joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801369a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
jne 0x180136a66
call fcn.180211d54
mov r8, qword [rax]
mov edx, 3
mov rcx, rax
call qword [r8 + 0x10]
mov ebx, eax
cmp eax, 2
je 0x180136ae7
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x180136a0f
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rcx, rax
call fcn.180125c50
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x180136a42
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rcx, rax
call fcn.180126600
call fcn.180211d54
mov r9, qword [rax]
mov r8d, ebx
mov edx, 0xf
mov rcx, rax
call qword [r9 + 8]
jmp 0x180136ae7
mov rcx, qword [rbx + 0x18]
mov rax, qword [rcx]
mov edx, 0x52
call qword [rax]
mov ebx, eax
call fcn.180211d54
mov r8, qword [rax]
mov edx, 3
mov rcx, rax
call qword [r8 + 0x10]
cmp eax, 2
jne 0x180136ae7
call fcn.180211d54
mov r8, qword [rax]
mov edx, 0xf
mov rcx, rax
call qword [r8 + 0x10]
cmp eax, 1
jne 0x180136ac4
call fcn.180074980
mov rcx, rax
call fcn.180125800
call fcn.180074980
mov rcx, rax
call fcn.180126600
jmp 0x180136ae7
call fcn.180074980
mov rcx, rax
call fcn.1801253b0
call fcn.180074980
mov rcx, rax
test ebx, ebx
jne 0x180136abd
add rsp, 0x30
pop rbx
jmp fcn.1801260a0
add rsp, 0x30
pop rbx
ret
Function at 0x1801442b0
Capabilities:
Read .ini file

Disassembly:
test rcx, rcx
je 0x18014441b
push rdi
sub rsp, 0x130
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [rcx + 0x110], 1
jne 0x1801443fb
movzx edx, byte [rcx + 0x111]
lea rcx, [rsp + 0x30]
call fcn.1801440c0
nop
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x180144331
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r9, [rbx + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x180144342
mov r9, qword [r9]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r8d, r8d
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rax + 1]
lea rdx, [0x1802abc24]
lea rcx, [rsp + 0x50]
call fcn.18005c530
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1801443b7
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r9, [rbx + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x1801443c8
mov r9, qword [r9]
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1801443fb
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18005cac0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x1801442b9
Capabilities:
Read .ini file

Disassembly:
test rcx, rcx
je 0x18014441b
push rdi
sub rsp, 0x130
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [rcx + 0x110], 1
jne 0x1801443fb
movzx edx, byte [rcx + 0x111]
lea rcx, [rsp + 0x30]
call fcn.1801440c0
nop
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x180144331
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r9, [rbx + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x180144342
mov r9, qword [r9]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r8d, r8d
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rax + 1]
lea rdx, [0x1802abc24]
lea rcx, [rsp + 0x50]
call fcn.18005c530
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1801443b7
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r9, [rbx + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x1801443c8
mov r9, qword [r9]
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1801443fb
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18005cac0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x180145750
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rsp + 0x60]
mov r14, r9
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x200
ja 0x18012c644
cmp r8d, 0x200
je 0x18012c637
cmp r8d, 0x14
ja 0x18012c595
je 0x18012c581
mov eax, r8d
sub eax, 1
je 0x18012c572
sub eax, 4
je 0x18012c544
cmp eax, 0xa
jne 0x18012c6cb
lea rdx, [rsp + 0x48]
call fcn.18012cf70
mov rsi, qword [rsp + 0x48]
jmp 0x18012c6cb
mov rax, rbp
movsx edx, bp
shr rax, 0x10
movsx ecx, ax
test edx, edx
jle 0x18012c6cb
test ecx, ecx
jle 0x18012c6cb
mov dword [rbx + 0xcc], edx
mov dword [rbx + 0xd0], ecx
jmp 0x18012c6cb
call fcn.18012c2c0
mov eax, 1
jmp 0x18012c6dc
lea rdx, [rsp + 0x48]
call fcn.18012cf70
mov eax, 1
jmp 0x18012c6dc
cmp edi, 0x20
je 0x18012c60f
cmp edi, 0x113
jne 0x18012c6cb
mov eax, r14d
sub eax, 1
je 0x18012c5db
cmp eax, 1
jne 0x18012c6cb
mov rcx, qword [rcx + 0xd8]
lea edx, [rax + 1]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18012c6cb
mov ecx, dword [rcx + 0x40]
sub ecx, 1
je 0x18012c605
sub ecx, 1
je 0x18012c5f8
cmp ecx, 1
mov rcx, rbx
call fcn.18012d520
jmp 0x18012c6cb
call fcn.1800b1040
mov byte [rbx], 1
jmp 0x18012c6cb
call fcn.1800b12d0
jmp 0x18012c6cb
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, rsi
je 0x18012c62d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x18012c6dc
mov r8, rbp
call fcn.18012d250
jmp 0x18012c6cb
mov eax, edi
sub eax, 0x201
je 0x18012c6c3
sub eax, 1
je 0x18012c6b9
sub eax, 0x9f
je 0x18012c69e
sub eax, 2
je 0x18012c680
cmp eax, 0x225
jne 0x18012c6cb
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18012c6cb
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18012c6cb
mov dword [rcx + 0x24], 0
xor edx, edx
mov rcx, qword [rcx + 0xd8]
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x18012c6cb
mov dword [rcx + 0x24], 1
mov edx, 2
mov rcx, qword [rcx + 0xd8]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x18012c6cb
mov r8, rbp
call fcn.18012c790
jmp 0x18012c6cb
mov r8, rbp
call fcn.18012c6f0
mov r9, rbp
mov r8, r14
mov edx, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov esi, r8d
mov rdi, rdx
cmp r8d, 0x4c8
jne 0x18014578e
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.1800afa80
mov rcx, rax
mov r9, rbx
mov r8d, esi
mov rdx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x18012c4d0
Function at 0x18014c400
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0xb8]
mov rdi, r8
mov rsi, rcx
cmp rbx, qword [rcx + 0xc0]
je 0x18014c455
nop word [rax + rax]
cmp dword [rbx + 0x48], 0
mov rdx, rdi
mov rcx, rbx
jne 0x18014c443
call fcn.180147a80
jmp 0x18014c448
call fcn.180147be0
add rbx, 0x50
cmp rbx, qword [rsi + 0xc0]
jne 0x18014c430
mov rbx, qword [rsi + 0xa0]
cmp rbx, qword [rsi + 0xa8]
je 0x18014c48c
nop word [rax + rax]
mov r8d, dword [rbx + 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.1801476a0
add rbx, 0x30
cmp rbx, qword [rsi + 0xa8]
jne 0x18014c470
mov rbx, qword [rsi + 0x88]
cmp rbx, qword [rsi + 0x90]
je 0x18014c54f
mov qword [rsp + 0x30], rbp
mov ebp, 0x3000
nop word [rax + rax]
cmp dword [rbx + 0x2c], 0
jne 0x18014c4e2
cmp dword [0x180342b30], 0
jne 0x18014c4d0
cmp dword [0x180342b24], 0
jne 0x18014c4d0
xor eax, eax
cmp word [rbx + 0x34], bp
jmp 0x18014c4d6
xor eax, eax
cmp word [rbx + 0x36], bp
setne al
test eax, eax
jne 0x18014c4e2
xor r8d, r8d
jmp 0x18014c50a
cmp byte [rbx + 0x29], 0
jne 0x18014c504
cmp word [rbx + 0x60], 0x14
jne 0x18014c4fe
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
je 0x18014c504
mov r8d, dword [rbx + 0x10]
jmp 0x18014c50a
mov r8d, 2
mov rdx, rdi
mov rcx, rbx
call fcn.1801476a0
mov ecx, dword [rbx + 0x2c]
test ecx, ecx
je 0x18014c52e
cmp ecx, 1
jne 0x18014c539
mov rdx, rdi
mov rcx, rbx
call fcn.180148dc0
jmp 0x18014c539
mov rdx, rdi
mov rcx, rbx
call fcn.1801486f0
add rbx, 0x68
cmp rbx, qword [rsi + 0x90]
jne 0x18014c4b0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180156b10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.180211b44
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov r8d, 0x9b
mov rcx, rax
mov r10, qword [rax]
call qword [r10 + 0x20]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.180233580
movzx r9d, word [rsp + 0x32]
lea rdx, str._.4d_.2d_.2d
movzx r8d, word [rsp + 0x30]
lea rcx, [rsp + 0x60]
xor eax, eax
mov word [rsp + 0x60], ax
mov qword [rsp + 0x62], rax
mov qword [rsp + 0x6a], rax
mov word [rsp + 0x72], ax
movzx eax, word [rsp + 0x36]
mov dword [rsp + 0x20], eax
call fcn.18005c530
add rbx, 0x118
cmp qword [rbx + 0x18], 8
jb 0x180156bc1
mov r9, qword [rbx]
jmp 0x180156bc4
mov r9, rbx
xor r8d, r8d
lea rdx, str.LastUseDay
lea rcx, [0x1802abe90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [rsp + 0x30]
imul edx, ecx, 0x64
movzx ecx, word [rsp + 0x32]
add edx, ecx
movzx ecx, word [rsp + 0x36]
imul r8d, edx, 0x64
add r8d, ecx
cmp eax, r8d
je 0x180156caf
cmp qword [rsp + 0x50], 0
jbe 0x180156caf
cmp qword [rbx + 0x18], 8
jb 0x180156c17
mov r9, qword [rbx]
jmp 0x180156c1a
mov r9, rbx
lea r8, [rsp + 0x60]
lea rdx, str.LastUseDay
lea rcx, [0x1802abe90]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rsp + 0x58], 8
lea r8, [rsp + 0x40]
lea rdx, str.UseDayTotal_s
cmovae r8, qword [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.18005c530
cmp qword [rbx + 0x18], 8
jb 0x180156c60
mov r9, qword [rbx]
jmp 0x180156c63
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [0x1802abe90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x1802abc24]
lea rcx, [rsp + 0x60]
lea r8d, [rax + 1]
call fcn.18005c530
cmp qword [rbx + 0x18], 8
jb 0x180156c96
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [0x1802abe90]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180156ccc
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
inc r8
call fcn.18005cac0
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rbp
ret
Function at 0x180157060
Capabilities:
Read .ini file

Disassembly:
push rbx
push r14
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
mov rax, qword [r14 + 0x40]
mov rax, qword [rax]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18015729b
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x460], r15
lea r15, str.nothing
mov qword [rsp + 0x498], rdi
mov rbp, qword [rbx + 0x28]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2 + 0x18], 0
jne 0x1801570f0
test eax, eax
jle 0x180157223
lea r8, [rbp + 0x18]
lea rdx, str.Is_s
lea rcx, [rsp + 0x240]
call fcn.18005c530
lea rdi, [r14 + 0xd8]
cmp qword [rdi + 0x18], 8
jb 0x18015712e
mov rax, qword [rdi]
jmp 0x180157131
mov rax, rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x1802b38c0]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1802b38c0]
jne 0x180157189
movzx eax, word [rsp + 0x32]
cmp ax, word [0x1802b38c2]
jne 0x180157189
movzx eax, word [rsp + 0x34]
cmp ax, word [0x1802b38c4]
je 0x180157199
lea rcx, [rsp + 0x30]
call fcn.18023b52c
mov rcx, qword [rbp + 8]
mov byte [rcx], al
lea r8, [rbp + 0x18]
lea rdx, str.Use_s
lea rcx, [rsp + 0x240]
call fcn.18005c530
cmp qword [rdi + 0x18], 8
jb 0x1801571bb
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov r8, r15
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r15 + rcx*2 - 2]
jne 0x180157207
cmp rcx, 8
jne 0x1801571f0
jmp 0x180157223
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x180157210
cmp byte [rbx + 0x19], 0
jne 0x18015726e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18015724e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x18015726e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180157240
jmp 0x18015726e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18015726b
cmp rbx, qword [rax + 0x10]
jne 0x18015726b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x180157258
mov rbx, rax
mov rax, qword [r14 + 0x40]
cmp rbx, qword [rax]
jne 0x1801570e1
mov r15, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
pop r14
pop rbx
ret
Function at 0x1801579f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
xchg byte [rcx + 0xc], al
xor ebx, ebx
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rdi + 0xd]
test al, al
jne 0x18007303e
inc ebx
cmp ebx, 0xa
jl 0x180073024
movzx eax, byte [rdi + 0xd]
test al, al
jne 0x180073051
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
lea rax, vtable.CRunOpenAdConfig.0
mov qword [rdi + 0x20], rax
lea rax, vtable.CDBSystemEventHandler.0
mov qword [rdi + 0x18], rax
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [0x180344f60]
mov rsi, rcx
test rbx, rbx
je 0x180157a57
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x180344ad8]
test rdi, rdi
je 0x180157a3a
mov rcx, rdi
call fcn.18015c610
mov edx, 0x30
mov rcx, rdi
call fcn.180085310
mov qword [0x180344ad8], 0
mov edx, 1
mov rcx, rbx
call fcn.180085310
mov rdi, qword [rsp + 0x30]
mov qword [0x180344f60], 0
mov rcx, rsi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp 0x180073010
Function at 0x18015f0d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rbp, r8
mov r14d, edx
mov rdi, rcx
xor r15d, r15d
mov rbx, qword [0x180345038]
test rbx, rbx
jne 0x18015f141
lea ecx, [rbx + 0x38]
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x20], r15
mov byte [rax + 0x2c], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x28], eax
mov byte [rbx + 0x30], r15b
mov qword [0x180345038], rbx
lea rsi, [rdi - 0x20]
mov qword [rbx + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x18], r15d
call fcn.180211d54
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x30]
movzx ebx, al
mov rax, qword [0x180345030]
test rax, rax
jne 0x18015f196
lea ecx, [rax + 0x40]
call fcn.1802037c4
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.18015a7e0
nop
mov qword [0x180345030], rax
cmp dword [rax + 0x34], 0
je 0x18015f1cb
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x18015f28b
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x18015f28b
mov rax, qword [0x180345030]
test bl, bl
jne 0x18015f28b
test rax, rax
jne 0x18015f1f5
lea ecx, [rax + 0x40]
call fcn.1802037c4
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.18015a7e0
nop
mov qword [0x180345030], rax
cmp dword [rax + 0x30], 0
je 0x18015f255
cmp qword [0x180344f68], 0
jne 0x18015f21e
mov ecx, 8
call fcn.1802037c4
mov qword [rsp + 0x50], rax
mov qword [rax], r15
mov qword [0x180344f68], rax
call fcn.180159c90
mov ebx, eax
cmp qword [0x180344f68], 0
jne 0x18015f248
mov ecx, 8
call fcn.1802037c4
mov qword [rsp + 0x50], rax
mov qword [rax], r15
mov qword [0x180344f68], rax
call fcn.180159da0
test ebx, ebx
jne 0x18015f28b
test eax, eax
jne 0x18015f28b
mov r8, rbp
mov edx, r14d
call fcn.18015fac0
mov rbx, qword [rdi + 0xa0]
test rbx, rbx
je 0x18015f275
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, rsi
call fcn.180169440
test rbx, rbx
je 0x18015f28b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1801636b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x178], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0xc8], edx
mov qword [rcx + 0xc0], r8
cmp qword [rcx + 0xa8], 0
jne 0x180163736
lea rdx, [0x18033fb70]
mov ecx, 0xa0
call fcn.1802042b8
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180163720
mov rdx, rbx
mov rcx, rax
call fcn.18015d300
nop
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x180163736
mov eax, 0x8007000e
jmp 0x1801637f2
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.180233580
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov rbx, qword [rsp + 0x190]
mov rax, rbx
shr rax, 0x10
movzx edx, ax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov ecx, edi
call qword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x180163793
movzx eax, word [rsp + 0x30]
movzx ecx, al
shl rcx, 0x10
or rdi, rcx
cmp qword [0x180344ac0], 0
jne 0x1801637b3
mov ecx, 1
call fcn.1802037c4
mov qword [rsp + 0x38], rax
mov qword [0x180344ac0], rax
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1801637de
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
lea r9, [rsp + 0x50]
mov r8d, ebx
mov edx, edi
mov rcx, rax
call fcn.1800c3dd0
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x180166770
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x48], rbp
mov r8d, 0x200
call fcn.180233580
lea r8, [rsp + 0x48]
mov dword [rsp + 0x40], 0x100
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1801667d0
xor eax, eax
jmp 0x180166890
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x2a0], rbx
mov ebx, ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180166869
nop
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov word [rsp + 0x25e], bp
call fcn.180166770
mov ebx, eax
test eax, eax
jne 0x180166869
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180166810
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180166886
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret