joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400527a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x1400527ed
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400e1bf4
lea rcx, [rdi*4]
call fcn.1400e2094
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.140053af0
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140052920
nop dword [rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x140052830
jmp 0x1400529e4
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x140052920
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140052b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x140052b5d
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400e1bf4
lea rcx, [rdi*4]
call fcn.1400e2094
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.140038a20
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x140052c90
nop dword [rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x140052ba0
jmp 0x140052d54
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x140052c90
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140052e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov r11d, r8d
shr r11d, 8
mov edi, r9d
and r11d, 0xff00ff
mov rbx, rdx
and r8d, 0xff00ff
movsxd rsi, dword [rax + 0x18]
nop dword [rax]
nop word [rax + rax]
mov eax, r11d
mov ecx, 0x100
shr eax, 0x10
mov edx, 0x100
sub ecx, eax
dec edi
mov eax, dword [rbx]
mov r9d, eax
shr eax, 8
and r9d, 0xff00ff
and eax, 0xff00ff
imul r9d, ecx
imul eax, ecx
mov ecx, 0x100
shr r9d, 8
shr eax, 8
and r9d, 0xff00ff
and eax, 0xff00ff
add r9d, r8d
lea r10d, [rax + r11]
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x140052e70
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140056b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov r14, rcx
xor bl, bl
mov rsi, qword [rcx + 0x18]
movsxd rax, dword [rcx + 0x24]
lea rbp, [rsi + rax*8]
cmp rsi, rbp
je 0x140056d1c
mov r15d, 1
mov rcx, qword [0x140441db8]
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [rsi]
test byte [rdi + 0x3c], 0x70
je 0x140056d0b
test rcx, rcx
sete al
test rcx, rcx
je 0x140056bd8
test al, al
jne 0x140056d31
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, dword [rsp + 0x70]
mov rcx, qword [0x140441db8]
jmp 0x140056be2
mov eax, dword [0x14043c87c]
mov dword [rsp + 0x70], eax
test al, 0x70
je 0x140056d0b
cmp dword [rdi + 0x14], 1
je 0x140056cc2
lea rcx, [rsp + 0x88]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rbx, qword [rsp + 0x88]
mov dword [rsp + 0x80], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsp + 0x84], eax
call fcn.1401eee40
mov rax, qword [0x140441f78]
test rax, rax
je 0x140056c4d
cmp qword [0x140441f18], 0
je 0x140056c4d
call rax
mov rcx, rax
call qword [0x140441f18]
cmp eax, 2
sete al
jmp 0x140056c52
call fcn.1401eeda0
test al, al
je 0x140056ca6
mov rax, qword [0x14043c860]
test rax, rax
jne 0x140056c7b
mov ecx, 0x150
call fcn.1400daadc
mov rcx, rax
call fcn.1402625b0
mov qword [0x14043c860], rax
xor r9d, r9d
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.14009c010
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov ebx, eax
jmp 0x140056cae
mov rax, qword [rsp + 0x80]
shr rax, 0x20
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
jmp 0x140056ccc
movss xmm0, dword [rdi + 0x20]
movss xmm1, dword [rdi + 0x24]
addss xmm1, dword [rdi + 0x1c]
addss xmm0, dword [rdi + 0x18]
unpcklps xmm0, xmm1
movsd qword [rdi + 0x20], xmm0
mov rcx, qword [rdi + 8]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r15d
jne 0x140056d02
mov rcx, qword [rdi + 8]
call fcn.14018a710
test al, al
jne 0x140056d02
mov rcx, qword [rdi + 8]
xor eax, eax
xchg dword [rcx + 0x18], eax
mov bl, 1
mov rcx, qword [0x140441db8]
add rsi, 8
cmp rsi, rbp
jne 0x140056ba0
test bl, bl
jne 0x140056d24
mov rcx, r14
call fcn.14018b960
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400d787c
nop
int3
Function at 0x140066150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x128]
mov rbx, rcx
mov rcx, qword [rcx + 0xf8]
mov r9b, 1
call fcn.140216990
mov rcx, qword [rbx + 0xf8]
lea rdx, [rbx + 0x108]
add rcx, 0x130
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140255440
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x140255523
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140255523
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.1400dcefc
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14009a8e0
nop
mov edi, dword [rsi + 0x1c]
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x140255500
cmp qword [rbx + 0x10], 0
je 0x140255500
test edi, edi
jle 0x140255500
mov eax, dword [rsi + 0x1c]
dec edi
cmp edi, eax
jl 0x1402554e7
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x140255500
movsxd rcx, edi
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov r8, rbp
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1402554c2
test rbx, rbx
je 0x140255523
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140255523
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400670a0
Capabilities:
Get file attributes

Disassembly:
test dl, dl
je 0x1400671b1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 8], 0
je 0x1400670d6
cmp dword [rcx + 0x24], 0
je 0x1400670dc
call fcn.140205390
mov rcx, rdi
call fcn.1402044c0
jmp 0x1400670dc
call fcn.140205390
nop
lea rdx, [rdi + 0x78]
lea rcx, [rsp + 0x40]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14006719b
cmp eax, 0xffffffff
je 0x14006719b
mov byte [rdi + 0xa8], 1
cmp qword [rdi + 0x98], 0
jne 0x14006717f
cmp qword [rdi + 0x88], 0
je 0x14006717f
mov ecx, 0xb8
call fcn.1400daadc
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x88]
mov r8, qword [rdi + 0xb0]
mov rdx, qword [rdx + 0x50]
mov rcx, rax
call fcn.1402551f0
mov rbx, rax
mov rcx, qword [rdi + 0x88]
mov r8d, dword [rcx + 0x60]
mov r9d, r8d
shr r9d, 1
and r9b, 1
and r8b, 1
lea rdx, [rdi + 0x78]
mov rcx, rax
call fcn.140254ee0
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call fcn.1400671c0
lea rcx, [rdi + 0x70]
mov rax, qword [rcx]
xor edx, edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + reloc.WS2_32.dll_htonl]
mov byte [rdi + 0xa8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400678d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140067988
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x140067922
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140067903
cmp byte [rdx + 0x11c], al
je 0x140067903
xor dl, dl
jmp 0x140067905
mov dl, 1
mov r8, qword [rbx + 8]
test r8, r8
je 0x14006791d
cmp byte [r8 + 0x11c], 0
je 0x14006791d
mov r8b, 1
jmp 0x14006792c
xor r8b, r8b
jmp 0x14006792c
cmp eax, 2
setne dl
sete r8b
cmp r8b, dl
je 0x140067988
mov qword [rsp + 0x30], rdi
test eax, eax
jne 0x140067954
mov rax, qword [rbx + 8]
test rax, rax
je 0x140067950
cmp byte [rax + 0x11c], 0
je 0x140067950
mov cl, 1
jmp 0x14006795a
xor cl, cl
jmp 0x14006795a
cmp eax, 2
sete cl
movzx eax, dl
inc eax
cmp eax, 2
mov dword [rbx + 0x28], eax
sete dil
cmp dil, cl
je 0x140067983
mov rcx, rbx
call fcn.1402044c0
mov rax, qword [rbx]
movzx edx, dil
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x80]
lea rdx, [rbx + 0x78]
add rcx, 0x120
add rsp, 0x20
pop rbx
jmp fcn.140255300
Function at 0x14008a270
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, sendto
shr ebx, 0xf
and ebx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 2
mov ecx, reloc.WS2_32.dll_select
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov esi, edi
or esi, 4
mov ecx, 0xa5
test al, 1
cmove esi, edi
mov ebx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x14008a2ef
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14008a2ef
and ebx, 0xfffffffd
or ebx, 4
mov eax, dword [0x14043c87c]
mov rsi, qword [rsp + 0x38]
and eax, 0x70
or eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x14043c87c], eax
add rsp, 0x20
pop rdi
ret

Function at 0x14008a310
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x14043c87c]
mov rdx, rcx
mov r9, rcx
shl rdx, 4
and edx, 0x10
mov r8d, edx
or r8d, 0x20
test cl, 2
cmove r8d, edx
and eax, 0xffffff8f
mov ecx, r8d
or ecx, 0x40
test r9b, 0x10
cmove ecx, r8d
or ecx, eax
mov dword [0x14043c87c], ecx
jmp fcn.14008a270
Function at 0x14008d9b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rdx
mov rsi, rcx
call fcn.14008a270
lea rax, [rbp - 0x10]
xor edi, edi
cmp rax, 0x95
ja case.0x14008da07.19
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x8dbc4]
mov edx, dword [rcx + rax*4 + 0x8dbb8]
add rdx, rcx
jmp rdx
mov dl, 1
mov rcx, rsi
call fcn.1401fdaa0
movzx r14d, al
mov rcx, rsi
call fcn.14008d7b0
jmp 0x14008db38
mov dl, 1
mov rcx, rsi
call fcn.1401fdaa0
movzx ebx, al
mov ecx, dword [0x14043c87c]
and ecx, 0xffffff8f
bts ebp, 0x10
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], edi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401fdbe0
test al, al
jne 0x14008db8d
test bl, bl
jmp 0x14008db3b
mov dl, 1
mov rcx, rsi
call fcn.1401fdaa0
movzx r14d, al
mov dword [rsp + 0x20], edi
mov r9d, 0x103
lea r8d, [r9 - 1]
mov rdx, qword [rsi + 0x88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14008db38
lea edx, [rax + 2]
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r15d, eax
xor edx, edx
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
mov edx, ebx
mov ecx, ebp
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x14008db06
movzx eax, di
mov word [rsp + 0x70], ax
jmp 0x14008db0b
movzx eax, word [rsp + 0x70]
movzx edx, ax
mov eax, dword [0x14043c87c]
and eax, 0xffffff8f
movzx ecx, r15w
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401fdbe0
test al, al
jne 0x14008db8d
test r14b, r14b
jne 0x14008db8d
call fcn.140054220
mov r8d, edi
mov ecx, dword [rax + 0x24]
sub ecx, 1
js 0x14008db84
movsxd rcx, ecx
mov rax, qword [rax + 0x18]
lea rdx, [rax + rcx*8]
nop dword [rax + rax]
mov r9, qword [rdx]
cmp byte [r9 + 0x5c], 0
je 0x14008db74
mov eax, r8d
inc r8d
test eax, eax
je 0x14008db80
sub rdx, 8
sub rcx, 1
js 0x14008db84
jmp 0x14008db60
mov rdi, qword [r9 + 0x40]
test rdi, rdi
jne 0x14008db8d
xor al, al
jmp 0x14008db8f
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400da5a0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140090830
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov r15, rdx
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rdi, eax
test eax, eax
jle 0x140090a58
xor ecx, ecx
call fcn.1400e1bf4
mov rcx, rdi
shr rcx, 1
inc rcx
lea edx, [r14 + 2]
call fcn.1400eb0e4
mov rbx, rax
mov qword [rsp + 0x60], rax
mov r9d, edi
mov r8, rax
mov edx, esi
mov rcx, rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test rbx, rbx
je 0x140090a44
movzx eax, word [rbx]
test ax, ax
je 0x140090a44
mov r8d, r14d
mov r12d, 0xdc00
lea r9d, [r14 + 4]
nop word [rax + rax]
movzx eax, ax
add rbx, 2
lea ecx, [rax - 0xd800]
cmp ecx, 0x7ff
ja 0x140090901
movzx edx, word [rbx]
cmp dx, r12w
jb 0x140090901
mov eax, edx
sub eax, r12d
shl ecx, 0xa
or eax, ecx
add eax, 0x10000
add rbx, 2
test eax, eax
je 0x140090933
mov ecx, 1
cmp eax, 0x80
jb 0x14009092b
mov ecx, 2
cmp eax, 0x800
jb 0x14009092b
mov ecx, 3
cmp eax, 0x10000
cmovae rcx, r9
add r8, rcx
movzx eax, word [rbx]
jmp 0x1400908d0
lea rbx, [r8 + 4]
and rbx, 0xfffffffffffffffc
lea rcx, [rbx + 0x17]
call fcn.1400daef4
xchg dword [rax], r14d
mov qword [rax + 8], rbx
lea r8, [rax + 0x10]
mov rax, r8
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
nop word [rax + rax]
mov rbp, rax
mov rsi, rax
movzx r9d, word [rdx]
add rdx, 2
lea ecx, [r9 - 0xd800]
cmp ecx, 0x7ff
ja 0x14009099e
movzx r10d, word [rdx]
cmp r10w, r12w
jb 0x14009099e
mov r9d, r10d
sub r9d, r12d
shl ecx, 0xa
or r9d, ecx
add r9d, 0x10000
add rdx, 2
test r9d, r9d
je 0x140090a3c
cmp r9d, 0x80
jb 0x140090a31
mov r11d, r9d
cmp r9d, 0x10000
jb 0x1400909d2
inc rax
mov edi, 2
shr r11d, 0x12
or r11b, 0xf0
jmp 0x140090a04
cmp r9d, 0x800
sbb r10d, r10d
add r10d, 2
inc rax
lea edi, [r10 - 1]
lea ecx, [r10 + r10*2]
add ecx, ecx
shr r11d, cl
mov ecx, 7
sub ecx, r10d
mov r10d, 0xffffffff
shl r10b, cl
or r11b, r10b
mov byte [rsi], r11b
lea ecx, [rdi + rdi*2]
add ecx, ecx
nop dword [rax]
mov r10d, r9d
shr r10d, cl
and r10b, 0x3f
or r10b, 0x80
mov byte [rax], r10b
inc rax
sub ecx, 6
sub edi, 1
jns 0x140090a10
jmp 0x140090960
mov byte [rax], r9b
inc rax
jmp 0x140090960
mov byte [rax], 0
mov qword [r15], r8
jmp 0x140090a4e
lea rax, [0x140370a58]
mov qword [r15], rax
mov rcx, rbx
call fcn.1400e1bf4
jmp 0x140090a62
lea rax, [0x140370a58]
mov qword [r15], rax
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140090b50
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
xor eax, eax
mov rsi, r8
mov qword [rdx], rax
mov rdi, rdx
mov qword [rdx + 8], rax
test r8, r8
je 0x140090cfe
test r9b, 0x20
je 0x140090cfe
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
lea edx, [rax + 0x20]
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rbp, eax
test eax, eax
jle 0x140090cef
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x20], r15
mov r15, rbp
shr r15, 2
lea rcx, [r15*4]
call fcn.1400e2094
mov r9d, ebp
mov qword [rsp + 0x68], rax
mov r8, rax
mov edx, 0x20
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jle 0x140090cce
cmp r15, 1
jbe 0x140090cce
mov qword [rsp + 0x38], r12
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov r14d, 1
nop dword [rax + rax]
mov ebp, dword [rcx]
lea r12, [rcx + 4]
cmp ebp, dword [r12]
mov edx, ebp
mov ecx, dword [rbx]
cmovl edx, dword [r12]
lea r13d, [rcx + rbp]
lea eax, [rcx + rdx]
cmp r13d, eax
cmovl ebp, edx
mov edx, dword [rdi + 8]
add ebp, ecx
mov ecx, dword [rdi + 0xc]
inc ecx
cmp ecx, edx
jle 0x140090c8e
mov eax, ecx
test ecx, ecx
jns 0x140090c47
lea eax, [rcx + 1]
sar eax, 1
lea esi, [rcx + 8]
add esi, eax
and esi, 0xfffffff8
cmp edx, esi
je 0x140090c8b
mov rcx, qword [rdi]
test esi, esi
jle 0x140090c7f
movsxd rdx, esi
shl rdx, 3
test rcx, rcx
jne 0x140090c75
mov rcx, rdx
call fcn.1400e2094
mov qword [rdi], rax
jmp 0x140090c8b
call fcn.1400e208c
mov qword [rdi], rax
jmp 0x140090c8b
call fcn.1400e1bf4
mov qword [rdi], 0
mov dword [rdi + 8], esi
movsxd rcx, dword [rdi + 0xc]
inc r14
mov edx, ebp
shl rdx, 0x20
lea eax, [rcx + 1]
mov dword [rdi + 0xc], eax
mov eax, r13d
or rdx, rax
mov rax, qword [rdi]
mov qword [rax + rcx*8], rdx
mov rcx, r12
cmp r14, r15
jb 0x140090c10
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.1400e1bf4
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
mov rbp, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140095f80
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rcx + 0xe0], rbp
mov qword [rcx + 0xe8], rbp
call fcn.14028c570
nop
lea rax, vtable.juce::FileChooser::Native.0
mov qword [rcx], rax
lea rax, vtable.juce::FileChooser::Native.1.0
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0xf0], rdx
mov ecx, 0x298
call fcn.1400daadc
mov qword [rsp + 0x68], rax
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.140092d60
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [r14 + 0xf8], rbp
mov qword [r14 + 0x100], rbp
test rax, rax
je 0x14009606b
lea ecx, [rbp + 0x18]
call fcn.1400daadc
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_resource_class_juce::Win32NativeFileChooser____ptr64__struct_std::default_delete_class_juce::Win32NativeFileChooser__.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov qword [r14 + 0xf8], rbx
mov qword [r14 + 0x100], rax
mov ebx, ebp
mov eax, ebp
test rax, rax
je 0x14009607d
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rax, qword [0x14043c860]
test rax, rax
jne 0x1400960a8
mov ecx, 0x150
call fcn.1400daadc
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.1402625b0
nop
mov qword [0x14043c860], rax
mov rcx, qword [rax + 0x88]
mov rax, qword [rcx]
movsxd rcx, dword [rcx + 0xc]
lea rdx, [rcx + rcx*4]
shl rdx, 4
add rdx, rax
cmp rax, rdx
je 0x1400960d4
cmp byte [rax], 0
jne 0x1400960d7
add rax, 0x50
cmp rax, rdx
jne 0x1400960c6
mov rax, rbp
movups xmm1, xmmword [rax + 0x14]
movq xmm0, qword [rax + 0x1c]
movq rax, xmm0
shr rax, 0x20
cdq
and edx, 3
add eax, edx
sar eax, 2
movq r8, xmm1
mov r10, r8
shr r10, 0x20
add r10d, eax
movd eax, xmm0
cdq
and edx, 3
add edx, eax
sar edx, 2
add edx, r8d
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8d, r10d
mov rcx, r14
call fcn.14028b770
mov dl, 1
mov rcx, r14
call fcn.140288f00
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x1401ed650]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x68]
mov rcx, r14
call fcn.140287480
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14028ba30
nop
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret