joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001548
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400aa678]
lea rdx, str.AutoIt_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400aa678]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, str.edit
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400aa668], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400aa668]
xor edx, edx
mov qword [0x1400aa660], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400aa668]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x140002990
Capabilities:
Get token privileges

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax + 0x18], 0
xor ebx, ebx
xor dil, dil
and dword [rax + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x90]
lea edx, [rbx + 8]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400029f7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x90]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002b2e
mov rsi, qword [rsp + 0x90]
xor r9d, r9d
lea rax, [rsp + 0x88]
lea ebp, [r9 + 3]
xor r8d, r8d
mov rcx, rsi
mov edx, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140002a87
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002b2e
mov ebx, dword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbp + 5]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140002b2e
mov r9d, dword [rsp + 0x88]
lea rax, [rsp + 0x88]
mov r8, rbx
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140002b2e
lea r8, [rsp + 0x30]
lea rdx, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002b2e
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x3c]
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002b2e
and dword [rsp + 0x44], 0
xor esi, esi
lea edi, [rsi + 1]
cmp dword [rbx], esi
jbe 0x140002b12
lea rcx, [rsi + rsi*2]
lea rbp, [rsp + 0x38]
lea r12, [rsp + 0x30]
lea r14, [rbx + rcx*4 + 4]
mov r13d, 2
mov r8d, 8
mov rdx, r12
mov rcx, r14
call fcn.140076100
test eax, eax
jne 0x140002aff
mov dword [rbp], edi
add r12, 0xc
add rbp, 0xc
sub r13, rdi
jne 0x140002ae7
add esi, edi
cmp esi, dword [rbx]
jb 0x140002ace
xor ecx, ecx
lea rax, [rsp + 0x38]
cmp dword [rax], 0
je 0x140002b2b
add ecx, edi
add rax, 0xc
cmp ecx, 2
jb 0x140002b19
jmp 0x140002b2e
xor dil, dil
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140002b41
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140002b5a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov al, dil
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002f3c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
xor r10d, r10d
mov rbp, r9
mov r12, r8
mov qword [rax - 0x20], r10
mov eax, dword [rsp + 0xb0]
lea ebx, [r10 + 1]
mov r13, rdx
test bl, al
je 0x140002f77
mov edi, ebx
jmp 0x140002f84
mov ecx, 2
mov edi, r10d
test cl, al
cmovne edi, ecx
xor sil, sil
test al, 4
je 0x140002fd1
and qword [rsp + 0x60], r10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov r8d, ebx
call sub.USERENV.dll_CreateEnvironmentBlock
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140003037
mov r10, qword [rsp + 0x68]
mov rax, qword [rsp + 0xe0]
mov ecx, dword [rsp + 0xc8]
mov r9d, edi
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
bts ecx, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov r8, rbp
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003046
call sub.USERENV.dll_DestroyEnvironmentBlock
lea r11, [rsp + 0x70]
mov al, sil
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x140003328
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rbp, r9
mov r12, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rdi]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rax
mov r9, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsi + 0x10]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r11, qword [r12]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140003410]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsi + 8], r11
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140003bb0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, qword [rcx]
mov r8b, 1
mov rdi, rcx
call fcn.140006220
xor edx, edx
test ebx, ebx
lea ebx, [rdx + 0x25]
mov ecx, ebx
jns 0x140003c0d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8, rbx
shl eax, 0x10
mov edx, 0x100
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8, rbx
jmp 0x140003c49
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov rcx, qword [rdi]
shl eax, 0x10
mov edx, 0x101
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140004268
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbp, r9
xor r9d, r9d
mov r14, rcx
mov rcx, qword [rcx]
mov r13, rdx
mov r12, r8
lea edx, [r9 + 0xe]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rsi, rax
cmp eax, ebx
jne 0x1400042b1
xor al, al
jmp 0x140004317
lea ecx, [rax + 0x101]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov rcx, qword [r14]
lea r8d, [rsi + 1]
mov r9, rax
mov edx, reloc.WSOCK32.dll_listen
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rbx
je 0x14000430d
cmp dword [rbp], esi
je 0x1400042fb
mov eax, dword [rbp]
mov word [rdi + rax*2], bx
mov eax, dword [r12]
mov rcx, r13
lea rdx, [rdi + rax*2]
call fcn.1400026d8
mov bl, 1
mov rcx, rdi
call fcn.140075884
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140006038
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
lea rdx, [0x1400956d0]
mov rcx, r8
mov rbp, r8
call fcn.1400026d8
mov r8b, 1
mov rdx, rdi
mov rcx, rsi
call fcn.140006220
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rsi + 0x1a8], rax
test rax, rax
jne 0x1400060c7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor al, al
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp rax, rdi
je 0x1400060d7
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x1400060c2
jmp 0x140006087
mov rdx, qword [rsi + 0x1a8]
mov rcx, rsi
call fcn.140005598
mov rcx, qword [rsi + 0x1a8]
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov qword [rsi + 0x1a0], rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x118]
call fcn.1400026d8
and dword [rsi + 0x238], 0
lea rdx, [0x140006184]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov r9d, dword [rsi + 0x238]
mov r8, qword [rsi + 0x118]
lea rdx, str._s_d
lea rcx, [rsp + 0x20]
call fcn.14007659c
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400026d8
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov al, 1
jmp 0x1400060a9

Function at 0x140006220
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rcx, rdx
cmp r8b, 1
jne 0x14000627a
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], 0x1388
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140006297
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x14000628d
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x40
pop rbx
ret
Function at 0x1400065dc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rdx
mov r13, rcx
lea rdx, [0x1400956d0]
mov rcx, rbp
call fcn.1400026d8
mov rcx, r13
call fcn.140006500
xor esi, esi
cmp al, sil
je 0x14000661f
xor al, al
jmp 0x1400066aa
mov rcx, qword [r13]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, 0xffffffffffffffff
mov rdi, rax
mov eax, 0x7fff
cmp rdi, rsi
cmove rdi, rax
mov eax, 2
lea rbx, [rdi + 1]
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov rcx, qword [r13]
mov r8, rbx
mov r9, rax
mov edx, reloc.WSOCK32.dll_listen
mov r12, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov word [r12 + rdi*2], si
mov rcx, rbp
cmp rax, rsi
jne 0x140006694
lea rdx, [0x1400956d0]
call fcn.1400026d8
jmp 0x14000669f
mov rdx, r12
call fcn.1400026d8
mov sil, 1
mov rcx, r12
call fcn.140075884
mov al, sil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140008a9c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x220
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp rax, rdi
je 0x140008b31
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test byte [rbx + 0x10], 1
je 0x140008af0
cmp word [rsp + 0x20], di
jne 0x140008af0
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x140008b31
movsd xmm0, qword [rbx + 0x18]
comisd xmm0, xmmword [0x14009da88]
jbe 0x140008b11
mov rcx, qword [rbx + 0x88]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x20]
call fcn.1400026d8
mov rcx, qword [rbx + 0x88]
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rdi
ret
Function at 0x14000bbe4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r12d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r12 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
lea ecx, [r12 + r12]
movsxd rbx, ecx
mov rcx, qword [rsi]
mov rbp, rax
lea rdx, [rdi + rcx]
mov r8, rbx
mov rcx, rax
call fcn.1400753d0
add qword [rsi], rbx
xor eax, eax
cmp r12d, eax
movsxd r11, r12d
mov word [rbp + r11*2], ax
jle 0x14000bc77
mov rax, rbp
mov rcx, r12
xor word [rax], r12w
add rax, 2
sub rcx, 1
jne 0x14000bc69
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x14000cc4c
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x30
and dword [rcx + 0x18], 0
and qword [rcx + 0x10], 0
mov eax, 5
mov dword [rcx], eax
mov dword [rcx + 4], eax
mov rdi, rcx
mov byte [rcx + 8], 1
mov byte [rcx + 9], 0
mov dword [rcx + 0x30], RegisterTypeLib
lea ecx, [rax + 0x56]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x10]
mov byte [rdi + 0x2d], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [rdi + 0x30]
xor edx, edx
mov byte [rdi + 0x2a], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, RegisterTypeLib
mov byte [rdi + 0x2b], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x11]
mov byte [rdi + 0x2c], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x12]
mov byte [rdi + 0x28], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [rsp + 0x20]
mov byte [rdi + 0x29], al
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov ebx, 1
lea rbp, [0x1400a87a8]
mov cl, byte [rbx + rbp]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
jne 0x14000cd00
mov byte [rbx + rbp], SafeArrayAllocDescriptor
inc rbx
cmp rbx, 7
jle 0x14000cce6
lea rdx, str.0409
lea rcx, [rsp + 0x24]
call fcn.140077180
test eax, eax
jne 0x14000cd4e
lea r8d, [rax + 4]
lea rdx, str.0002
lea rcx, [rsp + 0x20]
call fcn.140077240
mov byte [0x1400a87aa], 0x20
mov byte [0x1400a87ad], 0x20
test eax, eax
je 0x14000cde5
jmp 0x14000cdd0
lea rdx, str.0809
lea rcx, [rsp + 0x24]
call fcn.140077180
test eax, eax
jne 0x14000cd6c
mov byte [0x1400a87aa], 0x20
jmp 0x14000cdc9
lea rdx, [0x140096608]
lea rcx, [rsp + 0x26]
call fcn.140077180
test eax, eax
jne 0x14000cd8a
mov byte [0x1400a87ad], 0x20
jmp 0x14000cdde
lea rdx, [0x14009660c]
lea rcx, [rsp + 0x26]
call fcn.140077180
test eax, eax
je 0x14000cd63
lea rdx, [0x140096610]
lea rcx, [rsp + 0x26]
call fcn.140077180
test eax, eax
je 0x14000cdde
lea rdx, [0x140096614]
lea rcx, [rsp + 0x26]
call fcn.140077180
test eax, eax
jne 0x14000cde5
mov byte [0x1400a87ad], 0x20
mov byte [0x1400a87ae], 0x20
mov byte [0x1400a87ab], 0x20
mov byte [0x1400a87ac], 0x20
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14000cdf8
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
or edx, 0xffffffff
mov rcx, rax
mov rbx, r8
call fcn.140013b14
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
xor esi, esi
xor r13b, r13b
mov rbp, rax
xor r14d, r14d
mov qword [rdi + 0x20], rbx
call fcn.14000d090
mov rcx, rbp
call fcn.1400768c0
lea rcx, [rax + 1]
call fcn.140075b98
cmp byte [rdi + 8], 1
mov r12, rax
jne 0x14000ce75
lea edx, [rsi + 0x14]
xor r8d, r8d
mov rcx, rdi
call fcn.14000d1d4
mov rcx, rdi
mov r13b, al
call fcn.14000d5d0
mov r14d, eax
mov bl, byte [rbp]
jmp 0x14000cf43
inc esi
mov dword [rsp + 0x60], esi
cmp bl, 0x21
je 0x14000cf39
cmp bl, 0x23
je 0x14000cf33
cmp bl, 0x2b
je 0x14000cf2d
cmp bl, 0x5e
je 0x14000cf27
mov rcx, rdi
cmp bl, 0x7b
je 0x14000cecd
call fcn.14000e8a0
mov r8d, 1
mov dl, bl
mov rcx, rdi
call fcn.14000d270
and dword [rdi + 0x18], 0x3f00
jmp 0x14000cf3d
lea rax, [rsp + 0x60]
mov r9, r12
mov r8, rbp
mov dl, 0x7d
mov qword [rsp + 0x20], rax
call fcn.14000e5f4
test eax, eax
je 0x14000cefa
mov r8d, 1
mov dl, 0x7b
mov rcx, rdi
call fcn.14000d270
jmp 0x14000cf3d
mov rcx, r12
call fcn.1400768c0
test rax, rax
je 0x14000cf21
mov rcx, rdi
call fcn.14000e8a0
mov rdx, r12
mov rcx, rdi
call fcn.14000df9c
and dword [rdi + 0x18], 0x3f00
mov esi, dword [rsp + 0x60]
jmp 0x14000cf3d
or dword [rdi + 0x18], 8
jmp 0x14000cf3d
or dword [rdi + 0x18], 2
jmp 0x14000cf3d
or dword [rdi + 0x18], 0x10
jmp 0x14000cf3d
or dword [rdi + 0x18], 1
movsxd rax, esi
mov bl, byte [rax + rbp]
test bl, bl
jne 0x14000ce7d
cmp byte [rdi + 8], 1
jne 0x14000cf6c
mov edx, r14d
mov rcx, rdi
call fcn.14000d88c
mov r8b, r13b
mov edx, reloc.WSOCK32.dll_sendto
mov rcx, rdi
call fcn.14000d1d4
mov rcx, rbp
call fcn.140075884
mov rcx, r12
call fcn.140075884
mov rdx, qword [rdi + 0x20]
xor r8d, r8d
mov rcx, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
jmp fcn.14000d090
Function at 0x14000d090
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13b, r8b
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14000d0bf
cmp byte [rcx + 9], dl
je 0x14000d1b9
xor r12d, r12d
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
test r13b, r13b
je 0x14000d170
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea r8d, [r12 + 1]
mov ecx, ebx
mov edx, eax
mov dword [0x1400bd848], eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r13d, eax
test rdi, rdi
je 0x14000d149
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [0x1400bd848]
mov dword [0x1400bd844], eax
cmp ecx, eax
je 0x14000d137
lea r8d, [r12 + 1]
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r12d, eax
mov eax, dword [0x1400bd844]
mov r8d, 1
mov edx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov ebp, eax
test r13d, r13d
jne 0x14000d1b9
test r12d, r12d
jne 0x14000d1b9
test ebp, ebp
jne 0x14000d1b9
mov eax, dword [0x1400bd848]
cmp ebx, eax
jne 0x14000d1b9
cmp eax, dword [0x1400bd844]
jne 0x14000d1b9
and qword [rsi + 0x20], 0
jmp 0x14000d1b9
test rdi, rdi
je 0x14000d1a4
mov edx, dword [0x1400bd844]
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r11d, dword [0x1400bd848]
mov edx, dword [0x1400bd844]
cmp r11d, edx
je 0x14000d1ab
xor r8d, r8d
mov ecx, r11d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r11d, dword [0x1400bd848]
xor r8d, r8d
mov edx, r11d
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x14000d1d4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, edx
mov bl, r8b
mov ebp, edx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
and dil, 1
cmp bl, dil
je 0x14000d258
xor edx, edx
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov dl, al
mov cl, bpl
call qword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [rsi + 4]
test edx, edx
je 0x14000d22e
mov rcx, rsi
call fcn.14000e654
xor edx, edx
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, bpl
lea r8d, [r9 + 2]
mov dl, al
call qword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [rsi]
test edx, edx
je 0x14000d258
mov rcx, rsi
call fcn.14000e654
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret
Function at 0x14000d270
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov cl, dl
mov esi, r8d
mov bpl, dl
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov rcx, rbx
movsx edi, ax
cmp edi, 0xffffffff
jne 0x14000d2aa
mov dl, bpl
call fcn.14000d2f8
jmp 0x14000d2e1
mov edx, edi
call fcn.14000d3c0
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.14000d88c
test esi, esi
je 0x14000d2d6
movzx edi, dil
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.14000dd04
sub esi, 1
jne 0x14000d2c4
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.14000dacc
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret