joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180055110
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
movzx ecx, byte [rdi + 0x20]
cmp cl, byte [rbx + 0x38]
jne 0x180055159
cmp al, byte [rbx + 0x39]
je 0x180055174
mov byte [rbx + 0x38], cl
mov byte [rbx + 0x39], al
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x180055174
mov rax, qword [rcx]
mov edx, 0x10001
call qword [rax + 0x18]
nop
mov rcx, rdi
call fcn.18004f5d0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801027e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180055330
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xb0
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlKeyboard_Layouts
mov rcx, 0xffffffff80000002
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180055456
mov qword [rsp + 0xc0], rbx
mov ebx, 0xe0200804
nop dword [rax]
cmp ebx, 0xe0ff0804
ja 0x18005544e
mov r9d, ebx
lea r8, str._08X
mov edx, 9
lea rcx, [rsp + 0x48]
call fcn.180055230
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180055434
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0x40
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Ime_File
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180055434
cmp dword [rsp + 0x34], 1
jne 0x180055434
lea rdx, str.GSoInput.ime
lea rcx, [rsp + 0x60]
call fcn.1801164dc
test eax, eax
jne 0x180055434
mov edi, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0x10000
test rdi, rdi
je 0x180055390
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1801027e0
add rsp, 0xb0
pop rdi
ret
Function at 0x180055a00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x40], 0x100
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x180055a40
xor eax, eax
jmp 0x180055b18
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x1a0], rbx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x170], rbp
xor edx, edx
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov ebx, ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x180055ae9
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x15f], bpl
call fcn.180055a00
mov ebx, eax
test eax, eax
jne 0x180055ae9
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180055a90
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x170]
test ebx, ebx
jne 0x180055b0e
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1801027e0
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x180056840
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800568ef
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
je 0x180056899
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800568ef
lea rdx, str.GSoInputServer.exe
lea rcx, [rsp + 0x4c]
call fcn.1801164dc
test eax, eax
je 0x1800568d8
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x18005688e
lea rdx, str.GSoInputServer.exe
lea rcx, [rsp + 0x4c]
call fcn.1801164dc
test eax, eax
jne 0x1800568b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1800568ef
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1801027e0
add rsp, 0x270
pop rbx
ret
Function at 0x180058f60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov esi, edx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180059022
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
je 0x180058fc7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180059022
lea rdx, str.GSoInputServer.exe
lea rcx, [rsp + 0x8c]
call fcn.1801164dc
test eax, eax
je 0x18005900b
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x180058fbc
lea rdx, str.GSoInputServer.exe
lea rcx, [rsp + 0x8c]
call fcn.1801164dc
test eax, eax
jne 0x180058fe0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x68]
test ecx, ecx
je 0x180059022
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rdi + 0x1e0]
mov r8d, esi
mov edx, 0x800d
mov r9d, dword [rcx]
call fcn.18007b2f0
cmp esi, 0x9c4d
jb 0x180059124
cmp esi, 0x9c4e
jbe 0x1800590ad
cmp esi, 0x9c56
je 0x18005908a
cmp esi, 0x9c57
jne 0x180059124
mov rax, qword [rdi + 0x1c0]
test rax, rax
je 0x180059078
mov rax, qword [rax + 0x10]
mov byte [rax + 0x198], 0
mov edx, 1
mov rcx, rdi
call fcn.180058d30
jmp 0x180059124
mov rax, qword [rdi + 0x1c0]
test rax, rax
je 0x1800590a1
mov rax, qword [rax + 0x10]
mov byte [rax + 0x198], 1
xor edx, edx
mov rcx, rdi
call fcn.180058d30
jmp 0x180059124
mov dl, 1
mov rcx, rdi
call fcn.180051fb0
cmp esi, 0x9c4d
lea rbx, [rdi + 0x1f0]
mov rdx, rbx
lea rcx, [rsp + 0x20]
sete al
mov byte [rdi + 0x210], al
call fcn.1800520d0
movzx eax, byte [rbx + 0x20]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x40], al
mov rcx, rdi
movzx eax, byte [rbx + 0x21]
mov byte [rsp + 0x41], al
movzx eax, byte [rbx + 0x22]
mov byte [rsp + 0x42], al
movzx eax, byte [rbx + 0x23]
mov byte [rsp + 0x43], al
movzx eax, byte [rbx + 0x24]
mov byte [rsp + 0x44], al
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x48], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x50], eax
call fcn.180058c50
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800592e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
jmp 0x180059310
add rsp, 0x48
ret
Function at 0x180059d30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180059dae
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x180059da5
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call fcn.1801164dc
mov rcx, rbx
test eax, eax
je 0x180059dd1
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x180059d81
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1801027e0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x180059db0

Function at 0x180059de0
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x20f0
call fcn.180103500
sub rsp, rax
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x20e0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x2000
call fcn.1801099b0
mov r9d, 0xfff
lea rcx, [rsp + 0xe0]
mov r8, rbx
lea edx, [r9 + 1]
call fcn.1801163f0
xor edx, edx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.1801099b0
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180059ea5
mov eax, 0xffffffff
jmp 0x180059ecd
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x20e0]
xor rcx, rsp
call fcn.1801027e0
add rsp, 0x20f0
pop rbx
ret
Function at 0x18005d650
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x40
mov rbx, rcx
mov r14, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18005d6a9
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rdi - 1]
cmp ecx, 0xfffffffd
ja 0x18005d6ec
lea rdx, [0x1801c9390]
mov dword [rsp + 0x70], 0
mov ecx, edi
call fcn.18010333c
mov rbx, rax
test rax, rax
jne 0x18005d70a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1801099b0
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005d73e
cmp dword [rsp + 0x70], edi
je 0x18005d748
mov rcx, rbx
call fcn.180102804
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov qword [r14], rbx
jmp 0x18005d6f7
Function at 0x18005d760
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18005d79a
test al, 0x10
jne 0x18005d891
mov rax, rdi
test rdi, rdi
je 0x18005d898
xor esi, esi
nop dword [rax + rax]
mov edx, 0x5c
mov rcx, rax
call fcn.180109184
mov rbx, rax
test rax, rax
je 0x18005d891
cmp word [rax - 2], 0x3a
je 0x18005d884
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], si
jne 0x18005d7e0
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], si
jne 0x18005d7f0
sub eax, ecx
movsxd rcx, eax
cmp rcx, 0x7ffffffe
jbe 0x18005d80e
mov word [rsp + 0x20], si
jmp 0x18005d85e
lea r9, [rcx - 0x104]
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edx, 0x104
sub r8, rcx
lea rax, [rsp + 0x20]
nop word [rax + rax]
lea rcx, [r9 + rdx]
test rcx, rcx
je 0x18005d850
movzx ecx, word [r8 + rax]
test cx, cx
je 0x18005d850
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x18005d830
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
mov word [rcx], si
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18005d884
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18005d898
lea rax, [rbx + 2]
test rax, rax
jne 0x18005d7b0
mov eax, 1
jmp 0x18005d89a
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18005ea60
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18005eaba
mov rcx, qword [rbx + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x1801cad88], 0
mov byte [rbx + 0x8a0], 0
je 0x18005eaba
mov rcx, qword [rbx + 8]
mov edx, 0x1330684
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
mov qword [0x1801cad88], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800609b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rcx
lea rdx, [rsp + 0x20]
lea rcx, str.ntdll.dll
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test eax, eax
je 0x180060a66
mov ecx, ebx
call fcn.180116654
mov edx, dword [rsp + 0x20]
lea rcx, str.ntdll.dll
mov r9, rax
mov r8d, ebx
mov rdi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea r9, [rsp + 0x24]
mov rcx, rdi
lea r8, [rsp + 0x28]
lea rdx, [0x180179e58]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180060a4d
cmp dword [rsp + 0x24], 0x34
jb 0x180060a4d
mov rax, qword [rsp + 0x28]
mov rcx, rdi
movzx ebp, word [rax + 0xe]
movzx esi, word [rax + 8]
movzx ebx, word [rax + 0xa]
call fcn.1801164d4
jmp 0x180060a75
movzx ebp, word [rsp + 0x20]
mov rcx, rdi
movzx esi, word [rsp + 0x20]
movzx ebx, word [rsp + 0x20]
call fcn.1801164d4
jmp 0x180060a75
movzx ebp, word [rsp + 0x20]
movzx esi, word [rsp + 0x20]
movzx ebx, word [rsp + 0x20]
cmp bx, 6
jb 0x180060bca
ja 0x180060a9b
cmp si, 1
jb 0x180060bca
ja 0x180060a9b
mov eax, 0x1db0
cmp bp, ax
jb 0x180060bca
mov edi, 0x64
test r14, r14
je 0x180060b8e
cmp bx, 0xa
jb 0x180060afc
ja 0x180060ac0
test si, si
jne 0x180060ac0
mov eax, 0x3a6b
cmp bp, ax
jb 0x180060afc
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180060bc6
lea rdx, str.GetDpiForWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180060b81
mov rcx, r14
call rax
imul ecx, eax, 0x64
jmp 0x180060b75
cmp bx, 6
ja 0x180060b0c
cmp si, 3
jb 0x180060b8e
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180060bc6
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, 2
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_MonitorFromRect]
lea rdx, str.GetDpiForMonitor
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180060b81
lea r9, [rsp + 0x20]
xor edx, edx
lea r8, [rsp + 0x24]
mov rcx, rsi
call rax
test eax, eax
js 0x180060b81
imul ecx, dword [rsp + 0x24], 0x64
mov eax, 0xaaaaaaab
mul ecx
mov edi, edx
shr edi, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x180060bcf
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, 0x60
mov edx, edi
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rdx, rbx
mov rcx, r14
mov edi, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, edi
jmp 0x180060bcf
mov eax, 0x64
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801027e0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180063160
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov word [rsp + 0x30], bx
lea r8d, [rbx + 5]
lea rdx, [0x18017be60]
lea rcx, [r11 - 0x38]
call fcn.18004f440
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.180091e20
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.18004f5d0
test rdi, rdi
je 0x180063230
lea ecx, [rbx + 0x14]
call qword [sym.imp.USER32.dll_GetKeyState]
mov r8, qword [rdi]
test al, 1
je 0x180063214
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [r8 + 0x3f8]
cmp qword [rsp + 0x20], rbx
je 0x180063230
mov rax, qword [rdi]
lea edx, [rbx + 3]
mov rcx, rdi
call qword [rax + 0x468]
jmp 0x180063230
mov rax, qword [rsi + 0x348]
movzx ecx, byte [rax + 0x20]
neg cl
sbb edx, edx
add edx, 2
mov rcx, rdi
call qword [r8 + 0x468]
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
mov r8d, 7
lea rdx, [0x18017be80]
lea rcx, [rsp + 0x30]
call fcn.18004f440
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.180091e20
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.18004f5d0
test rdi, rdi
je 0x180063299
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x348]
mov edx, ebx
cmp byte [rcx + 0x23], dl
setne dl
inc edx
mov rcx, rdi
call qword [r8 + 0x468]
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
mov r8d, 9
lea rdx, [0x18017bec0]
lea rcx, [rsp + 0x30]
call fcn.18004f440
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.180091e20
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.18004f5d0
test rdi, rdi
je 0x18006330d
mov rcx, qword [rsi + 0x348]
cmp byte [rcx + 0x20], 0
jne 0x1800632fc
cmp byte [rcx + 0x24], 0
mov edx, 1
je 0x180063301
mov edx, 2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x468]
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
mov r8d, 7
lea rdx, [0x18017c1b0]
lea rcx, [rsp + 0x30]
call fcn.18004f440
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x48]
call fcn.180091e20
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.18004f5d0
test rdi, rdi
je 0x180063376
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x348]
cmp dword [rcx + 0x30], 1
sete bl
lea edx, [rbx + 1]
mov rcx, rdi
call qword [r8 + 0x468]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180067910
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], 0x114
mov qword [rcx], rax
mov rdi, r8
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, 0x110
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
lea rcx, [rsp + 0x24]
call fcn.1801099b0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18006798f
cmp dword [rsp + 0x24], 6
mov eax, 0x48
jae 0x180067994
mov eax, 0x40
mov rcx, rdi
mov dword [rbx], eax
mov dword [rbx + 4], 0
call qword [sym.imp.USER32.dll_GetParent]
or dword [rbx + 4], 1
mov qword [rbx + 8], rax
mov rax, rbx
mov qword [rbx + 0x10], rdi
mov rcx, qword [0x1801c9ff0]
mov qword [rbx + 0x28], rcx
mov rcx, qword [rsp + 0x188]
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x38], 0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1801027e0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x18007a350
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov qword [rbp - 0x50], rcx
xor r14d, r14d
mov dword [rbp - 0x5c], r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
mov dword [rbp - 0x5c], 1
lea r8d, [r14 + 9]
lea rdx, str..pipe_
call fcn.180053290
mov dword [rbp - 0x60], r14d
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [rbp - 0x60]
test eax, eax
je 0x18007a407
lea ecx, [rax + 1]
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180103264
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [rbp - 0x60], r14d
ja 0x18007a435
mov rcx, rdi
call fcn.180102804
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r14w
xor r8d, r8d
lea rdx, [0x180178270]
lea rcx, [rbp - 0x48]
call fcn.18004f440
mov dword [rbp - 0x5c], 3
jmp 0x18007a4a4
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r14w
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x18007a450
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.18004f440
mov rcx, rdi
call fcn.180102804
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x38], xmm1
movdqa xmm0, xmmword [0x1801833f0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r14w
mov dword [rbp - 0x5c], 3
lea rcx, [rbp - 0x28]
call fcn.18004f5d0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
mov rcx, rsi
call fcn.180053290
nop
lea rcx, [rbp - 0x48]
call fcn.18004f5d0
mov r8d, 1
lea rdx, [0x180179e58]
mov rcx, rsi
call fcn.180053290
mov r8d, 0x11
lea rdx, str.GSoInputNamedPipe
mov rcx, rsi
call fcn.180053290
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret