joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002245c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
sub edx, 7
je 0x14002255f
sub edx, 1
je 0x14002255b
sub edx, 0xf8
je 0x14002251c
sub edx, 0x101
je 0x14002250a
sub edx, 1
je 0x1400224c5
sub edx, 0x7dff
je 0x1400224ae
cmp edx, 0x300
jne 0x14002255b
call fcn.1400b572c
jmp 0x140022579
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140022579
cmp byte [0x14017a7d0], 0
je 0x140022579
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
shr ecx, 0x10
cmp ax, cx
jne 0x140022501
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8001
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x14017a7d0], 0
jmp 0x140022579
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rbx
setne byte [0x14017a7d0]
jmp 0x140022579
cmp r8, 8
jne 0x14002255b
lea ecx, [r8 + 9]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14002255b
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14002255b
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14002255b
mov edx, 0x8301
mov rcx, rbx
jmp 0x14002256d
xor al, al
jmp 0x14002257b
cmp byte [0x14017a7d0], 0
jne 0x140022579
mov edx, 0x8001
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400227ac
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1400b4efc
test al, al
jne 0x140022870
test rbx, rbx
je 0x140022870
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400227dd
cmp eax, 4
jl 0x140022870
cmp byte [rbx + 1], 0x3a
jne 0x140022870
mov sil, byte [rbx]
mov dword [rsp + 0x38], 0x5c3a41
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test eax, eax
je 0x14002286d
mov bpl, byte [rsp + 0x38]
mov cl, 0x41
mov al, cl
test dil, 1
je 0x140022863
cmp cl, sil
je 0x140022863
movsx ecx, cl
mov dword [rsp + 0x38], 0x5c3a3f
call fcn.140107548
mov byte [rsp + 0x38], al
sub al, 0x41
cmp al, 0x19
ja 0x140022863
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 1
je 0x140022854
sub eax, 1
je 0x140022854
cmp eax, 3
jne 0x140022863
mov rcx, rbx
mov byte [rbx], bpl
call fcn.1400b4efc
test al, al
jne 0x140022887
shr edi, 1
lea ecx, [rbp + 1]
mov bpl, cl
jne 0x140022813
mov byte [rbx], sil
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov al, 1
jmp 0x140022872
Function at 0x14002362c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, edx
xor r14d, r14d
mov edx, dword [rcx + 0x1b8]
mov r12d, r8d
mov rdi, rcx
cmp edx, 1
jne 0x140023670
cmp byte [rcx + 0x1bc], r14b
jne 0x14002383a
cmp edx, 3
jne 0x140023681
mov dword [rcx + 0x1b8], r14d
jmp 0x14002383a
test edx, edx
je 0x14002369d
lea rcx, str.OnMouseLeftButtonDown:_win__mouseAction_d_n
call fcn.1400b3458
mov dword [rdi + 0x1b8], r14d
jmp 0x14002383a
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400236b3
mov rax, qword [rcx]
call qword [rax + 0xf0]
test rax, rax
jne 0x1400236c3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400236c3
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400236e3
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rsi, rax
jmp 0x1400236e6
mov rsi, r14
mov rcx, rdi
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x6c], r12d
call fcn.140066d68
mov rbx, qword [rsp + 0x68]
mov rcx, rsi
mov rdx, rbx
mov rbp, rax
mov r8, qword [rax + 0xf8]
call fcn.140032f6c
test rax, rax
je 0x140023748
cmp rax, qword [rbp + 0xf8]
jne 0x140023748
mov ecx, dword [0x14016bf80]
cmp ecx, 0xffffffff
je 0x140023748
mov rdx, r14
cmp ecx, dword [rax]
je 0x1400237df
inc rdx
lea rcx, [0x14016bf80]
mov ecx, dword [rcx + rdx*4]
cmp ecx, 0xffffffff
jne 0x14002372e
mov r15b, r14b
cmp qword [rdi + 0x330], r14
je 0x140023764
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140023764
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140032eb4
test rax, rax
je 0x14002378b
lea rcx, str.dest
cmp qword [rax + 8], rcx
jne 0x14002378b
mov qword [rdi + 0x330], rax
mov ecx, 0x10
mov byte [rdi + 0x1bd], 1
mov qword [rdi + 0x1c8], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, 0x11
shr r14w, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [0x14016ee08]
movzx ebp, ax
mov rcx, qword [rdi]
shr esi, 5
shr bp, 0xf
and sil, 1
test rcx, rcx
je 0x1400237f4
mov rdx, qword [rcx]
call qword [rdx + 0xf0]
jmp 0x1400237f6
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, rdi
mov r15b, 1
call fcn.1400234e8
jmp 0x14002378b
xor eax, eax
mov rdx, rbx
mov rcx, rax
call fcn.140033040
test r15b, r15b
jne 0x140023829
test sil, sil
je 0x140023829
test r14b, r14b
jne 0x140023814
test al, al
jne 0x140023819
test bpl, bpl
je 0x140023829
mov r8d, r12d
mov edx, r13d
mov rcx, rdi
call fcn.14007aea8
jmp 0x14002383a
xor r9d, r9d
mov r8d, r12d
mov edx, r13d
mov rcx, rdi
call fcn.140022e80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140024b74
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_BeginPaint]
mov ecx, dword [rbx + 0x2cc]
mov rdi, rax
sub ecx, 2
je 0x140024bfd
cmp ecx, 1
je 0x140024bf9
mov rcx, qword [rbx + 0x1b0]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
jne 0x140024bd7
mov rdx, qword [rcx + 8]
lea r8, [rsp + 0x4c]
mov rcx, rbx
call fcn.14002437c
test al, al
je 0x140024c19
mov rcx, qword [rbx + 0x1b0]
mov rdx, rdi
call fcn.1400b8064
jmp 0x140024c19
xor ecx, ecx
jmp 0x140024c02
mov ecx, 4
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
mov r8, rax
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_EndPaint]
cmp byte [0x1401722f2], 0
je 0x140024c8a
mov rbx, qword [rbx + 0x4b0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x20]
xorps xmm2, xmm2
sub rax, qword [rsp + 0x28]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x30]
mov rcx, rbx
movsd xmm1, qword [0x140156958]
cvtsi2sd xmm2, rax
divsd xmm2, xmm0
mulsd xmm2, xmm1
divsd xmm1, xmm2
cvttsd2si edx, xmm1
call fcn.1400a449c
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x1400260a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
and dword [rsp + 0x34], 0
mov rdi, rcx
and dword [rsp + 0x38], 0
xorps xmm0, xmm0
mov ecx, 0x10
mov dword [rsp + 0x30], 0x100
movdqu xmmword [rsp + 0x20], xmm0
mov r15b, r8b
mov r14, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
xor r9d, r9d
xor r8d, r8d
movzx r13d, ax
or edx, 0xffffffff
mov rcx, r14
shr r13w, 0xf
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
mov r12d, eax
call fcn.14012a960
xor esi, esi
test r12d, r12d
jle 0x1400261a1
mov r9d, 0x104
lea r8, [rbp - 0x60]
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
call fcn.1400b2af0
mov r9, rax
lea rdx, [rbp - 0x60]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.1400be6d0
lea rdx, [0x14013fe94]
mov rcx, rax
mov rbx, rax
call fcn.1400b0518
test al, al
je 0x140026189
mov rcx, rbx
call fcn.1400b6924
test rax, rax
cmovne rbx, rax
or r8d, 0xffffffff
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400bb18c
inc esi
cmp esi, r12d
jl 0x140026135
test r15b, r15b
je 0x1400261af
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DragFinish]
mov r8, qword [rsp + 0x28]
lea r10, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x48], r9d
test r8, r8
jne 0x1400261f5
xor edx, edx
mov rax, rcx
test rcx, rcx
je 0x1400261ea
cmp dword [rax + 0xc], edx
jg 0x1400261ec
sub edx, dword [rax + 0xc]
mov rax, qword [rax]
test rax, rax
jne 0x1400261da
xor edx, edx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], edx
mov ebx, dword [rsp + 0x34]
test r8, r8
jne 0x140026218
mov rax, rcx
test rcx, rcx
je 0x140026218
mov edx, ebx
cmp dword [rax + 0xc], edx
jg 0x140026222
sub edx, dword [rax + 0xc]
mov rax, qword [rax]
test rax, rax
jne 0x140026208
lea rax, [rsp + 0x20]
cmp r10, rax
jne 0x140026227
cmp r9d, ebx
je 0x140026293
lea rcx, [rsp + 0x40]
call fcn.1400bb858
mov r8, rdi
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.14007f674
test r13b, r13b
je 0x14002625a
test rdi, rdi
jne 0x14002625a
xor ecx, ecx
call fcn.140082ccc
mov rdi, rax
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
call fcn.14008392c
lea rcx, [rsp + 0x60]
call fcn.14007f82c
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.1400bb8c4
mov r8, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x48]
mov r10, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
jmp 0x140026218
test r8, r8
je 0x1400262ab
mov rcx, r8
call fcn.140107298
and qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400262c0
mov rbx, qword [rcx]
call fcn.140107298
mov rcx, rbx
test rbx, rbx
jne 0x1400262b0
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400264e4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_BeginPaint]
mov rcx, qword [rbx + 0x1b0]
mov rdi, rax
mov rdx, qword [rcx + 0x10]
test rdx, rdx
jne 0x140026537
mov rdx, qword [rcx + 8]
mov eax, dword [0x14016ee08]
mov rcx, qword [0x140172270]
and eax, 6
cmp al, 6
jne 0x140026561
cmp byte [rcx + 0x4a], 0
je 0x140026561
cmp byte [rcx + 0x53], 0
je 0x140026561
mov rcx, rbx
call fcn.14005d6b0
jmp 0x140026569
mov rcx, rbx
call fcn.14005c650
mov rcx, qword [rbx + 0x1b0]
mov rdx, rdi
call fcn.1400b8064
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_EndPaint]
cmp byte [0x1401722f2], 0
je 0x1400265e9
mov rbx, qword [rbx + 0x4b0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x20]
xorps xmm2, xmm2
sub rax, qword [rsp + 0x28]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x30]
mov rcx, rbx
movsd xmm1, qword [0x140156958]
cvtsi2sd xmm2, rax
divsd xmm2, xmm0
mulsd xmm2, xmm1
divsd xmm1, xmm2
cvttsd2si edx, xmm1
call fcn.1400a449c
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x140026674
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
xor r9d, r9d
add rcx, 0x220
call fcn.14005c0a8
mov rcx, qword [rdi + 0x338]
mov rbx, rax
test rax, rax
je 0x1400266d2
cmp rax, rcx
je 0x1400266cd
test rcx, rcx
je 0x1400266d2
mov r9, rcx
sub r9, rax
movzx edx, byte [rax]
movzx r8d, byte [rax + r9]
sub edx, r8d
jne 0x1400266c9
inc rax
test r8d, r8d
jne 0x1400266b4
test edx, edx
jne 0x1400266d2
mov sil, 1
jmp 0x1400266d5
xor sil, sil
call fcn.140107298
and qword [rdi + 0x338], 0
test sil, sil
je 0x14002683d
lea rdx, str._File_Open_
cmp rbx, rdx
je 0x140026827
test rbx, rbx
je 0x1400267dc
mov rcx, rbx
call fcn.14012a690
test eax, eax
je 0x140026827
lea rdx, str._View_HideList_
cmp rbx, rdx
je 0x1400267ca
mov rcx, rbx
call fcn.14012a690
test eax, eax
je 0x1400267ca
lea rdx, str._View_ShowList_
cmp rbx, rdx
je 0x1400267b3
mov rcx, rbx
call fcn.14012a690
test eax, eax
je 0x1400267b3
lea rdx, str.http:
cmp rbx, rdx
je 0x1400267a6
mov r8d, 5
mov rcx, rbx
call fcn.14010b194
test eax, eax
je 0x1400267a6
lea rdx, str.https:
cmp rbx, rdx
je 0x1400267a6
mov r8d, 6
mov rcx, rbx
call fcn.14010b194
test eax, eax
je 0x1400267a6
lea rdx, [0x14013fef0]
cmp rbx, rdx
je 0x1400267a6
mov r8d, 7
mov rcx, rbx
call fcn.14010b194
test eax, eax
jne 0x1400267d7
mov rcx, rbx
call fcn.14007fb04
jmp 0x14002683d
mov rax, qword [0x140172270]
mov byte [rax + 0x53], 1
mov dl, 1
mov rcx, rdi
call fcn.1400670c0
jmp 0x14002683d
mov rax, qword [0x140172270]
mov byte [rax + 0x53], 0
jmp 0x1400267be
test rbx, rbx
jne 0x1400267ec
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400267ec
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14007f674
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
lea rcx, [rsp + 0x20]
xor al, 1
mov byte [rsp + 0x38], al
call fcn.14008392c
lea rcx, [rsp + 0x20]
call fcn.14007f82c
jmp 0x14002683d
mov rcx, qword [rdi + 0x10]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x48]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14002f2b4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x480
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, rcx
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002f304
mov al, 1
jmp 0x14002f3c6
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14002f3ba
lea r15, str.winex11.drv
call fcn.1400b2af0
mov r9, rax
lea rdx, [rsp + 0x60]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.1400be6d0
mov rdi, rax
cmp rax, r15
je 0x14002f360
test rax, rax
je 0x14002f363
mov rdx, r15
mov rcx, rax
call fcn.14010b2d0
test eax, eax
jne 0x14002f363
mov sil, 1
call fcn.1400b2af0
mov r9, rax
lea rdx, [rsp + 0x260]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.1400be6d0
mov r9d, dword [rsp + 0x50]
lea rdx, str.Module:__p__06X___16s__s_n
mov r8, qword [rsp + 0x48]
mov rcx, rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.1400b1a70
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14002f329
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, sil
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret
Function at 0x1400359dc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 8]
mov rbx, rcx
mov rdi, qword [rdx]
mov edx, 1
lea rcx, [rax + rax*2]
shr rcx, 2
lea rsi, [rdi + rax]
call fcn.140109ad8
xor r9b, r9b
mov r10, rax
xor r11d, r11d
mov r8, rax
jmp 0x140035a57
mov cl, byte [rdi]
cmp cl, 0x3d
je 0x140035a5c
lea edx, [rcx - 0x41]
cmp dl, 0x19
jbe 0x140035a3e
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x140035a34
lea edx, [rcx - 0x47]
jmp 0x140035a3e
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140035a79
lea edx, [rcx + 4]
cmp dl, 0xff
jne 0x140035a89
cmp cl, 0x20
je 0x140035a54
sub cl, 9
cmp cl, 4
ja 0x140035b05
inc rdi
cmp rdi, rsi
jb 0x140035a19
sub r8, r10
mov qword [rbx], r10
mov qword [rbx + 8], r8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp cl, 0x2b
jne 0x140035a82
mov dl, 0x3e
jmp 0x140035a89
cmp cl, 0x2f
jne 0x140035a43
mov dl, 0x3f
mov ecx, r11d
and ecx, 0x80000003
jge 0x140035a9b
dec ecx
or ecx, 0xfffffffc
inc ecx
inc r11d
test ecx, ecx
je 0x140035afd
sub ecx, 1
je 0x140035adf
sub ecx, 1
je 0x140035ac1
cmp ecx, 1
jne 0x140035a54
mov al, r9b
shl al, 6
or al, dl
mov byte [r8], al
inc r8
jmp 0x140035a54
shl r9b, 4
mov al, dl
sar al, 2
or al, r9b
mov r9b, dl
mov byte [r8], al
inc r8
and r9b, 3
jmp 0x140035a54
shl r9b, 2
mov al, dl
sar al, 4
or al, r9b
mov r9b, dl
mov byte [r8], al
inc r8
and r9b, 0xf
jmp 0x140035a54
mov r9b, dl
jmp 0x140035a54
mov rcx, r10
call fcn.140107298
and qword [rbx], 0
and qword [rbx + 8], 0
jmp 0x140035a66

Function at 0x14003dcb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rbp, r8
xor r9d, r9d
xor r8d, r8d
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, ebx
je 0x14003dce7
xor al, al
jmp 0x14003dd10
xor ebx, ebx
lea r9, [rsp + 0x48]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003dd0e
cmp dword [rsp + 0x48], edi
jne 0x14003dd0e
mov bl, 1
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400495a4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, rbx
call fcn.1400bf390
lea rcx, str.fileZip
mov esi, 0x120
cmp rax, rcx
jne 0x1400495df
xor edx, edx
mov rcx, rbx
call fcn.1400c160c
jmp 0x140049636
lea rcx, str.fileRar
cmp rax, rcx
jne 0x140049602
mov rcx, rsi
call fcn.1400f44e0
mov rdx, qword [sym.imp.libmupdf.dll_ar_open_rar_archive]
mov r8d, 1
jmp 0x140049623
lea rcx, str.file7Z
cmp rax, rcx
jne 0x14004963e
mov rcx, rsi
call fcn.1400f44e0
mov rdx, qword [sym.imp.libmupdf.dll_ar_open_7z_archive]
mov r8d, 2
mov rcx, rax
call fcn.1400c1044
mov rdx, rbx
mov rcx, rax
call fcn.1400c154c
mov rdi, rax
test rax, rax
jne 0x140049696
mov rcx, rbx
call fcn.1400bf530
lea rdx, str.fileCbt
cmp rax, rdx
je 0x140049662
lea rdx, str.fileTar
cmp rax, rdx
jne 0x140049726
mov rcx, rsi
call fcn.1400f44e0
mov rdx, qword [sym.imp.libmupdf.dll_ar_open_tar_archive]
mov r8d, 3
mov rcx, rax
call fcn.1400c1044
mov rdx, rbx
mov rcx, rax
call fcn.1400c154c
mov rdi, rax
test rax, rax
je 0x140049726
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x48]
lea rcx, str.EngineCbx::CreateFromFile__:_opening_archive_took__.2f_n
sub rax, qword [rsp + 0x50]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x140156958]
movq rdx, xmm1
call fcn.1400b3458
mov ecx, 0x2d8
call fcn.1400f44e0
mov rdx, rdi
mov rcx, rax
call fcn.140048840
mov rdi, rax
test rbx, rbx
je 0x14004971e
mov rdx, rbx
mov rcx, rax
call fcn.14003cdb0
mov rcx, rdi
call fcn.140048b90
test al, al
je 0x14004971e
mov rax, rdi
jmp 0x140049728
mov rcx, rdi
call fcn.14003ccc0
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x140054ba4
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x3040
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x3030], rax
mov rdi, rcx
lea rcx, [0x140145dec]
call fcn.1400b4b50
xor ecx, ecx
mov rbp, rax
call fcn.140107298
xor esi, esi
or r14, 0xffffffffffffffff
mov ebx, esi
test rbp, rbp
je 0x140054c93
mov r8, r14
inc r8
cmp byte [r8 + rbp], sil
jne 0x140054bfe
mov r9d, 1
mov rdx, rbp
xor ecx, ecx
call fcn.1400b3634
mov rbx, rax
test rdi, rdi
jne 0x140054c24
mov rax, rsi
jmp 0x140054c37
call fcn.1400b2af0
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.1400be600
lea rdx, [0x14013ed54]
mov rcx, rax
call qword [sym.imp.libmupdf.dll_gzopen_w]
mov rdi, rax
test rax, rax
je 0x140054c93
mov qword [rsp + 0x20], rsi
call fcn.1400b2af0
mov r8, rax
mov rdx, r14
mov rcx, rbp
call fcn.1400be600
lea r8, [0x140145f24]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140107708
test eax, eax
jne 0x140054c8a
cmp qword [rsp + 0x20], rsi
jne 0x140054d1b
mov rcx, rdi
call qword [sym.imp.libmupdf.dll_gzclose]
mov rbp, rsi
test rbx, rbx
je 0x140054cd1
call fcn.1400b2af0
mov r8, rax
mov rdx, r14
mov rcx, rbx
call fcn.1400be600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
sete sil
or esi, edi
jne 0x140054cd1
xor ecx, ecx
call fcn.1400b5d58
mov rcx, rbx
call fcn.140107298
mov rax, rbp
mov rcx, qword [rsp + 0x3030]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x3040]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, eax
mov edx, 1
call fcn.140109f78
mov r8d, 0x3000
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.libmupdf.dll_gzread]
test eax, eax
jg 0x140054d04
mov rcx, qword [rsp + 0x20]
call fcn.140107928
mov rcx, rdi
call qword [sym.imp.libmupdf.dll_gzclose]
mov rcx, rbp
call fcn.1400548e0
mov rbp, rax
jmp 0x140054c96
Function at 0x1400588e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
test rcx, rcx
jne 0x140058914
xor eax, eax
jmp 0x1400589c6
or rbx, 0xffffffffffffffff
mov rdx, rbx
call fcn.1400b2ccc
mov rsi, rax
mov dword [rsp + 0x40], 0x5c3a3f
movsx ecx, byte [rax]
call fcn.140107548
mov byte [rsp + 0x40], al
sub al, 0x41
cmp al, 0x19
ja 0x14005895a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 1
je 0x140058957
sub eax, 1
je 0x140058957
cmp eax, 3
jne 0x14005895a
mov byte [rsi], 0x3f
inc rbx
cmp byte [rsi + rbx], dil
jne 0x14005895a
lea r8, [rsp + 0x48]
mov edx, ebx
mov rcx, rsi
call fcn.1400c5848
mov edx, 0x10
lea rcx, [rsp + 0x48]
call fcn.1400b0d88
lea rcx, str.sumatrapdfcache
mov rbx, rax
call fcn.140022004
mov rsi, rax
test rax, rax
je 0x1400589bb
xor r8d, r8d
lea rdx, [0x1401445e0]
mov rcx, rbx
call fcn.1400b2d6c
mov rdx, rax
xor r8d, r8d
mov rcx, rsi
call fcn.1400b41a4
mov rdi, rax
mov rcx, rbx
call fcn.140107298
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret