joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440200
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040fd80
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00415900
mov esi, eax
cmp esi, 0x104
jbe 0x44025d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00408dd0
mov rdi, rax
jmp 0x440261
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00415900
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x4402b4
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x440298
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x4402c6
mov rcx, rdi
call fcn.00408e00
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x440540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x40], 0
mov rcx, qword [rbp + 0x60]
lea rdx, [0x004405e4]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x4405aa
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x38]
call sub.kernel32.dll_LoadResource
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x4405aa
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_LockResource
mov qword [rbp + 0x40], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_FreeResource
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x440790
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
Function at 0x4ca9b0
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor rdx, rdx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x4ca9b8
nop
ret

Function at 0x50f270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov qword [rbp + 0x60], r8
mov rcx, rsi
mov rdx, qword [rbp + 0x60]
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x20], 0
jne 0x50f2a7
mov rcx, rbp
call fcn.0050f160
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x28], 0
jne 0x50f2c6
mov rcx, rbp
call fcn.0050f160
mov rcx, qword [rbx + 0x28]
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call fcn.0050e830
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x522790
Capabilities:
Resume thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x19], 0
jne 0x5227c3
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x522821
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x1d], 0
jne 0x522821
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x68], 0
jne 0x522821
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x1b], 0
mov byte [rax + 0x19], 0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x52284b
lea rcx, [rbp + 0x38]
mov rdx, qword [0x0089c648]
call fcn.00415830
mov rcx, qword [0x004e2490]
mov dl, 1
mov r8, qword [rbp + 0x38]
call fcn.0043d4f0
mov rcx, rax
call fcn.0040e7f0
jmp 0x52284b
lea rcx, [rbp + 0x30]
mov rdx, qword [0x0089c648]
call fcn.00415830
mov rcx, qword [0x004e2490]
mov dl, 1
mov r8, qword [rbp + 0x30]
call fcn.0043d4f0
mov rcx, rax
call fcn.0040e7f0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040f660
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x5236c0
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
movzx rax, byte [rax + 0x1b]
mov byte [rbp + 0x3f], al
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x1b], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0x50]
test eax, eax
setge dl
call fcn.005225d0
jmp 0x52371b
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x523740
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rbx + 0x10]
call sub.kernel32.dll_ResumeThread
mov esi, eax
mov rcx, rbx
test esi, esi
setge dl
call fcn.005225d0
cmp esi, 1
jne 0x52376a
mov byte [rbx + 0x1b], 0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x527ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x008a6e68], 0
jne 0x527d95
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x008a6e60]
mov qword [rbx], rax
lea rcx, [0x008594a4]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.004091a0
lea rax, [0x00527ca0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00527cd0
mov dword [rsi + 1], eax
mov rax, qword [0x008a6e68]
mov qword [rsi + 5], rax
mov qword [0x008a6e68], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x527d53
mov qword [0x008a6e60], rbx
mov rax, qword [0x008a6e68]
mov rsi, qword [0x008a6e68]
mov rcx, qword [rsi + 5]
mov qword [0x008a6e68], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x587e70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
nop
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
call fcn.0040fc50
mov rcx, qword [rbp + 0x78]
call fcn.00587300
mov byte [rbp + 0x83], al
cmp byte [rbp + 0x83], 0
jne 0x587ee5
lea rcx, [rbp + 0x78]
mov edx, 1
mov r8d, 1
call fcn.00411000
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.00589100
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
je 0x588039
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x90]
call fcn.00587840
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0x54]
call fcn.005881f0
test al, al
je 0x588019
lea rcx, [rbp + 0x70]
xor rdx, rdx
mov r8d, dword [rbp + 0x58]
add r8d, 1
call fcn.0040f840
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x588018
mov eax, dword [rbp + 0x58]
add eax, 1
mov dword [rbp + 0x88], eax
mov rcx, qword [rbp + 0x70]
call fcn.00410930
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x84]
mov r8, rax
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.00587760
test al, al
je 0x588004
mov rcx, qword [rbp + 0x70]
call fcn.00410930
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.004109d0
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.00587e70
sub dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0xffffffff
jne 0x587f78
nop
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x98]
call fcn.00587840
mov rcx, qword [rbp + 0x90]
call sub.advapi32.dll_RegCloseKey_1
cmp byte [0x008a6efc], 0
je 0x588098
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.00587820
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00410930
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0xc0]
mov r8d, dword [rax + 0x2c]
and r8d, 0x300
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.00587760
mov byte [rbp + 0x8f], al
jmp 0x5880d7
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.00587820
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00410930
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.00587760
mov byte [rbp + 0x8f], al
nop
lea rcx, [rbp + 0x40]
call fcn.0040f580
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.0040f660
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret

Function at 0x5881c0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00410930
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.00587760
add rsp, 0x20
pop rbx
ret
Function at 0x5899b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
nop
mov rax, qword [rbp + 0xb0]
lea rax, [rax + rbp + 0x50]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rax, qword [rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xb0]
lea rax, [rax + rbp + 0x50]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov rdx, qword [rbp + 0xb8]
call fcn.00587840
nop
mov rax, qword [rbp + 0xb0]
lea rax, [rax + rbp + 0x50]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
lea rdx, [rbp + 0x64]
call fcn.005881f0
test al, al
je 0x589b5d
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
xor r9, r9
call fcn.00589780
lea rcx, [rbp + 0x58]
xor rdx, rdx
mov r8d, dword [rbp + 0x70]
add r8d, 1
call fcn.0040f840
xor rax, rax
mov ebx, dword [rbp + 0x6c]
sub ebx, 1
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], ebx
jg 0x589b5c
add ebx, 1
mov eax, dword [rbp + 0x70]
add eax, 1
mov dword [rbp + 0x84], eax
mov rcx, qword [rbp + 0x58]
call fcn.00410930
mov rcx, qword [rbp + 0xb8]
mov edx, dword [rbp + 0x80]
mov r8, rax
lea r9, [rbp + 0x84]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov rcx, qword [rbp + 0xb0]
lea rcx, [rcx + rbp + 0x50]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
mov edx, eax
call fcn.00587760
test al, al
je 0x589b49
mov rcx, qword [rbp + 0x58]
call fcn.00410930
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.004109d0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x40]
call fcn.00589780
add dword [rbp + 0x80], 1
cmp dword [rbp + 0x80], ebx
jne 0x589aa0
nop
nop
mov rax, qword [rbp + 0xb0]
lea rax, [rax + rbp + 0x50]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov rdx, qword [rbp + 0x88]
call fcn.00587840
nop
lea rcx, [rbp + 0x40]
call fcn.0040f580
lea rcx, [rbp + 0x58]
call fcn.0040f580
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x5955f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x595632
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x595603
nop
ret
Function at 0x5c74b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
xor rax, rax
mov qword [rbp + 0x38], rax
cmp qword [0x008a7298], 0
je 0x5c7674
mov ecx, 0x11
call sub.user32.dll_GetKeyState
mov rcx, qword [0x0089c5b0]
mov rcx, qword [rcx]
test ax, 0x8000
setne al
movzx rcx, byte [rcx + 0x178]
xor cl, al
test cl, cl
je 0x5c7674
mov rcx, qword [0x008a72a0]
mov rax, qword [0x008a72a0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
xor rbx, rbx
mov rax, qword [0x008a7298]
mov esi, dword [rax + 0x10]
sub esi, 1
cmp ebx, esi
jg 0x5c7636
add esi, 1
mov rcx, qword [0x008a7298]
mov edx, ebx
call fcn.00503120
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
cmp rax, qword [rbp + 0x98]
je 0x5c762b
mov rax, qword [rbp + 0x50]
cmp byte [rax + 0x381], 0
je 0x5c762b
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
call qword [rax + 0xd8]
test al, al
je 0x5c762b
mov rcx, qword [rbp + 0x50]
call fcn.005d9d60
mov rcx, rax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c762b
mov rcx, rbp
call fcn.005c7430
test al, al
jne 0x5c762b
mov rcx, qword [rbp + 0x50]
mov dx, 0xffb9
call fcn.0040c7f0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x98]
call rax
test al, al
je 0x5c762b
mov byte [rbp + 0x5f], 1
mov rcx, qword [rbp + 0x50]
mov dx, 0xffba
call fcn.0040c7f0
mov rdi, rax
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x98]
lea r8, [rbp + 0x40]
mov r9, qword [rbp + 0x90]
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x20], rax
call rdi
cmp byte [rbp + 0x5f], 0
je 0x5c762b
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x90]
call fcn.0041a600
test al, al
je 0x5c762b
mov rcx, qword [0x008a72a0]
mov rdx, qword [rbp + 0x50]
call fcn.005c6650
add ebx, 1
cmp ebx, esi
jne 0x5c753c
nop
mov rax, qword [0x008a72a0]
cmp dword [rax + 0x10], 0
jle 0x5c7654
mov rcx, qword [0x008a72a0]
call fcn.005c6750
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x5c7674
mov rcx, rbp
mov rdx, qword [rbp + 0x38]
call fcn.005c71d0
test al, al
jne 0x5c7674
xor rax, rax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x5d4a20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call sub.user32.dll_GetMessagePos
mov ecx, eax
call fcn.0041ad80
mov dword [rbp + 0x3c], eax
movsx rax, word [rbp + 0x3c]
mov dword [rbp + 0x34], eax
movsx rax, word [rbp + 0x3e]
mov dword [rbp + 0x38], eax
mov rcx, rbx
mov rdx, qword [rbp + 0x34]
call fcn.005cae80
mov qword [rbp + 0x158], rax
test rdi, rdi
jne 0x5d4a8b
mov rcx, rbx
mov rdx, qword [rbp + 0x158]
xor r8, r8
xor r9, r9
mov byte [rsp + 0x20], 0
call fcn.005d4830
mov rdi, rax
test rdi, rdi
je 0x5d4b7a
cmp rdi, rbx
je 0x5d4ab9
mov eax, dword [rbp + 0x158]
sub eax, dword [rdi + 0x90]
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x15c]
sub eax, dword [rdi + 0x94]
mov dword [rbp + 0x44], eax
jmp 0x5d4ac4
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x40], rax
movzx eax, word [rsi + 0x10]
mov dword [rbp + 0x48], eax
mov rax, qword [rsi + 8]
mov qword [rbp + 0x50], rax
movzx rax, word [rsi + 0x12]
cmp rax, 0x201
jge 0x5d4b04
sub rax, 0xa1
cmp rax, 2
jb 0x5d4b27
sub rax, 3
cmp rax, 2
jb 0x5d4b33
sub rax, 3
cmp rax, 2
jae 0x5d4b39
jmp 0x5d4b2d
sub rax, 0x201
cmp rax, 2
jb 0x5d4b27
sub rax, 3
cmp rax, 2
jb 0x5d4b33
sub rax, 3
cmp rax, 2
jae 0x5d4b39
jmp 0x5d4b2d
mov byte [rbp + 0x4c], 0
jmp 0x5d4b3d
mov byte [rbp + 0x4c], 2
jmp 0x5d4b3d
mov byte [rbp + 0x4c], 1
jmp 0x5d4b3d
mov byte [rbp + 0x4c], 0
lea rcx, [rbp + 0x58]
call sub.user32.dll_GetKeyboardState
lea rcx, [rbp + 0x58]
call fcn.006b7f00
mov ebx, eax
call fcn.005c5d30
or bx, ax
mov word [rbp + 0x4d], bx
mov rcx, rdi
mov edx, 0xb04b
xor r8, r8
lea r9, [rbp + 0x40]
call fcn.005cd770
mov qword [rsi + 0x18], rax
mov al, 1
jmp 0x5d4b7d
xor rax, rax
lea rsp, [rbp + 0x168]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x60f780
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040f710
nop
xor rcx, rcx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x60f869
nop
mov dword [rbp + 0x3c], 0
cmp qword [rbp + 0x68], 0
je 0x60f7c7
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalLock
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
cmp qword [rbp + 0x68], 0
je 0x60f808
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.00410930
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.004091a0
call sub.user32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call sub.user32.dll_SetClipboardData
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalUnlock
jmp 0x60f861
nop
call sub.user32.dll_CloseClipboard
jmp 0x60f886
mov rcx, qword [0x00428c58]
mov dl, 1
mov r8, qword [0x0089b9a8]
call fcn.0043d780
mov rcx, rax
call fcn.0040e7f0
nop
lea rcx, [rbp + 0x68]
call fcn.0040f580
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x616de0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x00616e34]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x616e01
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x616e15
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x616e29
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6a6040
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x0087aac0], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x00585db0]
mov dl, 1
call fcn.005874e0
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.005877b0
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.00410a30
lea rcx, [rbp + 0x30]
lea rdx, [0x006a6260]
mov r8, qword [rbp + 0x28]
call fcn.00410d90
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00587bc0
test al, al
je 0x6a617c
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x006a62d4]
call fcn.005888c0
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.004425a0
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x6a617c
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x006a62ec]
call fcn.0041dec0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x6a6172
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x6a6172
mov rcx, qword [rbp + 0x90]
call fcn.006a5fb0
test eax, eax
je 0x6a6156
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x6a6160
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x0087aac0], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary_2
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040c1b0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040f660
lea rcx, [rbp + 0x68]
call fcn.0040f580
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x6a6370
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x6a63ce
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6a63a9
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6a63be
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x6a63ce
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6b7e30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006b7e98]
mov eax, ecx
test ax, 4
je 0x6b7e4a
or bx, 1
mov eax, ecx
test ax, 8
je 0x6b7e57
or bx, 4
mov eax, ecx
test ax, 1
je 0x6b7e64
or bx, 8
mov eax, ecx
test ax, 2
je 0x6b7e71
or bx, 0x10
test cx, 0x10
je 0x6b7e7c
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b7e90
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6b7ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006b7ef0]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b7ec4
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b7ed8
or si, 4
test ebx, 0x20000000
je 0x6b7ee4
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6c9110
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x008a74e8]
cmp qword [rax + 0x2d0], 0
je 0x6c92ea
test sil, sil
jne 0x6c9209
cmp dword [rbx + 0x138], 0
jne 0x6c91fa
mov rcx, rbx
call fcn.006cd850
lea rcx, [0x006c8fb0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6c91bc
mov rax, qword [0x008a74e8]
cmp byte [rax + 0x193], 0
je 0x6c91bc
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6c9195
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c91bb
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c919d
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c91f9
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00503120
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c91cd
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6c92ea
cmp dword [rbx + 0x138], 0
jle 0x6c92ea
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6c92ea
cmp qword [rbx + 0xa8], 0
je 0x6c9289
mov rax, qword [0x008a74e8]
cmp byte [rax + 0x193], 0
je 0x6c9289
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6c925f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c9288
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c9267
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c92c6
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00503120
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c929a
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006b3048]
call fcn.00412a10
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6ca4f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6ca55f
cmp byte [rbx + 0x193], 0
jne 0x6ca55f
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040f840
xor rax, rax
cmp qword [rsi], 0
je 0x6ca54a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6ca56e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040fbd0
jmp 0x6ca56e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040fbd0
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret