joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055ff0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140056077
mov rsi, rbx
cmp word [rax], bp
je 0x140056036
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140056020
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14005601c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004fa68
mov rdi, rax
test rax, rax
je 0x140056064
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14005f2a0
mov rbp, rdi
xor ecx, ecx
call fcn.14004fa2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ed50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005ed78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005ed78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001054
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14b, byte [0x1400d9e75]
mov rsi, rdx
mov rdi, rcx
call fcn.140027bf8
mov edx, 0x8000
mov ecx, eax
call fcn.140027a20
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov rcx, rsi
mov ebp, eax
call fcn.14000dca8
test al, al
jne 0x14008812a
lea rcx, [rsp + 0x20]
call fcn.140015230
mov rcx, rsi
call fcn.1400119b4
mov rdx, qword [rsi + 8]
lea r8, [rsp + 0x20]
call fcn.140001180
mov r8, qword [rsp + 0x20]
lea rdx, [0x1400c0c10]
mov rcx, rdi
call fcn.140027e40
movsxd rbx, eax
test r14b, r14b
jne 0x140088158
lea rcx, [rsp + 0x20]
call fcn.14000de70
mov rcx, rdi
call fcn.14002803c
mov rcx, rdi
call fcn.140027bf8
mov edx, 0x4000
mov ecx, eax
cmp ebp, 0xffffffff
je 0x14000110a
mov edx, ebp
call fcn.140027a20
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r14
ret
mov rcx, rsi
call fcn.140055cc4
mov rcx, rsi
movsxd rbx, eax
call fcn.140055c14
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.140027db0
mov rbx, rax
jmp 0x1400010ec
mov rcx, rsi
call fcn.140015528
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
jmp 0x1400010e2

Function at 0x140001794
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
lea r14, [rcx + 0x18]
mov rbx, rcx
mov edx, 1
mov r8, r14
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1400017e8
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
lea r8, str.SCRIPT
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
test rax, rax
jne 0x140088f8e
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rbx + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400017e8
mov rcx, qword [rbx + 0x10]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x1400017e8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400017e8
mov rcx, qword [r14]
xor r9d, r9d
mov r8d, edi
mov r10, qword [rcx]
mov rdx, rax
call qword [r10 + reloc.OLEAUT32.dll_RegisterActiveObject]
mov rcx, qword [r14]
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
call qword [rax + SafeArrayCreateEx]
mov byte [rbx + 0x20], 1
jmp 0x1400017e8
Function at 0x140001800
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov esi, r9d
mov rbp, r8
test r8, r8
je 0x140088122
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140088122
lea rax, [r11 - 0x18]
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov word [rdi], bx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140088122
mov rcx, qword [rsp + 0x30]
lea eax, [rsi + rsi]
xor r9d, r9d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001895
mov eax, dword [rsp + 0x60]
shr eax, 1
mov dword [rsp + 0x60], eax
cmp eax, esi
jae 0x1400018b7
mov word [rdi + rax*2], bx
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea eax, [rsi - 1]
jmp 0x14000188f
xor al, al
jmp 0x1400018a2

Function at 0x1400018dc
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov word [rcx + 8], 1
mov eax, 5
mov rbx, rcx
mov dword [rcx], eax
mov dword [rcx + 4], eax
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov dword [rcx + 0x20], eax
mov dword [rcx + 0xc], 4
lea ecx, [rax + 0x5b]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x10]
mov byte [rbx + 0x35], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x32], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x33], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x11]
mov byte [rbx + 0x34], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x12]
mov byte [rbx + 0x30], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 0x31], al
add rsp, 0x20
pop rbx
ret

Function at 0x140002258
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
cmp byte [rcx + 0x20], 0
mov r10, r9
mov r11, r8
mov rbx, rdx
jne 0x140089070
mov r9, qword [rsp + 0x50]
mov r8, r10
mov rdx, r11
mov rcx, rbx
call fcn.140029554
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x18]
imul r10d, r11d
lea r9, [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, r10d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rsp + 0x30]
jmp 0x14000228a
Function at 0x1400033d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140003478
xor edi, edi
test rsi, rsi
je 0x140003423
nop
mov eax, dword [rbx + 0x10]
cmp dword [rbx + 0x14], eax
je 0x14000343f
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 8]
inc rdi
movzx edx, byte [rdx + rcx]
mov byte [rdi + rbp - 1], dl
inc dword [rbx + 0x14]
cmp rdi, rsi
jb 0x140003400
add qword [rbx + 0x18], rdi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140003423
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140003423
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x14], 0
jmp 0x140003408
mov qword [rcx + 0x10], 0
call fcn.140003500
jmp 0x1400033f7
Function at 0x140016214
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov rsi, rdx
lea rdx, [rsp + 0x50]
xor bl, bl
mov ecx, 0x104
xor dil, dil
mov byte [rbp + 0x390], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x3a0]
mov rdx, rsi
call fcn.140015f1c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140085128
mov eax, dword [0x1400d9f28]
test eax, eax
je 0x14001638a
mov r15d, 1
lea rcx, [0x1400dbf10]
cmp eax, r15d
je 0x14008514a
lea rax, [rbp + 0x390]
lea r8, [0x1400d9f28]
lea rdx, [0x1400d9f50]
mov qword [rsp + 0x20], rax
call fcn.140016590
test al, al
je 0x140016393
mov al, byte [0x1400dbf10]
mov dil, byte [0x1400dbf11]
lea r9, [0x1400d9f20]
lea r8, [rbp + 0x160]
lea rcx, [0x1400d9f50]
mov edx, 0x104
mov byte [0x1400d9f2c], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [rbp + 0x390]
mov r8d, dword [0x1400d9f28]
lea rdx, [0x1400d9f50]
call fcn.14001598c
test eax, eax
jne 0x14008516e
cmp dil, r15b
je 0x140085191
call fcn.140016be0
call fcn.140017b68
cmp byte [0x1400d9f2c], 0
jne 0x140016337
lea rcx, [0x1400dab40]
call fcn.140015dc8
lea rcx, [0x1400da160]
mov edx, r15d
call fcn.140007890
cmp byte [0x1400d9f2c], 0
jne 0x14001635b
lea rcx, [0x1400dab40]
call fcn.14001639c
lea rcx, [0x1400dbf10]
call fcn.140016400
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
or dword [0x1400d9e70], 0xffffffff
jmp 0x140016367
mov dword [0x1400d9e70], r15d
jmp 0x140016367
lea r8, [0x1400c4ecc]
lea rdx, str.Compiled_AutoIT_Script_by_CWAutComp_v2.16
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x140016372
mov r8, qword [0x1400d9f30]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14004ab50
mov al, byte [0x1400d9e76]
mov byte [0x1400dbf12], al
jmp 0x1400162f4
lea rcx, [0x1400dbf10]
call fcn.140016400
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400d9e70], r15d
jmp 0x140016372
call fcn.1400509bc
test al, al
jne 0x140016318
cmp byte [rbp + 0x3a0], al
jne 0x140016318
lea rdx, [rbp + 0x160]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1400af97c]
lea rcx, [rsp + 0x30]
call fcn.14000dda4
lea rcx, [rsp + 0x30]
test bl, bl
je 0x140085204
lea rdx, [0x1400c4f38]
call fcn.140015b3c
lea rdx, [0x1400d9f50]
lea rcx, [rsp + 0x30]
call fcn.140015b3c
lea rdx, [0x1400c4f38]
lea rcx, [rsp + 0x30]
jmp 0x140085207
mov rdx, rsi
call fcn.140015b3c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rbp + 0x160]
lea rdx, str.runas
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14000de70
nop
jmp 0x14001635b
Function at 0x140016e6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rcx, r9
mov rsi, r9
call fcn.1400154c0
lea rax, [rbp + 0x28]
xor ebx, ebx
lea rdx, str.SoftwareAutoIt_v3AutoIt
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008806c
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
lea rdx, str.Include
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088110
mov ecx, dword [rbp + 0x30]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140025a08
lea rcx, [rbp - 0x10]
mov rdx, rax
call fcn.1400037d4
mov rdi, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
lea rdx, str.Include
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088107
mov eax, dword [rbp + 0x30]
mov rdx, rdi
mov rcx, rsi
shr eax, 1
mov dword [rbp + 0x30], eax
mov word [rdi + rax*2], bx
call fcn.140014014
mov bl, 1
lea rcx, [rbp - 0x10]
call fcn.140003738
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x140016ec0

Function at 0x140017b68
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400d9e68]
lea rdx, [0x1400af980]
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400d9e68]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, str.edit
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400d9ec0], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400d9ec0]
xor edx, edx
mov qword [0x1400d9eb8], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400d9ec0]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]

Function at 0x140017fb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x270
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140087fb4
add rsp, 0x270
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140087fd0
or eax, 0xffffffff
jmp 0x140017fcf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
jmp 0x140017fcf
Function at 0x1400182b4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ecx, ecx
mov r15, r9
mov r13, rdx
lea ebx, [rcx + 1]
mov edi, ecx
mov ebp, ecx
cmp qword [rdx + 8], rcx
je 0x1400876e8
mov rax, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xb0]
mov byte [rax], cl
mov byte [r12], cl
mov byte [r14], cl
mov byte [r9], cl
mov dword [r8], ecx
mov rsi, rax
movsxd rdx, edi
mov rcx, r13
call fcn.140018494
movzx ecx, word [rax]
lea eax, [rcx - 0x21]
cmp ax, 0x3d
jbe 0x1400876ef
movsxd rdx, edi
add edi, ebx
mov rcx, r13
mov dword [rsp + 0x90], edi
call fcn.140018494
mov rsi, qword [rsp + 0xa0]
movzx ecx, word [rax]
cmp cx, 0x7b
jne 0x140087778
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.140013fc8
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x30]
mov edx, 0x7d
mov r8, r13
mov qword [rsp + 0x20], rax
call fcn.14001840c
test al, al
je 0x140018406
lea rdi, [0x1400d3f60]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi]
call fcn.140025f34
test eax, eax
je 0x1400183b5
lea rax, [0x1400d4270]
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x140018392
cmp ebp, 0x62
je 0x140087734
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xd3ef0], 0
jne 0x140018406
movzx eax, byte [rax + rcx + 0xd3e80]
mov dword [rsi], eax
lea rcx, [rsp + 0x30]
call fcn.14000de70
and dword [rsi], 0xff
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x1400183dc
lea rcx, [rsp + 0x30]
call fcn.14000de70
xor al, al
jmp 0x1400183ee
movabs rdx, 0x2000000000000405
bt rdx, rax
jae 0x140018330
cmp cx, 0x2b
jne 0x14008770e
mov byte [r15], bl
jmp 0x14008772d
cmp cx, 0x5e
jne 0x140087719
mov byte [r14], bl
jmp 0x14008772d
cmp cx, 0x21
jne 0x140087725
mov byte [r12], bl
jmp 0x14008772d
cmp cx, 0x23
jne 0x14008772d
mov byte [rsi], bl
add edi, ebx
jmp 0x140018315
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140004b28
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x1400876de
bt ecx, 9
jae 0x14008775c
mov byte [r14], bl
bt ecx, 0xa
jae 0x140087766
mov byte [r12], bl
bt ecx, 8
jae 0x1400183dc
mov byte [r15], bl
jmp 0x1400183dc
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x1400876e8
bt ecx, 9
jae 0x140087795
mov byte [r14], bl
bt ecx, 0xa
jae 0x14008779f
mov byte [r12], bl
bt ecx, 8
jae 0x1400183e6
mov byte [r15], bl
jmp 0x1400183e6
Function at 0x14001a458
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [rdx]
mov rsi, rcx
lea rcx, [rbp + 0x20]
mov r14d, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x20]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov dword [rdi + 0x290], eax
mov eax, dword [rbp + 0x24]
mov dword [rdi + 0x294], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x24]
cmp eax, dword [rdi + 0x298]
jne 0x14001a528
cmp ecx, dword [rdi + 0x29c]
jne 0x14001a528
mov ecx, dword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rsi + 0x1c]
movzx r15d, ax
shr r15d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r15d, dword [rdi + 0x2a0]
jne 0x14009450d
test r14d, r14d
je 0x14001a4f8
mov dword [rdi + 0x2a0], r15d
cmp ebx, dword [rdi + 0x2a4]
jne 0x140094594
test r14d, r14d
je 0x14001a50f
mov dword [rdi + 0x2a4], ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov dword [rdi + 0x298], eax
mov dword [rdi + 0x29c], ecx
cmp r14d, 1
jl 0x14001a4bf
jmp 0x1400944f0
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff5
call fcn.1400790c4
nop
jmp 0x14001a4bf
cmp r14d, 1
jl 0x14001a4ec
cmp byte [rdi + 0x2e0], 0
je 0x14001a4ec
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
test r15d, r15d
je 0x140094541
mov edx, 0xfffffff9
jmp 0x140094583
mov edx, 0xfffffff8
call fcn.1400790c4
cmp byte [rdi + 0x2a8], 0
je 0x140094588
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rbp + 0x24]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140094583
mov edx, 0xfffffff4
call fcn.1400790c4
mov byte [rdi + 0x2a8], 0
jmp 0x14001a4ec
cmp r14d, 1
jl 0x14001a504
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400945bd
mov edx, 0xfffffff6
call fcn.1400790c4
nop
jmp 0x14001a504
Function at 0x140024cc4
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov edi, edx
test r8, r8
jne 0x1400940b2
mov eax, dword [0x1400daa88]
cmp eax, 0xffffffff
je 0x1400941bd
movsxd rcx, eax
mov rax, qword [0x1400daa70]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp byte [rbx + 0x6a], 0
mov rbp, qword [rbx]
je 0x140024d26
cmp dword [rbx + 0x2b8], 0
mov byte [rbx + 0x6a], 0
jge 0x1400940cc
cmp qword [rbx + 0x2d8], 0
jne 0x1400940fb
cmp edi, 8
jg 0x140094137
je 0x140024d58
test edi, edi
je 0x140094123
cmp edi, 1
je 0x140024d58
mov edx, 6
cmp edi, 2
je 0x140024da2
cmp edi, 3
je 0x14009419e
jle 0x140024d83
cmp edi, 5
jg 0x140024d98
cmp byte [rbx + 0x68], 0
jne 0x1400941bd
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
lea eax, [rdi - 4]
test eax, 0xfffffffb
je 0x140024d7f
mov rdx, rbp
call fcn.140024dac
mov byte [rbx + 0x68], 1
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edi, edx
je 0x14009410a
jmp 0x140024d83
mov byte [rbx + 0x68], 1
jmp 0x14009410a
lea rcx, [0x1400da9d0]
mov rdx, r8
call fcn.14001ae54
mov dword [0x1400daa88], eax
jmp 0x140024ce4
cmp byte [rbx + 0x2c4], 0
je 0x140024d18
mov r8d, dword [rbx + 0x2c0]
lea rcx, [0x1400da9d0]
mov rdx, rbx
call fcn.14008007c
mov byte [rbx + 0x2c4], 0
jmp 0x140024d18
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_DrawMenuBar]
nop
jmp 0x140024d26
cmp byte [rbx + 0x68], 0
je 0x1400941bd
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
nop
jmp 0x140024d83
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rbx + 0x68], 0
jmp 0x140024d83
mov ecx, edi
sub ecx, 9
je 0x14009419e
sub ecx, 0x37
je 0x14009418a
dec ecx
je 0x140094186
dec ecx
je 0x140094173
dec ecx
jne 0x140024d83
mov byte [rbx + 0x69], cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
nop
jmp 0x140024d83
mov rcx, rbp
mov byte [rbx + 0x69], 1
call qword [sym.imp.USER32.dll_LockWindowUpdate]
nop
jmp 0x140024d83
xor edx, edx
jmp 0x14009418f
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_EnableWindow]
nop
jmp 0x140024d83
cmp byte [rbx + 0x68], 0
je 0x1400941bd
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbp
call fcn.140024dac
nop
jmp 0x140024d83
xor eax, eax
jmp 0x140024d88
Function at 0x140024dac
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rdi, rax
jne 0x1400877b2
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor ebx, ebx
test rax, rax
jne 0x1400877cb
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400877e6
mov edx, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x140087910
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, 1
mov ecx, r14d
mov edx, eax
mov r8d, esi
mov r15d, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x1400878de
lea esi, [rax + 0x12]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x1400878e3
lea ebx, [rsi - 0xe]
jmp 0x1400878e3
mov ebx, 3
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x140087915
mov ebx, 2
mov eax, ebx
jmp 0x140024dde

Function at 0x140026474
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400262dc