joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d2060
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.1800f8180
nop
lea rcx, [rsp + 0x48]
call fcn.1800f3cf0
xor ebp, ebp
test al, al
jne 0x1801d20b1
xor dil, dil
jmp 0x1801d21a3
mov qword [rsp + 0x30], rbp
mov ecx, 8
call fcn.18022a7fc
mov qword [rsp + 0x40], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.180109b00
mov rbx, qword [rsp + 0x30]
test al, al
je 0x1801d2173
mov rdi, rbp
test rbx, rbx
je 0x1801d2173
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x1801d211b
xor sil, sil
jmp 0x1801d214a
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1801d213c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1801d213c
xor sil, sil
jmp 0x1801d214a
mov edi, dword [rsp + 0x40]
shl rdi, 0x20
add rdi, rsi
mov sil, 1
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1801d2164
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1801d2164
mov qword [rbx], 0xffffffffffffffff
test sil, sil
je 0x1801d2173
test rdi, rdi
je 0x1801d2173
mov dil, 1
jmp 0x1801d2176
xor dil, dil
test rbx, rbx
je 0x1801d21a3
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1801d2191
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov edx, 8
mov rcx, rbx
call fcn.18022acec
mov qword [rsp + 0x30], rbp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1801d21e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801d21e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801d21e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801d51f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1801d5266
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x1801d5289
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1801d5266
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1801d5295
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180007110
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1801d52bd
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x1801d5268

Function at 0x1801d58d0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x90
xor eax, eax
mov rbx, r9
mov qword [r11 - 0x44], rax
mov rdi, r8
mov qword [r11 - 0x3c], rax
mov rsi, rdx
mov qword [r11 - 0x34], rax
mov rbp, rcx
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov qword [r11 - 0x1c], rax
mov dword [r11 - 0x14], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x20], WSAStartup
test rax, rax
jne 0x1801d5937
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x88], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1801d5981
cmp qword [rsp + 0x58], 0x20
seta al
jmp 0x1801d5998
mov rbx, qword [rsp + 0xc0]
test rbx, rbx
je 0x1801d5996
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1801d67c0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1801d67dd
jmp 0x1801d68fc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1801d680c
mov edx, 9
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x40], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x2000
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [rsp + 0x40], 0x64
jb 0x1801d6846
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x48], eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x44], eax
mov r8d, 1
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xfffffffffffffffe
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x68
ret
Function at 0x1801d8610
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
cmp qword [0x18032a010], rdi
jne 0x1801d869b
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rsp + 0x30]
mov word [rsp + 0x236], di
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x1801d8680
lea rdx, [rsp + 0x30]
lea rcx, [section..data]
call fcn.180007110
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x1801d8740
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov eax, dword [0x180331794]
test eax, eax
jle 0x1801d878e
inc eax
mov dword [0x180331794], eax
mov al, 1
jmp 0x1801d88ad
xor sil, sil
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x30]
call fcn.18010e400
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.18010f4e0
movzx ebx, al
lea rcx, [rsp + 0x30]
call fcn.18010e480
test bl, bl
je 0x1801d8899
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1801d8899
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x28]
call rax
test eax, eax
je 0x1801d8890
inc dword [0x180331794]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1801d881c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rsp + 0x28], rbp
mov sil, 1
cmp qword [0x18032a030], 0
jne 0x1801d8890
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov word [rsp + 0x246], bp
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1801d8874
lea rdx, [rsp + 0x40]
lea rcx, [0x18032a020]
call fcn.180007110
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1801d88a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18022a7d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1801d88e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1801d894e
mov eax, dword [rsp + 0x24]
cmp eax, 5
ja 0x1801d8934
jne 0x1801d894e
cmp dword [rsp + 0x28], 0
jbe 0x1801d894e
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret

Function at 0x1801d8970
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1801d89ca
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret

Function at 0x1801d89f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1801d8a5e
mov eax, dword [rsp + 0x24]
cmp eax, 6
ja 0x1801d8a44
jb 0x1801d8a5e
cmp dword [rsp + 0x28], 1
jb 0x1801d8a5e
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x158
ret
Function at 0x1801db4d8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x430
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r14, rdx
call fcn.1801dc1a8
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1801e2ed8
nop
call fcn.1801dc1b0
mov rdi, rax
mov rcx, rax
call fcn.1801e3a78
xor ebx, ebx
lea rcx, [rsp + 0x40]
test al, al
je 0x1801db570
mov rdx, r14
call fcn.1801e32a8
lea rcx, [rsp + 0x40]
call fcn.180087940
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801db6ac
mov dil, 1
jmp 0x1801db6a9
mov rdx, rdi
call fcn.1801e3280
call fcn.1801dc4e4
test al, al
je 0x1801db58b
call fcn.1801dc1b8
mov rsi, rax
jmp 0x1801db5e2
call fcn.1801dc1c0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1801e2ed8
nop
lea rcx, [rbp + 0x60]
call fcn.180087940
mov rcx, rax
xor edx, edx
call fcn.1801e1fc4
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.180087940
mov rcx, rax
mov rdx, rdi
call fcn.1802046b8
mov rsi, rax
test rdi, rdi
je 0x1801db5d9
mov rcx, rdi
call fcn.18022acec
nop
lea rcx, [rbp + 0x60]
call fcn.1801e3048
test rsi, rsi
jne 0x1801db5ef
mov dil, bl
jmp 0x1801db6a9
mov dword [rsp + 0x30], ebx
or r8d, 0xffffffff
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.1801e2f08
nop
lea r8, [0x1802898dc]
lea rdx, [0x18026cd74]
lea rcx, [rbp - 0x30]
call fcn.1801e3cb4
lea rcx, [rbp - 0x30]
call fcn.180087940
mov rdx, rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov dil, 1
mov r8b, dil
mov rcx, rsi
call fcn.1802040b8
test eax, eax
jne 0x1801db69d
mov r15d, dword [rbp + 0x31c]
lea eax, [r15 - 1]
cmp eax, 0x3fffff
ja 0x1801db69d
mov ecx, r15d
call fcn.18022afbc
mov r14, rax
mov r9d, r15d
mov r8, rax
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call fcn.180204bb4
test eax, eax
je 0x1801db6e4
cmp eax, 0x600
je 0x1801db6e4
mov rcx, r14
call fcn.18022acec
call fcn.1801dc4e4
test al, al
jne 0x1801db69d
mov rcx, rsi
call fcn.180203df8
mov dil, bl
lea rcx, [rbp - 0x30]
call fcn.1801e3048
mov bl, dil
lea rcx, [rsp + 0x40]
call fcn.1801e3048
mov al, bl
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.18022a7d0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1801dc4e4
nop
test al, al
jne 0x1801db6f6
mov rcx, rsi
call fcn.180203df8
mov rcx, r14
call fcn.18022acec
jmp 0x1801db6a0
Function at 0x1801dc668
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rdi + 8]
mov ebx, edi
test ax, ax
cmovs ebx, ecx
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1801dc699
or ebx, 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1801dc6ac
or ebx, 2
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1801dc6bf
or ebx, 4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1801dc6d2
or ebx, 0x20
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801dfa44
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea r15, [rcx + 0x530]
mov rbx, rcx
xor r13d, r13d
mov rcx, r15
mov r12, r9
mov r14, r8
mov edi, edx
mov esi, r13d
call fcn.1801e37d8
test eax, eax
jle 0x1801dfac3
mov edx, esi
mov byte [rbp + 0x30], r13b
mov rcx, r15
call fcn.1801e318c
lea rcx, [rbp + 0x30]
mov r9, r12
mov qword [rsp + 0x20], rcx
mov r8, r14
mov edx, edi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rbp + 0x30], r13b
jne 0x1801dfb2c
mov rcx, r15
inc esi
call fcn.1801e37d8
cmp esi, eax
jl 0x1801dfa87
sub edi, 0x100
je 0x1801dfba5
sub edi, 4
je 0x1801dfb30
cmp edi, 2
jne 0x1801dfb85
mov ecx, r14d
mov dword [rbp + 0x30], r13d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov rcx, qword [rbx + 0x160]
lea r8, [rbp + 0x30]
mov word [rbp + 0x30], ax
lea rdx, [0x1801e1de0]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x258]
mov rbx, rax
test rax, rax
je 0x1801dfb85
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x240]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov al, 1
jmp 0x1801dfb87
cmp qword [rbx + 0x168], r13
je 0x1801dfb85
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x190]
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x30], 6
mov word [rbp - 0x14], r14w
call fcn.1801dc668
mov word [rbp - 0x12], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x168]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r14, 9
jne 0x1801dfb85
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1801dfc0d
mov rax, qword [rcx]
call qword [rax + 0x1f0]
test al, al
je 0x1801dfc0d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x208]
test al, al
je 0x1801dfc0d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, str.RichEditUI
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x1801dfc0d
mov rcx, qword [rbx + 0x168]
call fcn.1801ff158
test al, al
jne 0x1801dfb85
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1801dfc5f
mov rax, qword [rcx]
call qword [rax + 0x1f0]
test al, al
je 0x1801dfc5f
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x208]
test al, al
je 0x1801dfc5f
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, str.WkeWebkitUI
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x1801dfb85
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.1801e1684
jmp 0x1801dfb2c
Function at 0x1801e1270
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0xc8]
cmp rax, rcx
je 0x1801e12a1
cmp rbx, qword [rdi + 0x168]
je 0x1801e12a1
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rdi + 0x168]
cmp rbx, rax
je 0x1801e13c0
test rax, rax
je 0x1801e131e
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x17
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
mov rdx, qword [rdi + 0x168]
lea r8, str.killfocus
xor r9d, r9d
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.1801e0d00
and qword [rdi + 0x168], 0
test rbx, rbx
je 0x1801e13c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp rax, rdi
jne 0x1801e13c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1f0]
test al, al
je 0x1801e13c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801e13c0
xor edx, edx
mov qword [rdi + 0x168], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
mov rdx, qword [rdi + 0x168]
lea r8, str.setfocus
mov byte [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.1801e0d00
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1801ecaac
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x728
jmp method.DuiLib::CMenuUI.virtual_632

Function at 0x1801f00c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rcx
call fcn.18002ad20
mov rcx, rax
mov edi, 0xfffffff0
mov edx, edi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
and ebx, 0xff3fffff
or ebx, 0x6000000
mov rcx, rsi
call fcn.18002ad20
mov rcx, rax
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea r14, [rsi + 0x58]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.1801dc238
mov rax, rsi
lea rcx, [rsi + 0x40]
neg rax
sbb rdx, rdx
and rdx, rcx
mov rcx, r14
call fcn.1801db0b0
lea rcx, [rbp + 0xf0]
call fcn.18021496c
nop
mov rax, qword [rsi]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [rax + 0x50]
nop
lea rcx, [rbp - 0x30]
call fcn.1801e3a78
lea rdx, [rsp + 0x40]
mov rcx, rsi
test al, al
mov rax, qword [rsi]
jne 0x1801f01f9
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.180087940
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
movzx ebx, ax
lea rcx, [rsp + 0x40]
call fcn.1801e3048
mov rax, rsi
lea rcx, [rsi + 0x48]
neg rax
sbb rdi, rdi
and rdi, rcx
lea rcx, [rbp - 0x30]
call fcn.180087940
mov r8, rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9, rdi
mov edx, ebx
lea rcx, [rbp + 0xf0]
call fcn.180215a3c
mov rbx, rax
jmp 0x1801f023f
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.180087940
mov rcx, rsi
lea rdx, [rsi + 0x48]
neg rcx
sbb r9, r9
and r9, rdx
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.180215a3c
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1801e3048
test rbx, rbx
jne 0x1801f02a9
or r8d, 0xffffffff
lea rdx, [0x180256170]
lea rcx, [rsp + 0x40]
call fcn.1801e2f08
nop
mov rax, qword [rsi]
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [rax + 0x58]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1801e3280
nop
lea rcx, [rbp + 0x60]
call fcn.1801e3048
lea rcx, [rsp + 0x40]
call fcn.180087940
mov rdx, rax
lea r9d, [rbx + 0x10]
lea r8, str.Duilib
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
mov rcx, r14
call fcn.1801db190
mov rax, rsi
lea r8, [rsi + 0x38]
neg rax
sbb rdx, rdx
and rdx, r8
mov rcx, r14
call fcn.1801dafcc
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + gethostname]
nop
lea rcx, [rbp - 0x30]
call fcn.1801e3048
nop
lea rcx, [rbp + 0xf0]
call fcn.1802136c8
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.18022a7d0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1801f470c
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x18032a080]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1801f47f1
cmp qword [rcx + 0x20], 0
je 0x1801f47f1
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1801f476c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18022b840
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1801f47f1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x1f0
call fcn.1801e3130
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + gethostname]
mov byte [rsp + 0x28], 0
lea r8, str.textchanged
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov rdx, rbx
call fcn.1801e0d00
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, rax
call fcn.1801dc4f4
test al, al
je 0x1801f47f1
mov rcx, qword [rdi + 0x20]
call fcn.1801e5228
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.18022a7d0
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret