joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aed20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x1400aee44
cmp r8d, 0xff
jne 0x1400aed81
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x1400aed6b
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0xd0130]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.140090200
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.140090200
cmp r8d, 0xfb
jne 0x1400aed93
lea r9, str.WILL
jmp 0x1400aedd1
cmp r8d, 0xfc
jne 0x1400aeda5
lea r9, str.WONT
jmp 0x1400aedd1
cmp r8d, 0xfd
jne 0x1400aedb7
lea r9, [0x1400d0b54]
jmp 0x1400aedd1
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x1400aee2d
cmp r10d, 0x27
jg 0x1400aee04
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0xd0750]
test r8, r8
jne 0x1400aee14
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.140090200
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x1400aedeb
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.140090200
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.140090200
add rsp, 0x38
ret

Function at 0x1400af190
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400af1ef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140090080
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1400aed20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400af3a0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400af548
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400af405
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400af405
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400af405
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400af43c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400af492
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400af492
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400af492
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400af492
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400af492
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400aee50
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400af4f4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140090080
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400af220
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400af540
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140090080
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b0cb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400f2080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400b0d45
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400b0da6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140090080
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c3810
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400b0e61
sub ecx, 1
je 0x1400b0ed4
sub ecx, 1
je 0x1400b0e10
cmp ecx, 1
je 0x1400b0df3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400d4d08]
call fcn.140090080
jmp 0x1400b0ed4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400b09e0
test eax, eax
je 0x1400b0ed4
jmp 0x1400b0d7a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400b0ed4
sub rax, rsi
cmp rax, rbp
jae 0x1400b0ed4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140090200
jmp 0x1400b0ed4
cmp r8d, 4
jle 0x1400b0ed4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400b0ed4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14008ffa0
mov esi, eax
test eax, eax
je 0x1400b0eb3
mov edx, 5
mov rcx, rbx
call fcn.1400b19a0
mov eax, esi
jmp 0x1400b0d7a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14009a450
mov rcx, r14
call fcn.14009a730
test eax, eax
je 0x1400b0d78
mov edx, 5
mov rcx, rbx
call fcn.1400b19a0
mov eax, Ordinal_45
jmp 0x1400b0d7a
Function at 0x1400c3630
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400c3672
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400c36b9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400c3712
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400c36d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400c3753
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400d3c52]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400d3c53]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400c3720
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400c483c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c4886
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c4886
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c4886
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c4886
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c4886
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c4888
xor al, al
add rsp, 0x28
ret
Function at 0x18000129c
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rsi, rax
test rax, rax
je 0x1800013e6
lea r13d, [rbx + 8]
xor r9d, r9d
mov edx, r13d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
movsxd r15, eax
lea eax, [r15 + 2]
cmp eax, 1
jbe 0x1800013da
lea eax, [r15 + 1]
movsxd rdx, eax
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x1800013da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov r12, rax
test rax, rax
je 0x1800013d1
mov r9d, r15d
mov r8, rax
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov byte [r15 + r12], bl
test dil, 0x10
je 0x180001395
xor r9d, r9d
lea edx, [rbx + 0x10]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
movsxd r13, eax
lea eax, [r13 + 2]
cmp eax, 1
jbe 0x180001395
lea eax, [r13 + 1]
movsxd rdx, eax
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180001395
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov rdi, rax
test rax, rax
jne 0x180001403
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov r8, rdi
mov rdx, r12
mov rcx, r14
call fcn.180001b3c
mov rcx, rbp
mov dword [0x1800260e4], r15d
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
test rdi, rdi
je 0x1800013d1
test rbx, rbx
je 0x1800013d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r9d, r13d
mov r8, rdi
mov edx, 0x10
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov byte [r13 + rdi], 0
jmp 0x180001397
Function at 0x180001424
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rbx, rax
test rax, rax
je 0x1800014d4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov r14d, eax
test eax, eax
jle 0x1800014c8
lea ecx, [rax + 1]
movsxd rdx, ecx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800014c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov rbp, rax
test rax, rax
je 0x1800014bf
mov r9d, r14d
mov r8, rax
mov edx, 0x800
mov rcx, rbx
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov rdx, rbp
mov rcx, rsi
call fcn.180001e80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800020e0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rdi, rax
test rax, rax
je 0x18000223c
mov rcx, rax
call qword [sym.imp.IMM32.dll_ImmGetOpenStatus]
test eax, eax
je 0x180002230
cmp dword [0x1800260e0], 0
je 0x180002230
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea r13d, [r9 + 8]
mov edx, r13d
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
movsxd r15, eax
test eax, eax
jle 0x180002230
lea ecx, [r15 + 1]
xor esi, esi
movsxd rdx, ecx
xor ebx, ebx
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x180002230
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov r12, rax
test rax, rax
jne 0x180002189
mov rcx, rbp
jmp 0x18000222a
mov r9d, r15d
mov r8, r12
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
test eax, eax
jle 0x180002202
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
movsxd r13, eax
test eax, eax
jle 0x1800021ed
lea edx, [r13 + 1]
mov ecx, 0x40
movsxd rdx, edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1800021ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov rsi, rax
test rax, rax
jne 0x180002259
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov r8, rsi
mov byte [r15 + r12], 0
mov rdx, r12
mov rcx, r14
call fcn.180001b3c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x180002230
test rbx, rbx
je 0x180002230
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r9d, r13d
mov r8, rsi
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov byte [r13 + rsi], 0
jmp 0x1800021ef
Function at 0x180002968
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x47], rax
mov rdi, rcx
mov eax, 0xa4a4
mov word [rbp - 0x39], ax
xor eax, eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.USER32.dll_GetDC]
mov ecx, 0x10
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rdx, rax
mov qword [0x1800260d0], rax
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
lea rdx, [rbp + 0x17]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextMetricsA]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r9, [rbp - 0x31]
mov r8d, 2
lea rdx, [rbp - 0x39]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov eax, dword [rbp - 0x31]
movzx ecx, byte [rbp + 0x4b]
shr eax, 1
mov dword [0x180025cb0], eax
mov eax, dword [rbp - 0x2d]
mov dword [0x1800260d8], eax
sub ecx, 0x80
je 0x180002a68
sub ecx, 1
je 0x180002a5c
cmp ecx, 7
je 0x180002a50
mov dword [0x180025fa0], 0x7071
jmp 0x180002a72
mov dword [0x180025fa0], 0xaaf9
jmp 0x180002a72
mov dword [0x180025fa0], 0xdaa6
jmp 0x180002a72
mov dword [0x180025fa0], 0x96e5
and dword [0x180025cb4], 0
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [0x180026050], eax
mov dword [0x18002604c], eax
lea edx, [r9 + 0x31]
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
je 0x180002ae8
lea r8, [rbp - 0x29]
mov edx, 0x3c
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x180002ae8
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rbx, rax
test rax, rax
je 0x180002ae8
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.IMM32.dll_ImmSetCompositionFontA]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov edx, 4
call qword [sym.imp.IMM32.dll_ImmGetProperty]
xor edx, edx
lea rcx, [0x1800260f0]
mov r8d, 0x200
mov dword [0x1800260e8], eax
call fcn.180004b20
xor r9d, r9d
mov edx, 0x111
mov rcx, rdi
lea r8d, [r9 + 0x29]
call qword [sym.imp.USER32.dll_PostMessageA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [0x180025f98], rax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180003d10
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180002e18
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, 1
call qword [sym.imp.IMM32.dll_ImmGetContext]
xor ebp, ebp
mov rdi, rax
test rax, rax
je 0x180002e67
xor r9d, r9d
lea edx, [rbx + 0x7f]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov rdx, rdi
mov rcx, rsi
test eax, eax
cmovne ebx, ebp
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180003784
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov rcx, qword [0x180025f98]
call qword [sym.imp.IMM32.dll_ImmIsIME]
test eax, eax
je 0x1800037d0
mov eax, dword [0x1800260e8]
bt eax, 0x11
jb 0x1800037d0
bt eax, 0x10
jae 0x1800037d0
mov rcx, rsi
call fcn.18000234c
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov qword [0x180025f98], rax
mov edx, 4
call qword [sym.imp.IMM32.dll_ImmGetProperty]
mov rcx, rsi
mov dword [0x1800260e8], eax
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rdi, rax
test rax, rax
je 0x180003853
xor ebx, ebx
test dword [0x1800260e8], 0x10000
jne 0x180003840
lea r8, [rsp + 0x20]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetCandidateWindow]
test eax, eax
je 0x180003840
cmp dword [rsp + 0x24], 0
je 0x180003840
and dword [rsp + 0x24], 0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmSetCandidateWindow]
inc ebx
cmp ebx, 4
jb 0x180003806
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180003d10
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18000debc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000deec
xor eax, eax
jmp 0x18000dfaf
mov rbp, rbx
cmp word [rax], si
je 0x18000df11
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000def8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000def4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000de0c
movsxd r14, eax
test eax, eax
jne 0x18000df4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000dee5
mov rcx, r14
call fcn.18000f0fc
mov rdi, rax
test rax, rax
jne 0x18000df68
xor ecx, ecx
call fcn.18000c510
jmp 0x18000df44
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000de0c
test eax, eax
jne 0x18000df99
mov rcx, rdi
call fcn.18000c510
jmp 0x18000dfa3
xor ecx, ecx
call fcn.18000c510
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400012f0
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx eax, byte [0x14004a4d2]
lea r8, [rbp - 0x40]
movsd xmm0, qword [0x14004a4c8]
mov rdx, rcx
movzx ecx, word [0x14004a4d0]
xor al, 0x43
movsd qword [rbp - 0x40], xmm0
xor byte [rbp - 0x3f], 0x3a
xor byte [rbp - 0x3e], 0x3b
xor byte [rbp - 0x3d], 0x3c
xor byte [rbp - 0x3c], 0x3d
xor byte [rbp - 0x3b], 0x3e
xor byte [rbp - 0x3a], 0x3f
xor byte [rbp - 0x39], 0x40
mov word [rbp - 0x38], cx
xor cl, 0x41
xor byte [rbp - 0x37], 0x42
mov byte [rbp - 0x38], cl
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x40], 0x20
mov byte [rbp - 0x36], al
call fcn.140017db0
cmp qword [rbp - 0x18], 0xf
lea rcx, [rbp - 0x30]
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400013b7
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013b2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140044eac
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140044e50
add rsp, 0x60
pop rbp
ret
Function at 0x140016bf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140016c11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140016c3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140016c40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140016c99
test ecx, ecx
jle 0x140016c79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140016c99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140016c99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rsi + 0x41], ah
mov ecx, dword [rbx]