joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c260
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x14005c29c
mov edx, dword [rcx + 0x288]
lea r11, [0x14008c8e0]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x14005c280
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x14005c37e
sub edx, 1
je 0x14005c370
cmp edx, 1
je 0x14005c330
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x14005c34f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x180005150
Capabilities:
Log keystrokes
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
jne 0x180005196
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x18000523d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
jne 0x18000523d
xor edx, edx
mov r8d, eax
mov rcx, rbx
mov dword [rbx + 0xc0], eax
add rsp, 0x20
pop rbx
jmp fcn.180003f60
cmp edx, 1
jne 0x180005204
mov rbx, qword [rcx + 0x548]
cmp dword [rbx + 0x58], edx
jne 0x18000523d
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1800051c1
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor r11d, r11d
mov qword [rbx + 0x48], r11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x1800127e0]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x18000523d
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x466
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostMessageW]
cmp edx, 2
jne 0x18000521a
mov rcx, qword [rcx + 0x548]
add rsp, 0x20
pop rbx
jmp 0x180012a30
cmp edx, 9
jne 0x18000523d
xor r11d, r11d
cmp dword [rcx + 0x10], r11d
sete r11b
xor r8d, r8d
xor edx, edx
mov dword [rcx + 0x10], r11d
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_InvalidateRect]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.180037bc4
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_abcdefghi
mov r11d, eax
mov eax, 0x8d3dcb09
imul r11d
add edx, r11d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul edx, edx, 0x3a
sub r11d, edx
mov edx, 2
movzx ecx, byte [r11 + rcx]
mov byte [rdi + 0x70], cl
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, byte [rdi + 0x70]
movzx edx, al
xor r9d, r9d
xor r8d, r8d
mov ebx, eax
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [rdi + 0x70]
xor r9d, r9d
movzx edx, bl
lea r8d, [r9 + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_keybd_event]
Function at 0x18000dd00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
mov eax, dword [0x1801359fc]
test eax, eax
je 0x18000dd3a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1801359fc]
test eax, eax
jne 0x18000dd47
call fcn.18000e570
test eax, eax
je 0x18000dd5d
lea rdx, [rsp + 0x50]
mov rcx, qword [0x180131720]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x18000dd61
xor eax, eax
jmp 0x18000dda1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov esi, eax
mov dword [rsp + 0x20], eax
mov edi, ebx
test eax, eax
sete dil
test edi, edi
je 0x18000dd86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x18000dd9f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18000ddc0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov word [rsp + 0x20], bx
mov qword [rsp + 0x48], rbx
mov eax, dword [0x1801359fc]
test eax, eax
je 0x18000ddfb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1801359fc]
test eax, eax
jne 0x18000de08
call fcn.18000e570
test eax, eax
je 0x18000de1e
lea rdx, [rsp + 0x48]
mov rcx, qword [0x180131720]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x18000de23
mov ax, bx
jmp 0x18000de65
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx edi, ax
mov word [rsp + 0x20], ax
mov esi, ebx
test di, di
sete sil
test esi, esi
je 0x18000de49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test esi, esi
je 0x18000de62
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000e450
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r12, rdx
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbx
mov eax, dword [0x1801359fc]
test eax, eax
je 0x18000e497
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1801359fc]
test eax, eax
jne 0x18000e4a4
call fcn.18000e570
test eax, eax
je 0x18000e4ba
lea rdx, [rsp + 0x60]
mov rcx, qword [0x180131720]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x18000e4c1
xor eax, eax
jmp 0x18000e553
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
mov edi, ebx
test rax, rax
sete dil
test edi, edi
je 0x18000e537
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x18000e550
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret

Function at 0x18000e7c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x48], rbx
mov eax, dword [0x1801359fc]
test eax, eax
je 0x18000e7f8
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1801359fc]
test eax, eax
jne 0x18000e805
call fcn.18000e570
test eax, eax
je 0x18000e81b
lea rdx, [rsp + 0x48]
mov rcx, qword [0x180131720]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x18000e81f
xor eax, eax
jmp 0x18000e865
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x20], rax
mov esi, ebx
test rax, rax
sete sil
test esi, esi
je 0x18000e849
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test esi, esi
je 0x18000e862
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000e970
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, r8
mov r12, rdx
mov rbx, rcx
xor r13d, r13d
mov qword [rax + 0x20], r13
mov qword [rax - 0x48], r13
test rcx, rcx
je 0x18000eb9c
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18000eb9c
test rdx, rdx
jne 0x18000e9d3
mov eax, 0x80070057
jmp 0x18000eba1
test r8, r8
jne 0x18000e9e2
mov eax, 0x80070057
jmp 0x18000eba1
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [0x1800f33e0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1800f34b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
js 0x18000eb3b
cmp qword [rsp + 0xb8], r13
je 0x18000eb3b
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.18000e880
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x18000ea3c
mov rdx, qword [rcx]
jmp 0x18000ea3f
mov rdx, r13
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x18]
mov edi, eax
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x18000eab0
lock xadd dword [rbx + 0x10], esi
add esi, 0xffffffff
jne 0x18000eab0
test rbx, rbx
je 0x18000eab0
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000ea9a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000eaa8
call fcn.18003747c
mov rcx, rbx
call fcn.180036ed0
test edi, edi
js 0x18000eb0b
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000eb0b
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
test eax, eax
js 0x18000eb69
mov rcx, qword [rsp + 0xb8]
mov qword [r12], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rbp], rcx
mov eax, r13d
jmp 0x18000eba1
test edi, edi
jne 0x18000eb17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
bt edi, 0x1d
jae 0x18000eb2c
test edi, edi
jle 0x18000eb69
movzx edi, di
or edi, 0xa0070000
jmp 0x18000eb69
test edi, edi
jle 0x18000eb69
movzx edi, di
or edi, 0x80070000
jmp 0x18000eb69
test eax, eax
jne 0x18000eb47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
bt edi, 0x1d
jae 0x18000eb5c
test edi, edi
jle 0x18000eb69
movzx edi, di
or edi, 0xa0070000
jmp 0x18000eb69
test edi, edi
jle 0x18000eb69
movzx edi, di
or edi, 0x80070000
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x18000eb84
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0xb8], r13
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000eb98
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
jmp 0x18000eba1
mov eax, edi
jmp 0x18000eba1
mov eax, 0x80070057
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000ff60
Capabilities:
Get local ipv4 addresses
Initialize winsock library

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x208
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
xor esi, esi
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x18], r13
mov dword [rsp + 0x30], 0x3c00
mov qword [r11 - 0x28], r15
mov r14, rcx
mov rbp, rsi
mov r12, rsi
mov edi, esi
test rbp, rbp
je 0x18000ffb4
mov rcx, rbp
call fcn.18003747c
mov ecx, dword [rsp + 0x30]
call fcn.180036df8
mov rbp, rax
test rax, rax
je 0x18001012b
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.180037390
xor r8d, r8d
lea rax, [rsp + 0x30]
lea edx, [r8 + 0xc]
mov r9, rbp
xor ecx, ecx
inc edi
mov qword [rsp + 0x20], rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x18000ffff
cmp edi, 3
jb 0x18000ffa7
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18001004d
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov esi, eax
jae 0x180010037
test eax, eax
jle 0x180010130
movzx esi, ax
or esi, 0xa0070000
jmp 0x180010130
test eax, eax
jle 0x180010130
movzx esi, ax
or esi, 0x80070000
jmp 0x180010130
mov rcx, 0xffffffffffffffff
mov eax, 2
mov r15d, 0x400
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.180036df8
mov r13, rax
test rax, rax
jne 0x180010080
mov esi, 0x8007000e
jmp 0x180010130
xor edx, edx
mov r8d, 0x800
mov rcx, rax
mov qword [rsp + 0x228], rbx
call fcn.180037390
mov rbx, rbp
or rsi, 0xffffffffffffffff
nop
cmp dword [rbx + 0x58], 0
jbe 0x1800100ad
test r12, r12
cmove r12, rbx
mov rcx, qword [rbx + 0x10]
call fcn.18000f410
test eax, eax
je 0x1800100e5
cmp dword [rbx + 0x58], 0
je 0x1800100e5
xor eax, eax
mov rcx, rsi
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
add rcx, 0x40
cmp rcx, r15
ja 0x1800100ee
mov r8d, r15d
mov rdx, r13
mov rcx, rbx
call fcn.18000fd10
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1800100a0
mov rbx, qword [rsp + 0x228]
xor eax, eax
mov rcx, rsi
mov rdi, r13
mov rsi, rax
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x180010120
test r12, r12
je 0x180010120
mov r8d, r15d
mov rdx, r13
mov rcx, r12
call fcn.18000fd10
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov qword [r14], r13
jmp 0x180010130
mov esi, 0x8007000e
mov r15, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov r13, qword [rsp + 0x200]
mov r12, qword [rsp + 0x238]
mov rdi, qword [rsp + 0x230]
test rbp, rbp
je 0x180010165
mov rcx, rbp
call fcn.18003747c
mov eax, esi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.180037360
add rsp, 0x208
pop rsi
pop rbp
ret
Function at 0x1800120b0
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x58], 1
mov rbx, rcx
jne 0x180012171
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1800120da
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x40], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x180012650]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x180012117
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x466
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18001212e
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x48], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x1800127e0]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x18001217b
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x466
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
add rsp, 0x20
pop rbx
ret
Function at 0x180012a30
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
jne 0x180005196
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x18000523d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
jne 0x18000523d
xor edx, edx
mov r8d, eax
mov rcx, rbx
mov dword [rbx + 0xc0], eax
add rsp, 0x20
pop rbx
jmp fcn.180003f60
cmp edx, 1
jne 0x180005204
mov rbx, qword [rcx + 0x548]
cmp dword [rbx + 0x58], edx
jne 0x18000523d
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1800051c1
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor r11d, r11d
mov qword [rbx + 0x48], r11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x1800127e0]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x18000523d
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x466
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostMessageW]
cmp edx, 2
jne 0x18000521a
mov rcx, qword [rcx + 0x548]
add rsp, 0x20
pop rbx
jmp 0x180012a30
cmp edx, 9
jne 0x18000523d
xor r11d, r11d
cmp dword [rcx + 0x10], r11d
sete r11b
xor r8d, r8d
xor edx, edx
mov dword [rcx + 0x10], r11d
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_InvalidateRect]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.180037bc4
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_abcdefghi
mov r11d, eax
mov eax, 0x8d3dcb09
imul r11d
add edx, r11d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul edx, edx, 0x3a
sub r11d, edx
mov edx, 2
movzx ecx, byte [r11 + rcx]
mov byte [rdi + 0x70], cl
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, byte [rdi + 0x70]
movzx edx, al
xor r9d, r9d
xor r8d, r8d
mov ebx, eax
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [rdi + 0x70]
xor r9d, r9d
movzx edx, bl
lea r8d, [r9 + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_keybd_event]
Function at 0x180014260
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x588], 0
mov rbx, rcx
jne 0x1800053bf
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
cmp eax, 1
jne 0x1800053bf
cmp dword [rbx + 0x1c], eax
jne 0x1800053b5
mov rcx, qword [rbx + 0x550]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov rcx, qword [rbx + 0x550]
cmp eax, 1
jne 0x1800053a3
mov rcx, qword [rcx]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rbx + 8]
lea r8, [rbx + 0x54]
add rsp, 0x20
pop rbx
jmp 0x180014260
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetFocus]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov rax, rdx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], ecx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rbx, r8
mov dword [rsp + 0x40], 0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rdi]
mov dword [rsp + 0x30], 0x34
mov rdx, 0xfffffffffffffffe
mov dword [rsp + 0x28], SysAllocStringByteLen
mov dword [rsp + 0x20], 0x1b8
call qword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [rbx]
mov rcx, rdi
mov dword [rdi + 0x5c8], eax
mov eax, dword [rbx + 4]
mov dword [rdi + 0x5cc], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x5d0], eax
mov eax, dword [rbx + 0xc]
mov dword [rdi + 0x5d4], eax
call fcn.180014c00
mov rcx, qword [rdi]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetFocus]
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x180014720
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x60
mov r12, rcx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [r12]
lea rdx, [rsp + 0x50]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
sub r8d, dword [rsp + 0x54]
sub edx, dword [rsp + 0x50]
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rsi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [r12 + 0x24]
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r9d, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
add r9d, 5
add r8d, 5
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x28], 0x85
mov dword [rsp + 0x20], 0x1ae
call fcn.180014870
mov r11d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x40], 0xcc0020
xor eax, eax
sub r11d, r8d
sub r9d, edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov rcx, rbp
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [r12]
mov rdx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret