joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005fa98
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180051784
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18005fb39
cmp ebx, dword [rsp + 0x30]
je 0x18005fb32
test esi, esi
je 0x18005fb32
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18005fb0d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18005fb1a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18005faf7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18005fb1e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18005fb3b
mov eax, 1
jmp 0x18005fb3b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800633f4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180058aac
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180058aac
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180063544
cmp rax, 0xffffffffffffffff
je 0x180063544
xor edi, edi
test rbp, rbp
jle 0x1800634ef
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18004fdec
mov rbx, rax
test rax, rax
jne 0x18006347c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800634e5
mov edx, 0x8000
mov ecx, r14d
call fcn.180063278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800568e0
cmp eax, 0xffffffff
je 0x1800634c5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18006348c
mov edx, r15d
mov ecx, r14d
call fcn.180063278
jmp 0x1800634e5
cmp byte [rsi + 0x38], dil
je 0x1800634dc
cmp dword [rsi + 0x34], 5
jne 0x1800634dc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800634e5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18004fe64
jmp 0x180063558
jns 0x180063558
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180058aac
cmp rax, 0xffffffffffffffff
jne 0x180063510
cmp byte [rsi + 0x30], dil
je 0x180063558
mov edi, dword [rsi + 0x2c]
jmp 0x180063558
mov ecx, r14d
call fcn.1800602f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180063558
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180063558
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180063551
mov eax, dword [rsi + 0x2c]
jmp 0x180063556
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180058aac
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180063f70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180063f98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180063f98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000105c
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov rcx, rdx
mov r14, rdx
call fcn.1400012c8
mov rcx, rsi
call fcn.140001020
test al, al
je 0x14000109a
xor al, al
jmp 0x140001247
mov rcx, rsi
call fcn.140001020
test al, al
jne 0x1400010c0
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
test eax, eax
jne 0x1400010c5
mov ebp, 0x7fff
mov rcx, 0xffffffffffffffff
lea ebx, [rbp + 1]
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140006e68
mov rcx, qword [rsi]
mov r8d, ebx
mov r9, rax
mov edx, 0xd
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jle 0x14000123d
mov rcx, rdi
call fcn.140006d70
mov ecx, ebp
mov r8, rax
cmp rax, rcx
jne 0x140001232
test rax, rax
je 0x14000113f
mov rdx, rdi
mov rcx, rdi
neg rdx
mov al, byte [rcx]
sub al, 0x20
cmp al, 0x5e
ja 0x140001232
inc rcx
lea rax, [rdx + rcx]
cmp rax, r8
jb 0x140001127
mov rcx, rdi
call fcn.140006d70
mov r15, rax
lea rbx, [rax + 1]
test rbx, rbx
jne 0x140001158
lea ecx, [rbx + 0x10]
jmp 0x140001160
lea rcx, [rbx + 0xf]
and rcx, 0xfffffffffffffff0
call fcn.140006e68
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.1400067f0
mov ecx, 4
call fcn.140006e68
mov rsi, rax
test rax, rax
je 0x140001190
mov dword [rax], 1
jmp 0x140001192
xor esi, esi
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r12d, [r15 + 1]
mov r9d, r12d
mov r8, rbp
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
test eax, eax
jne 0x1400011c5
mov rcx, r14
call fcn.1400012c8
jmp 0x140001218
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.140006e68
mov r9d, r12d
mov r8, rbp
mov edx, 1
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov rbx, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
dec eax
mov rdx, rbx
mov rcx, r14
movsxd r9, eax
call fcn.140001400
mov rcx, rbx
call fcn.140006f10
or rax, 0xffffffffffffffff
add dword [rsi], eax
jne 0x14000123d
mov rcx, rbp
call fcn.140006f10
mov rcx, rsi
call fcn.140006f10
jmp 0x14000123d
mov rdx, rdi
mov rcx, r14
call fcn.14000133c
mov rcx, rdi
call fcn.140006f10
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400025ac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp + 0x20]
lea rdx, str.SoftwareAutoIt_v3AutoIt
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400027f5
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x10]
lea r9, [0x140019128]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x18]
lea rdx, str.SoftwareAutoIt_v3AU3Info
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x18]
mov ebx, 4
lea rax, [0x14001eab8]
lea rdx, str.WinX
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eabc]
lea rdx, str.WinY
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eac0]
lea rdx, str.WinW
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eac4]
lea rdx, str.WinH
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eaa8]
lea rdx, str.CoordMode
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eac8]
lea rdx, str.ControlFindMode
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eaac]
lea rdx, str.HighlightControls
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eab4]
lea rdx, str.Magnify
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [0x14001eab0]
mov rcx, qword [rbp + 0x18]
lea rdx, str.AlwaysOnTop
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001eacc]
lea rdx, str.HighlightColor
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
lea rax, [0x14001ead0]
lea rdx, str.LastTab
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140002c50
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and dword [rax - 0x78], 0
mov dword [rax - 0x80], 0xe
mov dword [rsp + 0x40], 0xfd
mov dword [rsp + 0x38], 0x196
mov dword [rsp + 0x30], 0xbe
mov edi, 0x220
lea r9, [0x140019128]
lea r8, str.SysListView32
mov edx, edi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 0xd
call fcn.140002880
mov r9d, edi
xor r8d, r8d
mov edx, 0x1036
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 9]
lea r8d, [rdx + 0x28]
call fcn.140006f70
and dword [rbp - 5], 0
and dword [rbp + 0x13], 0
lea rax, str.Property
mov edi, 0x1061
lea r9, [rbp - 9]
mov r8d, 1
mov rcx, rbx
mov edx, edi
mov qword [rbp + 7], rax
mov dword [rbp - 9], 0xf
mov dword [rbp - 1], 0x46
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Value
lea r9, [rbp - 9]
mov r8d, 2
mov edx, edi
mov rcx, rbx
mov qword [rbp + 7], rax
mov dword [rbp - 1], 0x258
mov dword [rbp + 0x13], 1
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp + 0x1f]
lea r8d, [rdx + 0x38]
call fcn.140006f70
and dword [rbp + 0x27], 0
and dword [rbp + 0x23], 0
lea rax, str.Title
mov edi, 0x104d
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov rcx, rbx
mov edx, edi
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x1f], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Class
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
mov dword [rbp + 0x23], 1
mov qword [rbp + 0x37], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x140019590]
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x23], 2
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Size
mov dword [rbp + 0x23], 3
mov qword [rbp + 0x37], rax
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Style
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x23], 4
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.ExStyle
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
mov dword [rbp + 0x23], 5
mov qword [rbp + 0x37], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Handle
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, edi
mov rcx, rbx
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x23], 6
call qword [sym.imp.USER32.dll_SendMessageW]
lea edx, [rdi - 0x2f]
mov r9d, 0xfffe
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x30], 0x13
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rdx, rbx
call fcn.1400052c0
lea r11, [rsp + 0xc0]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400031f0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov dword [rax - 0x78], 5
mov dword [rax - 0x80], 0x16
mov dword [rsp + 0x40], 0xfd
mov dword [rsp + 0x38], 0x196
mov dword [rsp + 0x30], 0xbe
lea r14, [0x140019128]
mov edi, 0x220
lea r8, str.SysListView32
mov r9, r14
mov edx, edi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 0xd
call fcn.140002880
mov r9d, edi
xor r8d, r8d
mov rcx, rax
mov edx, 0x1036
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, 0x28
lea rcx, [rbp - 9]
mov r8d, edi
xor edx, edx
call fcn.140006f70
and dword [rbp - 5], 0
and dword [rbp + 0x13], 0
lea rax, str.Index
lea r9, [rbp - 9]
lea r8d, [rdi - 0x27]
mov edx, 0x1061
mov rcx, rbx
mov dword [rbp - 9], 0xf
mov qword [rbp + 7], rax
mov dword [rbp - 1], edi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Command_ID
mov edi, 2
lea r9, [rbp - 9]
mov edx, 0x1061
mov rcx, rbx
mov r8d, edi
mov qword [rbp + 7], rax
mov dword [rbp - 1], 0x4b
mov dword [rbp + 0x13], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Text
lea r9, [rbp - 9]
lea r8d, [rdi + 1]
mov edx, 0x1061
mov rcx, rbx
mov qword [rbp + 7], rax
mov dword [rbp - 1], 0x258
mov dword [rbp + 0x13], edi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8d, [rdi + 0x36]
lea rcx, [rbp + 0x1f]
xor edx, edx
call fcn.140006f70
and dword [rbp + 0x27], 0
xor edi, edi
mov dword [rbp + 0x1f], 1
mov qword [rbp + 0x37], r14
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rbx
mov dword [rbp + 0x23], edi
call qword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, 0xa
jl 0x140003339
mov dword [rsp + 0x30], 0x13
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rdx, rbx
call fcn.1400052c0
lea r11, [rsp + 0xc0]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400033a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov eax, 6
lea r9, [0x140019128]
lea r8, str.SysListView32
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], 0x13
mov dword [rsp + 0x40], 0xfd
mov dword [rsp + 0x38], 0x196
mov dword [rsp + 0x30], 0xbe
mov dword [rsp + 0x28], eax
mov edx, 0x220
mov dword [rsp + 0x20], 0xd
call fcn.140002880
mov r9d, 0x220
xor r8d, r8d
mov rcx, rax
mov edx, 0x1036
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 9]
lea r8d, [rdx + 0x28]
call fcn.140006f70
and dword [rbp - 5], 0
and dword [rbp + 0x13], 0
lea rax, str.Property
lea r9, [rbp - 9]
mov edx, 0x1061
mov r8d, 1
mov rcx, rbx
mov dword [rbp - 9], 0xf
mov qword [rbp + 7], rax
mov dword [rbp - 1], 0x46
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Value
lea r9, [rbp - 9]
mov edx, 0x1061
mov r8d, 2
mov rcx, rbx
mov dword [rbp - 1], 0x258
mov qword [rbp + 7], rax
mov dword [rbp + 0x13], 1
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp + 0x1f]
lea r8d, [rdx + 0x38]
call fcn.140006f70
and dword [rbp + 0x27], 0
and dword [rbp + 0x23], 0
lea rax, str.Position
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rbx
mov dword [rbp + 0x1f], 1
mov qword [rbp + 0x37], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Cursor_ID
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rbx
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x23], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Color
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rbx
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x23], 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0xfffe
xor r8d, r8d
mov edx, 0x101e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x30], 0x13
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rdx, rbx
call fcn.1400052c0
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret

Function at 0x1400040fc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rdi, rdx
call fcn.140006e18
mov ecx, 2
lea rdx, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140004175
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140004175
mov rdx, rdi
mov rcx, rax
call fcn.140006f44
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x14001ea58]
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400061b4
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rcx, rdx
cmp r8d, 1
jne 0x140006212
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], 0x1388
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14000622f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x140006225
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x40
pop rbx
ret
Function at 0x140006238
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov edx, 0x7f8a
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x39], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f03
xor ecx, ecx
mov qword [rbp - 0x31], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f8b
xor ecx, ecx
mov qword [rbp - 0x29], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f01
xor ecx, ecx
mov qword [rbp - 0x21], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f81
xor ecx, ecx
mov qword [rbp - 0x19], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f88
xor ecx, ecx
mov qword [rbp - 0x11], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f80
xor ecx, ecx
mov qword [rbp - 9], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f86
xor ecx, ecx
mov qword [rbp - 1], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f83
xor ecx, ecx
mov qword [rbp + 7], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f85
xor ecx, ecx
mov qword [rbp + 0xf], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f82
xor ecx, ecx
mov qword [rbp + 0x17], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f84
xor ecx, ecx
mov qword [rbp + 0x1f], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f04
xor ecx, ecx
mov qword [rbp + 0x27], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov edx, 0x7f02
xor ecx, ecx
mov qword [rbp + 0x2f], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rbp - 0x49]
mov qword [rbp + 0x37], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov r8d, 1
mov rdx, rax
mov rbx, rax
call fcn.1400061b4
call qword [sym.imp.USER32.dll_GetCursor]
xor edx, edx
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor ecx, ecx
test rdi, rdi
je 0x1400063b8
cmp rdi, qword [rbp + rcx*8 - 0x39]
je 0x1400063c1
inc rcx
cmp rcx, 0xe
jbe 0x1400063ac
cmp rcx, 0xe
ja 0x1400063cc
lea eax, [rcx + 1]
jmp 0x1400063ce
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400067c0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400042e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 8], 0
je 0x14000432c
mov rcx, qword [rdx + 0x38]
test rcx, rcx
je 0x140004322
mov rax, qword [rcx]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14000e5e6.0]
and qword [rbx + 0x38], 0
mov eax, 0x80070005
jmp 0x1400043ce
add rcx, 0x10
call fcn.1400044d8
and qword [rdi + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1400046e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
test rax, rax
jne 0x1400043a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400043a3
mov r8, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [r8 + 0x20]
call qword [case.0x14000e5e6.0]
and qword [rbx + 0x38], 0
mov eax, edi
jmp 0x1400043ce
mov qword [rdi + 8], rax
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400043cc
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14000e5e6.0]
and qword [rbx + 0x38], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140006620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movabs r9, 0xcbf29ce484222325
mov r10, rdx
mov r11, r9
mov rbx, rcx
xor edx, edx
movabs rdi, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor r11, rax
imul r11, rdi
cmp rdx, 8
jb 0x140006649
xor ecx, ecx
movzx eax, byte [r8 + rcx + 8]
inc rcx
xor r9, rax
imul r9, rdi
cmp rcx, 8
jb 0x140006660
mov rdx, qword [rbx + 8]
xor r9, r11
and r9, qword [rbx + 0x30]
mov r11, qword [rbx + 0x18]
mov rax, r9
add rax, rax
add r9, r9
mov rax, qword [r11 + rax*8]
cmp qword [r11 + r9*8], rdx
jne 0x14000669d
mov rcx, rdx
jmp 0x1400066a5
mov rcx, qword [r11 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400066df
mov rcx, qword [rax + 0x10]
cmp rcx, qword [r8]
jne 0x1400066bd
mov rcx, qword [rax + 0x18]
cmp rcx, qword [r8 + 8]
je 0x1400066c2
mov rax, qword [rax]
jmp 0x140006692
mov rcx, qword [r8]
sub rcx, qword [rax + 0x10]
jne 0x1400066d3
mov rcx, qword [r8 + 8]
sub rcx, qword [rax + 0x18]
test rcx, rcx
cmovne rax, rdx
mov qword [r10], rax
jmp 0x1400066e2
mov qword [r10], rdx
mov rbx, qword [rsp + 8]
mov rax, r10
mov rdi, qword [rsp + 0x10]
ret