joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400563e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov r14, rcx
xor bl, bl
mov rsi, qword [rcx + 0x18]
movsxd rax, dword [rcx + 0x24]
lea rbp, [rsi + rax*8]
cmp rsi, rbp
je 0x140056577
mov r15d, 1
nop dword [rax]
mov rdi, qword [rsi]
test byte [rdi + 0x3c], 0x70
je 0x140056566
mov rcx, qword [0x14044a208]
test rcx, rcx
je 0x14005643a
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, dword [rsp + 0x70]
jmp 0x140056444
mov eax, dword [0x140444cd8]
mov dword [rsp + 0x70], eax
test al, 0x70
je 0x140056566
cmp dword [rdi + 0x14], 1
je 0x140056524
lea rcx, [rsp + 0x88]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rbx, qword [rsp + 0x88]
mov dword [rsp + 0x80], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsp + 0x84], eax
call fcn.1401ed110
mov rax, qword [0x14044a3d0]
test rax, rax
je 0x1400564af
cmp qword [0x14044a378], 0
je 0x1400564af
call rax
mov rcx, rax
call qword [0x14044a378]
cmp eax, 2
sete al
jmp 0x1400564b4
call fcn.1401ed070
test al, al
je 0x140056508
mov rax, qword [0x140444cb0]
test rax, rax
jne 0x1400564dd
mov ecx, 0x150
call fcn.1400da124
mov rcx, rax
call fcn.1402603d0
mov qword [0x140444cb0], rax
xor r9d, r9d
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.14009b310
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov ebx, eax
jmp 0x140056510
mov rax, qword [rsp + 0x80]
shr rax, 0x20
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
jmp 0x14005652e
movss xmm0, dword [rdi + 0x20]
movss xmm1, dword [rdi + 0x24]
addss xmm1, dword [rdi + 0x1c]
addss xmm0, dword [rdi + 0x18]
unpcklps xmm0, xmm1
movsd qword [rdi + 0x20], xmm0
mov rcx, qword [rdi + 8]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r15d
jne 0x140056564
mov rcx, qword [rdi + 8]
call fcn.140188d70
test al, al
jne 0x140056564
mov rcx, qword [rdi + 8]
xor eax, eax
xchg dword [rcx + 0x18], eax
mov bl, 1
add rsi, 8
cmp rsi, rbp
jne 0x140056410
test bl, bl
jne 0x14005657f
mov rcx, r14
call fcn.14018a070
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140065a80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x128]
mov rbx, rcx
mov rcx, qword [rcx + 0xf8]
mov r9b, 1
call fcn.140214d30
mov rcx, qword [rbx + 0xf8]
lea rdx, [rbx + 0x108]
add rcx, 0x130
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140253420
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x140253503
lea rcx, [rsp + 0x50]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140253503
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.1400dc674
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140099a40
nop
mov edi, dword [rsi + 0x1c]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1402534e0
cmp qword [rbx + 0x10], 0
je 0x1402534e0
test edi, edi
jle 0x1402534e0
mov eax, dword [rsi + 0x1c]
dec edi
cmp edi, eax
jl 0x1402534c7
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x1402534e0
movsxd rcx, edi
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov r8, rbp
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1402534a2
test rbx, rbx
je 0x140253503
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140253503
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140065ad0
Capabilities:
Check if file exists

Disassembly:
lea rdx, [rcx + 0x108]
mov rcx, qword [rcx + 0xf8]
add rcx, 0x130
jmp fcn.1402532e0
Function at 0x140066990
Capabilities:
Get file attributes

Disassembly:
test dl, dl
je 0x140066aa1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 8], 0
je 0x1400669c6
cmp dword [rcx + 0x24], 0
je 0x1400669cc
call fcn.1402034b0
mov rcx, rdi
call fcn.1402025c0
jmp 0x1400669cc
call fcn.1402034b0
nop
lea rdx, [rdi + 0x78]
lea rcx, [rsp + 0x40]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140066a8b
cmp eax, 0xffffffff
je 0x140066a8b
mov byte [rdi + 0xa8], 1
cmp qword [rdi + 0x98], 0
jne 0x140066a6f
cmp qword [rdi + 0x88], 0
je 0x140066a6f
mov ecx, 0xb8
call fcn.1400da124
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x88]
mov r8, qword [rdi + 0xb0]
mov rdx, qword [rdx + 0x50]
mov rcx, rax
call fcn.1402531d0
mov rbx, rax
mov rcx, qword [rdi + 0x88]
mov r8d, dword [rcx + 0x60]
mov r9d, r8d
shr r9d, 1
and r9b, 1
and r8b, 1
lea rdx, [rdi + 0x78]
mov rcx, rax
call fcn.140252ec0
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call fcn.140066ab0
lea rcx, [rdi + 0x70]
mov rax, qword [rcx]
xor edx, edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + reloc.WS2_32.dll_htonl]
mov byte [rdi + 0xa8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140067180
Capabilities:
Check if file exists

Disassembly:
mov r8, rdx
lea rdx, [rcx + 0x78]
mov rcx, qword [rcx + 0x80]
add rcx, 0x120
jmp 0x140253420

Function at 0x1400671a0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140067258
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1400671f2
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400671d3
cmp byte [rdx + 0x11c], al
je 0x1400671d3
xor dl, dl
jmp 0x1400671d5
mov dl, 1
mov r8, qword [rbx + 8]
test r8, r8
je 0x1400671ed
cmp byte [r8 + 0x11c], 0
je 0x1400671ed
mov r8b, 1
jmp 0x1400671fc
xor r8b, r8b
jmp 0x1400671fc
cmp eax, 2
setne dl
sete r8b
cmp r8b, dl
je 0x140067258
mov qword [rsp + 0x30], rdi
test eax, eax
jne 0x140067224
mov rax, qword [rbx + 8]
test rax, rax
je 0x140067220
cmp byte [rax + 0x11c], 0
je 0x140067220
mov cl, 1
jmp 0x14006722a
xor cl, cl
jmp 0x14006722a
cmp eax, 2
sete cl
movzx eax, dl
inc eax
cmp eax, 2
mov dword [rbx + 0x28], eax
sete dil
cmp dil, cl
je 0x140067253
mov rcx, rbx
call fcn.1402025c0
mov rax, qword [rbx]
movzx edx, dil
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x80]
lea rdx, [rbx + 0x78]
add rcx, 0x120
add rsp, 0x20
pop rbx
jmp fcn.1402532e0
Function at 0x140088710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movzx ebx, dl
mov rdi, rcx
lea rsi, [rcx + 0x154]
mov qword [rsp + 0x40], rsi
movzx ebp, byte [rsi]
mov byte [rsp + 0x48], bpl
mov byte [rsi], 1
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x60]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x78]
cmp al, bl
je 0x14008894e
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140088765
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov byte [rdi + 0xb0], bl
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x90]
call fcn.140099a40
nop
mov eax, dword [rdi + 0x10]
shr eax, 3
and al, 1
cmp byte [rdi + 0xb0], 0
jne 0x1400888bb
movups xmm6, xmmword [rdi + 0x14]
test al, al
je 0x1400887ac
mov edx, 1
mov rcx, qword [rdi + 0x88]
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmm6
psrldq xmm0, 8
movd ebx, xmm0
test ebx, ebx
jle 0x1400888e4
movdqa xmm0, xmm6
psrldq xmm0, 0xc
movd r14d, xmm0
test r14d, r14d
jle 0x1400888e4
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x80]
movaps xmm3, xmm0
ucomiss xmm3, dword [0x1403b5ae4]
jp 0x1400887f7
je 0x1400888a2
movd xmm0, r14d
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
cvtps2pd xmm1, xmm0
movsd xmm2, qword [0x1403b5e08]
addsd xmm1, xmm2
movsd qword [rsp + 0x28], xmm1
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [rsp + 0x20], xmm0
movdqa xmm1, xmm6
psrldq xmm1, 4
movd eax, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
addsd xmm0, xmm2
movsd qword [rsp + 0xa8], xmm0
movd eax, xmm6
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
cvtps2pd xmm1, xmm0
addsd xmm1, xmm2
movsd qword [rsp + 0xa0], xmm1
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x3c], eax
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm6
mov rax, qword [rdi]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x1400888e4
mov rcx, qword [rdi + 0x88]
test al, al
je 0x1400888d3
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400888e4
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayCopy
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x140088900
cmp qword [rbx + 0x10], 0
je 0x140088900
mov rcx, rdi
call fcn.1401fb8b0
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140088910
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
nop
test rbx, rbx
je 0x14008894e
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140088937
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
movzx eax, byte [rsp + 0x48]
mov byte [rsi], al
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov byte [rsi], bpl
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140089320
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, sendto
shr ebx, 0xf
and ebx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 2
mov ecx, reloc.WS2_32.dll_select
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov esi, edi
or esi, 4
mov ecx, 0xa5
test al, 1
cmove esi, edi
mov ebx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x14008939f
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14008939f
and ebx, 0xfffffffd
or ebx, 4
mov eax, dword [0x140444cd8]
mov rsi, qword [rsp + 0x38]
and eax, 0x70
or eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x140444cd8], eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400893c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x140444cd8]
mov rdx, rcx
mov r9, rcx
shl rdx, 4
and edx, 0x10
mov r8d, edx
or r8d, 0x20
test cl, 2
cmove r8d, edx
mov ecx, r8d
or ecx, 0x40
test r9b, 0x10
cmove ecx, r8d
and eax, 0xffffff8f
or ecx, eax
mov dword [0x140444cd8], ecx
jmp fcn.140089320
Function at 0x14008ced0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x140425440]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rdx
mov rsi, rcx
call fcn.140089320
lea rax, [rbp - 0x10]
xor edi, edi
cmp rax, 0x95
ja case.0x14008cf27.19
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x8d0e4]
mov edx, dword [rcx + rax*4 + 0x8d0d8]
add rdx, rcx
jmp rdx
mov dl, 1
mov rcx, rsi
call fcn.1401fbd30
movzx r14d, al
mov rcx, rsi
call fcn.14008ccd0
jmp 0x14008d05c
mov dl, 1
mov rcx, rsi
call fcn.1401fbd30
movzx ebx, al
mov ecx, dword [0x140444cd8]
and ecx, 0xffffff8f
bts ebp, 0x10
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], edi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401fbe70
test al, al
jne 0x14008d0ad
test bl, bl
jmp 0x14008d05f
mov dl, 1
mov rcx, rsi
call fcn.1401fbd30
movzx r14d, al
mov dword [rsp + 0x20], edi
mov r9d, 0x103
mov r8d, 0x102
mov rdx, qword [rsi + 0x88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14008d05c
mov edx, 2
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r15d, eax
xor edx, edx
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
mov edx, ebx
mov ecx, ebp
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x14008d02a
movzx eax, di
mov word [rsp + 0x70], ax
jmp 0x14008d02f
movzx eax, word [rsp + 0x70]
movzx edx, ax
mov eax, dword [0x140444cd8]
and eax, 0xffffff8f
movzx ecx, r15w
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401fbe70
test al, al
jne 0x14008d0ad
test r14b, r14b
jne 0x14008d0ad
call fcn.140053d50
mov r8d, edi
mov ecx, dword [rax + 0x24]
sub ecx, 1
js 0x14008d0a4
movsxd rcx, ecx
mov rax, qword [rax + 0x18]
lea rdx, [rax + rcx*8]
nop dword [rax]
mov r9, qword [rdx]
cmp byte [r9 + 0x5c], 0
je 0x14008d094
mov eax, r8d
inc r8d
test eax, eax
je 0x14008d0a0
sub rdx, 8
sub rcx, 1
jns 0x14008d080
jmp 0x14008d0a4
mov rdi, qword [r9 + 0x40]
test rdi, rdi
jne 0x14008d0ad
xor al, al
jmp 0x14008d0af
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d9d70
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008fba0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov r15, rdx
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rdi, eax
test eax, eax
jle 0x14008fdc8
xor ecx, ecx
call fcn.1400e0818
mov rcx, rdi
shr rcx, 1
inc rcx
mov edx, 2
call fcn.1400e9d14
mov rbx, rax
mov qword [rsp + 0x60], rax
mov r9d, edi
mov r8, rax
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test rbx, rbx
je 0x14008fdb4
movzx eax, word [rbx]
test ax, ax
je 0x14008fdb4
mov r8d, r14d
mov r12d, 0xdc00
mov r9d, 4
nop word [rax + rax]
movzx eax, ax
add rbx, 2
lea ecx, [rax - 0xd800]
cmp ecx, 0x7ff
ja 0x14008fc71
movzx edx, word [rbx]
cmp dx, r12w
jb 0x14008fc71
mov eax, edx
sub eax, r12d
shl ecx, 0xa
or eax, ecx
add eax, 0x10000
add rbx, 2
test eax, eax
je 0x14008fca3
mov ecx, 1
cmp eax, 0x80
jb 0x14008fc9b
mov ecx, 2
cmp eax, 0x800
jb 0x14008fc9b
mov ecx, 3
cmp eax, 0x10000
cmovae rcx, r9
add r8, rcx
movzx eax, word [rbx]
jmp 0x14008fc40
lea rbx, [r8 + 4]
and rbx, 0xfffffffffffffffc
lea rcx, [rbx + 0x17]
call fcn.1400da540
xchg dword [rax], r14d
mov qword [rax + 8], rbx
lea r8, [rax + 0x10]
mov rax, r8
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
nop word [rax + rax]
mov rbp, rax
mov rsi, rax
movzx r9d, word [rdx]
add rdx, 2
lea ecx, [r9 - 0xd800]
cmp ecx, 0x7ff
ja 0x14008fd0e
movzx r10d, word [rdx]
cmp r10w, r12w
jb 0x14008fd0e
mov r9d, r10d
sub r9d, r12d
shl ecx, 0xa
or r9d, ecx
add r9d, 0x10000
add rdx, 2
test r9d, r9d
je 0x14008fdac
cmp r9d, 0x80
jb 0x14008fda1
mov r11d, r9d
cmp r9d, 0x10000
jb 0x14008fd42
inc rax
mov edi, 2
shr r11d, 0x12
or r11b, 0xf0
jmp 0x14008fd74
cmp r9d, 0x800
sbb r10d, r10d
add r10d, 2
inc rax
lea edi, [r10 - 1]
lea ecx, [r10 + r10*2]
add ecx, ecx
shr r11d, cl
mov ecx, 7
sub ecx, r10d
mov r10d, 0xffffffff
shl r10b, cl
or r11b, r10b
mov byte [rsi], r11b
lea ecx, [rdi + rdi*2]
add ecx, ecx
nop dword [rax]
mov r10d, r9d
shr r10d, cl
and r10b, 0x3f
or r10b, 0x80
mov byte [rax], r10b
inc rax
sub ecx, 6
sub edi, 1
jns 0x14008fd80
jmp 0x14008fcd0
mov byte [rax], r9b
inc rax
jmp 0x14008fcd0
mov byte [rax], 0
mov qword [r15], r8
jmp 0x14008fdbe
lea rax, [0x140379908]
mov qword [r15], rax
mov rcx, rbx
call fcn.1400e0818
jmp 0x14008fdd2
lea rax, [0x140379908]
mov qword [r15], rax
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14008fec0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
xor eax, eax
mov rsi, r8
mov qword [rdx], rax
mov rdi, rdx
mov qword [rdx + 8], rax
test r8, r8
je 0x14009006f
test r9b, 0x20
je 0x14009006f
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov edx, 0x20
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rbp, eax
test eax, eax
jle 0x140090060
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x20], r15
mov r15, rbp
shr r15, 2
lea rcx, [r15*4]
call fcn.1400e0cb8
mov r9d, ebp
mov qword [rsp + 0x68], rax
mov r8, rax
mov edx, 0x20
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jle 0x14009003f
cmp r15, 1
jbe 0x14009003f
mov qword [rsp + 0x38], r12
mov rbp, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov r14d, 1
nop word [rax + rax]
mov ecx, dword [rbx]
lea r12, [rbp + 4]
mov ebp, dword [rbp]
mov edx, ebp
cmp ebp, dword [r12]
cmovl edx, dword [r12]
lea r13d, [rcx + rbp]
lea eax, [rcx + rdx]
cmp r13d, eax
cmovl ebp, edx
mov edx, dword [rdi + 8]
add ebp, ecx
mov ecx, dword [rdi + 0xc]
inc ecx
cmp ecx, edx
jle 0x14008ffff
mov eax, ecx
test ecx, ecx
jns 0x14008ffb8
lea eax, [rcx + 1]
sar eax, 1
lea esi, [rcx + 8]
add esi, eax
and esi, 0xfffffff8
cmp edx, esi
je 0x14008fffc
mov rcx, qword [rdi]
test esi, esi
jle 0x14008fff0
movsxd rdx, esi
shl rdx, 3
test rcx, rcx
jne 0x14008ffe6
mov rcx, rdx
call fcn.1400e0cb8
mov qword [rdi], rax
jmp 0x14008fffc
call fcn.1400e0cb0
mov qword [rdi], rax
jmp 0x14008fffc
call fcn.1400e0818
mov qword [rdi], 0
mov dword [rdi + 8], esi
movsxd rcx, dword [rdi + 0xc]
inc r14
mov edx, ebp
mov rbp, r12
shl rdx, 0x20
lea eax, [rcx + 1]
mov dword [rdi + 0xc], eax
mov eax, r13d
or rdx, rax
mov rax, qword [rdi]
mov qword [rax + rcx*8], rdx
cmp r14, r15
jb 0x14008ff80
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.1400e0818
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
mov rbp, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400953b0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rcx + 0xe0], rbp
mov qword [rcx + 0xe8], rbp
call fcn.14028a750
nop
lea rax, vtable.juce::FileChooser::Native.0
mov qword [rcx], rax
lea rax, vtable.juce::FileChooser::Native.1.0
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0xf0], rdx
mov ecx, 0x298
call fcn.1400da124
mov qword [rsp + 0x68], rax
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.140092000
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [r14 + 0xf8], rbp
mov qword [r14 + 0x100], rbp
test rax, rax
je 0x14009549d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400da124
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_resource_class_juce::Win32NativeFileChooser____ptr64__struct_std::default_delete_class_juce::Win32NativeFileChooser__.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov qword [r14 + 0xf8], rbx
mov qword [r14 + 0x100], rax
mov ebx, ebp
mov eax, ebp
test rax, rax
je 0x1400954af
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rax, qword [0x140444cb0]
test rax, rax
jne 0x1400954da
mov ecx, 0x150
call fcn.1400da124
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.1402603d0
nop
mov qword [0x140444cb0], rax
mov rcx, qword [rax + 0x88]
mov rax, qword [rcx]
movsxd rcx, dword [rcx + 0xc]
lea rdx, [rcx + rcx*4]
shl rdx, 4
add rdx, rax
cmp rax, rdx
je 0x140095506
cmp byte [rax], 0
jne 0x140095509
add rax, 0x50
cmp rax, rdx
jne 0x1400954f8
mov rax, rbp
movups xmm1, xmmword [rax + 0x14]
movq xmm0, qword [rax + 0x1c]
movq rax, xmm0
shr rax, 0x20
cdq
and edx, 3
add eax, edx
sar eax, 2
movq r8, xmm1
mov r10, r8
shr r10, 0x20
add r10d, eax
movd eax, xmm0
cdq
and edx, 3
add edx, eax
sar edx, 2
add edx, r8d
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8d, r10d
mov rcx, r14
call fcn.140289940
mov dl, 1
mov rcx, r14
call fcn.140287150
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x1401ebbb0]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x68]
mov rcx, r14
call fcn.1402856d0
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140289c00
nop
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a0960
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
call fcn.140089320
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 2
shr ebx, 0xf
and ebx, 1
shl ebx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 0x20
mov ecx, 4
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x30]
mov ecx, edi
shr eax, 0xf
or ecx, 0x40
test al, 1
mov eax, dword [0x140444cd8]
cmove ecx, edi
and eax, 0xffffff8f
or ecx, eax
mov rax, rsi
mov dword [rsi], ecx
mov rsi, qword [rsp + 0x38]
mov dword [0x140444cd8], ecx
add rsp, 0x20
pop rdi
ret