joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [0x14012652a]
call fcn.140002032
lea rdx, str.EBWebViewx64EmbeddedBrowserWebView.dll
mov rcx, rsi
call fcn.140002032
mov rcx, rsi
call fcn.1400202f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140001c99
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x260
mov r15, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rdi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400eced0
mov dword [rsp + 0x3c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
movzx eax, bl
mov rcx, 0xffffffff80000002
sub rcx, rax
mov qword [rsp + 0x20], rdx
xor ebx, ebx
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001d3e
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.1400eb9c0
mov eax, ebx
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea rdx, str.EBWebView
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x140001d1d
cmp dword [rsp + 0x3c], 3
jb 0x140001d1d
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.140001f4e
mov rcx, r15
call fcn.1400202f4
mov rcx, rax
mov dx, 0x5c
call fcn.1400ecdf0
test rax, rax
je 0x140001deb
mov rdi, rax
add rdi, 2
movaps xmm0, xmmword [0x140126290]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rdi
call fcn.140001ba4
test al, al
je 0x140001deb
test r14, r14
je 0x140001dd7
mov rcx, r14
mov rdx, rdi
call fcn.140001f4e
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.140001df2
mov ebx, eax
jmp 0x140001d1d
xor ebx, ebx
jmp 0x140001d1d

Function at 0x140001df2
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
xor eax, eax
lea rdx, [0x1401267f0]
mov esi, dword [rax + rdx]
cmp dword [rcx + rax], esi
ja 0x140001e18
jb 0x140001e26
add rax, 4
cmp rax, 0x10
jne 0x140001e04
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400010ab
lea rcx, str.Loader_skipped_an_incompatible_version:
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rsi
mov rcx, rdi
call fcn.1400202f4
mov rcx, rax
call rsi
lea rcx, [0x140126852]
call rsi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140002756
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0xa0]
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1400027f9
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002822
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
call 0x140002855
test al, al
je 0x140002834
mov rcx, qword [r15]
test rcx, rcx
je 0x140002851
xor edx, edx
mov r8d, 0xa
call fcn.1400fea20
cmp eax, 1
jmp 0x140002827
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400eb9c0
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140002855
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x140002836
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400eb9c0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x14000282a
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.1400eced0
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x1400028e6
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140001f4e
mov rcx, r15
call fcn.1400202f4
mov qword [r14], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400eb9c0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140002855
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0xa0]
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1400027f9
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140002822
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
call 0x140002855
test al, al
je 0x140002834
mov rcx, qword [r15]
test rcx, rcx
je 0x140002851
xor edx, edx
mov r8d, 0xa
call fcn.1400fea20
cmp eax, 1
jmp 0x140002827
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400eb9c0
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140002855
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x140002836
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400eb9c0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x14000282a
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.1400eced0
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x1400028e6
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140001f4e
mov rcx, r15
call fcn.1400202f4
mov qword [r14], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400eb9c0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14000295c
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400029b0
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.140001ec6
test al, al
je 0x1400029b0
mov rcx, rsi
call fcn.1400202f4
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140002010
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400192d4
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
sub edx, 7
je 0x1400193d7
sub edx, 1
je 0x1400193d3
sub edx, 0xf8
je 0x140019394
sub edx, 0x101
je 0x140019382
sub edx, 1
je 0x14001933d
sub edx, 0x7dff
je 0x140019326
cmp edx, 0x300
jne 0x1400193d3
call fcn.1400829c8
jmp 0x1400193f1
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400193f1
cmp byte [0x14016f180], 0
je 0x1400193f1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
shr ecx, 0x10
cmp ax, cx
jne 0x140019379
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8001
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x14016f180], 0
jmp 0x1400193f1
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rbx
setne byte [0x14016f180]
jmp 0x1400193f1
cmp r8, 8
jne 0x1400193d3
lea ecx, [r8 + 9]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400193d3
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400193d3
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400193d3
mov edx, 0x8301
mov rcx, rbx
jmp 0x1400193e5
xor al, al
jmp 0x1400193f3
cmp byte [0x14016f180], 0
jne 0x1400193f1
mov edx, 0x8001
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14001a4e4
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, edx
xor r14d, r14d
mov edx, dword [rcx + 0x1b8]
mov r12d, r8d
mov rdi, rcx
cmp edx, 1
jne 0x14001a528
cmp byte [rcx + 0x1bc], r14b
jne 0x14001a6f4
cmp edx, 3
jne 0x14001a539
mov dword [rcx + 0x1b8], r14d
jmp 0x14001a6f4
test edx, edx
je 0x14001a555
lea rcx, str.OnMouseLeftButtonDown:_win__mouseAction_d_n
call fcn.14007fe80
mov dword [rdi + 0x1b8], r14d
jmp 0x14001a6f4
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001a568
mov rax, qword [rcx]
call qword [rax + 0xf0]
jmp 0x14001a56b
mov rax, r14
test rax, rax
lea rdx, str._win__AsFixed__
sete cl
call fcn.140024848
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001a59d
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rsi, rax
jmp 0x14001a5a0
mov rsi, r14
mov rcx, rdi
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x6c], r12d
call fcn.140038b38
mov rbx, qword [rsp + 0x68]
mov rcx, rsi
mov rdx, rbx
mov rbp, rax
mov r8, qword [rax + 0xf8]
call fcn.140027cfc
test rax, rax
je 0x14001a602
cmp rax, qword [rbp + 0xf8]
jne 0x14001a602
mov ecx, dword [0x140162e60]
cmp ecx, 0xffffffff
je 0x14001a602
mov rdx, r14
cmp ecx, dword [rax]
je 0x14001a699
inc rdx
lea rcx, [0x140162e60]
mov ecx, dword [rcx + rdx*4]
cmp ecx, 0xffffffff
jne 0x14001a5e8
mov r15b, r14b
cmp qword [rdi + 0x330], r14
je 0x14001a61e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001a61e
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140027c44
test rax, rax
je 0x14001a645
lea rcx, str.dest
cmp qword [rax + 8], rcx
jne 0x14001a645
mov qword [rdi + 0x330], rax
mov ecx, 0x10
mov byte [rdi + 0x1bd], 1
mov qword [rdi + 0x1c8], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, 0x11
shr r14w, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [0x140162398]
movzx ebp, ax
mov rcx, qword [rdi]
shr esi, 5
shr bp, 0xf
and sil, 1
test rcx, rcx
je 0x14001a6ae
mov rdx, qword [rcx]
call qword [rdx + 0xf0]
jmp 0x14001a6b0
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, rdi
mov r15b, 1
call fcn.14001a3a0
jmp 0x14001a645
xor eax, eax
mov rdx, rbx
mov rcx, rax
call fcn.140027dc0
test r15b, r15b
jne 0x14001a6e3
test sil, sil
je 0x14001a6e3
test r14b, r14b
jne 0x14001a6ce
test al, al
jne 0x14001a6d3
test bpl, bpl
je 0x14001a6e3
mov r8d, r12d
mov edx, r13d
mov rcx, rdi
call fcn.14004bcd8
jmp 0x14001a6f4
xor r9d, r9d
mov r8d, r12d
mov edx, r13d
mov rcx, rdi
call fcn.140019d08
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001ba74
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_BeginPaint]
mov ecx, dword [rdi + 0x2cc]
mov rbx, rax
sub ecx, 2
je 0x14001baf9
cmp ecx, 1
je 0x14001baf5
mov rcx, qword [rdi + 0x1b0]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
jne 0x14001bad7
mov rdx, qword [rcx + 8]
lea r8, [rsp + 0x4c]
mov rcx, rdi
call fcn.14001b2a8
mov rcx, qword [rdi + 0x1b0]
mov rdx, rbx
call fcn.140084d2c
jmp 0x14001bb15
xor ecx, ecx
jmp 0x14001bafe
mov ecx, 4
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rdx, [rsp + 0x4c]
mov rcx, rbx
mov r8, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_EndPaint]
cmp byte [0x140167bc5], 0
je 0x14001bb86
mov rdi, qword [rdi + 0x4b8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbx, qword [rsp + 0x28]
xorps xmm2, xmm2
movsd xmm1, qword [0x140149f78]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x30]
mov rcx, rdi
cvtsi2sd xmm2, rbx
divsd xmm2, xmm0
mulsd xmm2, xmm1
divsd xmm1, xmm2
cvttsd2si edx, xmm1
call fcn.1400743d8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x14001ce18
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor ebx, ebx
mov dword [rsp + 0x74], 1
lea rax, [rsp + 0x78]
mov dword [rbp - 0x68], ebx
mov qword [rsp + 0x68], rax
mov r12b, r8b
mov r14, rdx
mov qword [rsp + 0x60], rbx
mov rdi, rcx
mov dword [rsp + 0x70], ebx
lea rax, [rbp - 0x38]
mov byte [rsp + 0x78], bl
lea r8d, [rbx + 0x40]
mov qword [rbp - 0x60], rbx
xor edx, edx
mov qword [rbp - 0x48], rbx
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x40], rax
call fcn.1400eced0
lea ecx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
xor r9d, r9d
xor r8d, r8d
movzx r13d, ax
or edx, 0xffffffff
mov rcx, r14
shr r13w, 0xf
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x208
mov r15d, eax
call fcn.1400eced0
mov esi, ebx
test r15d, r15d
jle 0x14001cf49
mov r9d, 0x104
lea r8, [rbp + 0x10]
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
call fcn.1400804a4
mov r9, rax
lea rdx, [rbp + 0x10]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.14008902c
lea rdx, [0x140133de4]
mov rcx, rax
mov rbx, rax
call fcn.14007c3d8
test al, al
je 0x14001cf33
mov rcx, rbx
call fcn.1400839ec
test rax, rax
cmovne rbx, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14007eaec
inc esi
cmp esi, r15d
jl 0x14001cedf
xor ebx, ebx
test r12b, r12b
je 0x14001cf57
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
mov esi, dword [rbp - 0x58]
test esi, esi
je 0x14001cfaf
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.14007ecc8
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14005305c
test r13b, r13b
je 0x14001cf93
test rdi, rdi
jne 0x14001cf93
xor ecx, ecx
call fcn.140056aa8
mov rdi, rax
mov qword [rsp + 0x28], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400576fc
lea rcx, [rsp + 0x20]
call fcn.140053214
inc ebx
cmp ebx, esi
jne 0x14001cf5e
mov rdx, qword [rbp - 0x40]
lea rax, [rbp - 0x38]
cmp rdx, rax
je 0x14001cfdf
test rdx, rdx
je 0x14001cfda
mov rcx, qword [rbp - 0x60]
test rcx, rcx
jne 0x14001cfd4
mov rcx, rdx
call fcn.1400feb88
jmp 0x14001cfda
mov rax, qword [rcx]
call qword [rax + 0x18]
and qword [rbp - 0x40], 0
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14001d00d
lea rax, [rsp + 0x78]
cmp rdx, rax
je 0x14001d00d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14001d007
mov rcx, rdx
call fcn.1400feb88
jmp 0x14001d00d
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d2d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_BeginPaint]
mov rdx, qword [0x14015f400]
mov rsi, rax
mov ebx, dword [rdx + 0x10]
call fcn.14006acd8
mov ecx, dword [0x140162398]
mov r8d, eax
and ecx, 6
cmp cl, 6
jne 0x14001d37a
mov rcx, qword [0x140167368]
cmp byte [rcx + 0x198], 0
je 0x14001d37a
cmp byte [rcx + 0x219], 0
je 0x14001d37a
mov rax, qword [rdi + 0x1b0]
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x14001d361
mov rdx, qword [rax + 8]
mov dword [rsp + 0x20], r8d
mov r9d, ebx
lea r8, [0x140167c00]
mov rcx, rdi
call fcn.140050334
jmp 0x14001d396
mov rax, qword [rdi + 0x1b0]
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x14001d38e
mov rdx, qword [rax + 8]
mov rcx, rdi
call fcn.14005024c
mov rcx, qword [rdi + 0x1b0]
mov rdx, rsi
call fcn.140084d2c
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_EndPaint]
cmp byte [0x140167bc5], 0
je 0x14001d416
mov rdi, qword [rdi + 0x4b8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbx, qword [rsp + 0x38]
xorps xmm2, xmm2
movsd xmm1, qword [0x140149f78]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x40]
mov rcx, rdi
cvtsi2sd xmm2, rbx
divsd xmm2, xmm0
mulsd xmm2, xmm1
divsd xmm1, xmm2
cvttsd2si edx, xmm1
call fcn.1400743d8
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001d4a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
xor r9d, r9d
add rcx, 0x220
call fcn.14004fcc4
mov rcx, qword [rsi + 0x338]
mov rdi, rax
test rax, rax
je 0x14001d501
cmp rax, rcx
je 0x14001d4fd
test rcx, rcx
je 0x14001d501
mov r9, rcx
sub r9, rax
movzx edx, byte [rax]
movzx r8d, byte [rax + r9]
sub edx, r8d
jne 0x14001d4f9
inc rax
test r8d, r8d
jne 0x14001d4e4
test edx, edx
jne 0x14001d501
mov bl, 1
jmp 0x14001d503
xor bl, bl
call fcn.1400feb88
and qword [rsi + 0x338], 0
test bl, bl
je 0x14001d672
lea rdx, str._File_Open_
cmp rdi, rdx
je 0x14001d65c
test rdi, rdi
je 0x14001d60f
mov rcx, rdi
call fcn.140123190
test eax, eax
je 0x14001d65c
lea rdx, str._View_HideList_
cmp rdi, rdx
je 0x14001d5fa
mov rcx, rdi
call fcn.140123190
test eax, eax
je 0x14001d5fa
lea rdx, str._View_ShowList_
cmp rdi, rdx
je 0x14001d5e0
mov rcx, rdi
call fcn.140123190
test eax, eax
je 0x14001d5e0
lea rdx, str.http:
cmp rdi, rdx
je 0x14001d5d3
mov r8d, 5
mov rcx, rdi
call fcn.140102768
test eax, eax
je 0x14001d5d3
lea rdx, str.https:
cmp rdi, rdx
je 0x14001d5d3
mov r8d, 6
mov rcx, rdi
call fcn.140102768
test eax, eax
je 0x14001d5d3
lea rdx, [0x140133e70]
cmp rdi, rdx
je 0x14001d5d3
mov r8d, 7
mov rcx, rdi
call fcn.140102768
test eax, eax
jne 0x14001d60a
mov rcx, rdi
call fcn.1400534bc
jmp 0x14001d672
mov rax, qword [0x140167368]
mov byte [rax + 0x219], 1
mov dl, 1
mov rcx, rsi
call fcn.140038e8c
jmp 0x14001d672
mov rax, qword [0x140167368]
mov byte [rax + 0x219], 0
jmp 0x14001d5ee
test rdi, rdi
jne 0x14001d61f
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001d61f
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rdi
movzx ebx, ax
call fcn.14005305c
shr bx, 0xf
lea rcx, [rsp + 0x20]
xor bl, 1
mov dl, bl
call fcn.1400576fc
lea rcx, [rsp + 0x20]
call fcn.140053214
jmp 0x14001d672
mov rcx, qword [rsi + 0x10]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x48]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140023fd0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15b, dl
mov r14, rcx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140024027
mov al, 1
jmp 0x14002410a
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400240fe
lea r13, str.winex11.drv
call fcn.1400804a4
mov r9, rax
lea rdx, [rsp + 0x60]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.14008902c
mov rdi, rax
cmp rax, r13
je 0x140024083
test rax, rax
je 0x140024086
mov rdx, r13
mov rcx, rax
call fcn.1401028a4
test eax, eax
jne 0x140024086
mov bpl, 1
call fcn.1400804a4
mov r9, rax
lea rdx, [rsp + 0x260]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.14008902c
mov rsi, rax
test r15b, r15b
je 0x1400240c5
mov rcx, qword [0x140168590]
test rcx, rcx
je 0x1400240c5
mov rdx, rax
call fcn.14007c434
test rax, rax
jne 0x1400240e8
mov r9d, dword [rsp + 0x50]
lea rdx, str.Module:__p__06X___16s__s_n
mov r8, qword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
call fcn.14007d820
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14002404c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bpl
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x140031418
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
test rcx, rcx
jne 0x14003144c
xor eax, eax
jmp 0x1400314ff
or rbx, 0xffffffffffffffff
mov rdx, rbx
call fcn.140080680
mov rsi, rax
mov dword [rsp + 0x40], 0x5c3a3f
movsx ecx, byte [rax]
call fcn.1400fee38
mov byte [rsp + 0x40], al
sub al, 0x41
cmp al, 0x19
ja 0x140031492
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 1
je 0x14003148f
sub eax, 1
je 0x14003148f
cmp eax, 3
jne 0x140031492
mov byte [rsi], 0x3f
inc rbx
cmp byte [rsi + rbx], dil
jne 0x140031492
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call fcn.14008f12c
mov edx, 0x10
lea rcx, [rsp + 0x48]
call fcn.14007cb24
lea rcx, str.sumatrapdfcache
mov rbx, rax
call fcn.140018cd4
mov rsi, rax
test rax, rax
je 0x1400314f4
xor r8d, r8d
lea rdx, [0x140138178]
mov rcx, rbx
call fcn.140080720
mov rdx, rax
xor r8d, r8d
mov rcx, rsi
call fcn.1400809f4
mov rdi, rax
mov rcx, rbx
call fcn.1400feb88
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret