword [0x007a4088], 0
jne 0x6ac045
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.KERNEL32.DLL_CreateEventW
mov qword [0x007a4088], rax
cmp qword [0x007a4098], 0
jne 0x6ac07e
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x0078b980]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.KERNEL32.DLL_CreateThread
mov qword [0x007a4098], rax
add rsp, 0x48
ret

Function at 0x6ad220
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2e0]
test rax, rax
je 0x6ad2ff
cmp dword [rbx + 0x128], 0
jne 0x6ad2f5
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006ad120]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6ad2f5
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6ad2a3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6ad2f4
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.005027d0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6ad2b4
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6ad770
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007a4058]
cmp qword [rax + 0x2e0], 0
je 0x6ad934
test sil, sil
jne 0x6ad85c
cmp dword [rbx + 0x138], 0
jne 0x6ad84d
mov rcx, rbx
call fcn.006b21e0
lea rcx, [0x006ad630]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6ad80f
mov rax, qword [0x007a4058]
cmp byte [rax + 0x193], 0
je 0x6ad80f
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6ad7e9
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ad80e
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ad7f1
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ad84c
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005027d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ad820
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6ad934
cmp dword [rbx + 0x138], 0
jle 0x6ad934
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6ad934
cmp qword [rbx + 0xa8], 0
je 0x6ad8d3
mov rax, qword [0x007a4058]
cmp byte [rax + 0x193], 0
je 0x6ad8d3
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6ad8aa
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ad8d2
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ad8b2
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ad910
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005027d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ad8e4
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x00696208]
call fcn.00414c00
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6aec50
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6aecbc
cmp byte [rbx + 0x193], 0
jne 0x6aecbc
mov rcx, qword [rbx + 0x2e0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.004107c0
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x6aeca7
mov eax, dword [rcx - 4]
test eax, eax
jne 0x6aeccb
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410b30
jmp 0x6aeccb
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410b30
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret