joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d2a0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140135b60], 0
jne 0x14003d3f1
lea rcx, str.Wintrust.dll
mov byte [0x140135b60], 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x14003d2d5
add rsp, 0x20
pop rbx
ret
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
mov qword [0x1401358a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
mov qword [0x1401358b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
mov qword [0x1401358b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
mov qword [0x1401358c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
mov qword [0x1401358c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
mov qword [0x1401358d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
mov qword [0x1401358d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
mov qword [0x1401358e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminAddCatalog
mov rcx, rbx
mov qword [0x1401358e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminRemoveCatalog
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsCatalogFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.crypt32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.CertNameToStrW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1401358e8], 0
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x14003e1f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14003e2b0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rax, 0xffffffffffffffff
nop
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14003e220
lea rbp, [rax*2 + 2]
mov qword [rsp + 0x38], rsi
mov rdx, rbp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14003e2a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14003e2a2
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.14009d3c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_CloseClipboard]
test rdi, rdi
setne al
jmp 0x14003e28d
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140041bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x140041e40
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov r10, rdx
movzx ebx, r9b
mov rdx, rax
mov r9, qword [rcx]
mov r8d, 0xffffffff
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xffffffff
jne 0x140041e73
movzx eax, bl
add rsp, 0x20
pop rbx
ret
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x140042060
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14004216c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov esi, 1
mov dword [rsp + 0x30], esi
mov rdi, qword [rdi]
mov rax, qword [rbx]
mov edx, esi
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
add ecx, 0xffffff80
or edx, ecx
jge 0x1400420d8
lea edx, [rsi + 0x7f]
mov rcx, rbx
call fcn.140006870
mov r9, qword [rbx]
cmp dword [r9 - 0xc], 0x80
jl 0x140042177
mov dword [r9 - 0x10], 0x80
mov rax, qword [rbx]
mov word [rax + 0x100], r15w
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80
mov r8, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movsxd rdi, eax
test eax, eax
js 0x140042177
mov rcx, qword [rbx]
sub esi, dword [rcx - 8]
mov edx, dword [rcx - 0xc]
sub edx, edi
or esi, edx
jge 0x14004213d
mov edx, edi
mov rcx, rbx
call fcn.140006870
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x140042177
mov dword [rax - 0x10], edi
mov rax, qword [rbx]
mov word [rax + rdi*2], r15w
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140007f00
int3
mov ecx, 0x80070057
call fcn.140007f00
int3
Function at 0x14004b3e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14004b4b0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov edi, 1
mov dword [rsp + 0x20], edi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [rax + 1]
test esi, esi
js 0x14004b4bb
mov rax, qword [rbx]
sub edi, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, esi
or edi, ecx
jge 0x14004b456
mov edx, esi
mov rcx, rbx
call fcn.140006870
mov r8d, esi
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x14004b481
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14004b478
mov eax, r14d
jmp 0x14004b485
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b0c58
test eax, eax
js 0x14004b4bb
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14004b4bb
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r14w
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140007f00
int3
mov ecx, 0x80070057
call fcn.140007f00
int3
Function at 0x14004e470
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x14004e50f
mov rax, qword [rbx]
mov r9d, 1
mov r8d, dword [rax - 0xc]
sub r9d, dword [rax - 8]
sub r8d, edi
or r9d, r8d
jge 0x14004e4b8
mov edx, edi
mov rcx, rbx
call fcn.140006870
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x14004e4e5
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14004e4dc
mov eax, esi
jmp 0x14004e4e9
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b0c58
test eax, eax
js 0x14004e50f
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14004e50f
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140007f00
int3
Function at 0x14004f530
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, r8
mov rdi, rcx
xor r12d, r12d
xor bl, bl
lea r8, [0x1400d6fa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14004f76e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x1400d6fa8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14004f76e
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004f626
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14004f626
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x4c]
mov r8d, r15d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14004f763
lea rcx, [rsp + 0x40]
call fcn.14004cd10
nop
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14004bf10
test al, al
jne 0x14004f670
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14004f669
lea rcx, [rsp + 0x40]
call fcn.14004d310
xor bl, bl
jmp 0x14004f763
mov byte [rdi + 0x90], 0
lea rcx, [rdi + 8]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x14004f6a0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rdx, qword [rcx]
mov qword [rcx], rax
test rdx, rdx
je 0x14004f6a0
call fcn.14004d310
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14004f761
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + 0x98]
lea r9, [0x14003ee70]
mov edx, 8
lea r8d, [rdx + 0x17]
call fcn.14009c6b0
nop
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x14004f6ed
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x14004f6ed
mov qword [rbx + 0x90], r12
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x14004f70a
call qword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x14004f70a
mov qword [rbx + 0x88], r12
lea rax, [rbx + 8]
mov qword [rsp + 0x50], rax
mov rdx, qword [rax]
sub rdx, 0x18
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f735
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov qword [rsp + 0x50], rbx
mov rdx, qword [rbx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004f754
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edx, 0x210
mov rcx, rbx
call fcn.14009bfe4
mov bl, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14009c570
add rsp, 0x280
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140053810
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 0xa
lea r8, str.https:__www.sysinternals.com
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret
Function at 0x140056070
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x140056127
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400560f2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140056112
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140056112
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140056112
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x140133c78], 0
jne 0x140056172
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140056162
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140133c70], rax
mov byte [0x140133c78], 1
jmp 0x140056179
mov rax, qword [0x140133c70]
mov byte [0x140133c78], 1
jmp 0x140056179
mov rax, qword [0x140133c70]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1400560fb
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140057300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140057385
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140057385
call fcn.140055b50
mov ebx, eax
jmp 0x1400574a7
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400573a6
call fcn.140055b50
jmp 0x140057496
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400573c9
call fcn.140055b50
jmp 0x140057496
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400573eb
mov ebx, 0x8007000e
jmp 0x140057498
mov ecx, eax
test eax, eax
je 0x140057420
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400574df
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140057420
lea rcx, [rsp + 0x60]
call fcn.14002aee0
jmp 0x14005742a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14005743d
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14005744e
mov ebx, 0x8007000e
jmp 0x140057498
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140057473
call fcn.140055b50
jmp 0x140057496
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140056e20
mov ebx, eax
test rdi, rdi
je 0x1400574a7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x1400574be
lea rcx, [rsp + 0x60]
call fcn.1400561b0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14009c570
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140007f00
int3
Function at 0x14005fd50
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp fcn.140083430
Function at 0x140068160
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsxd rsi, edx
lea r9, [rsp + 0x30]
mov rbp, r8
mov rdi, rcx
mov rcx, qword [rcx + 0x48]
xorps xmm0, xmm0
mov r8, rsi
mov edx, 0x130a
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x3c]
xor r9d, r9d
sub eax, dword [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rdi + 0x48]
sub eax, 0xd
cdq
sub eax, edx
mov edx, 0x130b
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, dword [rsp + 0x34]
mov ecx, 1
mov r9d, dword [rsp + 0x38]
cmp esi, eax
mov r10d, 4
cmove r10d, ecx
add r8d, ebx
sub r9d, r10d
mov rcx, rbp
lea eax, [r8 + 0xd]
lea edx, [r9 - 0xe]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetRect]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079040
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rdi, rdx
mov rsi, rcx
jne 0x140079090
mov rcx, qword [rcx + 0x438]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rbx
jne 0x140079090
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsi + 0x500]
test rcx, rcx
je 0x1400790ad
mov rcx, qword [rcx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1400790c7
mov rdx, qword [rsi - 8]
test rdx, rdx
je 0x1400790dc
mov rcx, qword [rsi - 0x60]
mov r8, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x1400790dc
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
sub rsi, 0xffffffffffffff80
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_IsWindow]
xor ebx, ebx
test eax, eax
je 0x1400791e9
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
test eax, eax
jle 0x140079194
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
cmp dword [rdi + 8], 0x100
jne 0x140079194
cmp qword [rdi + 0x10], 9
jne 0x140079194
test al, al
je 0x140079194
cmp ebp, 1
jle 0x14007918d
mov edi, dword [rsi + 0x9c]
lea ecx, [rbx + 0x10]
mov qword [rsp + 0x38], r14
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14007915f
test edi, edi
cmovle edi, ebp
dec edi
jmp 0x140079170
test edi, edi
js 0x14007916e
lea eax, [rbp - 1]
cmp edi, eax
jge 0x14007916e
inc edi
jmp 0x140079170
mov edi, ebx
mov edx, edi
mov rcx, rsi
call fcn.14007edf0
mov edx, dword [rsi + 0x9c]
mov rcx, rsi
call fcn.140077870
mov r14, qword [rsp + 0x38]
mov ebx, 1
jmp 0x1400791e4
test byte [rsi + 0x14d], 2
je 0x1400791ba
cmp dword [rdi + 8], 0x100
jne 0x1400791ba
cmp qword [rdi + 0x10], 0x1b
jne 0x1400791ba
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov ebx, 1
jmp 0x1400791e4
mov edx, dword [rsi + 0x9c]
cmp edx, 0xffffffff
je 0x1400791e4
mov rcx, rsi
call fcn.14006ea10
mov rcx, rax
mov r9, rdi
xor r8d, r8d
mov edx, 0x37f
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140082a50
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rbx, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x140082b00
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x140082b15
mov rcx, qword [rbx]
mov edx, 1
mov eax, dword [rcx - 0xc]
sub edx, dword [rcx - 8]
sub eax, edi
or edx, eax
jge 0x140082aa9
mov edx, edi
mov rcx, rbx
call fcn.140006870
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x140082ad6
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140082acd
mov eax, esi
jmp 0x140082ada
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b0c58
test eax, eax
js 0x140082b15
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140082b15
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, rbx
call fcn.140006b70
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov ecx, 0x80070057
call fcn.140007f00
int3
Function at 0x140085430
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [r11 - 0x38], r15d
mov dword [r11 + 0x10], r15d
lea rax, [r11 + 0x10]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r15
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400855ef
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x1400855ef
mov esi, dword [rsp + 0x78]
shr esi, 1
je 0x1400855ef
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140009270
nop
mov rdi, qword [rsp + 0x38]
lea eax, [rsi + rsi]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008550c
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x14008550c
test rdi, rdi
je 0x14008554e
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14008554a
test al, 1
jne 0x14008550c
shr rax, 1
cmp word [rdi + rax*2 - 2], r15w
je 0x14008554e
call fcn.140008180
test rax, rax
je 0x140085670
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x1400f1b38]
cmp rdx, 0x10000
jae 0x1400855b3
movzx edx, dx
mov rcx, rbx
call fcn.140006660
jmp 0x1400855d6
mov word [rdi], r15w
mov rdi, qword [rsp + 0x38]
call fcn.140008180
test rax, rax
je 0x140085670
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
test rdi, rdi
je 0x14008559f
cmp rdi, 0x10000
jae 0x14008558c
movzx edx, di
mov rcx, rbx
call fcn.140006660
jmp 0x1400855b1
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x140085593
jmp 0x1400855a2
mov eax, r15d
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.1400068f0
nop
jmp 0x1400855d6
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400855c0
mov r8d, eax
mov rcx, rbx
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008564e
call fcn.14009bfe4
jmp 0x14008564e
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140085665
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x1400f1b38]
cmp rdx, 0x10000
jae 0x140085626
movzx edx, dx
mov rcx, rbx
call fcn.140006660
jmp 0x140085646
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140085630
mov r8d, eax
mov rcx, rbx
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3