joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401315a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x1401315b6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x1401e22c0]
not ecx
cmp r10d, 8
jb 0x1401316a8
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1401315e0
test r10d, r10d
je 0x1401316d0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x1401316b0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret

Function at 0x140131ff0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov rsi, r9
imul edi, r8d
mov rbp, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x140132048
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x30]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140132042
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x30]
jmp 0x14013207c
mov ecx, dword [r9 + 0x24]
mov edx, dword [r9 + 0x20]
mov qword [rsp + 0x48], rbx
lea eax, [rcx + rdi]
cmp eax, edx
jbe 0x140132060
mov edi, edx
sub edi, ecx
mov rdx, rcx
mov r8d, edi
add rdx, qword [r9 + 0x18]
mov rcx, r10
call fcn.14018e300
add dword [rsi + 0x24], edi
mov rbx, qword [rsp + 0x48]
mov eax, edi
xor edx, edx
div rbp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401320a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x48
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x70], rbp
mov rbx, rcx
mov qword [rsp + 0x40], rdi
mov edi, 1
je 0x1401320ff
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x34]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401320f9
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x34]
jmp 0x140132136
mov qword [rsp + 0x78], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x140132115
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x30]
mov ebp, edi
call fcn.14018e300
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x78]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x40]
cmp ebp, 1
mov rbp, qword [rsp + 0x70]
jne 0x140132164
movzx eax, byte [rsp + 0x30]
mov dword [r14], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x48
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x14013214d
cmp byte [rbx + 0x10], 0
je 0x14013214d
or eax, 0xffffffff
jmp 0x14013214f

Function at 0x1401333a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rdx
mov rdi, rcx
jne 0x140133435
cmp dword [rcx + 8], 0xffffffff
jne 0x140133435
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x13c]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
nop
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1401333e0
mov eax, dword [0x140203598]
lea r9, [rsp + 0x48]
mov rcx, rsi
mov dword [rbx], eax
call fcn.140131ed0
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x140133419
mov eax, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call fcn.1401323e0
mov qword [rdi], rax
mov eax, dword [0x1402791b8]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0x1000000
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140133910
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x450
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rsi, rdx
mov rbx, rcx
test ax, ax
je 0x140133a19
mov qword [rsp + 0x470], rdi
mov rcx, rdx
mov rdi, rdx
nop
cmp ax, 0x2f
je 0x14013395c
cmp ax, 0x5c
jne 0x14013395f
mov rdi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140133950
cmp rdi, rdx
je 0x1401339a8
sub rdi, rdx
lea rcx, [rsp + 0x20]
sar rdi, 1
mov r8, rdi
call fcn.14019c54c
add rdi, rdi
cmp rdi, 0x208
jae 0x140133a3a
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + rdi + 0x20], ax
call fcn.140133910
lea rcx, [rsp + 0x230]
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1401339c0
lea rcx, [rsp + 0x230]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1401339e0
xor edx, edx
nop dword [rax]
movzx eax, word [rsi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1401339f0
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rsi
ret
call fcn.14018626c
int3
Function at 0x140138b50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rdx + 0x18], 8
mov rbx, rcx
jb 0x140138b76
mov rdx, qword [rdx]
xor edi, edi
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp word [rdx], di
jne 0x140138b95
mov r8d, edi
jmp 0x140138baa
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140138ba0
lea rcx, [rsp + 0x30]
call fcn.140003290
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
lea r9, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
cmovae rdx, qword [rsp + 0x30]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rsp + 0x48]
test eax, eax
sete bl
cmp r8, 8
jb 0x140138c06
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
inc r8
call fcn.140003900
test bl, bl
sete al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14013e1c0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rdi, eax
mov rcx, 0xffffffffffffffff
mov eax, 8
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.140185afc
mov rdx, rax
mov ecx, edi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
test eax, eax
jne 0x14013e220
mov rcx, rsi
call fcn.140185a84
jmp 0x14013e2e3
xor ecx, ecx
mov qword [rsp + 0x68], rbp
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbp, rax
test rax, rax
je 0x14013e2de
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r14
xor r14d, r14d
mov ebx, r14d
test rdi, rdi
je 0x14013e2be
nop
mov rcx, qword [rsi + rbx*8]
mov edx, 2
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
test rax, rax
je 0x14013e2b6
xor eax, eax
mov word [rsp + 0x28], r14w
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x2a], rax
mov qword [rsp + 0x32], rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x14013e2b6
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], r14d
lea rdx, [0x140211738]
lea rcx, [rsp + 0x28]
call fcn.1400b6a00
mov r8d, dword [rsp + 0x20]
test r8, r8
je 0x14013e2b6
mov rdx, qword [rsi + rbx*8]
xor r9d, r9d
call fcn.14013e7a0
inc rbx
cmp rbx, rdi
jb 0x14013e250
mov rcx, rsi
call fcn.140185a84
mov edx, 2
mov rcx, rbp
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140144090
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
add ecx, 0xfffffffe
mov qword [0x1402791c8], r8
mov rdi, rdx
cmp ecx, 0xa
ja case.0x1401440c4.4
movsxd rax, ecx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1441e4]
add rcx, rdx
jmp rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.4
or qword [0x1402791d0], 1
jmp case.0x1401440c4.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.9
or qword [0x1402791d0], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.4
or qword [0x1402791d0], 0x10
jmp case.0x1401440c4.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.8
or qword [0x1402791d0], 4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.4
or qword [0x1402791d0], 8
jmp case.0x1401440c4.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je 0x140144151
or qword [0x1402791d0], 4
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.3
or qword [0x1402791d0], 8
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
test rax, rax
je case.0x1401440c4.4
or qword [0x1402791d0], 2
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbx, rax
test rax, rax
je 0x1401441d9
test rdi, rdi
je 0x1401441d9
mov rdx, qword [0x1402791d0]
test rdx, rdx
je 0x1401441a4
mov rcx, rax
call fcn.140144460
mov rdx, rdi
mov rcx, rbx
call fcn.140144310
mov rdx, rdi
mov rcx, rbx
call fcn.1401443d0
mov rdx, qword [0x1402791d0]
test rdx, rdx
je 0x1401441ce
mov rcx, rbx
call fcn.1401444e0
mov qword [0x1402791d0], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140144210
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rbp, rdx
mov edi, ecx
cmp ecx, 0xffffffff
jne 0x140144231
xor al, al
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rsi, rax
test rax, rax
jne 0x140144256
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp edi, 7
jne 0x14014426a
lea ebx, [rdi - 6]
jmp 0x1401442ea
cmp edi, 8
jne 0x140144274
lea ebx, [rdi - 6]
jmp 0x1401442ea
cmp edi, 0xb
jne 0x14014427e
lea ebx, [rdi - 7]
jmp 0x1401442ea
cmp edi, 9
jne 0x140144288
lea ebx, [rdi - 1]
jmp 0x1401442ea
cmp edi, 0xa
jne 0x140144292
lea ebx, [rdi + 6]
jmp 0x1401442ea
cmp edi, 0xd
jne 0x14014429c
lea ebx, [rdi + 0x13]
jmp 0x1401442ea
test rbp, rbp
jne 0x1401442a5
xor al, al
jmp 0x1401442f7
mov rdx, qword [0x1402791d0]
test rdx, rdx
je 0x1401442b9
mov rcx, rax
call fcn.140144460
mov rdx, rbp
mov rcx, rsi
call fcn.140144310
mov rdx, rbp
mov rcx, rsi
call fcn.1401443d0
mov rdx, qword [0x1402791d0]
test rdx, rdx
je 0x1401442e3
mov rcx, rsi
call fcn.1401444e0
mov qword [0x1402791d0], rbx
or qword [0x1402791d0], rbx
test rbx, rbx
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14014cb00
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
test cx, cx
jne 0x14014cb16
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
shr rax, 8
movzx eax, al
dec rax
cmp rax, 7
ja case.0x14014cb48.3
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x14cbd8]
add rax, rcx
jmp rax
cmp edi, 2
sete bl
add ebx, 2
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edi, 2
sete bl
add ebx, 5
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edi, 2
sete bl
add ebx, 8
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, 9
mov eax, 0xb
cmp edi, 2
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, 0xa
mov eax, 0xc
cmp edi, 2
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, InitCommonControls
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14014cc00
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cc20
mov eax, 2
add rsp, 0x28
ret
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 3
add rsp, 0x28
ret

Function at 0x14014cc40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cc60
mov eax, 8
add rsp, 0x28
ret
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 9
add rsp, 0x28
ret
Function at 0x14014cc80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cca0
mov eax, 5
add rsp, 0x28
ret
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 6
add rsp, 0x28
ret

Function at 0x14014ccc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cce6
mov edi, 2
jmp 0x14014ccfe
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb edi, edi
and edi, 3
mov ecx, 0xa4
mov qword [rsp + 0x30], rsi
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cd1c
mov esi, 8
jmp 0x14014cd34
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cd4d
mov eax, 5
jmp 0x14014cd65
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 6
test edi, edi
je 0x14014cd7d
mov dword [rbx], edi
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test esi, esi
je 0x14014cd95
mov dword [rbx], esi
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test eax, eax
je 0x14014cdad
mov dword [rbx], eax
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov dword [rbx], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14014cdd0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov qword [rsp + 0x38], rsi
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cdf7
mov esi, 2
jmp 0x14014ce0f
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 3
mov ecx, 0xa4
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014ce2d
mov ebx, 8
jmp 0x14014ce45
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ebx, ebx
and ebx, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014ce5e
mov ecx, 5
jmp 0x14014ce76
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ecx, ecx
and ecx, 6
lea eax, [rsi - 2]
mov rsi, qword [rsp + 0x38]
cmp eax, 1
jbe 0x14014ceb7
test ebx, ebx
je 0x14014ce96
mov dword [rdi], ebx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test ecx, ecx
je 0x14014cea9
mov dword [rdi], ecx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov dword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14014ced0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cefb
mov esi, 2
jmp 0x14014cf13
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 3
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cf2c
mov ebx, 8
jmp 0x14014cf44
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ebx, ebx
and ebx, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014cf5d
mov eax, 5
jmp 0x14014cf75
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 6
cmp ebx, 9
jne 0x14014cf93
mov dword [rdi], 0
lea eax, [rbx - 8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test ebx, ebx
je 0x14014cfab
mov dword [rdi], ebx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test eax, eax
je 0x14014cfc3
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test esi, esi
je 0x14014cfdb
mov dword [rdi], esi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14014cff0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d01b
mov ebx, 2
jmp 0x14014d033
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ebx, ebx
and ebx, 3
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d04c
mov esi, 8
jmp 0x14014d064
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d07d
mov eax, 5
jmp 0x14014d095
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 6
cmp esi, 8
je 0x14014d0e4
cmp ebx, 5
je 0x14014d0e4
test ebx, ebx
je 0x14014d0b7
mov dword [rdi], ebx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 5
je 0x14014d0d0
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], esi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
mov dword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14014d100
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d12b
mov ebx, 2
jmp 0x14014d143
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ebx, ebx
and ebx, 3
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d15c
mov esi, 8
jmp 0x14014d174
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x14014d18d
mov eax, 5
jmp 0x14014d1a5
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb eax, eax
and eax, 6
cmp esi, 9
je 0x14014d1f3
cmp ebx, 3
je 0x14014d1f3
test ebx, ebx
je 0x14014d1c7
mov dword [rdi], ebx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test eax, eax
je 0x14014d1df
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], esi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
mov dword [rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14014e420
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov edi, 0xffff
cmp di, dx
jne 0x14014e471
xor eax, eax
cmp dx, di
cmovne ax, dx
jmp 0x14014e654
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14014e4ae
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14014e4ae
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x14014e654
cmp qword [rcx + 0x80], 0
je 0x14014e651
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14014e4ed
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x68], 0
jne 0x14014e516
mov rdx, qword [rbx + 0x80]
movzx ecx, r14w
call fcn.14019cea4
cmp ax, di
je 0x14014e651
movzx edi, r14w
jmp 0x14014e651
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], InitCommonControls
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.140150990
nop
mov r9, qword [rbp + 0x1f]
lea rdx, [rbp + 7]
cmp r9, 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x68]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x74]
call qword [r10 + 0x38]
test eax, eax
js 0x14014e636
cmp eax, 1
jg 0x14014e618
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov rsi, qword [rbp - 0x11]
sub rsi, rax
je 0x14014e5e0
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
call fcn.14019c7d4
mov r9, qword [rbp + 0x1f]
cmp rsi, rax
jne 0x14014e63a
mov byte [rbx + 0x72], 1
lea rax, [rbp - 1]
cmp qword [rbp - 9], rax
jne 0x14014e612
test rsi, rsi
jne 0x14014e540
cmp qword [rbp + 0x17], 0x20
jae 0x14014e63a
xor r8d, r8d
lea edx, [rsi + 8]
lea rcx, [rbp + 7]
call fcn.14012ab10
jmp 0x14014e53c
movzx edi, r14w
jmp 0x14014e63a
cmp eax, 3
jne 0x14014e636
mov rdx, qword [rbx + 0x80]
movzx ecx, word [rbp - 1]
call fcn.14019cea4
cmp ax, di
je 0x14014e636
movzx edi, r14w
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
jb 0x14014e651
lea r8, [r9 + 1]
mov rdx, qword [rbp + 7]
lea rcx, [rbp + 7]
call fcn.140126d00
movzx eax, di
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret