joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b6d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x14020fd6c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test al, 1
je 0x14005b7ad
cmp byte [0x1401db199], bl
lea ecx, [rbx + 0x18]
mov qword [rsp + 0x20], rbx
sete al
xor r9d, r9d
xor r8d, r8d
mov byte [0x1401db199], al
xor edx, edx
test al, al
je 0x14005b785
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
lea r8d, [rbx + 2]
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x53
call qword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x14020b618], bl
je 0x14005b76d
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 1]
mov edx, 0xfffffff8
call qword [sym.imp.USER32.dll_mouse_event]
movsxd rax, dword [0x1401d8e24]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071060
jmp 0x14005b7ad
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x44
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x53
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x1401db199], bl
je 0x14005b874
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
cmp byte [0x14020b618], bl
je 0x14005b7ef
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [r9 + 8]
lea ecx, [rdx - 7]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x44
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movsxd rax, dword [0x1401d9088]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071060
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
cmp byte [0x14020b618], bl
je 0x14005b84e
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, 0xfffffff8
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
movsxd rax, dword [0x1401d9088]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.140071060
add rsp, 0x30
pop rbx
ret
Function at 0x14005c7b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14020fef0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005c92e
mov qword [rsp + 0x40], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x45
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x41
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [reloc.WS2_32.dll_accept]
xor edi, edi
mov ecx, dword [0x14020fd60]
add eax, eax
cmp ecx, eax
jle 0x14005c838
mov eax, dword [0x14020fee0]
cmp dword [0x1401da078], eax
jne 0x14005c838
mov ecx, edi
mov dword [0x14020fd60], ecx
mov ebx, 0xa
nop dword [rax]
mov edx, dword [0x1401da050]
add edx, ecx
mov ecx, dword [0x1401da09c]
call qword [sym.imp.USER32.dll_SetCursorPos]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
jle 0x14005c87a
add dword [0x1401da09c], eax
cvttss2si rcx, dword [0x1401d8ecc]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
sub rbx, 1
je 0x14005c8ad
mov ecx, dword [0x14020fd60]
jmp 0x14005c840
mov eax, dword [0x1401da054]
mov ecx, Ordinal_79
mov dword [0x1401da09c], eax
mov eax, dword [0x1401da088]
mov dword [0x1401da050], eax
mov eax, dword [reloc.WS2_32.dll_accept]
add dword [0x14020fd60], eax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x45
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14005c940
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14020fee4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005ca9d
movzx ecx, byte [0x14020fee4]
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor edx, edx
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x14020fd58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x14020fd58]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edi, edi
mov ebx, 0x3e8
nop word [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, 0x3e8
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r8d, [r9 + 0x64]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
sub rbx, 1
jne 0x14005c9b0
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea ecx, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x37]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14020b61f], dil
je 0x14005ca36
lea ecx, [rbx + 0x37]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea ecx, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x37]
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [0x14020fdc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x14020fdc0]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ebx, edi
cmp dword [0x14020fdb0], ebx
jle 0x14005ca93
nop dword [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, 0xfffffffb
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
inc ebx
cmp ebx, dword [0x14020fdb0]
jl 0x14005ca70
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x14005d3b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x14020fe69], 0
je 0x14005d434
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xa2
mov rdi, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x51
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, bx
mov rbx, qword [rsp + 0x30]
jge 0x14005d42f
xor r9d, r9d
mov edx, 0x100
mov rcx, rdi
lea r8d, [r9 + 0x51]
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor edx, edx
mov cl, 0x51
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x14020fdb8]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1400601e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x14020fd70]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400602de
cmp byte [0x14020fde4], 0
je 0x140060216
mov dword [0x14020fdac], 0
movzx ecx, byte [0x14020fdd4]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x14020fdd4]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x204
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x205
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x14020fdf3], 0
jne 0x14006027a
mov ecx, dword [0x1401d8e1c]
jmp 0x14006029e
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add ecx, dword [0x1401d8e1c]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [reloc.WS2_32.dll_accept], 0
je case.default.0x1400602d7
movzx ecx, byte [0x14020fda0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x14020fda0]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_keybd_event]
add rsp, 0x20
pop rbx
ret
Function at 0x140061640
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov ecx, dword [0x14020fe54]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdi, [0x1401d8d88]
test al, 1
je 0x1400616ce
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 7
jb 0x1400616a4
cmp rax, 0x10
mov qword [reloc.WS2_32.dll_getsockopt], 7
mov rbx, rdi
lea rdx, str.Config1
cmovae rbx, qword [0x1401d8d88]
mov r8d, 7
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x1400616b8
lea r9, str.Config1
mov edx, 7
mov rcx, rdi
call fcn.140072280
mov byte [0x1401d9fdf], 1
call fcn.140060770
mov dword [0x14020fdd0], 0
mov ecx, dword [0x14020fe70]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006174a
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 7
jb 0x140061720
cmp rax, 0x10
mov qword [reloc.WS2_32.dll_getsockopt], 7
mov rbx, rdi
lea rdx, str.Config2
cmovae rbx, qword [0x1401d8d88]
mov r8d, 7
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x140061734
lea r9, str.Config2
mov edx, 7
mov rcx, rdi
call fcn.140072280
mov byte [0x1401d9fdf], 1
call fcn.140060770
mov dword [0x14020fdd0], 0
mov ecx, dword [0x14020fe7c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400617c6
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 7
jb 0x14006179c
cmp rax, 0x10
mov qword [reloc.WS2_32.dll_getsockopt], 7
mov rbx, rdi
lea rdx, str.Config3
cmovae rbx, qword [0x1401d8d88]
mov r8d, 7
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x1400617b0
lea r9, str.Config3
mov edx, 7
mov rcx, rdi
call fcn.140072280
mov byte [0x1401d9fdf], 1
call fcn.140060770
mov dword [0x14020fdd0], 0
mov ecx, dword [0x14020fddc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140061842
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 7
jb 0x140061818
cmp rax, 0x10
mov qword [reloc.WS2_32.dll_getsockopt], 7
mov rbx, rdi
lea rdx, str.Config4
cmovae rbx, qword [0x1401d8d88]
mov r8d, 7
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x14006182c
lea r9, str.Config4
mov edx, 7
mov rcx, rdi
call fcn.140072280
mov byte [0x1401d9fdf], 1
call fcn.140060770
mov dword [0x14020fdd0], 0
mov ecx, dword [0x14020fd64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x30]
test al, 1
je 0x1400618c0
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rax, 7
jb 0x140061896
cmp rax, 0x10
mov qword [reloc.WS2_32.dll_getsockopt], 7
mov r8d, 7
lea rdx, str.Config5
cmovae rdi, qword [0x1401d8d88]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 7], 0
jmp 0x1400618aa
lea r9, str.Config5
mov edx, 7
mov rcx, rdi
call fcn.140072280
mov byte [0x1401d9fdf], 1
call fcn.140060770
mov dword [0x14020fdd0], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1400630a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400630e0
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x57
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063111
xor r9d, r9d
xor edx, edx
mov cl, 0x41
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063142
xor r9d, r9d
xor edx, edx
mov cl, 0x53
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x53
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063173
xor r9d, r9d
xor edx, edx
mov cl, 0x44
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400631a4
xor r9d, r9d
xor edx, edx
mov cl, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x14020fd16], 0
je 0x1400631ee
mov ecx, dword [0x1401d8e3c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140063214
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa2
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0xa2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_keybd_event]
add rsp, 0x28
ret
Function at 0x140063d40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x14020feec]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140063dc6
mov edx, dword [0x1401da078]
mov r8d, dword [0x14020fee0]
cmp edx, r8d
jne 0x140063d91
cmp byte [0x1401da0a5], 0
sete cl
cmp byte [0x1401d9fd9], 0
mov byte [0x1401da0a5], cl
sete byte [0x1401d9fd9]
jmp 0x140063d98
movzx ecx, byte [0x1401da0a5]
test cl, cl
jne 0x140063dc6
cmp edx, r8d
jne 0x140063dc6
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140063dc6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x1401db13f], 0
je 0x140063e6f
mov ecx, dword [0x1401d9078]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140063e6f
cmp byte [0x14020fe4d], 0
jne 0x140063df8
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [reloc.XINPUT1_3.dll_Ordinal_2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140063e2a
cmp byte [reloc.WS2_32.dll_accept], al
je 0x140063e18
mov byte [0x14020fdf1], 1
cmp byte [0x14020fe4d], 0
je 0x140063e3a
mov byte [reloc.WS2_32.dll_accept], 0
jmp 0x140063e3a
cmp byte [0x14020fe4d], 0
je 0x140063e3a
mov byte [reloc.WS2_32.dll_accept], 1
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140063e68
cmp byte [0x14020fdf1], 0
je 0x140063e68
xor r9d, r9d
xor r8d, r8d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x14020fdf1], 0
mov ecx, dword [0x1401d9078]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140063e8e
mov byte [reloc.WS2_32.dll_accept], 1
mov byte [0x14020fdf1], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140064280
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x14020fd16], 0
je 0x1400643e2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp byte [0x14020fde7], 0
mov rbx, rax
jne 0x140064351
mov ecx, dword [0x1401d8dc0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400643b7
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1402100c0], eax
jle 0x14006430a
lea rcx, [0x1402100c0]
call fcn.1400d4400
cmp dword [0x1402100c0], 0xffffffff
jne 0x14006430a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x1402100c0]
mov dword [0x140210070], eax
call fcn.1400d4394
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140210070]
cmp eax, 0xa
jbe 0x1400643dd
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401da0a4], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [rsp + 0x20]
mov dword [0x140210070], eax
add rsp, 0x28
ret
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140064372
cmp byte [0x14020fe6b], 0
sete al
mov byte [0x14020fe6b], al
jmp 0x140064379
movzx eax, byte [0x14020fe6b]
test al, al
je 0x1400643dd
mov ecx, dword [0x1401d8dc0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400643b7
movsxd r8, dword [0x1401d8e3c]
xor r9d, r9d
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x20]
mov byte [0x1401da0a4], 1
add rsp, 0x28
ret
cmp byte [0x1401da0a4], 0
je 0x1400643dd
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401da0a4], 0
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140064730
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14020fd0c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006492a
cmp byte [0x14020fe5e], 0
je 0x14006492a
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
xor esi, esi
cmp byte [reloc.WS2_32.dll_accept], sil
mov qword [rsp + 0x30], rdi
je 0x140064794
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea ecx, [rsi + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
cvttss2si rcx, dword [0x1401d8e18]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
cmp dword [0x14020fe60], esi
mov edi, esi
mov eax, 3
je 0x1400647b8
mov eax, 6
mov dword [reloc.WS2_32.dll_closesocket], eax
nop
mov ebx, 0xa
nop word [rax + rax]
mov edx, dword [0x1401da058]
mov ecx, dword [0x1401d9ff0]
call qword [sym.imp.USER32.dll_SetCursorPos]
xor edx, edx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
jle 0x140064808
add dword [0x1401d9ff0], eax
cvttss2si rcx, dword [0x1401d8d80]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_mouse_event]
sub rbx, 1
jne 0x1400647d0
mov ecx, dword [reloc.WS2_32.dll_accept]
test ecx, ecx
jle 0x14006484f
mov eax, dword [0x1401d9ff8]
add dword [0x1401da058], ecx
mov dword [0x1401d9ff0], eax
inc edi
cmp edi, dword [reloc.WS2_32.dll_closesocket]
jl 0x1400647c0
mov rdi, qword [rsp + 0x30]
mov ecx, Ordinal_79
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
cmp byte [reloc.WS2_32.dll_accept], 0
mov rsi, qword [rsp + 0x48]
je 0x1400648b2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x45
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x45
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x1401d9ff8]
mov ebx, 1
mov dword [0x1401d9ff0], eax
mov eax, dword [0x1401da0c0]
mov dword [0x1401da058], eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14006491b
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
movzx ecx, bl
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
inc ebx
cmp ebx, 0x100
jl 0x1400648e0
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1400655a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140065727
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400655f3
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x57
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140065624
xor r9d, r9d
xor edx, edx
mov cl, 0x41
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140065655
xor r9d, r9d
xor edx, edx
mov cl, 0x53
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x53
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140065686
xor r9d, r9d
xor edx, edx
mov cl, 0x44
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400656b7
xor r9d, r9d
xor edx, edx
mov cl, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x14020fd16], 0
je 0x140065701
mov ecx, dword [0x1401d8e3c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140065727
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8e3c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa2
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0xa2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_keybd_event]
add rsp, 0x28
ret

Function at 0x140065730
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020fd84]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14006575b
cmp byte [0x14020fde5], 0
je 0x14006575b
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x1401d8d06]
add rsp, 0x28
ret