joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005af60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
movsxd rdi, r9d
mov ebx, r8d
mov ebp, edx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14005af9d
cmp dword [0x1401fbbe0], 1
jle 0x14005af9d
mov r8, rdi
jmp 0x14005aff2
test ebp, ebp
je 0x14005afe6
cmp dword [0x1401fbc08], 0
jne 0x14005afe6
xor r9d, r9d
test ebx, ebx
je 0x14005afd6
mov rcx, qword [0x1401fbb00]
mov r8, rdi
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r8d, word [rsp + 0x58]
mov edx, 0x115
mov rcx, rsi
jmp 0x14005affe
movzx r8d, word [rsp + 0x60]
mov edx, 0x115
mov rcx, rsi
jmp 0x14005b001
mov r8, rdi
test ebx, ebx
jne 0x14005aff2
movsxd r8, dword [rsp + 0x50]
mov rcx, qword [0x1401fbb00]
mov edx, 0x111
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_SendMessageW]

Function at 0x14005b020
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [0x1401fbce8], 1
mov ebx, ecx
jne 0x14005b05b
mov ecx, 0x30
call qword [sym.imp.USER32.dll_MessageBeep]
mov eax, 2
jmp 0x14005b19d
cmp qword [0x1401fbae0], 0
je 0x14005b18e
lea rdx, [rsp + 0x20]
lea rcx, [0x140209940]
mov r8d, 8
call fcn.1400ed200
movsxd rax, dword [0x1401fbc6c]
test eax, eax
jle 0x14005b0a2
cmp eax, dword [0x1401f717c]
jg 0x14005b0a2
lea rdx, [0x140208ec0]
cmp qword [rdx + rax*8 - 8], 0
jne 0x14005b0d3
lea rcx, [0x140209940]
call fcn.1400e7210
test eax, eax
jne 0x14005b18e
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005b0c0
test rax, rax
jne 0x14005b18e
lea r9, [0x140208860]
lea rdx, str.SaveChanges
lea rcx, str.Others
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x14005b18e
test ebx, ebx
je 0x14005b120
mov rcx, qword [0x1401fbb00]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14005b120
mov rcx, qword [0x1401fbb00]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401fbba0]
lea r8, [0x140209da0]
mov r9d, 0x80
mov edx, 0x4e82
mov dword [0x1401fbce8], 1
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
call fcn.140059780
lea r8, [0x140209d60]
lea rdx, [0x140209da0]
mov rcx, rax
mov r9d, 0x23
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [0x1401fbce8], 0
cmp eax, 6
jne 0x14005b185
mov ecx, ebx
call fcn.14005ad80
jmp 0x14005b18e
cmp eax, 2
je 0x14005b051
mov dword [0x1401fbce8], 0
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x240
pop rbx
ret
Function at 0x14005bb70
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x670
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005bba1
test eax, eax
jle 0x14005bcd9
cmp dword [0x1401f712c], 0
je 0x14005bcd9
lea r8, [rsp + 0x34]
lea rcx, [rsp + 0x40]
mov edx, 0x30c
call fcn.1400c0fa0
mov rcx, qword [0x1401fbab8]
mov dword [0x1401fbc74], 0
call fcn.1400c0ed0
mov rcx, qword [0x1401fbac0]
test rcx, rcx
je 0x14005bc07
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov qword [0x1401fbac0], 0
mov rcx, rbx
call fcn.1400e47e0
mov eax, dword [rsp + 0x34]
mov rcx, qword [0x1401fbab8]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov r9, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400c2400
mov ebx, dword [0x1401f714c]
lea r9, [0x140208860]
lea rdx, str.FullSort
lea rcx, [0x140185d88]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x14005bc66
add ebx, 0x64
cmp dword [0x1401f714c], 0x1e
je 0x14005bc8b
mov rcx, qword [0x1401fbab8]
lea r9, [fcn.1400c1970]
movsxd r8, ebx
mov edx, 0x1030
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbab8]
lea rdx, [0x140209940]
call fcn.1400c1630
mov rcx, qword [0x1401fbb48]
mov dword [0x1401fbc74], eax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14005bcd9
mov rcx, qword [0x1401fbb48]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x48f
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
xor ecx, ecx
call fcn.1400c6c00
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x690]
add rsp, 0x670
pop rdi
ret

Function at 0x14005bf80
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x448
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rcx
xor eax, eax
lea r8, str.1_2_3_10_14_16_19_21_25_28_33_38_43_50_57_66_76_87_100_115_132_150_174_200_230_260_300_350_400_450_500_600_700_800_900_1000_1200_1400_1600_2000_3000_
nop word [rax + rax]
movzx ecx, word [rax + r8]
lea rax, [rax + 2]
mov word [rsp + rax + 0x2e], cx
test cx, cx
jne 0x14005bfb0
lea rax, [0x140208860]
lea r8, [rsp + 0x30]
lea rcx, str.Viewing
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
lea rdx, str.ZoomTable
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x448
ret
Function at 0x14005c010
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x340
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbx, rcx
mov esi, edx
lea rcx, [rsp + 0x30]
xor edi, edi
xor edx, edx
mov r8d, 0x300
mov dword [rsp + 0x20], edi
call fcn.1400f9ab0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140051030
test eax, eax
je 0x14005c184
xor ecx, ecx
call fcn.14005c5a0
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [rsp + 0x20]
cmp esi, ecx
je 0x14005c12e
jge 0x14005c0e6
cmp esi, 1
jne 0x14005c0c6
cmp ecx, 4
jne 0x14005c0b3
mov rcx, qword [0x1401fbae0]
call fcn.14009bca0
mov ecx, dword [rsp + 0x20]
mov rdi, rax
cmp ecx, 8
jne 0x14005c103
mov rcx, qword [0x1401fbae0]
call fcn.14009bee0
jmp 0x14005c100
cmp esi, 4
jne 0x14005c16e
cmp ecx, 8
jne 0x14005c16e
mov rcx, qword [0x1401fbae0]
call fcn.14009d010
jmp 0x14005c100
mov edx, 1
or r9d, 0xffffffff
shl edx, cl
mov rcx, qword [0x1401fbae0]
or r8d, r9d
call fcn.14003f8c0
mov rdi, rax
test rdi, rdi
je 0x14005c16e
mov rcx, qword [0x1401fbae0]
test rcx, rcx
je 0x14005c127
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1401fbae0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [0x1401fbae0], rdi
lea r9, [0x140208860]
lea rdx, str.PaletteNearest
lea rcx, str.Others
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [rsp + 0x20]
mov rcx, qword [0x1401fbae0]
lea r8, [rsp + 0x30]
mov r9d, eax
call fcn.140050790
mov eax, 1
jmp 0x14005c186
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14005c1b0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
lea r9, [0x140208860]
lea rdx, str.ResampleFilter
lea rcx, str.Resize
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [0x140208860]
lea rdx, str.FastResampleDown
lea rcx, str.Resize
mov r8d, 1
mov dword [0x1401f7150], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [0x140208860]
lea rdx, str.ResampleGamma
lea rcx, str.Resize
xor r8d, r8d
mov dword [0x1401f7154], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x1401fbc40], eax
add rsp, 0x28
ret
Function at 0x14005c850
Capabilities:
Log keystrokes via polling
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r13d, r13d
mov r14d, r8d
mov rbx, rdx
mov r12, rcx
lea r9, [0x140208860]
lea rdx, str.AskDelete
lea r8d, [r13 + 1]
lea rcx, str.Others
mov qword [rbp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [0x140208860]
lea r8d, [r13 + 1]
lea rdx, str.DelToRecycle
lea rcx, str.Others
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [0x140208860]
lea rdx, str.DelSideCars
lea rcx, str.Others
xor r8d, r8d
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [r13 + 0x10]
mov esi, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
cmovs edi, r13d
test r15d, r15d
jne 0x14005c91e
test edi, edi
jne 0x14005c91e
test esi, esi
jne 0x14005c91e
cmp r14d, 1
jne 0x14005c91e
mov rcx, rbx
call fcn.1400fa630
test eax, eax
je 0x14005ca19
or eax, 0xffffffff
jmp 0x14005ca1b
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov eax, 4
mov qword [rbp - 0x40], r12
mov dword [rbp - 0x38], 3
mov qword [rbp - 0x28], r13
mov word [rbp - 0x20], ax
test r15d, r15d
jne 0x14005c962
mov eax, 0x14
mov word [rbp - 0x20], ax
test edi, edi
je 0x14005c96e
or ax, 0x40
mov word [rbp - 0x20], ax
mov dword [rbp - 0x1c], r13d
test esi, esi
jne 0x14005c97c
mov qword [rbp - 0x30], rbx
jmp 0x14005c99b
lea rcx, [rbp + 0x48]
xor r9d, r9d
mov r8d, r14d
mov rdx, rbx
call fcn.1400e9c80
cmp eax, 0xffffffff
je 0x14005c916
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rbp + 0x48]
test eax, eax
je 0x14005c9e5
test rcx, rcx
je 0x14005c9d4
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
or eax, 0xffffffff
cmp dword [rbp - 0x1c], 1
mov ecx, 0xfffffffd
cmove eax, ecx
jmp 0x14005ca1b
test rcx, rcx
je 0x14005ca0c
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp - 0x1c], 1
jne 0x14005ca19
mov eax, 0xfffffffe
jmp 0x14005ca1b
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14005cd90
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, qword [0x1401fbb00]
mov ebp, edx
mov edx, 0x7cd
mov esi, r8d
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [0x1401fbb00]
mov edx, 0x7d4
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [0x1401fbc78]
xor edi, edi
mov dword [0x1401fbbd4], edi
call fcn.14000e210
mov rcx, qword [0x1401fbb20]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14005ce39
mov rcx, qword [0x1401fbb20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x808
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb20]
lea edx, [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [0x1401fbb20], rdi
lea rcx, [0x140209940]
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14005ce50
lea r9, [0x140208860]
lea rdx, str.FullScreen
lea rcx, str.Viewing
xor r8d, r8d
mov dword [0x1401fbc74], ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x14005cf29
test esi, esi
jne 0x14005cf29
mov rcx, qword [0x1401fbb00]
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, qword [0x1401fbb00]
test eax, eax
je 0x14005cebb
lea edx, [rsi + 9]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14005cf82
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14005cf15
mov rcx, qword [0x1401fbb00]
call qword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x14005cf15
mov rcx, qword [0x1401fbb00]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401fbb00]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetClientRect]
movzx r9d, word [rsp + 0x2c]
movzx eax, word [rsp + 0x28]
shl r9d, 0x10
or r9, rax
xor r8d, r8d
lea edx, [r8 + 5]
jmp 0x14005cf75
mov rcx, qword [0x1401fbb00]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14005cf82
mov rcx, qword [0x1401fbae0]
test rcx, rcx
je 0x14005cf4f
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1401fbae0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [0x1401fbae0], rdi
mov rcx, qword [0x1401fbb10]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005cf82
test esi, esi
mov edx, 0x111
mov r8d, 0x448
setne dil
lea r9, [rdi + 0x65]
mov rcx, qword [0x1401fbb00]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb00]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x472
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14005aa60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14005df20
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, ecx
test ecx, ecx
jne 0x14005df3a
call fcn.140059710
mov ebx, eax
mov dword [rdi], 0
cmp ebx, 0xbb8
jb 0x14005df87
lea r9, [0x140208860]
lea rdx, str.ShowCountdown
lea rcx, str.Capture
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x14005df87
mov eax, 0x10624dd3
mov ecx, ebx
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rdi], edx
mov rdx, rdi
call fcn.140056640
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f920
Capabilities:
Change the wallpaper

Disassembly:
sub rsp, 0x28
xor edx, edx
mov r8, rcx
mov r9d, 3
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r9d, r9d
lea edx, [r9 + 0x1a]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov ecx, 0xffff
lea edx, [r9 + 0x1a]
lea r8d, [r9 + 0x14]
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_UpdateWindow]
Function at 0x140068d12
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax + 0x30]
mov rbx, qword [rax + 0x60]
lea r9, [rdi + 0x1926fb]
mov eax, dword [r9]
mov r10d, dword [r9 + 4]
test eax, eax
je 0x140068d77
lea rcx, [rsp + 0x60]
mov r8d, eax
sub r9, rcx
lea rdx, [rsp + 0x60]
nop dword [rax + rax]
mov ecx, dword [r9 + rdx + 8]
lea rdx, [rdx + 4]
add ecx, r10d
mov dword [rdx - 4], ecx
sub r8, 1
jne 0x140068d62
lea rcx, [rsp + 0x60]
call fcn.140068c72
xor r8d, r8d
mov edx, r8d
cmp word [rax], dx
je 0x140068da0
nop word [rax + rax]
inc edx
cmp word [rax + rdx*2], r8w
jne 0x140068d92
cmp edx, 0x1f
ja 0x140068e14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0xd0]
add rdx, rdi
cmp dword [rdx], r8d
je 0x140068e03
movzx r9d, word [rbx]
mov ecx, r8d
test r9w, r9w
je 0x140068dcf
inc ecx
cmp word [rbx + rcx*2], r8w
jne 0x140068dc6
cmp cl, byte [rdx]
je 0x140068dd8
cmp cl, byte [rdx + 1]
jne 0x140068e14
mov ecx, r8d
cmp word [rbx], cx
je 0x140068df7
nop
movzx eax, r9w
lea ecx, [rcx + 1]
movzx r9d, word [rbx + rcx*2]
add r8d, eax
test r9w, r9w
jne 0x140068de2
cmp r8d, dword [rdx + 4]
je 0x140068e03
cmp r8d, dword [rdx + 8]
jne 0x140068e14
mov edx, dword [rsp + 0x94]
lea rcx, [rsp + 0x20]
add rdx, rdi
call rdx
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2d0
pop rdi
ret
Function at 0x14006e680
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x8a0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rsi, rcx
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, [rsp + 0x480]
xor edx, edx
call fcn.14006e940
lea rdx, [rsp + 0x480]
sub rdx, 2
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x14006e6d3
movsd xmm0, qword [str..8bf]
mov eax, dword [0x140188d78]
lea rcx, [rsp + 0x480]
movsd qword [rdx], xmm0
mov dword [rdx + 8], eax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006e81e
mov qword [rsp + 0x8b8], rbx
xor ebx, ebx
nop dword [rax]
mov ecx, dword [rsp + 0x20]
test cl, 0x10
jne 0x14006e7ea
test cl, 2
jne 0x14006e7ea
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x4c]
mov r8d, 4
call fcn.1400ed200
lea rdx, str.Perspective
lea rcx, [rsp + 0x270]
call fcn.1400f92fc
test eax, eax
je 0x14006e7ea
lea rdx, str.Smartcurve
lea rcx, [rsp + 0x270]
call fcn.1400f92fc
test eax, eax
je 0x14006e7ea
lea rdx, str.HarrysFilters
lea rcx, [rsp + 0x270]
call fcn.1400f92fc
test eax, eax
je 0x14006e7ea
lea rdx, [0x140188a30]
lea rcx, [rsp + 0x270]
call fcn.1400f92fc
test eax, eax
je 0x14006e7ea
lea rdx, str.Wireworm
lea rcx, [rsp + 0x270]
call fcn.1400f92fc
test eax, eax
je 0x14006e7ea
lea eax, [rbx + 0x4a83]
lea r9, [rsp + 0x4c]
xor edx, edx
movsxd r8, eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_AppendMenuW]
inc ebx
cmp ebx, 0x1e
jge 0x14006e800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14006e720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1401fbb00]
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov rbx, qword [rsp + 0x8b8]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.1400f9a80
mov rsi, qword [rsp + 0x8c0]
add rsp, 0x8a0
pop rdi
ret
Function at 0x14006e940
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
mov edx, 1
mov rbx, rcx
call fcn.1400ebbc0
lea rax, [rbx - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x14006e972
movups xmm0, xmmword [str.Plugins32_]
movups xmmword [rax], xmm0
mov ecx, dword [0x140188d30]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x140188d34]
mov word [rax + 0x14], cx
lea rcx, [rbx - 2]
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14006e9a0
movups xmm0, xmmword [str.Adobe_8BF]
movups xmmword [rcx], xmm0
mov eax, dword [0x140188d48]
mov dword [rcx + 0x10], eax
test edi, edi
jne 0x14006ea1c
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rbx
call fcn.1400fb86c
lea rax, [0x140208860]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.8BFPath
lea rcx, str.Plugins
mov r9, rbx
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x14006ea1c
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call fcn.1400fb86c
mov rcx, rbx
call fcn.1400e47e0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1400705d0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
xor ecx, ecx
mov esi, r9d
mov ebp, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, ebx
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
xor ecx, ecx
lea r10d, [rbx - 0x21]
mov word [rdi], cx
cmp r10d, 7
jbe 0x14007061b
lea ecx, [rbx - 0x2d]
cmp ecx, 1
ja 0x14007061f
bts eax, 8
shl eax, 0x10
mov r8d, ebp
mov rdx, rdi
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140070634
cmp ebx, 1
jle 0x140070662
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
sub rcx, rdi
sar rcx, 1
sub ebx, ecx
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_CharLowerBuffW]
test esi, esi
je 0x140070683
lea rcx, [rdi - 2]
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140070670
mov eax, dword [0x140188eac]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140070690
xor edx, edx
nop dword [rax]
movzx ecx, word [rdi + rdx*2]
lea rdx, [rdx + 1]
mov word [rax + rdx*2 - 2], cx
test cx, cx
jne 0x1400706a0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400716f0
Capabilities:
Read .ini file

Disassembly:
push rsi
push r14
sub rsp, 0x4e8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r14, rcx
call qword [sym.imp.USER32.dll_GetMenu]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x400
mov rsi, rax
call fcn.1400f9ab0
lea rax, [0x140208860]
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea r8, [0x140181e34]
lea rdx, [0x140188ec8]
lea rcx, [0x140188ee8]
mov dword [rsp + 0x20], 0x1fe
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xc0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140071771
test eax, eax
jle 0x140071920
mov qword [rsp + 0x510], rbp
mov qword [rsp + 0x4e0], rdi
lea r8, [0x1401839b4]
mov qword [rsp + 0x4d0], r15
lea rcx, [rsp + 0xc0]
xor r15d, r15d
mov edx, 0x200
mov edi, r15d
call fcn.1400e4ab0
lea edx, [r15 + 0x7c]
lea rcx, [rsp + 0xc0]
call fcn.1400e8af0
mov ebp, eax
test eax, eax
jle 0x140071908
mov qword [rsp + 0x508], rbx
mov qword [rsp + 0x4d8], r12
mov r12d, 0x4ae7
mov ebx, r15d
nop
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.1400f9ab0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
mov r9d, 0x7c
mov edx, ebx
mov dword [rsp + 0x20], 0x3f
call fcn.1400ec2b0
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140071830
test eax, eax
jle 0x1400718df
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rdx, [0x140188f10]
lea rcx, [rsp + 0x40]
call fcn.1400fb8b4
movzx edx, word [rsp + 0x30]
movzx eax, dx
sub ax, r12w
cmp ax, 0xf
ja 0x1400718b1
test edi, edi
jne 0x1400718b1
movzx edx, dx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_GetMenuStringW]
test eax, eax
jne 0x1400718ac
lea r8d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call fcn.140071cf0
mov rcx, r14
call qword [sym.imp.USER32.dll_GetMenu]
mov edi, 1
mov rsi, rax
movzx edx, word [rsp + 0x30]
movzx r8d, word [rsp + 0x34]
mov rcx, rsi
call fcn.140071940
mov rcx, qword [0x1401fbb48]
call qword [sym.imp.USER32.dll_GetMenu]
movzx r8d, word [rsp + 0x34]
movzx edx, word [rsp + 0x30]
mov rcx, rax
call fcn.140071940
movzx ecx, word [rsp + 0x30]
movzx edx, word [rsp + 0x34]
call fcn.140071580
inc ebx
cmp ebx, ebp
jl 0x1400717f0
mov r12, qword [rsp + 0x4d8]
mov rbx, qword [rsp + 0x508]
mov rbp, qword [rsp + 0x510]
mov rdi, qword [rsp + 0x4e0]
mov r15, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x4e8
pop r14
pop rsi
ret