joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400510b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140051074
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140051096
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051096
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x140051096
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400510de
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140051000
cmp byte [0x140375508], 0
jne 0x140051129
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140051119
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140375508], 1
mov qword [0x140375500], rax
jmp 0x140051130
mov rax, qword [0x140375500]
mov byte [0x140375508], 1
jmp 0x140051130
mov rax, qword [0x140375500]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14005114f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
Function at 0x140051d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140051d8e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140051d8e
call fcn.14004fd80
mov ebx, eax
jmp 0x140051eb6
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140051daf
call fcn.14004fd80
jmp 0x140051ea5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140051dd2
call fcn.14004fd80
jmp 0x140051ea5
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140051df4
mov ebx, 0x8007000e
jmp 0x140051ea7
mov ecx, eax
test eax, eax
je 0x140051e2c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140051e22
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140051e2c
lea rcx, [rsp + 0x70]
call fcn.14004fd50
jmp 0x140051e36
mov ecx, 0x80070216
call fcn.140012d00
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140051e49
cmp qword [rsp + 0x70], 0
jne 0x140051e58
mov ebx, 0x8007000e
jmp 0x140051ea7
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140051e82
call fcn.14004fd80
jmp 0x140051ea5
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140051b10
mov ebx, eax
test rdi, rdi
je 0x140051eb6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140051ecd
lea rcx, [rsp + 0x70]
call fcn.14004fd30
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401e3980
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005a5b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
lea rbp, [rdx + reloc.mfc110u.dll_Ordinal_488]
mov qword [r11 - 0x38], rbp
mov rcx, rbp
call qword [sym.imp.MSVCP110.dll__Mtx_lock]
test eax, eax
je 0x14005a5fe
mov ecx, eax
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Throw_C_error_int_]
mov byte [rsp + 0x38], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
lea rcx, [0x14032d720]
call fcn.14004c990
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7d0
ja 0x14005a683
lea rcx, [0x14033de68]
call qword [sym.imp.BarcodeReader.dll_public:_bool___cdecl_CBarcodeReader::trytoReadReaderData_void____ptr64]
movzx ebx, al
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x14005a623
mov bl, 1
lea rdx, [rsp + 0x20]
lea rcx, [0x14032d720]
call fcn.14004caf0
nop
lea rcx, [rsi + 0x1d0]
mov rdx, rax
call qword [sym.imp.mfc110u.dll_Ordinal_1492]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
jmp 0x14005a699
xor bl, bl
lea rcx, [rsi + 0x1d0]
lea rdx, [0x140224a18]
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
movzx r9d, bl
mov r8d, 1
cmp byte [0x14034e6e4], 0
cmove r9d, r8d
lea rdx, [rsp + 0x40]
call fcn.140059e90
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov rdx, rax
mov rcx, rsi
call fcn.14005a730
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
nop
mov rcx, rbp
call qword [sym.imp.MSVCP110.dll__Mtx_unlock]
test eax, eax
je 0x14005a702
mov ecx, eax
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Throw_C_error_int_]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401e3980
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005eb40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
mov eax, 0x186f0
call fcn.1401ea950
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x18700], rbx
mov qword [rsp + 0x18710], rsi
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x186e0], rax
mov rsi, rdx
movzx eax, word [0x14034e4f0]
sub ax, 2
cmp ax, 1
jbe 0x14005ec3d
cmp byte [0x14034e6e7], 1
jne 0x14005ec17
lea rcx, [0x14032d970]
call fcn.1401d7d40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor edx, edx
mov rcx, qword [0x14032db10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14005ebfe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
ja 0x14005ebf1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [0x14032db10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14005ebc2
jmp 0x14005ebfe
mov rcx, qword [0x14032db10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
movzx ebx, byte [0x14032db42]
mov eax, ebx
xor ecx, ecx
cmp bl, 1
cmove eax, ecx
mov byte [0x14032db42], al
jmp 0x14005ec68
mov rcx, qword [0x14032d918]
lea rbx, [rcx + 0x520]
add rcx, 0x10008
call fcn.14019fec0
mov edi, eax
mov rcx, rbx
call fcn.14019fec0
jmp 0x14005ec61
mov rcx, qword [0x14032d918]
lea rbx, [rcx + 0x520]
add rcx, 0x10008
call fcn.14019ff50
mov edi, eax
mov rcx, rbx
call fcn.14019ff50
add edi, eax
test edi, edi
setle bl
xor edx, edx
mov r8d, 0x186a0
lea rcx, [rsp + 0x40]
call sub.MSVCR110.dll_memset
mov dword [rsp + 0x40], 0x1070
movzx ebx, bl
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, ebx
lea rdx, str.Veriworks____MES__Buffer_Empty__:__d
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov rdx, rax
lea rcx, [0x14032ef60]
call qword [sym.imp.LogMsgInterface.dll_public:_void___cdecl_CLogMsgInterface::writeLogData_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_______ptr64]
mov ebx, dword [rsp + 0x48]
lea rcx, [rsi + 0x3e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, 0x7d0
lea rcx, [rsi + 0x270]
mov r8d, ebx
lea rdx, [rsp + 0x40]
call qword [sym.imp.TcpIPInterface.dll_public:_int___cdecl_CNetSocket::Send_char____ptr64__int__unsigned_short_int____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsi + 0x3d0]
mov rax, qword [rcx]
call qword [rax + gethostname]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov rcx, qword [rsp + 0x186e0]
xor rcx, rsp
call fcn.1401e3980
lea r11, [rsp + 0x186f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b8c70
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
cmp qword [rcx + 0x78], 0
je 0x1400b8dd2
cmp byte [rcx + 0x81], 0
je 0x1400b8dd2
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + SafeArrayCopy]
cmp eax, 0xffffffff
jne 0x1400b8cc7
xor al, al
jmp 0x1400b8dd4
mov qword [rsp + 0x58], shutdown
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.140012860
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x50]
add r9, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x84]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.MSVCP110.dll_public:_int___cdecl_std::codecvt_char__char__int_::unshift_int____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400b8d39
dec eax
jne 0x1400b8daf
jmp 0x1400b8d40
mov byte [rbx + 0x81], 0
lea rax, [rsp + 0x40]
mov rdx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
cmp r9, 0x10
cmovae rax, rdx
mov rdi, qword [rsp + 0x38]
sub rdi, rax
je 0x1400b8d88
lea rcx, [rsp + 0x40]
cmp r9, 0x10
cmovae rcx, rdx
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR110.dll_fwrite]
cmp rdi, rax
jne 0x1400b8db4
cmp byte [rbx + 0x81], 0
je 0x1400b8db8
test rdi, rdi
jne 0x1400b8cf0
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.140012b10
jmp 0x1400b8cf0
sub eax, 2
je 0x1400b8db8
xor bl, bl
jmp 0x1400b8dba
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x1400b8dcd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_]
movzx eax, bl
jmp 0x1400b8dd4
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401e3980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400ba280
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.ToolkitPro1631vc110x64U.dll_protected_virtual:_int___cdecl_CXTPResizeDialog::OnInitDialog_void____ptr64]
mov byte [rbx + Ordinal_12915], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [0x1400e2c80]
mov r9, rbx
mov dword [rbx + 0x31b8], eax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.MSVCR110.dll__beginthreadex]
mov rcx, rbx
call fcn.1400ba3f0
mov rcx, rbx
call fcn.1400bb280
mov rcx, rbx
call fcn.1400bb030
cmp word [0x14034e788], 1
jne 0x1400ba3a2
lea rcx, [0x14034efe0]
call fcn.14004f100
mov rax, qword [0x14034f1fd]
cmp byte [0x14034e391], 0
mov ecx, 7
cmove rax, rcx
mov qword [0x14034f1fd], rax
mov rax, qword [0x14032d908]
test rax, rax
je 0x1400ba35d
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1400ba33e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80b
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14032d908]
test rax, rax
je 0x1400ba35d
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1400ba35d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80b
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x14034e78c]
lea rcx, [0x14034f280]
mov dword [0x14034f334], 0x2580
mov dword [0x14034f330], eax
movzx eax, byte [0x14034e790]
mov dword [0x14034f340], 0x2580
mov byte [0x14034f338], al
mov eax, dword [0x14034e794]
mov dword [0x14034f33c], eax
call fcn.1401c7c90
mov rcx, rbx
call fcn.1400e18c0
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0x7d0
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
lea edx, [r9 + 2]
mov r8d, 0x1f4
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1400e6350
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x48], rax
movsxd rdi, r8d
movsxd rsi, edx
mov rbp, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
cmp esi, 1
ja 0x1400e6456
cmp edi, 3
ja 0x1400e644a
lea rdx, [rdi + rsi*4]
mov rax, qword [0x14032d8f0]
mov rbx, qword [rax + rdx*8 + 0x46390]
test rbx, rbx
jne 0x1400e63d5
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
xor r8d, r8d
xor edx, edx
lea rcx, str.X2__
call qword [sym.imp.mfc110u.dll_Ordinal_2100]
mov rbx, rax
movzx eax, word [rbp + reloc.mfc110u.dll_Ordinal_12656]
mov word [rbx + 0x88], ax
movzx eax, word [rbp + 0x3174]
mov word [rbx + 0x8a], ax
mov word [rbx + 0x8c], si
lea rdx, [rbp + 0x3178]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov rdx, rax
mov rcx, rbx
call fcn.1400ea660
mov eax, dword [rbp + 0x318c]
mov dword [rbx + 0x98], eax
mov eax, dword [rbp + 0x3188]
mov dword [rbx + 0xa0], eax
mov word [rbx + 0xa4], di
mov rcx, rbx
call fcn.1401dbf60
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov bl, 1
jmp 0x1400e648d
mov r8d, edi
lea rdx, str.doPrepairJudgedDBProcThread__Invalid_db_index_info.__db_index:_d_
jmp 0x1400e6460
mov r8d, esi
lea rdx, str.doPrepairJudgedDBProcThread__Invalid_lane_info.__lane:_d_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov rdx, rax
lea rcx, [0x14034efc0]
call qword [sym.imp.LogMsgInterface.dll_public:_void___cdecl_CLogMsgInterface::writeLogData_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_______ptr64]
xor bl, bl
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e3980
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140102990
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x1401029e9
mov rax, qword [rdx + 0x10]
cmp rax, 0xd
je 0x1401029dc
cmp rax, 0x1b
je 0x1401029dc
cmp rax, 9
jne 0x1401029e9
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1401029e9
mov rcx, qword [0x14032d908]
xor edx, edx
call fcn.14014cf00
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.mfc110u.dll_Ordinal_11693]
Function at 0x1401107e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov rdi, rcx
mov eax, dword [rdx + 8]
cmp eax, 0x102
jne 0x14011087b
cmp qword [rdx + 0x10], 0xd
je 0x14011093f
cmp byte [rcx + 0x159], 1
jne 0x140110842
add rcx, 0x160
lea rdx, [0x140224a18]
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
mov byte [rdi + 0x159], 0
mov r8d, 1
movzx edx, byte [rbx + 0x10]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_281]
nop
lea rcx, [rdi + 0x160]
lea rdx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1658]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
jmp 0x14011093f
cmp eax, 0x100
jne 0x14011093f
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1401108c7
mov rax, qword [rbx + 0x10]
sub rax, 0x58
test rax, 0xffffffffffffffdf
jne 0x1401108c7
xor r8d, r8d
mov edx, dword [rdi + 0x248]
lea rcx, [0x14032f520]
call fcn.140057dc0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.mfc110u.dll_Ordinal_13685]
mov rax, qword [rbx + 0x10]
cmp rax, 0xd
je 0x1401108dd
cmp rax, 0x1b
jne 0x14011093f
cmp rax, 0xd
jne 0x140110938
mov byte [rdi + 0x159], 1
mov edx, 0xd
lea rcx, [rdi + 0x160]
call qword [sym.imp.mfc110u.dll_Ordinal_12098]
mov edx, 0xa
lea rcx, [rdi + 0x160]
call qword [sym.imp.mfc110u.dll_Ordinal_12098]
lea rdx, [rdi + 0x160]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov r9b, 1
mov r8, rax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140110410
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov eax, 1
jmp 0x14011094b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.mfc110u.dll_Ordinal_11693]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e3980
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140138480
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rdi
mov rax, qword [0x140324030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, ebx
lea rdx, str.Select_Unload_Side_:__d
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
mov rdx, rax
lea rcx, [0x14034efc0]
call qword [sym.imp.LogMsgInterface.dll_public:_void___cdecl_CLogMsgInterface::writeLogData_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_______ptr64]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x38]
lea rcx, [0x14034e310]
call fcn.14003a6e0
nop
mov r8, qword [rax]
lea rdx, str._sUnloadSide.txt
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, ebx
lea rdx, [0x1402242c4]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_306]
nop
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_306]
nop
lea rdx, [0x14026a5b0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.MSVCR110.dll_fopen]
mov rdi, rax
test rax, rax
je 0x1401385ad
mov rcx, qword [rbp - 0x30]
movsxd rbx, dword [rcx - 0x10]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_4831]
mov rcx, rax
mov r9, rdi
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.MSVCR110.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.MSVCR110.dll_fclose]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1028]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_1028]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401e3980
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x14013e210
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14013e266
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
ja 0x14013e278
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14013e240
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x14013e290
Capabilities:
Get hostname

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp + 0x138], rbx
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rdi
mov rax, qword [0x140324030]
xor rax, rbp
mov qword [rbp + 0x110], rax
mov rsi, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call sub.MSVCR110.dll_memset
mov edx, 0x100
lea rcx, [rbp + 0x10]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rax, [rbp + 0x10]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14013e302
inc ecx
cmp ecx, 0x3fffffff
jg 0x14013e373
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14013e32e
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1401ea950
sub rsp, rdx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x14013e373
xor ebx, ebx
mov word [rdi], bx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rdi, rbx
mov rbx, rdi
jmp 0x14013e375
xor ebx, ebx
mov r8, rbx
lea rdx, [0x14022875c]
mov rcx, rsi
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov rcx, qword [rbp + 0x110]
xor rcx, rbp
call fcn.1401e3980
mov rbx, qword [rbp + 0x138]
mov rsi, qword [rbp + 0x140]
mov rdi, qword [rbp + 0x148]
lea rsp, [rbp + 0x120]
pop rbp
ret
Function at 0x140141680
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov qword [r11 - 0x78], 0xfffffffffffffffe
mov r10, r9
mov eax, r8d
mov rbx, rcx
lea rcx, vtable.CDPoint.0
mov qword [r11 - 0x64], rcx
mov qword [r11 - 0x4c], rcx
xor ecx, ecx
mov dword [rsp + 0x40], ecx
xorps xmm0, xmm0
movsd qword [rsp + 0x4c], xmm0
movsd qword [rsp + 0x54], xmm0
movsd qword [rsp + 0x64], xmm0
movsd qword [rsp + 0x6c], xmm0
mov qword [r11 - 0x34], rcx
mov qword [r11 - 0x2c], rcx
mov qword [r11 - 0x24], rcx
mov qword [r11 - 0x1c], rcx
cmp r8d, 0x206
ja 0x140141789
cmp eax, 0x200
jae 0x140141797
sub eax, 0x100
je 0x14014170a
dec eax
jne 0x1401417c4
mov edx, 0x101
jmp 0x14014170f
mov edx, 0x100
lea rax, [rsp + 0x40]
mov r8, r10
mov r9, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140142f10
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, shutdown
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
cmp dword [rsp + 0x74], 0x100
jne 0x1401417c4
cmp dword [rsp + 0x7c], 9
jne 0x1401417c4
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1401417c4
mov edx, 5
mov rcx, rbx
call fcn.14014cf00
jmp 0x1401417c4
cmp eax, 0x20a
je 0x140141797
cmp eax, 0x2a3
jne 0x1401417c4
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0xd0]
mov r8, r10
mov edx, eax
mov rcx, rbx
call fcn.140142f10
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140142fd0
nop
add rsp, 0xa0
pop rbx
ret