joyce8/EMBER2024-capa huggingface dataset:
Function at 0x181dce0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.181dce237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181dce0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181dce0c7
add dl, dl
jne 0x181dce0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181dce14e
xor eax, eax
add dl, dl
jne 0x181dce0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181dce205
add dl, dl
jne 0x181dce10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181dce11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181dce128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181dce135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x181dce142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x181dce0d6
mov eax, 1
add dl, dl
jne 0x181dce15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181dce16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181dce153
sub eax, ebx
mov ebx, 1
jne 0x181dce1a4
mov ecx, 1
add dl, dl
jne 0x181dce186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181dce193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181dce17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181dce0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181dce1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181dce1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181dce1b5
cmp eax, 0x7d00
jae 0x181dce1f3
cmp eax, 0x500
jb 0x181dce1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181dce0d6
cmp eax, 0x7f
ja 0x181dce1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181dce0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x181dce22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x181dce0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000c568
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x140487610]
xor edx, edx
xor ebx, ebx
call fcn.1400b8230
lea r13d, [rbx + 1]
mov ebp, r13d
jmp 0x14000c645
test rbx, rbx
jne 0x14000c651
mov ecx, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr ecx, 4
add cx, r13w
movzx r8d, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x14000c634
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000c5e2
xor ebx, ebx
jmp 0x14000c62f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14000c5de
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x14000c61e
cmp rdi, r11
jae 0x14000c5de
dec ecx
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x14000c60d
cmp rdi, r11
jae 0x14000c5de
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x14000c66c
lea rcx, [0x140487610]
mov edx, ebp
call fcn.1400b8230
add ebp, r13d
mov rsi, rax
test rax, rax
jne 0x14000c59f
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x14000c653

Function at 0x14000c674
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, edx
mov esi, edx
mov r8d, 6
shr eax, 4
mov rbp, rcx
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov r12, rax
test rax, rax
je 0x14000c711
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000c70e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14000c70e
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and esi, 0xf
jbe 0x14000c6fd
cmp rdi, r11
jae 0x14000c70e
dec esi
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x14000c6ec
cmp rdi, r11
jae 0x14000c70e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400116e8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14001177a
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140011754
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011773
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140011773
mov rdx, qword [rdi]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x140011763
cmp dword [rdi + 8], 0
je 0x140011773
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x140011763
cmp byte [0x14048afd8], 0
jne 0x1400117c5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400117b1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov qword [0x14048afe0], rax
jmp 0x1400117b8
mov r11, qword [0x14048afe0]
mov eax, 1
mov byte [0x14048afd8], al
jmp 0x1400117cc
mov r11, qword [0x14048afe0]
mov rcx, qword [rbx]
mov rdx, rsi
test r11, r11
je 0x14001175d
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r11
jmp 0x140011763
Function at 0x140012290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140012304
call fcn.14001072c
mov ebx, eax
jmp 0x140012413
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140012325
call fcn.14001072c
jmp 0x140012407
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14001231b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x140012360
mov ebx, 0x8007000e
jmp 0x140012409
mov ecx, eax
test eax, eax
je 0x14001239d
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140012393
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001239d
lea rcx, [rsp + 0x70]
call fcn.140010700
mov rax, qword [rsp + 0x70]
jmp 0x1400123a7
mov ecx, 0x80070216
call fcn.14000cbb8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1400123be
test rax, rax
je 0x140012356
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14001231b
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400120dc
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14001242a
lea rcx, [rsp + 0x70]
call fcn.140010f78
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x1400137ec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov rdi, rcx
call fcn.14002cbf4
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14001388c
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x140013874
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x30]
mov r8d, 0xff
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000cb18
lea rcx, [rdi + 0x48]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 0x50]
mov rcx, qword [rdi + 8]
lea rdx, [0x140330de8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [rdi + 0xa8]
call fcn.140014e4c
lea rcx, [rdi + 0xa8]
call fcn.140014f00
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x1400160f0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.1402b529c

Function at 0x14001c704
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r15d, r15d
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
cmp dword [rsp + 0xf0], r15d
jne 0x14001c819
mov rdi, qword [rsp + 0xe8]
cmp r8d, 0x100
jne 0x14001c7e6
cmp r9, 0x41
jne 0x14001c7df
lea ecx, [r9 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14001c7df
mov rcx, qword [rbx + 8]
lea edx, [rsi - 0x51]
call qword [sym.imp.USER32.dll_GetWindowLongW]
test al, 4
jne 0x14001c7df
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14001c7df
mov r12d, r15d
mov r13d, eax
xor edx, edx
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x40], r15d
lea r8d, [rdx + 0x44]
call fcn.1400c7360
mov rcx, qword [rbx + 8]
mov eax, 2
lea r9, [rsp + 0x40]
mov r8, r12
mov edx, 0x102b
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.USER32.dll_SendMessageW]
inc r12
dec r13
jne 0x14001c79e
mov qword [rdi], 1
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8d, ebp
mov rcx, rbx
mov rdx, r14
call fcn.14004350c
test eax, eax
je 0x14001c819
mov eax, 1
jmp 0x14001c81b
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001f440
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, r9
mov r14, r8
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor r13d, r13d
mov qword [rcx + 8], r13
mov qword [rcx + 0x28], r13
mov qword [rcx + 0x30], r13
mov dword [rcx + 0x38], r13d
xor edx, edx
mov r8d, 0x98
add rcx, 0x40
call fcn.1400c7360
lea rbp, [rdi + 0x2dc]
mov word [rbp], r13w
lea r13, [rdi + 0xdc]
xor eax, eax
mov word [r13], ax
mov dword [rdi + 0xd8], ebx
mov dword [rdi + 0x40], 0x98
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x34]
call fcn.1400c7360
mov dword [rsp + 0x30], VarUI4FromDisp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x14001f510
cmp dword [rsp + 0x34], 5
jae 0x14001f517
cmp dword [rsp + 0x34], 4
jne 0x14001f510
cmp dword [rsp + 0x38], 0x5a
jae 0x14001f517
mov dword [rdi + 0x40], 0x88
mov qword [rdi + 0x70], rbp
mov dword [rdi + 0x78], 0x104
mov qword [rdi + 0xa8], r14
mov qword [rdi + 0x80], r13
mov dword [rdi + 0x88], 0x100
mov eax, dword [rsp + 0x1b0]
or eax, 0x880020
mov dword [rdi + 0xa0], eax
mov rax, qword [rsp + 0x1b8]
mov qword [rdi + 0x58], rax
mov rax, qword [0x140487620]
mov qword [rdi + 0x50], rax
lea rax, [0x140007b38]
mov qword [rdi + 0xb8], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rdi + 0x48], rax
test rsi, rsi
je 0x14001f5b6
test rbp, rbp
je 0x14001f5b6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x103
cmp eax, ecx
ja 0x14001f5a5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea r8d, [rcx + 1]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
nop
lea rax, vtable.Piriform::CFileDialogEx.0
mov qword [rdi], rax
call fcn.1400046d0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rax + 4], 6
jne 0x14001f5e2
and dword [rdi + 0xa0], 0xffffffdf
mov qword [rdi + 0xb8], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400be110
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14001fbc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x50], 0
mov rdx, qword [rdx]
mov rbx, rcx
test r8b, r8b
je 0x14001fc39
lea rcx, [rsp + 0x58]
call fcn.140020b2c
mov r11, qword [rsp + 0x58]
mov r8d, dword [r11 - 0x10]
and dword [rsp + 0x50], 0
test r8d, r8d
jne 0x14001fbf9
lea ebx, [r8 + 1]
jmp 0x14001fc1c
mov rcx, qword [rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11, qword [rsp + 0x58]
xor ebx, ebx
test eax, eax
setne bl
lea rdx, [r11 - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001fc6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001fc6c
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x50], 0
add r8d, r8d
jne 0x14001fc51
mov ebx, 1
jmp 0x14001fc6c
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebx, ebx
test eax, eax
setne bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14001fc74
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
mov dword [rax + 0x18], ebx
test r8b, r8b
je 0x14001fcef
lea rcx, [rax + 0x20]
call fcn.140020b2c
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x50], ebx
test r8d, r8d
jne 0x14001fcb1
lea edi, [rbx + 1]
jmp 0x14001fcd2
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x58]
mov ecx, ebx
test eax, eax
setne cl
mov edi, ecx
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14001fd29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001fd29
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
lea edi, [rax + 1]
mov dword [rsp + 0x50], ebx
not rcx
sub rcx, rdi
add ecx, ecx
je 0x14001fd29
mov r8d, ecx
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov edi, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14002988c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 8]
xor r13d, r13d
mov r12, rdx
mov dword [rsp + 0x40], r13d
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140029963
mov rcx, qword [rsi + 8]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
jns 0x1400298ee
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov rax, qword [rsi + 0x50]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebp
or ecx, eax
jge 0x14002990e
lea rcx, [rsi + 0x50]
mov edx, ebp
call fcn.14000c998
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x50]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8d, ebp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi + 0x50]
test rcx, rcx
jne 0x14002993e
mov eax, r13d
jmp 0x14002994b
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14002998b
mov rcx, qword [rsi + 0x50]
cmp eax, dword [rcx - 0xc]
jg 0x14002998b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi + 0x50]
mov word [rax + rcx*2], r13w
lea rdx, [rsi + 0x50]
mov rcx, r12
call fcn.14000c4d8
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rax, r12
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000cbb8
int3
Function at 0x14003246c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0x90]
mov ebx, 1
mov eax, ecx
mov sil, bl
and eax, 0xc
cmp al, 0xc
jne 0x1400324da
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [rsp + 0x40], 0xfffffffe
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rbx
lea r9, [rsp + 0x30]
mov edx, 0x4e
jmp 0x140032504
shr ecx, 2
test bl, cl
je 0x14003250f
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
movzx r8d, bx
mov edx, VarUI4FromDisp
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140032552
mov r8, qword [rdi + 0x50]
lea rdx, [0x14034e618]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta sil
test sil, sil
je 0x140032552
mov rcx, qword [rdi + 8]
or byte [rdi + 0x94], 2
mov r8d, ebx
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x60]
mov al, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140042df4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r13d, r13d
mov rbp, r9
mov edi, r8d
mov r12, rdx
mov rbx, rcx
cmp dword [rsp + 0xf0], r13d
jne 0x140042f8a
mov rsi, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xe0]
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call fcn.140043874
test eax, eax
je 0x140042e62
mov eax, 1
jmp 0x140042f8c
mov r8d, reloc.OLEAUT32.dll_VarUI4FromDisp
cmp edi, r8d
jne 0x140042edf
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_CallWindowProcW]
lea r8, [rsp + 0xf0]
xor r9d, r9d
xor edx, edx
mov ecx, 0x1006
mov rdi, rax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [rsp + 0xf0], r13d
je 0x140042ed7
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140042ed7
mov rcx, qword [rbx + 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsi], rdi
jmp 0x140042e58
cmp edi, 0x100
jne 0x140042f62
cmp rbp, 0x41
jne 0x140042f5b
lea ecx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140042f5b
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x140042f5b
mov r15d, eax
and dword [rsp + 0x40], 0
xor edx, edx
lea rcx, [rsp + 0x44]
lea r8d, [rdx + 0x44]
call fcn.1400c7360
mov rcx, qword [rbx + 8]
mov eax, 2
lea r9, [rsp + 0x40]
mov r8, r13
mov edx, 0x102b
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.USER32.dll_SendMessageW]
inc r13
dec r15
jne 0x140042f17
xor r13d, r13d
mov qword [rsi], 1
mov dword [rsp + 0x30], r13d
mov r9, rbp
mov r8d, edi
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call fcn.14004350c
test eax, eax
jne 0x140042e58
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004350c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
cmp dword [rsp + 0x80], 0
mov rsi, r9
mov ebx, r8d
mov r13, rdx
mov rbp, rcx
jne 0x140043649
cmp ebx, 0xf
jne 0x14004355a
call fcn.140043d2c
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov eax, 1
jmp 0x14004364b
cmp ebx, 0x14
jne 0x14004356d
mov rax, qword [rsp + 0x78]
mov qword [rax], 1
jmp 0x140043550
mov r8d, reloc.OLEAUT32.dll_VarUI4FromDisp
cmp ebx, r8d
jne 0x1400435f1
mov rax, qword [rsp + 0x70]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
lea r8, [rsp + 0x80]
xor r9d, r9d
xor edx, edx
mov ecx, 0x1006
mov rbx, rax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [rsp + 0x80], 0
je 0x1400435e4
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1400435e4
mov rcx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
jmp 0x140043550
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
cmp ebx, 0x31a
jne 0x140043664
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], 1
call fcn.140043bdc
cmp dword [rsp + 0x80], 0
mov qword [rdi], rax
jne 0x140043550
mov r9, r12
mov r8, rsi
mov edx, ebx
mov rcx, r13
mov qword [rsp + 0x20], rdi
call fcn.140023b08
test eax, eax
jne 0x140043550
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
cmp ebx, 0x4e
jne 0x14004362c
cmp dword [r12 + 0x10], 0xfffffeba
jne 0x14004362c
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rbp + 8]
mov rsi, qword [r12]
mov rdi, qword [r12 + 8]
movsxd rbx, eax
mov qword [r12], rcx
mov qword [r12 + 8], rbx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov r9, r12
mov r8, rbx
mov rcx, rax
mov edx, 0x4e
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [r12], rsi
mov qword [r12 + 8], rdi
jmp 0x140043548