joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003beb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov eax, dword [0x140162398]
mov r14d, r8d
and eax, 6
mov r15d, edx
mov rbp, rcx
cmp al, 6
jne 0x14003c142
mov rax, qword [0x140167368]
cmp byte [rax + 0x198], 0
je 0x14003c142
cmp byte [rax + 0x219], 0
je 0x14003c142
add rcx, 0x220
xor r9d, r9d
call fcn.14004fcc4
mov rdi, rax
test rax, rax
je 0x14003c142
cmp byte [rax], 0x3c
je 0x14003c142
or rbx, 0xffffffffffffffff
lea rdx, [0x14013aa80]
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x14003bf38
cmp rdi, rdx
je 0x14003c142
mov rcx, rdi
call fcn.1400fd8f0
test eax, eax
je 0x14003c142
lea rdx, [0x14013aa88]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14003bf62
cmp rdi, rdx
je 0x14003c142
mov r8, rbx
mov rcx, rdi
call fcn.1400fd8f0
test eax, eax
je 0x14003c142
mov rdx, rdi
call fcn.140030c68
mov rsi, rax
test rax, rax
jne 0x14003bfb0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14003c142
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14003c142
call qword [sym.imp.USER32.dll_CreatePopupMenu]
xor r8d, r8d
lea rcx, str.Open_Document
mov rdx, rax
call fcn.14003b1bc
mov r8b, byte [rsi + 0x10]
mov edx, 0x132
mov rcx, rax
mov rbx, rax
call fcn.140084e00
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0xb8]
mov r9d, 1
mov dword [rsp + 0xb8], r15d
xor edx, edx
mov dword [rsp + 0xbc], r14d
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, rbx
call fcn.14003cae4
mov rax, qword [rbp + 0x10]
mov edx, 0x102
and qword [rsp + 0x30], 0
mov rcx, rbx
mov r9d, dword [rsp + 0xbc]
mov r8d, dword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, rbx
mov r14d, eax
call fcn.14003ca1c
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyMenu]
cmp r14d, 0x131
jne 0x14003c09a
mov r8, rbp
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.14005305c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
lea rcx, [rsp + 0x48]
xor al, 1
mov r8b, al
call fcn.140057938
lea rcx, [rsp + 0x48]
call fcn.140053214
jmp 0x14003c142
cmp r14d, 0xd1
jne 0x14003c0d3
mov eax, dword [0x140162398]
shr eax, 1
test al, 1
je 0x14003c142
mov rdx, rdi
lea rcx, str._select___s_
call fcn.1400807a0
mov rdx, rax
lea rcx, str.explorer.exe
call fcn.14008407c
jmp 0x14003c142
cmp r14d, 0x132
jne 0x14003c0e8
cmp byte [rsi + 0x10], 0
sete al
mov byte [rsi + 0x10], al
jmp 0x14003c12c
cmp r14d, 0x133
jne 0x14003c142
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
jbe 0x14003c109
mov rdx, qword [rsi]
mov r8b, 1
call fcn.140030e6c
jmp 0x14003c127
mov rcx, qword [0x140167c00]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rsi
call fcn.140031254
mov rcx, rsi
call fcn.140033c40
call fcn.140031520
mov rcx, qword [rbp + 0x198]
call fcn.140077d08
mov dl, 1
mov rcx, rbp
call fcn.140038e8c
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140048834
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x100
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r12b, dl
mov r15b, r9b
xor edx, edx
mov rsi, r8
mov r14, rcx
call fcn.1400487d8
xor r13d, r13d
test rsi, rsi
je 0x140048a41
cmp byte [rsi], r13b
je 0x140048a41
lea ecx, [r13 + 0x30]
call fcn.1400ebc6c
mov rbx, rax
xor r8d, r8d
lea rax, [0x14013c9c0]
or rdx, 0xffffffffffffffff
mov rcx, rsi
mov byte [rbx + 0x11], r13b
lea rdi, [rbx + 0x18]
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rbx], rax
mov qword [rbx + 0x28], r13
mov qword [rbx + 8], r14
mov byte [rbx + 0x10], r12b
call fcn.140088f60
mov rsi, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
je 0x1400488e5
mov rcx, qword [rdi]
call fcn.1400feb88
mov qword [rdi], rsi
mov esi, r13d
mov qword [rdi + 8], r13
mov rcx, rsi
call fcn.1400feb88
mov byte [rbx + 0x11], r15b
lea rdi, str.findProgress
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x18]
call fcn.14003eb0c
cmp byte [rbp + 0x7f], r13b
je 0x1400489c1
test rax, rax
jne 0x1400489c1
lea rax, str.responseToAction
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x71]
mov rax, qword [rbx + 8]
xorps xmm0, xmm0
mov byte [rsp + 0x58], r13b
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x39], r13
mov rcx, qword [rax + 0x18]
lea rax, [0x14013c9d8]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x31]
mov qword [rbp + 7], rax
mov dword [rsp + 0x5c], r13d
call fcn.140023d98
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140048989
mov rax, qword [rcx]
lea rdx, [rbp - 0x31]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
lea rcx, str.Searching__d_of__d...
call fcn.14006cfcc
lea rcx, [rsp + 0x40]
mov qword [rbp - 0x79], rax
mov qword [rsp + 0x50], rdi
call fcn.14003e8a0
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1400489c1
mov rax, qword [rcx]
lea rdx, [rbp - 0x71]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx + 8]
mov edi, 0x401
xor r9d, r9d
mov r8d, 0x105
mov edx, edi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 0x104
mov edx, edi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 0x108
mov edx, edi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rbx
mov qword [rsp + 0x28], r13
lea r8, [0x14004853c]
mov qword [r14 + 0x318], r13
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 0x318], rax
mov qword [rbx + 0x28], rax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004b7c0
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
call fcn.140038b38
mov rsi, rax
mov rdx, qword [rax + 0xb8]
cmp qword [rdx + 8], 0
jne 0x14004b801
cmp dword [rbx + 0x1b8], 4
je 0x14004b801
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004b801
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14004b91e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004b82d
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rdi, rax
jmp 0x14004b82f
xor edi, edi
lea r8, [rsp + 0x68]
mov byte [rsp + 0x68], 0
lea rdx, [0x140137650]
mov rcx, rsi
call fcn.14004b5a4
mov rbx, rax
test rax, rax
je 0x14004b85f
cmp byte [rax], 0
je 0x14004b85f
mov dl, 1
mov rcx, rax
call fcn.140084710
mov rcx, rbx
call fcn.1400feb88
cmp byte [rsp + 0x68], 0
jne 0x14004b918
test rdi, rdi
je 0x14004b918
mov rbx, qword [rsi + 0xb8]
test rbx, rbx
je 0x14004b918
cmp qword [rbx + 8], 0
je 0x14004b918
cmp dword [rbx + 8], 0
jg 0x14004b8ac
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004b8ac
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rbx, qword [rbx + 0x20]
mov rcx, rdi
mov edx, dword [rbx]
call fcn.140026b30
mov ecx, dword [rdi + 0x90]
lea rdx, [rsp + 0x20]
mov eax, dword [rbx]
and qword [rsp + 0x40], 0
mov dword [rsp + 0x20], eax
lea rax, [rbx + 4]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x24], xmm0
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x38], 2
mov rcx, qword [rdi + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rbx, rax
test rax, rax
je 0x14004b918
mov rcx, qword [rax + 0x10]
mov dl, 1
call fcn.140084810
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8 + 0x10]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14004bcd8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
mov rcx, qword [rcx]
mov esi, r8d
mov ebp, edx
test rcx, rcx
je 0x14004bd15
mov rax, qword [rcx]
call qword [rax + 0xf0]
test rax, rax
jne 0x14004bd25
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004bd25
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov dl, 1
mov rcx, rdi
call fcn.14004ab50
mov dword [rdi + 0x204], ebp
mov ecx, 0x10
mov dword [rdi + 0x208], esi
mov qword [rdi + 0x20c], r15
mov byte [rdi + 0x200], 1
mov dword [rdi + 0x1b8], 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004bd7a
test bx, bx
jns 0x14004be17
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004bd90
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rbx, rax
jmp 0x14004bd93
mov rbx, r15
mov dword [rsp + 0x58], ebp
mov rcx, rbx
mov dword [rsp + 0x5c], esi
mov rdx, qword [rsp + 0x58]
call fcn.14002759c
mov rcx, qword [rbx]
mov edx, eax
mov r14d, eax
mov r8, qword [rcx + 0xc0]
mov rcx, rbx
call r8
test al, al
je 0x14004be17
mov dword [rsp + 0x58], ebp
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x5c], esi
mov r9d, r14d
mov r8, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140027a50
movss xmm3, dword [rsp + 0x5c]
mov edx, r14d
movss xmm2, dword [rsp + 0x58]
mov rbx, qword [rbx + 0x28]
cvtps2pd xmm3, xmm3
mov rcx, rbx
cvtps2pd xmm2, xmm2
call fcn.14006a05c
mov r8d, eax
mov edx, r14d
mov rcx, rbx
call fcn.14006a67c
mov dword [rdi + 0x1b8], 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
lea edx, [r9 + 2]
lea r8d, [r9 + 0x14]
call qword [sym.imp.USER32.dll_SetTimer]
xor edx, edx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14001cb48
Function at 0x1400510d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edx, cx
xor ecx, ecx
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14005113f
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005113f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
xor r8d, r8d
mov rcx, rbx
call fcn.1400803b4
cmp dword [rax], 0xffff0001
jne 0x140051138
bts dword [rax + 8], 0x16
jmp 0x140051141
bts dword [rax + 4], 0x16
jmp 0x140051141
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140056e3c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rcx + 0x30]
mov rdi, rcx
mov rcx, rbp
call fcn.140056dd0
test al, al
je 0x140056e6c
xor al, al
jmp 0x140056f9f
cmp qword [rdi + 8], 0
je 0x140056e83
cmp byte [rdi + 0x11], 0
jne 0x140056e83
cmp qword [rdi], 0
jne 0x140056e83
mov bl, 1
jmp 0x140056e85
xor bl, bl
mov rdx, rbp
call fcn.140030c68
test bl, bl
je 0x140056f9d
test rax, rax
je 0x140056f9d
or rsi, 0xffffffffffffffff
mov rcx, rbp
mov rdx, rsi
call fcn.140080680
mov rcx, rax
mov rbx, rax
call fcn.1400817f0
test al, al
jne 0x140056e65
test rbx, rbx
je 0x140056e65
mov rax, rsi
inc rax
cmp byte [rbx + rax], 0
jne 0x140056ec4
cmp rax, 4
jb 0x140056e65
cmp byte [rbx + 1], 0x3a
jne 0x140056e65
mov r14b, byte [rbx]
mov dword [rsp + 0x50], 0x5c3a41
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
test eax, eax
je 0x140056f57
mov r12b, byte [rsp + 0x50]
mov cl, 0x41
mov al, cl
test r15b, 1
je 0x140056f48
cmp cl, r14b
je 0x140056f48
movsx ecx, al
mov dword [rsp + 0x50], 0x5c3a3f
call fcn.1400fee38
mov byte [rsp + 0x50], al
sub al, 0x41
cmp al, 0x19
ja 0x140056f48
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 1
je 0x140056f39
sub eax, 1
je 0x140056f39
cmp eax, 3
jne 0x140056f48
mov rcx, rbx
mov byte [rbx], r12b
call fcn.1400817f0
test al, al
jne 0x140056f5f
shr r15d, 1
lea ecx, [r12 + 1]
mov r12b, cl
mov al, cl
jne 0x140056efa
mov byte [rbx], r14b
jmp 0x140056e65
mov rdx, rbx
mov rcx, rbp
call fcn.140056cfc
mov rcx, qword [rdi + 0x30]
call fcn.1400feb88
and qword [rdi + 0x30], 0
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140056f78
mov r9d, 1
mov r8, rsi
mov rdx, rbx
xor ecx, ecx
call fcn.140080004
mov qword [rdi + 0x30], rax
jmp 0x140056e65
mov al, bl
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140057938
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
movaps xmmword [rsp + 0x40], xmm6
cmp byte [0x140167bc4], r15b
mov rdi, rcx
je 0x14005795f
mov byte [r15], r15b
mov rsi, qword [rcx + 0x30]
test r8b, r8b
je 0x14005798a
mov dl, 1
mov rcx, rsi
call fcn.140053904
mov rbx, rax
test rax, rax
je 0x14005798a
mov rcx, rax
call fcn.140038efc
mov rax, rbx
jmp 0x140057abf
mov rbx, qword [rdi + 8]
mov rcx, rdi
call fcn.140056e3c
test al, al
je 0x1400579b0
mov r8b, byte [rdi + 0x15]
mov rdx, rsi
mov rcx, rbx
call fcn.14005705c
xor eax, eax
jmp 0x140057abf
mov rcx, rdi
call fcn.1400575c0
mov rbp, rax
test rax, rax
je 0x1400579a9
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x10]
lea rcx, [0x14013ea20]
mov qword [rsp + 0x28], rcx
lea r8, [rsp + 0x28]
mov rcx, qword [rdi]
mov r9, rbp
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
call fcn.140054fc0
lea rcx, [rsp + 0x80]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbx, qword [rsp + 0x98]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x20]
cvtsi2sd xmm1, rbx
divsd xmm1, xmm0
mulsd xmm1, qword [0x140149f78]
cvtpd2ps xmm0, xmm1
cvtps2pd xmm6, xmm0
test r14, r14
je 0x140057a87
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
mov r9, rsi
lea rcx, str.LoadDocument:__.2f_ms___d_pages_for__s_n
mov r8d, eax
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.14007fe80
xor edx, edx
mov qword [rdi + 0x18], r14
mov rcx, rdi
call fcn.1400571f4
mov rbp, rax
jmp 0x140057abc
movaps xmm2, xmm6
lea rcx, str.LoadDocument:_failed_to_load__s_in__.2f_ms_n
movq r8, xmm6
mov rdx, rsi
call fcn.14007fe80
mov rdx, rsi
lea rcx, [0x140162450]
call fcn.14007eb68
mov r8b, byte [rdi + 0x15]
mov rdx, rsi
mov rcx, rbp
call fcn.140057128
mov rax, rbp
mov rbx, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005c3a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [rcx + 0x2c8], 0
mov rdi, rcx
jne 0x14005c3f6
cmp dword [rcx + 0x2cc], 0
jne 0x14005c3f6
mov rax, qword [0x140167368]
cmp byte [rax + 0x1f2], 0
je 0x14005c3f6
call fcn.140038ac8
test al, al
je 0x14005c3f6
mov bpl, 1
jmp 0x14005c3f9
xor bpl, bpl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movsx esi, ax
xorps xmm0, xmm0
mov rax, qword [rdi + 0x10]
mov ebx, 1
sar esi, 0xf
and esi, 0xfffffffe
mov qword [rsp + 0x20], rax
inc esi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
test bpl, bpl
je 0x14005c457
mov rax, qword [rdi + 0x50]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov ebx, 2
call fcn.140047b90
test al, al
je 0x14005c457
mov rax, qword [rdi + 0x38]
mov ebx, 3
mov qword [rsp + 0x30], rax
cmp byte [rdi + 0x90], 0
je 0x14005c47d
cmp byte [rdi + 0x91], 0
je 0x14005c47d
mov rax, qword [rdi + 0x88]
mov ecx, ebx
inc ebx
mov rax, qword [rax + 0x40]
mov qword [rsp + rcx*8 + 0x20], rax
mov rax, qword [0x140167368]
cmp byte [rax + 0x1f3], 0
je 0x14005c4a1
mov rax, qword [rdi + 0xa8]
mov ecx, ebx
inc ebx
mov rax, qword [rax + 0x40]
mov qword [rsp + rcx*8 + 0x20], rax
cmp ebx, 5
jbe 0x14005c4b6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14005c4b6
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call qword [sym.imp.USER32.dll_GetFocus]
xor edx, edx
mov r8d, ebx
test ebx, ebx
je 0x14005c4d8
xor ecx, ecx
cmp qword [rsp + rcx*8 + 0x20], rax
je 0x14005c4d8
inc edx
inc rcx
cmp rcx, r8
jl 0x14005c4c7
cmp edx, ebx
jne 0x14005c4ed
mov eax, esi
neg eax
jns 0x14005c4e9
lea ecx, [rbx + rbx]
add eax, ecx
js 0x14005c4e5
xor edx, edx
div ebx
lea eax, [rdx + rsi]
test eax, eax
jns 0x14005c4fb
lea ecx, [rbx + rbx]
add eax, ecx
js 0x14005c4f7
xor edx, edx
div ebx
movsxd rcx, edx
mov rcx, qword [rsp + rcx*8 + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140074930
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x20
cmp byte [0x140167c25], 0
je 0x14007496e
lea rdx, [rax + 0x10]
call fcn.14007c7a4
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.1400feb88
add rsp, 0x20
pop rbx
ret
Function at 0x140079928
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r12
push r13
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x40]
mov r15, rcx
cmp rdx, 0x6a
jne 0x140079996
lea ecx, [rdx - 0x5a]
call qword [sym.imp.USER32.dll_GetKeyState]
xor r9d, r9d
xor ebx, ebx
mov edx, 0x110a
mov rcx, rdi
test ax, ax
jns 0x140079974
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140079982
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov bl, 1
mov r9b, bl
mov r8d, 2
mov rdx, rax
mov rcx, rdi
jmp 0x140079a95
cmp rdx, 0x6f
jne 0x140079a13
lea ecx, [rdx - 0x5f]
call qword [sym.imp.USER32.dll_GetKeyState]
xor r9d, r9d
xor ebx, ebx
mov edx, 0x110a
mov rcx, rdi
test ax, ax
jns 0x1400799f4
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x110a
lea r8d, [rbx + 1]
mov r9, rax
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x140079a05
mov r9, rbp
lea r8d, [rbx + 4]
mov edx, 0x110a
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140079a02
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov bl, 1
mov rbp, rax
mov r9b, bl
mov r8d, 1
mov rcx, rdi
jmp 0x140079a92
cmp rdx, 0xd
jne 0x140079ada
lea ecx, [rdx + 3]
call qword [sym.imp.USER32.dll_GetKeyState]
xor r9d, r9d
mov edx, 0x110a
mov rcx, rdi
movzx r12d, ax
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13, qword [r15 + 0x40]
mov edx, 0x110a
mov r9, rax
mov rcx, r13
mov r8d, 4
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140079aad
mov rdx, rbp
mov rcx, r15
call fcn.1400798d0
test rax, rax
je 0x140079aad
mov eax, dword [rax + 0x10]
mov rcx, r13
shr eax, 5
not eax
shr r12w, 0xf
and eax, 1
inc eax
test r12b, r12b
je 0x140079a9c
xor r9d, r9d
mov r8d, eax
mov rdx, rbp
call fcn.140086594
jmp 0x140079aad
mov r8d, eax
mov r9, rbp
mov edx, 0x1102
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x110a
mov rcx, rdi
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov edx, 0x1114
mov r9, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
jmp 0x140079adc
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r13
pop r12
ret
Function at 0x14007e318
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0x37], rax
and qword [rbp - 0x59], 0
lea r8, [rbp - 0x59]
mov edi, 4
mov rbx, rcx
mov r9d, edi
mov ecx, 0x400
lea edx, [rdi + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14007e37d
lea r8, [0x140138558]
mov edx, edi
lea rcx, [rbp - 0x59]
call fcn.14007e2c8
call fcn.1400804a4
or r12, 0xffffffffffffffff
lea rdx, [rbp - 0x59]
mov r8, r12
mov r9, rax
mov ecx, 0xfde9
call fcn.14008902c
mov dword [rbp - 0x69], 1
lea rdx, [rbp - 0x69]
mov qword [rbp - 0x61], rbx
mov r14, rax
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
call fcn.140088310
xor edx, edx
lea rcx, [rbp - 0x49]
mov r8d, 0x80
mov rdi, rax
call fcn.1400eced0
lea rbx, [rbp - 0x49]
test rdi, rdi
je 0x14007e3e5
mov rcx, r12
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14007e3da
jmp 0x14007e3e7
xor ecx, ecx
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
inc edx
lea esi, [rdx + rdx*2]
sub esi, ecx
jmp 0x14007e43c
mov byte [rbx], al
inc rdi
inc rbx
cmp byte [rdi], 0
je 0x14007e427
cmp esi, 2
jne 0x14007e427
lea rdx, [rbp + 0x37]
mov r8, r14
sub rdx, rbx
mov rcx, rbx
call fcn.14007e1e0
add rbx, rax
inc esi
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub esi, eax
mov al, byte [rdi]
test al, al
jne 0x14007e400
mov rdx, r12
mov byte [rbx], al
lea rcx, [rbp - 0x49]
call fcn.140080680
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
Function at 0x14007e47c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp - 8], rax
mulsd xmm0, qword [0x140149f58]
movabs rax, 0xa3d70a3d70a3d70b
addsd xmm0, qword [0x140149ea0]
cvttsd2si rdi, xmm0
imul rdi
lea rbx, [rdi + rdx]
sar rbx, 6
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov rcx, rbx
call fcn.14007e318
xor r14d, r14d
lea r8, [rbp - 0x10]
mov ecx, 0x400
mov qword [rbp - 0x10], r14
mov rsi, rax
lea r9d, [r14 + 4]
lea edx, [r14 + 0xe]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14007e507
mov dword [rbp - 0x10], 0x2e
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x50]
mov al, byte [rcx]
add rcx, 2
mov byte [rdx], al
inc rdx
lea rax, [rbp - 8]
cmp rcx, rax
jne 0x14007e50f
mov dword [rbp - 0x40], 1
lea r9, [rbp - 0x40]
mov dword [rbp - 0x30], 4
lea r8, [rbp - 0x30]
mov dword [rbp - 0x20], 4
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x18], rsi
lea rcx, str._s_s_02d
imul rax, rbx, 0x64
sub rdi, rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rdi
movaps xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x28], rax
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
call fcn.1400883a8
lea rdx, [0x140138938]
mov rcx, rax
mov r10, rax
call fcn.14007c368
test al, al
je 0x14007e5b4
test r10, r10
je 0x14007e5ac
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [r10 + rcx], r14b
jne 0x14007e5a1
jmp 0x14007e5af
mov rcx, r14
mov byte [rcx + r10 - 1], r14b
mov rax, r10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret