joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6428
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbp, rdx
mov rbx, rcx
jne 0x1400d6510
xor edx, edx
call fcn.14004c560
xor r15d, r15d
mov rcx, rbx
test rax, rax
je 0x1400d6472
mov rdx, rbp
call fcn.1400fc188
jmp 0x1400d651b
call fcn.14004c558
mov esi, eax
cmp dword [rbx + 0x1394], r15d
je 0x1400d6488
sub esi, dword [rbx + 0x1388]
mov r14d, dword [rbx + 0x1138]
test r14d, r14d
js 0x1400d6510
cmp r14d, esi
jge 0x1400d6510
mov edi, dword [rbp + 0x10]
cmp edi, 9
jne 0x1400d64b6
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x27
mov rcx, rbx
call fcn.14001ef04
bt eax, 0x16
jae 0x1400d64d8
mov eax, 0x25
cmp edi, eax
jne 0x1400d64d2
lea edi, [rax + 2]
jmp 0x1400d64d8
cmp edi, 0x27
cmove edi, eax
sub edi, 0xd
je 0x1400d65d5
sub edi, 0xe
je 0x1400d65b1
sub edi, 0xa
je 0x1400d65a3
sub edi, 2
je 0x1400d6551
mov rcx, rbx
cmp edi, 1
je 0x1400d6534
mov rax, qword [rbx]
mov edx, dword [rbp + 0x10]
call qword [rax + 0x728]
test eax, eax
jne 0x1400d654a
mov rdx, rbp
mov rcx, rbx
call fcn.140052330
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov edx, dword [rbx + 0x1138]
call fcn.14004c300
mov rdx, rax
mov rcx, rbx
call fcn.14004b90c
mov eax, 1
jmp 0x1400d651b
inc dword [rbx + 0x1138]
mov eax, dword [rbx + 0x1138]
cmp eax, esi
cmovge eax, r15d
mov dword [rbx + 0x1138], eax
mov edx, r14d
mov rcx, rbx
call fcn.14004cdfc
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14004cdfc
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x1138]
call qword [rax + 0x4b8]
jmp 0x1400d6510
sub dword [rbx + 0x1138], 1
jns 0x1400d6569
lea eax, [rsi - 1]
jmp 0x1400d6563
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c8]
mov dword [0x14028e710], r15d
jmp 0x1400d6510
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14004c300
mov rdx, rax
mov rcx, rbx
call fcn.14004b90c
test eax, eax
jne 0x1400d654a
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.14004c300
mov rdx, rax
mov rcx, rbx
call fcn.140052544
jmp 0x1400d654a
Function at 0x1400d8cc8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rdx
mov qword [rax + 8], rbx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x370]
mov edx, dword [reloc.WS2_32.dll_ntohs]
lea r8, [rsp + 0x50]
or ecx, 0xffffffff
and al, 0x80
mov rax, qword [rdi]
cmovne edx, ecx
mov rcx, rdi
call qword [rax + 0x568]
mov rdx, qword [rsp + 0x50]
lea rcx, str.CDockablePane
mov ebp, eax
call fcn.140038c08
mov rsi, rax
cmp rax, rdi
je 0x1400d8dc8
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400d8dc8
test rsi, rsi
je 0x1400d8d6d
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8 + 0x450]
mov rdx, rax
lea rcx, str.CMultiPaneFrameWnd
call fcn.140038c08
mov r14, rax
jmp 0x1400d8d70
mov r14, rbx
cmp ebp, 2
jne 0x1400d8de3
test r14, r14
je 0x1400d8dad
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x380]
test al, 0x40
je 0x1400d8dc8
cmp qword [rsp + 0x50], rbx
je 0x1400d8dad
mov rax, qword [r14]
mov rdx, rdi
mov rcx, r14
call qword [rax + 0x498]
test eax, eax
mov rax, rdi
sete bl
mov dword [r15], ebx
jmp 0x1400d8dca
mov rax, qword [rdi]
mov r9d, 5
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x3f0]
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
cmp ebp, 3
jne 0x1400d8dc8
test rsi, rsi
je 0x1400d8dc8
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x308]
test eax, eax
je 0x1400d8dc8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x318]
test eax, eax
je 0x1400d8dc8
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x480]
mov rax, qword [rdi]
lea r9d, [rbp - 2]
lea r8d, [rbp + 2]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x698]
test rax, rax
setne bl
mov dword [r15], ebx
jmp 0x1400d8dca
Function at 0x1400db550
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rsi, rcx
mov edx, dword [0x1402915e8]
mov rdi, r8
mov ecx, 4
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x14028e800], eax
jle 0x1400db5d7
lea rcx, [0x14028e800]
call fcn.1401948fc
cmp dword [0x14028e800], 0xffffffff
jne 0x1400db5d7
call fcn.140013888
mov rcx, rax
test rax, rax
je 0x1400db6a6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x1401cda18]
mov qword [0x14028e7f8], rax
call fcn.14019473c
lea rcx, [0x14028e800]
call fcn.14019489c
test rdi, rdi
je 0x1400db6b1
mov rax, qword [rsi + 0x4b8]
test rax, rax
je 0x1400db694
cmp qword [rax + 0x40], 0
je 0x1400db694
test rax, rax
je 0x1400db604
mov rax, qword [rax + 0x40]
cmp qword [rdi], rax
jne 0x1400db694
mov rax, qword [rdi + 8]
sub rax, 1
je 0x1400db65b
sub rax, 1
je 0x1400db62a
cmp rax, 1
jne 0x1400db694
mov ebx, 0x428e
jmp 0x1400db660
mov ecx, reloc.WS2_32.dll_recvfrom
mov ebx, 0x3ea1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1400db660
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x680]
test eax, eax
je 0x1400db660
mov ebx, 0x3ea4
jmp 0x1400db660
mov ebx, 0x3ea0
mov ecx, ebx
call fcn.1400132ac
test rax, rax
je 0x1400db6b7
mov r8d, ebx
lea rcx, [0x14028e7f8]
mov rdx, rax
call fcn.14000f128
test eax, eax
je 0x1400db6b7
mov rax, qword [0x14028e7f8]
mov qword [rdi + 0x18], rax
mov eax, 1
jmp 0x1400db696
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400026dc
int3
call fcn.14001240c
int3
call fcn.14001240c
int3
Function at 0x1400dd598
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14028e878]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140287a24]
test eax, eax
je 0x1400dd5e3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x1400dd5ec
call fcn.14001ebbc
test eax, eax
je 0x1400dd608
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400dd610
xor eax, eax
jmp 0x1400dd66d
test rbx, rbx
jne 0x1400dd630
lea rcx, str.ImageList_Destroy
call fcn.14001e600
mov rbx, rax
test rax, rax
je 0x1400dd63b
mov qword [0x14028e878], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400dd650
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400dd652
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400dd66b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne 0x1400e5156
xor eax, eax
add rsp, 0x28
ret
call fcn.1400e5168
mov rcx, rax
add rsp, 0x28
jmp 0x1400dd598
Function at 0x1400e58d0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x14028e9d8]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x140287a24]
test eax, eax
je 0x1400e592d
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x1400e5936
call fcn.14001ebbc
test eax, eax
je 0x1400e5952
lea rdx, [rsp + 0x40]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x1400e595d
xor eax, eax
jmp 0x1400e59e8
test rbx, rbx
jne 0x1400e597d
lea rcx, str.ImageList_LoadImageW
call fcn.14001e600
mov rbx, rax
test rax, rax
je 0x1400e59b4
mov qword [0x14028e9d8], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400e59ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400e59cc
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400e59e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1400e8f88
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd40]
sub rsp, 0xe40
mov rax, qword [0x1402809a0]
xor rax, rsp
mov qword [rbp + 0xd30], rax
xor ebx, ebx
mov esi, r9d
mov rdi, r8
mov r10, rdx
test rdx, rdx
je 0x1400e917e
test r8, r8
je 0x1400e9184
mov qword [rbp + 0x170], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x30], xmm1
mov ecx, r9d
mov qword [rsp + 0x40], rbx
test r9d, r9d
je 0x1400e913c
sub ecx, 1
je 0x1400e9010
sub ecx, 1
je 0x1400e90bc
cmp ecx, 1
jne 0x1400e915a
mov rcx, qword [r10 + 8]
lea rdx, [rbp + 0x910]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400e9137
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x910]
call fcn.1400eadf8
test eax, eax
je 0x1400e9137
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0xb20]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400e9130
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xb20]
call fcn.1400eadf8
test eax, eax
je 0x1400e9130
cmp esi, 1
jne 0x1400e911d
test byte [rbp + 0x180], 0x10
jne 0x1400e9137
test byte [rsp + 0x50], 0x10
jne 0x1400e9130
mov rax, qword [rbp + 0x178]
cmp rax, qword [rsp + 0x48]
seta bl
or ecx, 0xffffffff
cmp rax, qword [rsp + 0x48]
cmovb ebx, ecx
jmp 0x1400e915a
mov rcx, qword [r10 + 8]
lea r8, [rbp + 0x650]
mov esi, 0x408
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400e915a
mov rcx, qword [rdi + 8]
lea r8, [rbp + 0x390]
mov r9d, 0x2b8
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400e915a
lea rdx, [rbp + 0x5a8]
lea rcx, [rbp + 0x868]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
jmp 0x1400e915a
mov rax, qword [rbp + 0x168]
cmp rax, qword [rsp + 0x38]
jl 0x1400e9137
setg bl
jmp 0x1400e915a
mov ebx, 1
jmp 0x1400e915a
or ebx, 0xffffffff
jmp 0x1400e915a
mov rcx, qword [rdx]
mov r9, qword [r8 + 0x10]
mov r8, qword [rdx + 0x10]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jns 0x1400e9157
xor eax, eax
jmp 0x1400e915c
movsx ebx, ax
mov eax, ebx
mov rcx, qword [rbp + 0xd30]
xor rcx, rsp
call fcn.140194eb0
mov rbx, qword [rsp + 0xe60]
add rsp, 0xe40
pop rdi
pop rsi
pop rbp
ret
call fcn.14001240c
int3
call fcn.14001240c
int3
Function at 0x1400ee740
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14028eb68]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140287a24]
test eax, eax
je 0x1400ee78b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x1400ee794
call fcn.14001ebbc
test eax, eax
je 0x1400ee7b0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400ee7b8
xor eax, eax
jmp 0x1400ee815
test rbx, rbx
jne 0x1400ee7d8
lea rcx, str.GetOpenFileNameW
call fcn.140046c90
mov rbx, rax
test rax, rax
je 0x1400ee7e3
mov qword [0x14028eb68], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400ee7f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400ee7fa
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400ee813
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400ee82c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14028eb70]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140287a24]
test eax, eax
je 0x1400ee877
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x1400ee880
call fcn.14001ebbc
test eax, eax
je 0x1400ee89c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400ee8a4
xor eax, eax
jmp 0x1400ee901
test rbx, rbx
jne 0x1400ee8c4
lea rcx, str.GetSaveFileNameW
call fcn.140046c90
mov rbx, rax
test rax, rax
je 0x1400ee8cf
mov qword [0x14028eb70], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400ee8e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400ee8e6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400ee8ff
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400eec44
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400eed88
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1400eedca
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1400ef1d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400ef2aa
test rbx, rbx
je 0x1400ef2b0
test r9, r9
je 0x1400ef2b6
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ef293
cmp dword [rsp + 0x48], 3
jne 0x1400ef293
test eax, eax
jne 0x1400ef293
cmp dword [rdi], eax
je 0x1400ef293
mov ecx, dword [rdi]
call fcn.1400123a8
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ef287
cmp dword [rsp + 0x48], 3
jne 0x1400ef287
test eax, eax
jne 0x1400ef287
mov eax, 1
jmp 0x1400ef295
mov rcx, qword [rbx]
call fcn.1400123a0
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14001240c
int3
call fcn.14001240c
int3
call fcn.14001240c
int3

Function at 0x1400ef574
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400ef585
xor eax, eax
jmp 0x1400ef5b3
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ef5bc
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400ef5cd
xor eax, eax
jmp 0x1400ef5f1
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1401026d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov ebx, ecx
cmp dword [reloc.WS2_32.dll_accept], edi
je 0x1401027d9
cmp dword [0x14027fdf0], 0xfffffffe
jne 0x1401027be
cmp ecx, 0xffffffff
je 0x1401027d9
mov edx, dword [0x1402915e8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov ecx, dword [rcx + rax]
cmp dword [0x14028ef88], ecx
jle 0x14010275c
lea rcx, [0x14028ef88]
call fcn.1401948fc
cmp dword [0x14028ef88], 0xffffffff
jne 0x14010275c
lea rcx, [0x14028ef50]
call fcn.1400857c0
lea rcx, [0x1401cdb38]
call fcn.14019473c
lea rcx, [0x14028ef88]
call fcn.14019489c
lea rcx, [0x14028ef60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x14028ef28], rdi
jne 0x1401027e4
xor r8d, r8d
lea rcx, [0x1401027ec]
xor edx, edx
call fcn.1401a2c98
mov qword [0x14028ef28], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401027a8
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x14027fdf0], ebx
jmp 0x1401027af
mov qword [0x14028ef28], rdi
lea rcx, [0x14028ef60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1401027d9
mov rax, qword [0x14028ef28]
cmp ecx, 0xffffffff
mov dword [0x14027fdf0], ecx
cmove rax, rdi
mov qword [0x14028ef28], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14001240c
int3
Function at 0x14010b3d4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, dword [rdx + 8]
mov rbx, rcx
mov ecx, 0x104
xor edi, edi
mov rbp, rdx
cmp eax, ecx
ja 0x14010b5a3
je 0x14010b5c9
cmp eax, 0xa1
jb 0x14010b619
cmp eax, 0xa2
jbe 0x14010b5c9
cmp eax, 0xa3
jbe 0x14010b619
cmp eax, 0xa5
jbe 0x14010b5c9
cmp eax, 0xa6
jbe 0x14010b619
cmp eax, 0xa8
jbe 0x14010b5c9
cmp eax, 0x100
jne 0x14010b619
cmp dword [rbx + 0x154], 0xffffffff
je 0x14010b5c9
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14010b5c9
mov rax, qword [rbp + 0x10]
sub rax, 0x21
je 0x14010b524
cmp rax, 1
jne 0x14010b5c9
mov ecx, dword [rbx + 0x154]
lea ebp, [rcx + 1]
add ecx, dword [rbx + 0x150]
cmp ebp, ecx
jge 0x14010b51a
mov eax, ebp
mov rcx, rbx
cdq
idiv dword [rbx + 0x150]
mov rax, qword [rbx]
mov r14d, edx
call qword [rax + 0x4f8]
test eax, eax
jne 0x14010b4d3
mov eax, dword [rbx + 0x150]
inc ebp
add eax, dword [rbx + 0x154]
cmp ebp, eax
jl 0x14010b4a3
jmp 0x14010b51a
mov r8, qword [rbx]
mov edx, r14d
mov rcx, rbx
mov dword [rbx + 0x3b8], 1
call qword [r8 + 0x428]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x420]
mov rcx, rax
call fcn.14001f1ac
mov r8, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x154]
call qword [r8 + 0x4e0]
mov dword [rbx + 0x3b8], edi
mov eax, 1
jmp 0x14010b647
mov ecx, dword [rbx + 0x154]
lea ebp, [rcx - 1]
add ebp, dword [rbx + 0x150]
cmp ebp, ecx
jle 0x14010b51a
mov eax, ebp
mov rcx, rbx
cdq
idiv dword [rbx + 0x150]
mov rax, qword [rbx]
mov r14d, edx
call qword [rax + 0x4f8]
test eax, eax
jne 0x14010b55f
dec ebp
cmp ebp, dword [rbx + 0x154]
jg 0x14010b537
jmp 0x14010b51a
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
mov dword [rbx + 0x3b8], 1
call qword [rax + 0x428]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x420]
mov rcx, rax
call fcn.14001f1ac
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x154]
call qword [rax + 0x4e0]
jmp 0x14010b514
cmp eax, 0x200
jb 0x14010b619
cmp eax, 0x202
jbe 0x14010b5c9
cmp eax, 0x203
jbe 0x14010b619
cmp eax, 0x205
jbe 0x14010b5c9
add eax, 0xfffffdf9
cmp eax, 1
ja 0x14010b619
mov rcx, qword [rbx + 0x1c0]
mov r14d, 0x407
test rcx, rcx
je 0x14010b5f4
cmp qword [rcx + 0x40], rdi
je 0x14010b5f4
mov rcx, qword [rcx + 0x40]
mov r9, rbp
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x1b8]
test rcx, rcx
je 0x14010b619
cmp qword [rcx + 0x40], rdi
je 0x14010b619
mov rcx, qword [rcx + 0x40]
mov r9, rbp
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rbp + 8], 0x203
jne 0x14010b63c
lea rax, [rbx + 0x3208]
test rax, rax
je 0x14010b632
mov rdi, qword [rax + 0x40]
cmp qword [rbp], rdi
je 0x14010b51a
mov rdx, rbp
mov rcx, rbx
call fcn.1400b11b8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14011aff8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
mov rax, qword [0x1402809a0]
xor rax, rbp
mov qword [rbp], rax
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r12, rcx
test rdx, rdx
jne 0x14011b03c
xor eax, eax
jmp 0x14011b169
test r8, r8
je 0x14011b035
call fcn.140036c74
mov r8, rdi
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14011b035
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14011b035
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14011b18f
mov rcx, rax
call fcn.14019d0a0
lea r15d, [rax + 1]
lea ecx, [r15 + r15]
movsxd r8, ecx
lea rdx, [r8 + 0x10]
cmp r8, rdx
sbb rcx, rcx
test rdx, rcx
je 0x14011b122
lea rcx, [r8 + 0x10]
cmp r8, rcx
sbb rax, rax
and rax, rcx
cmp rax, 0x400
lea rax, [r8 + 0x10]
ja 0x14011b100
cmp r8, rax
sbb rcx, rcx
and rcx, rax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14011b0de
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140194e40
sub rsp, rax
lea rdi, [rsp + 0x20]
test rdi, rdi
je 0x14011b195
mov dword [rdi], 0xcccc
jmp 0x14011b11c
cmp r8, rax
sbb rcx, rcx
and rcx, rax
call fcn.1401a2968
mov rdi, rax
test rax, rax
je 0x14011b125
mov dword [rax], 0xdddd
add rdi, 0x10
jmp 0x14011b125
mov rdi, rbx
test rdi, rdi
je 0x14011b195
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call fcn.140013844
test rax, rax
je 0x14011b14d
mov rdx, rax
mov rcx, r12
call fcn.14011d7bc
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rdi - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14011b167
call fcn.14019cdc4
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140194eb0
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop rbp
ret
call fcn.14001240c
int3
call fcn.14001240c
int3