joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053af0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x140053b42
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call fcn.1400d4bdc
lea rcx, [rbx + rbx*2]
test rcx, rcx
jne 0x140053b39
xor eax, eax
jmp 0x140053b3e
call fcn.1400de56c
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, r15d
mov rcx, rsi
call fcn.140054b90
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
sar ebp, 8
movsxd r11, eax
add r11, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140053c64
mov rsi, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, ebp
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shl r10d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
shr eax, 8
or edx, r10d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test ebx, ebx
jg 0x140053b90
jmp 0x140053ca7
mov r8, rcx
nop word [rax + rax]
mov rax, rdi
dec ebx
add rdi, 3
movzx ecx, byte [rax + 2]
movzx edx, word [rax]
or ecx, 0xffffff00
shl ecx, 8
mov word [rsp + 0x50], dx
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [r11], ecx
add r11, r8
test ebx, ebx
jg 0x140053c70
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140053cc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x140053d12
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call fcn.1400d4bdc
lea rcx, [rbx + rbx*2]
test rcx, rcx
jne 0x140053d09
xor eax, eax
jmp 0x140053d0e
call fcn.1400de56c
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, r15d
mov rcx, rsi
call fcn.140054f30
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
sar ebp, 8
movsxd r11, eax
add r11, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140053e34
mov rsi, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, ebp
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shl r10d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
shr eax, 8
or edx, r10d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test ebx, ebx
jg 0x140053d60
jmp 0x140053e77
mov r8, rcx
nop word [rax + rax]
mov rax, rdi
dec ebx
add rdi, 3
movzx ecx, byte [rax + 2]
movzx edx, word [rax]
or ecx, 0xffffff00
shl ecx, 8
mov word [rsp + 0x50], dx
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [r11], ecx
add r11, r8
test ebx, ebx
jg 0x140053e40
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140053e90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x140053ee6
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400d4bdc
lea rcx, [rdi*4]
test rcx, rcx
jne 0x140053edd
xor eax, eax
jmp 0x140053ee2
call fcn.1400de56c
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.140055180
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140054000
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x140053f30
jmp 0x1400540ab
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x140054000
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400541f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x140054246
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400d4bdc
lea rcx, [rdi*4]
test rcx, rcx
jne 0x14005423d
xor eax, eax
jmp 0x140054242
call fcn.1400de56c
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.14003a5b0
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140054360
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x140054290
jmp 0x14005440b
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x140054360
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400544f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov ebx, r8d
shr r8d, 8
and ebx, 0xff00ff
and r8d, 0xff00ff
mov r10d, 0x100
mov edi, r9d
mov r11, rdx
movsxd rsi, dword [rax + 0x18]
mov eax, r8d
shr eax, 0x10
sub r10d, eax
nop
mov ecx, dword [r11]
mov edx, 0x100
mov r9d, ecx
dec edi
shr ecx, 8
and r9d, 0xff00ff
and ecx, 0xff00ff
imul r9d, r10d
imul ecx, r10d
shr r9d, 8
shr ecx, 8
and r9d, 0xff00ff
and ecx, 0xff00ff
add r9d, ebx
add ecx, r8d
mov eax, ecx
shl ecx, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
or edx, ecx
shr eax, 8
and eax, 0xff00ff
and edx, 0xff00ff00
mov ecx, 0x100
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test edi, edi
jg 0x140054530
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400641d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, select
shr ebx, 0xf
and ebx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 2
mov ecx, reloc.WS2_32.dll_select
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov esi, edi
or esi, 4
mov ecx, 0xa5
test al, 1
cmove esi, edi
mov ebx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x14006424f
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14006424f
and ebx, 0xfffffffd
or ebx, 4
mov eax, dword [0x1405a7830]
mov rsi, qword [rsp + 0x38]
and eax, 0x70
or eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x1405a7830], eax
add rsp, 0x20
pop rdi
ret

Function at 0x140064270
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x1405a7830]
mov rdx, rcx
mov r9, rcx
shl rdx, 4
and edx, 0x10
mov r8d, edx
or r8d, 0x20
test cl, 2
cmove r8d, edx
and eax, 0xffffff8f
mov ecx, r8d
or ecx, 0x40
test r9b, 0x10
cmove ecx, r8d
or ecx, eax
mov dword [0x1405a7830], ecx
jmp fcn.1400641d0
Function at 0x1400681d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x1405921c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rdx
mov rsi, rcx
call fcn.1400641d0
lea rax, [rbp - 0x10]
xor edi, edi
cmp rax, 0x95
ja case.0x140068227.19
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x683e4]
mov edx, dword [rcx + rax*4 + 0x683d8]
add rdx, rcx
jmp rdx
mov dl, 1
mov rcx, rsi
call fcn.1401c8510
movzx r14d, al
mov rcx, rsi
call fcn.140067fd0
jmp 0x140068358
mov dl, 1
mov rcx, rsi
call fcn.1401c8510
movzx ebx, al
mov ecx, dword [0x1405a7830]
and ecx, 0xffffff8f
bts ebp, 0x10
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], edi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401c8650
test al, al
jne 0x1400683ad
test bl, bl
jmp 0x14006835b
mov dl, 1
mov rcx, rsi
call fcn.1401c8510
movzx r14d, al
mov dword [rsp + 0x20], edi
mov r9d, 0x103
lea r8d, [r9 - 1]
mov rdx, qword [rsi + 0xd8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140068358
lea edx, [rax + 2]
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r15d, eax
xor edx, edx
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
mov edx, ebx
mov ecx, ebp
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x140068326
movzx eax, di
mov word [rsp + 0x70], ax
jmp 0x14006832b
movzx eax, word [rsp + 0x70]
movzx edx, ax
mov eax, dword [0x1405a7830]
and eax, 0xffffff8f
movzx ecx, r15w
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401c8650
test al, al
jne 0x1400683ad
test r14b, r14b
jne 0x1400683ad
call fcn.140057130
mov r8d, edi
mov ecx, dword [rax + 0x24]
sub ecx, 1
movsxd rdx, ecx
js 0x1400683a4
mov rax, qword [rax + 0x18]
lea rcx, [rax + rdx*8]
nop dword [rax + rax]
mov r9, qword [rcx]
cmp byte [r9 + 0x5c], 0
je 0x140068394
mov eax, r8d
inc r8d
test eax, eax
je 0x1400683a0
sub rcx, 8
sub rdx, 1
jns 0x140068380
jmp 0x1400683a4
mov rdi, qword [r9 + 0x40]
test rdi, rdi
jne 0x1400683ad
xor al, al
jmp 0x1400683af
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400c9d20
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140068480
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call fcn.1400641d0
sar rbx, 0x10
lea eax, [rdi - 0x30]
movzx ecx, bl
mov esi, edi
cmp eax, 9
ja 0x1400684d7
lea eax, [rcx - 0x47]
cmp eax, 0xb
ja case.0x1400684cd.74
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x68544]
add rcx, rdx
jmp rcx
add edi, 0x10030
jmp case.0x1400684cd.74
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
test ecx, ecx
cmovne edi, ecx
cmp esi, 0x20
jae case.0x1400684cd.74
test byte [0x1405a7830], 6
mov eax, 0
cmovne esi, eax
mov eax, dword [0x1405a7830]
lea rdx, [rsp + 0x20]
and eax, 0xffffff8f
mov dword [rsp + 0x20], edi
mov rcx, rbp
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], esi
call fcn.1401c8650
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14006aea0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov r12, rdx
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rdi, eax
test eax, eax
jle 0x14006b0e8
xor ecx, ecx
call fcn.1400d4bdc
mov r8, rdi
shr r8, 1
inc r8
lea rcx, [r8 + r8]
test rcx, rcx
jne 0x14006af28
mov r15d, r14d
mov r9d, edi
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
lea rax, [0x140592ed8]
mov qword [r12], rax
mov rcx, r15
call fcn.1400d4bdc
jmp 0x14006b0f3
mov edx, 2
mov rcx, r8
call fcn.1400d595c
mov rbx, rax
mov qword [rsp + 0x60], rax
mov r9d, edi
mov r8, rax
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov r15, rbx
test rbx, rbx
je 0x14006af10
movzx eax, word [rbx]
test ax, ax
je 0x14006af10
mov r8, r14
mov ebp, 0xdc00
mov r9d, 4
nop dword [rax]
movzx eax, ax
add rbx, 2
lea ecx, [rax - 0xd800]
cmp ecx, 0x7ff
ja 0x14006af9f
movzx edx, word [rbx]
cmp dx, bp
jb 0x14006af9f
mov eax, edx
sub eax, ebp
shl ecx, 0xa
or eax, ecx
add eax, 0x10000
add rbx, 2
test eax, eax
je 0x14006afd1
mov ecx, 1
cmp eax, 0x80
jb 0x14006afc9
mov ecx, 2
cmp eax, 0x800
jb 0x14006afc9
mov ecx, 3
cmp eax, 0x10000
cmovae rcx, r9
add r8, rcx
movzx eax, word [rbx]
jmp 0x14006af70
lea rbx, [r8 + 4]
and rbx, 0xfffffffffffffffc
lea rcx, [rbx + 0x17]
call fcn.1400ca4ec
xchg dword [rax], r14d
mov qword [rax + 8], rbx
lea r8, [rax + 0x10]
mov rax, r8
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
mov rsi, rax
mov rdi, rax
movzx r9d, word [rdx]
add rdx, 2
lea ecx, [r9 - 0xd800]
cmp ecx, 0x7ff
ja 0x14006b03e
movzx r10d, word [rdx]
cmp r10w, bp
jb 0x14006b03e
mov r9d, r10d
sub r9d, ebp
shl ecx, 0xa
or r9d, ecx
add r9d, 0x10000
add rdx, 2
test r9d, r9d
je 0x14006b0dc
cmp r9d, 0x80
jb 0x14006b0d1
mov r11d, r9d
cmp r9d, 0x10000
jb 0x14006b072
inc rax
mov ebx, 2
shr r11d, 0x12
or r11b, 0xf0
jmp 0x14006b0a4
cmp r9d, 0x800
sbb r10d, r10d
add r10d, 2
inc rax
lea ebx, [r10 - 1]
lea ecx, [r10 + r10*2]
add ecx, ecx
shr r11d, cl
mov ecx, 7
sub ecx, r10d
mov r10d, 0xffffffff
shl r10b, cl
or r11b, r10b
mov byte [rdi], r11b
lea ecx, [rbx + rbx*2]
add ecx, ecx
nop dword [rax]
mov r10d, r9d
shr r10d, cl
and r10b, 0x3f
or r10b, 0x80
mov byte [rax], r10b
inc rax
sub ecx, 6
sub ebx, 1
jns 0x14006b0b0
jmp 0x14006b000
mov byte [rax], r9b
inc rax
jmp 0x14006b000
mov byte [rax], 0
mov qword [r12], r8
jmp 0x14006af1b
lea rax, [0x140592ed8]
mov qword [r12], rax
mov rax, r12
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14006fb00
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rcx + 0xf0], rbp
mov qword [rcx + 0xf8], rbp
call fcn.140250ac0
nop
lea rax, vtable.juce::FileChooser::Native.0
mov qword [r14], rax
lea rax, vtable.juce::FileChooser::Native.1.0
mov qword [r14 + 0xe8], rax
mov qword [r14 + 0x100], rbx
mov ecx, 0x2a8
call fcn.1400c9d40
mov qword [rsp + 0x68], rax
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.14006cab0
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [r14 + 0x108], rbp
mov qword [r14 + 0x110], rbp
test rax, rax
je 0x14006fbeb
lea ecx, [rbp + 0x18]
call fcn.1400c9d40
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_resource_class_juce::Win32NativeFileChooser____ptr64__struct_std::default_delete_class_juce::Win32NativeFileChooser__.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov qword [r14 + 0x108], rbx
mov qword [r14 + 0x110], rax
mov ebx, ebp
mov eax, ebp
test rax, rax
je 0x14006fc05
mov rcx, rbx
call fcn.14006d070
mov edx, 0x2a8
mov rcx, rbx
call fcn.1400c9d7c
mov rax, qword [0x1405a7808]
test rax, rax
jne 0x14006fc30
mov ecx, 0x1b0
call fcn.1400c9d40
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140231320
nop
mov qword [0x1405a7808], rax
mov rcx, qword [rax + 0xc8]
mov rax, qword [rcx]
movsxd rcx, dword [rcx + 0xc]
imul r8, rcx, 0x70
add r8, rax
cmp rax, r8
je 0x14006fc5e
nop word [rax + rax]
cmp byte [rax], 0
jne 0x14006fc5e
add rax, 0x70
cmp rax, r8
jne 0x14006fc50
mov rcx, rbp
cmp rax, r8
cmovne rcx, rax
movq xmm0, qword [rcx + 0x1c]
movq rax, xmm0
shr rax, 0x20
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9, qword [rcx + 0x14]
mov r8, r9
shr r8, 0x20
add r8d, eax
movd eax, xmm0
cdq
and edx, 3
add edx, eax
sar edx, 2
add edx, r9d
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov rcx, r14
call fcn.140239be0
mov dl, 1
mov rcx, r14
call fcn.14023a930
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x140248c70]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x68]
mov rcx, r14
call fcn.14023a4a0
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140250100
nop
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140070630
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.14023fd10
Function at 0x14007df50
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov rdi, rdx
add rcx, 0x18
mov r9b, 1
mov edx, dword [rbx + 0x140]
call fcn.1401e37f0
mov rcx, qword [rbx + 0x110]
lea rdx, [rbx + 0x120]
add rcx, 0x168
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1402290f0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x58
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x1402291a9
lea rcx, [rsp + 0x50]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1402291a9
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rbx
call fcn.1400cc570
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400a5460
nop
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
call fcn.1400b1220
nop
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1402291a9
mov ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
cmp ecx, 1
jne 0x1402291a9
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14007dfb0
Capabilities:
Check if file exists

Disassembly:
lea rdx, [rcx + 0x120]
mov rcx, qword [rcx + 0x110]
add rcx, 0x168
jmp fcn.140228ff0

Function at 0x14007eca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r8, rdx
lea rdx, [rcx + 0x70]
mov rcx, qword [rcx + 0xb8]
add rcx, 0x130
jmp 0x1402290f0

Function at 0x14007ecc0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x14007ed78
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x14007ed12
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14007ecf3
cmp byte [rdx + 0x12c], al
je 0x14007ecf3
xor dl, dl
jmp 0x14007ecf5
mov dl, 1
mov r8, qword [rbx + 8]
test r8, r8
je 0x14007ed0d
cmp byte [r8 + 0x12c], 0
je 0x14007ed0d
mov r8b, 1
jmp 0x14007ed1c
xor r8b, r8b
jmp 0x14007ed1c
cmp eax, 2
setne dl
sete r8b
cmp r8b, dl
je 0x14007ed78
mov qword [rsp + 0x30], rdi
test eax, eax
jne 0x14007ed44
mov rax, qword [rbx + 8]
test rax, rax
je 0x14007ed40
cmp byte [rax + 0x12c], 0
je 0x14007ed40
mov cl, 1
jmp 0x14007ed4a
xor cl, cl
jmp 0x14007ed4a
cmp eax, 2
sete cl
movzx eax, dl
inc eax
cmp eax, 2
mov dword [rbx + 0x28], eax
sete dil
cmp dil, cl
je 0x14007ed73
mov rcx, rbx
call fcn.1401ce200
mov rax, qword [rbx]
movzx edx, dil
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rbx + 0xb8]
lea rdx, [rbx + 0x70]
add rcx, 0x130
add rsp, 0x20
pop rbx
jmp fcn.140228ff0