joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f3f8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r14d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r14 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14002698c
mov rdx, qword [rsi]
lea ecx, [r14 + r14]
movsxd rbx, ecx
add rdx, rdi
mov rcx, rax
mov r8, rbx
mov r15, rax
call fcn.140026a50
add qword [rsi], rbx
xor eax, eax
movsxd rcx, r14d
mov word [r15 + rcx*2], ax
test r14d, r14d
jle 0x14006f487
mov rax, r15
mov ecx, r14d
xor word [rax], r14w
lea rax, [rax + 2]
dec rcx
jne 0x14006f47a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r15
add rsp, 0x20
pop r15
ret

Function at 0x14006fc10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
xor eax, eax
cmp qword [rcx + 0x28], rax
lea edx, [rax + 2]
cmovne eax, edx
mov edx, dword [rcx]
cmp edx, eax
jge 0x14006fc24
mov edx, eax
jmp 0x140071364
test edx, edx
js 0x1400713f3
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ebx, edx
movaps xmmword [rsp + 0x20], xmm7
test edx, edx
jne 0x14007138a
xor ecx, ecx
jmp 0x1400713de
cmp ebx, 0xf
jae 0x1400713dc
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400713dc
xorps xmm7, xmm7
cvtsi2sd xmm7, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm6, xmm6
sub rax, qword [rsp + 0x60]
cvtsi2sd xmm6, rax
call fcn.1400260dc
divsd xmm6, xmm0
comisd xmm7, xmm6
ja 0x1400713a6
jmp 0x1400713e4
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret

Function at 0x14006fc2c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
xor eax, eax
cmp qword [rcx + 0x28], rax
lea edx, [rax + 2]
cmovne eax, edx
mov edx, dword [rcx + 4]
cmp edx, eax
jge 0x14006fc41
mov edx, eax
jmp 0x140071364
Function at 0x14006fc48
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x120
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rdx], esi
mov word [rdx + 4], si
cmp qword [rcx + 0x28], rsi
je 0x14006fce2
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x14006fdb8
mov al, 0x80
cmp byte [rsp + 0xc0], al
je 0x14006fc97
cmp byte [rsp + 0x30], al
jne 0x14006fca0
cmp byte [rdi + 0x1e], sil
jne 0x14006fca0
mov byte [rbx], 1
cmp byte [rsp + 0xc1], al
jne 0x14006fcb3
cmp byte [rdi + 0x1f], sil
jne 0x14006fcb3
mov byte [rbx + 1], 1
cmp byte [rsp + 0x31], al
jne 0x14006fcc3
cmp byte [rdi + 0x20], sil
jne 0x14006fcc3
mov byte [rbx + 2], 1
cmp byte [rsp + 0x32], al
jne 0x14006fcd3
cmp byte [rdi + 0x21], sil
jne 0x14006fcd3
mov byte [rbx + 3], 1
cmp byte [rsp + 0x7b], al
jne 0x14006fdb8
jmp 0x14006fdae
mov ecx, LHashValOfNameSys
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebp, 0x8000
test bp, ax
jne 0x14006fd07
mov ecx, LHashValOfNameSys
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14006fd10
cmp byte [rdi + 0x1e], sil
jne 0x14006fd10
mov byte [rbx], 1
mov ecx, LHashValOfNameSys
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bp, ax
jne 0x14006fd30
mov ecx, LHashValOfNameSys
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14006fd3a
cmp byte [rdi + 0x1f], sil
jne 0x14006fd3a
mov byte [rbx + 1], 1
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bp, ax
jne 0x14006fd5a
mov ecx, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14006fd64
cmp byte [rdi + 0x20], sil
jne 0x14006fd64
mov byte [rbx + 2], 1
mov ecx, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bp, ax
jne 0x14006fd84
mov ecx, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14006fd8e
cmp byte [rdi + 0x21], sil
jne 0x14006fd8e
mov byte [rbx + 3], 1
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bp, ax
jne 0x14006fdae
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14006fdb8
cmp byte [rdi + 0x22], sil
jne 0x14006fdb8
mov byte [rbx + 4], 1
lea r11, [rsp + 0x120]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400703d4
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, r8
mov r14, rdx
mov r8b, 1
mov rdx, rax
mov rbx, rcx
mov qword [rcx + 0x28], rax
call fcn.1400713f4
xor r15d, r15d
cmp byte [rbx + 8], 1
mov bpl, r15b
mov dword [rsp + 0x50], r15d
mov word [rsp + 0x54], r15w
jne 0x14007043d
xor r8d, r8d
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.140070b64
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov bpl, al
call fcn.14006fc48
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.14006fbe4
mov edi, r15d
movsxd rdx, edi
mov rcx, r14
call fcn.14001ed20
movzx esi, word [rax]
test si, si
je 0x140070479
mov rcx, rbx
inc edi
call fcn.14006fec8
mov r8d, 1
movzx edx, si
mov rcx, rbx
call fcn.140070344
mov dword [rbx + 0x18], r15d
mov word [rbx + 0x1c], r15w
jmp 0x140070440
cmp byte [rbx + 8], 1
jne 0x140070499
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140070f08
mov r8b, bpl
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.140070b64
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1400713f4

Function at 0x140070b64
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
movzx esi, dl
mov r14, rcx
mov bl, r8b
mov ecx, esi
mov ebp, esi
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
and dil, 1
cmp bl, dil
je 0x140070be5
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov dl, sil
mov r8d, eax
mov rcx, r14
int3
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov al, dil
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140070c04
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x160
mov dil, byte [rdx]
mov bpl, byte [rdx + 7]
mov rbx, rcx
movzx ecx, word [rdx + 8]
xor r14d, r14d
mov rsi, rdx
mov r15d, 1
cmp qword [rbx + 0x28], r14
je 0x140070cf2
cmp dil, 0x14
je 0x140070cf2
lea eax, [rdi + 0x70]
cmp al, r15b
jbe 0x140070cf2
cmp dil, 0xff
je 0x140070cda
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140070c82
movzx eax, dil
lea rcx, [rsp + 0x60]
or byte [rsp + rax + 0x60], 0x80
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bpl
mov rcx, rsi
shl eax, 0x10
movsxd r9, eax
or r9, r15
call fcn.14006fe88
cmp al, r15b
jne 0x140070ca1
bts r9, 0x18
cmp byte [rbx + 0x1b], r14b
jne 0x140070cb3
cmp byte [rbx + 0x21], r14b
jne 0x140070cb3
cmp dil, 0x12
jne 0x140070ccf
cmp byte [rbx + 0x1a], r14b
jne 0x140070ccf
cmp byte [rbx + 0x20], r14b
jne 0x140070ccf
bts r9, 0x1d
movzx r8d, dil
mov edx, 0x104
jmp 0x140070ce6
movzx r8d, dil
mov edx, 0x100
jmp 0x140070ce6
movzx r8d, cx
mov r9, r15
mov edx, 0x102
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140070d4f
cmp dil, 0xff
je 0x140070d1d
mov rcx, rdx
call fcn.14006fe88
mov r8b, bpl
mov dl, dil
mov rcx, rbx
cmp al, r15b
jne 0x140070d13
mov r9d, r15d
jmp 0x140070d16
xor r9d, r9d
int3
mov word [rsp + 0x3a], cx
lea rdx, [rsp + 0x30]
mov r8d, SafeArrayCreateEx
mov ecx, r15d
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x38], r14w
mov qword [rsp + 0x3c], 4
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
jmp fcn.14006fc2c
Function at 0x140070d74
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x160
mov dil, byte [rdx]
mov bpl, byte [rdx + 7]
mov rbx, rcx
movzx ecx, word [rdx + 8]
xor r14d, r14d
mov rsi, rdx
cmp qword [rbx + 0x28], r14
je 0x140070e52
cmp dil, 0x14
je 0x140070e52
lea eax, [rdi + 0x70]
cmp al, 1
jbe 0x140070e52
cmp dil, 0xff
je 0x140070eb6
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140070df0
movzx eax, dil
lea rcx, [rsp + 0x60]
xor byte [rsp + rax + 0x60], 0x80
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bpl
mov rcx, rsi
shl eax, 0x10
movsxd r9, eax
mov eax, 0xc0000001
or r9, rax
call fcn.14006fe88
cmp al, 1
jne 0x140070e13
bts r9, 0x18
cmp byte [rbx + 0x1b], r14b
jne 0x140070e25
cmp byte [rbx + 0x21], r14b
jne 0x140070e25
cmp dil, 0x12
jne 0x140070e3d
cmp byte [rbx + 0x1a], r14b
jne 0x140070e3d
cmp byte [rbx + 0x20], r14b
jne 0x140070e3d
bts r9, 0x1d
mov edx, 0x105
jmp 0x140070e42
mov edx, 0x101
mov rcx, qword [rbx + 0x28]
movzx r8d, dil
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140070eb6
cmp dil, 0xff
je 0x140070e80
mov rcx, rdx
call fcn.14006fe88
mov r8b, bpl
mov dl, dil
mov rcx, rbx
mov r9d, 3
cmp al, 1
je 0x140070e79
mov r9d, 2
int3
mov r8d, SafeArrayCreateEx
mov word [rsp + 0x3a], cx
lea rdx, [rsp + 0x30]
lea ecx, [r8 - 0x27]
mov dword [rsp + 0x30], 1
mov word [rsp + 0x38], r14w
mov qword [rsp + 0x3c], 6
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp fcn.14006fc10

Function at 0x140070edc
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140070c04
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140070d74
Function at 0x140070f08
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp byte [rdx], sil
jne 0x140070f4c
cmp byte [rdx + 1], sil
jne 0x140070f4c
cmp byte [rdx + 2], sil
jne 0x140070f4c
cmp byte [rdx + 3], sil
jne 0x140070f4c
cmp byte [rdx + 4], sil
je 0x140071114
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x14007109a
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14007109a
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140070fc2
mov al, byte [rsp + 0x40]
mov cl, 0x80
cmp byte [rbx], sil
je 0x140070f8b
or al, cl
or byte [rbp - 0x30], cl
mov byte [rsp + 0x40], al
cmp byte [rbx + 1], sil
je 0x140070f9a
or al, cl
or byte [rbp - 0x2f], cl
mov byte [rsp + 0x40], al
cmp byte [rbx + 2], sil
je 0x140070fa4
or byte [rsp + 0x41], cl
cmp byte [rbx + 3], sil
je 0x140070fae
or byte [rsp + 0x42], cl
cmp byte [rbx + 4], sil
je 0x140070fb7
or byte [rbp - 0x75], cl
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [rbx], sil
jne 0x140070fcd
cmp byte [rbx + 1], sil
je 0x140070ff0
movzx eax, byte [rdi + 0x32]
mov rcx, qword [rdi + 0x28]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.WSOCK32.dll_recv
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbx + 2], sil
je 0x140071019
movzx eax, byte [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.WSOCK32.dll_recvfrom
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, byte [rbx + 3]
test al, al
je 0x14007106b
cmp byte [rbx + 2], sil
jne 0x140071044
cmp byte [rdi + 0x20], sil
jne 0x140071044
movzx eax, byte [rdi + 0x31]
mov edx, 0x104
shl eax, 0x10
movsxd r9, eax
or r9, 0x20000001
jmp 0x14007105b
test al, al
je 0x14007106b
movzx eax, byte [rdi + 0x31]
mov edx, 0x100
shl eax, 0x10
movsxd r9, eax
or r9, 1
mov rcx, qword [rdi + 0x28]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbx + 4], sil
je 0x14007110c
movzx eax, byte [rdi + 0x35]
mov rcx, qword [rdi + 0x28]
mov edx, 0x100
shl eax, 0x10
mov r8d, 0x5b
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14007110c
cmp byte [rbx], sil
je 0x1400710b0
mov r8b, byte [rdi + 0x33]
xor r9d, r9d
mov dl, 0xa0
mov rcx, rdi
int3
cmp byte [rbx + 1], sil
je 0x1400710c7
mov r8b, byte [rdi + 0x34]
xor r9d, r9d
mov dl, 0xa1
mov rcx, rdi
int3
cmp byte [rbx + 2], sil
je 0x1400710de
mov r8b, byte [rdi + 0x30]
xor r9d, r9d
mov dl, reloc.WSOCK32.dll_recvfrom
mov rcx, rdi
int3
cmp byte [rbx + 3], sil
je 0x1400710f5
mov r8b, byte [rdi + 0x31]
xor r9d, r9d
mov dl, reloc.WSOCK32.dll_select
mov rcx, rdi
int3
cmp byte [rbx + 4], sil
je 0x14007110c
mov r8b, byte [rdi + 0x35]
xor r9d, r9d
mov dl, 0x5b
mov rcx, rdi
int3
mov rcx, rdi
call fcn.14006fc2c
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140071364
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
xor eax, eax
cmp qword [rcx + 0x28], rax
lea edx, [rax + 2]
cmovne eax, edx
mov edx, dword [rcx]
cmp edx, eax
jge 0x14006fc24
mov edx, eax
jmp 0x140071364
test edx, edx
js 0x1400713f3
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ebx, edx
movaps xmmword [rsp + 0x20], xmm7
test edx, edx
jne 0x14007138a
xor ecx, ecx
jmp 0x1400713de
cmp ebx, 0xf
jae 0x1400713dc
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400713dc
xorps xmm7, xmm7
cvtsi2sd xmm7, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm6, xmm6
sub rax, qword [rsp + 0x60]
cvtsi2sd xmm6, rax
call fcn.1400260dc
divsd xmm6, xmm0
comisd xmm7, xmm6
ja 0x1400713a6
jmp 0x1400713e4
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret

Function at 0x1400713f4
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15b, r8b
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140071423
cmp byte [rcx + 9], dl
je 0x140071516
xor r14d, r14d
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
test r15b, r15b
je 0x1400714d2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea r8d, [r14 + 1]
mov ecx, ebx
mov edx, eax
mov dword [0x1400e8198], eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r15d, eax
test rdi, rdi
je 0x1400714ab
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [0x1400e8198]
mov dword [0x1400e819c], eax
cmp ecx, eax
je 0x140071499
lea r8d, [r14 + 1]
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14d, eax
mov eax, dword [0x1400e819c]
mov r8d, 1
mov edx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov ebp, eax
test r15d, r15d
jne 0x140071516
test r14d, r14d
jne 0x140071516
test ebp, ebp
jne 0x140071516
mov eax, dword [0x1400e8198]
cmp ebx, eax
jne 0x140071516
cmp eax, dword [0x1400e819c]
jne 0x140071516
and qword [rsi + 0x28], 0
jmp 0x140071516
test rdi, rdi
je 0x140071503
mov edx, dword [0x1400e819c]
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [0x1400e8198]
mov edx, dword [0x1400e819c]
cmp eax, edx
je 0x140071509
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [0x1400e8198]
xor r8d, r8d
mov edx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140071598
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov qword [rcx], 0xff
mov word [rcx + 8], dx
mov byte [rcx + 0xa], al
test dx, dx
je 0x140071600
movzx ecx, dx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
jne 0x1400715cd
xor al, al
jmp 0x140071600
movzx edi, ax
movzx ecx, al
xor edx, edx
sar di, 8
mov byte [rbx], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 7], al
mov al, 1
test al, dil
je 0x1400715ee
mov byte [rbx + 1], al
test dil, 2
je 0x1400715f7
mov byte [rbx + 3], al
test dil, 4
je 0x140071600
mov byte [rbx + 4], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140073934
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.1400737ac
mov rcx, qword [rsi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add qword [rsi + 0x18], rax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140073bbc
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp dl, 1
jne 0x140073bee
int3
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret

Function at 0x140073c14
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1ff88]
mov eax, 0x20080
call fcn.140039090
sub rsp, rax
mov dil, r8b
mov rbx, rdx
mov esi, 0x7fff
lea r8, [rbp + 0xff80]
mov edx, esi
call fcn.14007512c
lea r8, [rbp - 0x80]
mov edx, esi
mov rcx, rbx
call fcn.14007512c
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xff80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jne 0x140073cae
test dil, dil
je 0x140073ca7
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xff80]
call fcn.140027cf4
test eax, eax
je 0x140073ca0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xff80]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x140073d52
xor al, al
jmp 0x140073d52
lea rcx, [rbp + 0xff80]
int3
lea r11, [rsp + 0x20080]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140074080
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rcx]
lea rdx, [0x1400ac49c]
mov edi, 1
mov qword [rbp - 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rbp - 0x38], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x30], rax
mov rax, qword [rcx + 0x18]
lea rcx, [rbp - 0x40]
add dword [rax], edi
mov qword [rbp - 0x28], rax
call fcn.14001f520
mov rsi, qword [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140074176
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x140074104
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140074109
jmp 0x140074184
cmp eax, 3
jne 0x14007417f
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rsi
lea rdx, [0x1400ac49c]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 8], rax
add dword [rax], edi
call fcn.14001f140
or r8, 0xffffffffffffffff
cmp rax, r8
je 0x14007416b
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.14001f1a4
lea rcx, [rbp - 0x20]
call fcn.140074080
test al, al
je 0x140074169
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea rcx, [rbp - 0x20]
call fcn.14001c5f8
jmp 0x140074181
test al, 0x10
je 0x14007417f
mov bl, dil
jmp 0x140074181
xor ebx, ebx
mov dil, bl
lea rcx, [rbp - 0x40]
call fcn.14001c5f8
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140074338
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
mov r15, rdx
xor edx, edx
mov r12, rcx
lea ecx, [rdx + 2]
mov rbx, r8
mov dword [rbp - 0x70], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x70]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, qword [r12]
xor r13d, r13d
mov byte [rbx], r13b
mov esi, r13d
cmp word [rdi], r13w
je 0x1400743b7
mov rcx, rdi
movzx ecx, word [rcx]
call fcn.140027df0
test eax, eax
je 0x1400743c7
inc esi
lea rcx, [rdi + rsi*2]
cmp word [rcx], r13w
jne 0x14007439f
mov rcx, rdi
call fcn.140027d3c
mov rdi, rax
jmp 0x14007447c
mov edi, r13d
jmp 0x14007447c
lea rdx, [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140074485
lea rcx, [rsp + 0x30]
call fcn.14001e7d0
lea rcx, [rsp + 0x50]
call fcn.14001e7d0
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x70]
call fcn.14001f29c
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140025674
lea rcx, [rsp + 0x70]
call fcn.14001c5f8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14001ee40
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
call fcn.14001ec94
test eax, eax
jne 0x140074457
mov eax, dword [rbp - 0x68]
jmp 0x140074462
test edi, edi
je 0x140074468
mov eax, dword [rbp - 0x68]
cmp edi, eax
jne 0x140074468
mov dword [r15], eax
mov byte [rbx], 1
lea rcx, [rsp + 0x50]
call fcn.14001c5f8
lea rcx, [rsp + 0x30]
call fcn.14001c5f8
cmp byte [rbx], r13b
je 0x1400743cf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x2d0]
mov al, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x1400744b4
Capabilities:
Get storage device properties

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x80
and qword [rax - 0x58], 0
and dword [rdx], 0
mov rdi, rdx
mov edx, 0x80
xor r9d, r9d
lea r8d, [rdx - 0x7d]
mov dword [rax - 0x60], edx
mov dword [rax - 0x68], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400744f8
xor al, al
jmp 0x140074571
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
xor eax, eax
lea ebx, [rax + 0x28]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, ebx
mov dword [rsp + 0x48], eax
call fcn.1400272c0
and qword [rsp + 0x38], 0
and dword [rsp + 0x98], 0
lea rax, [rsp + 0x98]
lea r9d, [rbx - 0x1c]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400744f4
mov eax, dword [rsp + 0x6c]
mov dword [rdi], eax
mov al, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret