joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070af0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x140070b33
lea eax, [rdx + 0xd]
jmp 0x140070d00
mov qword [rbp + 0x2f], 7
xor r14d, r14d
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
lea rdx, [rbp + 0x17]
mov rcx, rbx
call fcn.140070d30
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r14
mov word [rbp - 0x29], r14w
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
lea r8, [rbx + 8]
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
mov rdx, rdi
call fcn.140067590
mov edi, eax
test eax, eax
jne 0x140070c8e
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov edi, 2
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x140070c8e
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rbp - 0x41], 7
mov qword [rbp - 0x49], r14
mov word [rbp - 0x59], r14w
cmp word [rdx], r14w
jne 0x140070c01
mov r8d, r14d
jmp 0x140070c10
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140070c05
lea rcx, [rbp - 0x59]
call fcn.140003290
mov dword [rbp - 0x31], r14d
mov eax, dword [rbp - 0x49]
lea r8d, [rax + rax]
lea rdx, [rbp - 0x59]
cmp qword [rbp - 0x41], 8
cmovae rdx, qword [rbp - 0x59]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x31]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
sete bl
mov r8, qword [rbp - 0x41]
cmp r8, 8
jb 0x140070c68
inc r8
mov rdx, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.140003900
mov qword [rbp - 0x41], 7
mov qword [rbp - 0x49], r14
mov word [rbp - 0x59], r14w
test bl, bl
sete bl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140070c8e
mov edi, r14d
mov r8, qword [rbp + 0xf]
cmp r8, 8
jb 0x140070ca8
inc r8
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 9]
call fcn.140003900
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
mov r8, qword [rbp - 0x11]
cmp r8, 8
jb 0x140070cd3
inc r8
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x29]
call fcn.140003900
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r14
mov word [rbp - 0x29], r14w
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x140070cfe
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.140003900
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140185a60
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140089b20
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x1402792b0]
call fcn.14013c930
test al, al
jne 0x140089bef
mov rax, qword [0x140279e80]
sub rax, qword [0x140279e78]
test rax, 0xfffffffffffffff8
je 0x140089bd8
lea rcx, [0x1402792b0]
call fcn.14013c930
test al, al
jne 0x140089bd8
lea rdx, [0x1402792b0]
lea rcx, [0x140279e70]
call fcn.1400805d0
test rax, rax
je 0x140089bd8
mov rax, qword [rax + 0x70]
mov ecx, 0xefffffff
cmp rax, rcx
jne 0x140089c3c
cmp qword [0x140279f30], 0
je 0x140089bd8
lea rcx, [0x140279e90]
call fcn.1400b31e0
mov ecx, dword [0x14027a4f8]
cmp eax, 0xffffffff
cmovne ecx, eax
mov dword [0x14027a4f8], ecx
xor ecx, ecx
call fcn.140089c50
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
call fcn.140127f90
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
xor eax, eax
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x2a], rax
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], bx
mov qword [rsp + 0x32], rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x140089c34
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rdx, [0x140211738]
lea rcx, [rsp + 0x28]
call fcn.1400b6a00
mov ebx, dword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret

Function at 0x140089c50
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
cmp rcx, 0xffffffffffffffff
jne 0x140089c63
add rsp, 0x28
jmp fcn.140089b20
mov rax, qword [0x14027a4e0]
sub rax, qword [0x14027a4d8]
test rax, 0xfffffffffffffff8
je 0x140089cae
cmp qword [0x140279f30], rcx
jbe 0x140089cbc
cmp qword [0x140279f38], 8
lea rax, [0x140279f20]
cmovae rax, qword [0x140279f20]
movzx edx, word [rax + rcx*2]
lea rcx, [0x14027a4d0]
call fcn.140159890
test rax, rax
jne 0x140089cb7
add rsp, 0x28
jmp fcn.140127f90
add rsp, 0x28
ret
lea rcx, [0x1401e3a20]
call fcn.140161f38
int3

Function at 0x14008fee0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [0x14027aa10]
lea rcx, [0x140279e70]
call fcn.1400805d0
test rax, rax
je 0x14008ff58
mov rax, qword [rax + 0x70]
mov ecx, 0xefffffff
cmp rax, rcx
jne 0x14008ff1e
call fcn.140127f90
mov r9d, InitCommonControls
movzx ecx, ax
lea r8, [rsp + 0x20]
lea edx, [r9 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14008ff58
test dword [rsp + 0x2c], 0x8000000
je 0x14008ff58
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
Function at 0x140095e00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14027aa10]
lea rcx, [0x140279e70]
call fcn.1400805d0
test rax, rax
je 0x140095e81
mov r8, qword [rax + 0xc0]
xor edx, edx
sub r8, qword [rax + 0xb8]
movsx r9, word [0x14026fc18]
sar r8, 3
test r8, r8
je 0x140095e81
mov r10, qword [rax + 0xb8]
mov rcx, r10
nop dword [rax]
mov rax, qword [rcx]
cmp qword [rax + 8], r9
je 0x140095e6b
inc rdx
add rcx, 8
cmp rdx, r8
jne 0x140095e50
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r10 + rdx*8]
test rcx, rcx
je 0x140095e81
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140096220
add rsp, 0x20
pop rbx
ret

Function at 0x140096220
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14009639c
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp + 0x2f], 7
xor esi, esi
mov qword [rbp + 0x27], rsi
mov word [rbp + 0x17], si
lea edx, [rsi + 1]
mov r8d, 0xfeff
lea rcx, [rbp + 0x17]
call fcn.14002c260
lea rdx, [rbx + 0x90]
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
lea rcx, [rbp + 0x17]
call fcn.140004ee0
cmp qword [rdi + 0x18], 8
jb 0x1400962a4
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x140096364
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
cmp word [rdx], 0
jne 0x140096300
mov rbx, rsi
jmp 0x14009630a
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140096300
mov r8, rbx
lea rcx, [rbp - 0x19]
call fcn.140003290
mov dword [rbp + 0xf], esi
mov eax, dword [rbp - 9]
lea r8d, [rax + rax]
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x14009635a
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.140003900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x14009637e
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.140003900
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140096229
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14009639c
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp + 0x2f], 7
xor esi, esi
mov qword [rbp + 0x27], rsi
mov word [rbp + 0x17], si
lea edx, [rsi + 1]
mov r8d, 0xfeff
lea rcx, [rbp + 0x17]
call fcn.14002c260
lea rdx, [rbx + 0x90]
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
lea rcx, [rbp + 0x17]
call fcn.140004ee0
cmp qword [rdi + 0x18], 8
jb 0x1400962a4
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x140096364
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
cmp word [rdx], 0
jne 0x140096300
mov rbx, rsi
jmp 0x14009630a
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140096300
mov r8, rbx
lea rcx, [rbp - 0x19]
call fcn.140003290
mov dword [rbp + 0xf], esi
mov eax, dword [rbp - 9]
lea r8d, [rax + rax]
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x14009635a
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.140003900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x14009637e
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.140003900
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140185a60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400afe40
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x1298], 1
mov r12d, r9d
movzx r15d, r8w
movzx r14d, dx
mov rbx, rcx
jne 0x1400afe74
or rax, 0xffffffffffffffff
jmp 0x1400aff76
mov rax, qword [rcx + 0x1250]
test rax, rax
je 0x1400afe6b
add rax, 0x28
je 0x1400afe6b
mov qword [rsp + 0x40], rbp
mov rbp, qword [rax + 8]
test rbp, rbp
jne 0x1400afe9d
or rax, 0xffffffffffffffff
jmp 0x1400aff71
mov rbp, qword [rbp + 8]
movzx r8d, r15w
movzx edx, r14w
mov qword [rsp + 0x48], rsi
call fcn.1400affe0
mov rsi, rax
test al, 4
je 0x1400aff30
lea rcx, [rbx + 0x1160]
call fcn.140143500
mov rcx, rbx
test sil, 0x40
je 0x1400aff01
mov r9d, r12d
movzx r8d, r15w
movzx edx, r14w
call fcn.1400b05b0
cmp eax, 0xffffffff
je 0x1400affda
mov rdx, rbp
mov rcx, rbx
call fcn.1400b0ac0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov eax, 0x20
jmp 0x1400aff6c
mov rdx, rbp
call fcn.1400b0a40
mov rcx, qword [rsp + 0x60]
movzx edx, r14w
mov dword [rcx], eax
mov rcx, rbx
call fcn.1400b0410
or rdx, 0xffffffffffffffff
mov ecx, InitCommonControls
cmp eax, edx
cmove rcx, rdx
mov rax, rcx
jmp 0x1400aff6c
test al, 2
je 0x1400affda
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbx
bt rax, 0xf
jb 0x1400aff8b
mov edx, 0x38
call fcn.1400b0ac0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
lea rcx, [rbx + 0x1160]
call fcn.140143500
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
test sil, 0x20
je 0x1400affc9
mov r9d, 0x62
movzx r8d, r15w
movzx edx, r14w
call fcn.1400b05b0
mov rdx, rbp
mov rcx, rbx
call fcn.1400b0ac0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
lea rcx, [rbx + 0x1160]
call fcn.140143500
mov eax, 0x20
jmp 0x1400aff6c
mov rdx, rbp
call fcn.1400b0a40
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
jmp 0x1400aff6a
or rax, 0xffffffffffffffff
jmp 0x1400aff6c
Function at 0x1400b02b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ecx, ecx
mov rsi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdi, rax
test rax, rax
jne 0x1400b02f1
xor eax, eax
jmp 0x1400b03be
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.14018f1e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1400b02ea
xor eax, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea r9, [rsp + 0x40]
movzx edx, sil
lea r8, [rsp + 0x50]
mov ecx, ebx
mov dword [rsp + 0x20], 1
mov word [rsp + 0x40], ax
call qword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
jne case.default.0x1400b0371
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae case.default.0x1400b0371
lea rax, [rbx - 0x60]
cmp rax, 9
ja case.default.0x1400b0371
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0xb03e4]
add rax, rcx
jmp rax
mov eax, 0x30
jmp 0x1400b03be
mov eax, 0x31
jmp 0x1400b03be
mov eax, 0x32
jmp 0x1400b03be
mov eax, 0x33
jmp 0x1400b03be
mov eax, 0x34
jmp 0x1400b03be
mov eax, 0x35
jmp 0x1400b03be
mov eax, 0x36
jmp 0x1400b03be
mov eax, 0x37
jmp 0x1400b03be
mov eax, 0x38
jmp 0x1400b03be
mov eax, 0x39
jmp 0x1400b03be
movzx eax, word [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140185a60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b0410
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, qword [rcx + 0x218]
movzx ebp, dx
mov rbx, rcx
cmp rsi, 0xffffffffffffffff
jne 0x1400b0445
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
test esi, esi
js 0x1400b0523
mov rax, qword [rcx + 0x280]
sub rax, qword [rcx + 0x278]
sar rax, 3
cmp esi, eax
jge 0x1400b0523
mov rax, qword [rcx + 0x278]
mov qword [rsp + 0x30], rdi
movzx edi, word [rax + rsi*8 + 2]
mov eax, edi
and eax, 4
jne 0x1400b0486
inc qword [rcx + 0x160]
test rax, rax
jne 0x1400b048f
or rdi, 2
movzx eax, dil
and al, 0xc
cmp al, 0xc
jne 0x1400b049d
or rdi, 0x10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
movabs rax, 0xffffffff00000000
sub rdx, qword [rbx + 0x228]
shl rdx, 0x20
and rdx, rax
movzx ecx, di
mov rax, qword [rbx + 0x278]
shl rcx, 0x10
mov ecx, ecx
or rdx, rcx
movzx ebp, bp
or rdx, rbp
mov qword [rax + rsi*8], rdx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, qword [rsp + 0x30]
mov eax, eax
mov qword [rbx + 0x228], rax
cmp rbp, 0x20
je 0x1400b0518
cmp rbp, 0xa
je 0x1400b0518
cmp qword [rbx + 0x240], 1
jne 0x1400b0523
inc qword [rbx + 0x148]
mov qword [rbx + 0x240], 3
jmp 0x1400b0523
mov qword [rbx + 0x240], 1
xor ecx, ecx
cmp qword [rbx + 0x1250], rcx
je 0x1400b055a
mov byte [rbx + 0x1288], cl
mov qword [rbx + 0x128c], rcx
mov word [rbx + 0x128a], cx
mov dword [rbx + 0x1294], 0xffffffff
mov rax, qword [rbx + 0x1250]
mov word [rax + 0xb0], cx
mov rax, qword [rbx + 0x1250]
test rax, rax
je 0x1400b0573
mov dword [rbx + 0x1260], ecx
mov word [rax + 0xb0], cx
mov rcx, qword [rbx + 0xc90]
test rcx, rcx
je 0x1400b0432
mov rbp, qword [rsp + 0x40]
xor edx, edx
imul rax, rsi, 0x64
div rcx
mov qword [rbx + 0x1158], rax
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1400b0b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
or rdi, 0xffffffffffffffff
mov rcx, qword [rcx + 0x218]
mov r14, rdx
cmp ecx, edi
jg 0x1400b0b6e
xor eax, eax
jmp 0x1400b0b9e
test ecx, ecx
js 0x1400b0b9b
mov rax, qword [rbx + 0x280]
sub rax, qword [rbx + 0x278]
sar rax, 3
cmp ecx, eax
jge 0x1400b0b9b
mov rax, qword [rbx + 0x278]
mov ecx, dword [rax + rcx*8]
shr rcx, 0x10
movzx eax, cl
jmp 0x1400b0b9e
mov rax, rdi
mov rsi, qword [rdx]
mov qword [rsp + 0x30], rbp
test rsi, rsi
je 0x1400b0c71
test al, 0x1c
jne 0x1400b0c71
movabs rbp, 0xffffffff00200000
test rax, rax
je 0x1400b0c06
test esi, esi
js 0x1400b0c06
mov rax, qword [rbx + 0x280]
sub rax, qword [rbx + 0x278]
sar rax, 3
cmp esi, eax
jge 0x1400b0c06
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub rcx, qword [rbx + 0x228]
mov rax, qword [rbx + 0x278]
shl rcx, 0x20
and rcx, rbp
bts rcx, 0x15
mov qword [rax + rsi*8], rcx
mov rax, qword [rbx + 0x218]
cmp rax, 0xffffffffffffffff
je 0x1400b0c28
lea rdi, [rax - 1]
cmp rdi, 0xffffffffffffffff
jne 0x1400b0c21
xor edi, edi
jmp 0x1400b0c28
mov qword [rbx + 0x218], rdi
mov qword [r14], rdi
test edi, edi
js 0x1400b0cc0
mov rax, qword [rbx + 0x280]
sub rax, qword [rbx + 0x278]
sar rax, 3
cmp edi, eax
jge 0x1400b0cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub rcx, qword [rbx + 0x228]
mov rax, qword [rbx + 0x278]
shl rcx, 0x20
and rcx, rbp
bts rcx, 0x15
mov qword [rax + rdi*8], rcx
jmp 0x1400b0cc0
test rax, rax
je 0x1400b0cc0
test esi, esi
js 0x1400b0cc0
mov rax, qword [rbx + 0x280]
sub rax, qword [rbx + 0x278]
sar rax, 3
cmp esi, eax
jge 0x1400b0cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
movabs rbp, 0xffffffff00200000
sub rcx, qword [rbx + 0x228]
mov rax, qword [rbx + 0x278]
shl rcx, 0x20
and rcx, rbp
bts rcx, 0x15
mov qword [rax + rsi*8], rcx
lea rcx, [rbx + 8]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1400cc350
Function at 0x1400b0cf0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov ebp, r8d
movzx ebx, dx
test dx, dx
jne 0x1400b0d0e
or eax, 0xffffffff
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
or edi, 0xffffffff
mov qword [rsp + 0x70], r14
lea r14, [rcx + 0x1230]
mov dword [rsp + 0x68], edi
lea rax, [rsp + 0x30]
mov dword [rsp + 0x78], edi
mov rcx, r14
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
movzx edx, bx
call fcn.14015a340
mov edx, dword [rsp + 0x78]
movzx ecx, bx
call fcn.14014cb00
mov ecx, eax
cmp eax, edi
jne 0x1400b0d64
mov eax, edi
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], rsi
test eax, eax
jne 0x1400b0d93
lea rcx, [rsp + 0x68]
call fcn.14014ccc0
test eax, eax
je 0x1400b0e95
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1400b0e83
lea eax, [rcx - 8]
cmp eax, 1
jbe 0x1400b0e74
cmp ecx, 0xb
jne 0x1400b0dbc
lea rcx, [rsp + 0x68]
call fcn.14014cff0
jmp 0x1400b0d77
cmp ecx, 0xa
jne 0x1400b0dcd
lea rcx, [rsp + 0x68]
call fcn.14014d100
jmp 0x1400b0d77
cmp ecx, 0xc
jne 0x1400b0d7f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x1400b0deb
mov esi, 2
jmp 0x1400b0e03
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb esi, esi
and esi, 3
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jae 0x1400b0e1c
mov ebx, 8
jmp 0x1400b0e34
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
neg rax
sbb ebx, ebx
and ebx, 9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt rax, 0xf
jb 0x1400b0e51
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ebx, 5
je 0x1400b0d7f
cmp ebx, 8
je 0x1400b0d7f
cmp esi, 2
je 0x1400b0d7f
cmp esi, 5
cmovne ebx, esi
jmp 0x1400b0e99
lea rcx, [rsp + 0x68]
call fcn.14014ced0
jmp 0x1400b0d77
lea rcx, [rsp + 0x68]
call fcn.14014cdd0
test eax, eax
jne 0x1400b0d7f
mov ebx, dword [rsp + 0x68]
cmp ebx, 0xffffffff
je 0x1400b0eba
mov rcx, qword [r14 + 0x20]
test rcx, rcx
je 0x1400b0eba
add rcx, 0x28
mov r8d, ebp
mov edx, ebx
call fcn.1401589d0
mov edi, 1
mov eax, edi
jmp 0x1400b0d81
Function at 0x1400bd5e0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
test r9, r9
jne 0x1400bd613
lea eax, [r9 + 0xd]
jmp 0x1400bd6af
xor eax, eax
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x2a], rax
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], bx
mov qword [rsp + 0x32], rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x1400bd658
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rdx, [0x140211738]
lea rcx, [rsp + 0x28]
call fcn.1400b6a00
mov ebx, dword [rsp + 0x20]
cmp rbx, rsi
mov rbx, qword [rsp + 0x50]
je 0x1400bd66a
mov rdx, rsi
call fcn.14013e480
mov r8, rdi
mov rdx, rbp
mov ecx, 2
call fcn.1400be340
test eax, eax
jne 0x1400bd6af
mov r9, rdi
lea ecx, [rax + 2]
mov r8, r14
mov rdx, rbp
call fcn.1400beb80
test eax, eax
jne 0x1400bd6af
mov r8, rdi
lea ecx, [rax + 2]
mov rdx, rbp
call fcn.1400bf2b0
test eax, eax
jne 0x1400bd6af
mov dl, 1
mov rcx, rdi
call fcn.1400bc040
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d9cb0
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [0x140279e70]
call fcn.1400805d0
test rax, rax
jne 0x1400d9ce9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
mov qword [rsp + 0x50], rdi
mov rdi, qword [rax + 0x70]
mov eax, 0xefffffff
cmp rdi, rax
jne 0x1400d9d00
mov al, 1
jmp 0x1400d9d54
xor eax, eax
mov qword [rsp + 0x68], rbx
xor ebx, ebx
mov qword [rsp + 0x2a], rax
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], bx
mov qword [rsp + 0x32], rax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x1400d9d2b
mov eax, ebx
jmp 0x1400d9d49
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rdx, [0x140211738]
lea rcx, [rsp + 0x28]
call fcn.1400b6a00
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x68]
cmp rdi, rax
sete al
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140185a60
add rsp, 0x58
ret
Function at 0x1400ea100
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14026f088]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
cmp qword [rcx + 0x18], 8
jb 0x1400ea137
mov rcx, qword [rcx]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [rbx + 4]
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
jne 0x1400ea16a
lea eax, [rbx + 1]
jmp 0x1400ea259
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
cmp qword [rsi + 0x10], 0
sete al
test al, al
jne 0x1400ea233
test ecx, ecx
jne 0x1400ea1b3
lea edx, [rcx + 1]
mov r8d, 0xfeff
lea rcx, [rsp + 0x50]
call fcn.14002c260
jmp 0x1400ea1cb
cmp ecx, 2
jle 0x1400ea1cb
mov edx, 1
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x50]
call fcn.140009d70
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140004ee0
mov dword [rsp + 0x48], ebx
mov eax, dword [rsp + 0x60]
lea r8d, [rax + rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x1400ea21f
mov eax, 2
jmp 0x1400ea238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400ea23a
mov eax, 3
jmp 0x1400ea238
mov eax, InitCommonControls
mov ebx, eax
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x1400ea257
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140003900
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140185a60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret