joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007988
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x1400c3980]
xor r13d, r13d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov esi, r13d
test rax, rax
jne 0x1400079da
lea r8, [fcn.140007944]
mov ecx, 0x260
lea edx, [rax + 0x10]
call fcn.1400097c0
mov qword [0x1400c3980], rax
mov rdx, rdi
mov rcx, rax
call fcn.1400096ac
mov rbx, rax
test rax, rax
je 0x140007add
test r14, r14
lea r15, [0x1400afbf8]
cmovne r15, r14
test rbp, rbp
je 0x140007a0b
cmp word [rbp], r13w
jne 0x140007a12
lea rbp, [0x1400b6e40]
mov rcx, r15
call fcn.140009120
mov rcx, rbp
mov r12, rax
call fcn.140009120
mov rcx, qword [0x1400c2978]
add eax, 2
add eax, r12d
xor edx, edx
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140007ac6
mov rdx, r15
mov rcx, rax
call fcn.140009104
test r12d, r12d
je 0x140007a73
movsxd rax, r12d
cmp word [r15 + rax*2 - 2], 0x5c
je 0x140007a73
lea rdx, [0x1400afb9c]
mov rcx, r14
call fcn.1400090d8
mov rdx, rbp
mov rcx, r14
call fcn.1400090d8
lea rdx, [rbx + 0xc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140007a9a
mov dword [rbx + 8], r13d
jmp 0x140007aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140007aaf
mov dword [rbx + 8], 1
mov rsi, rbx
mov rcx, qword [0x1400c2978]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
jne 0x140007add
mov rcx, qword [0x1400c3980]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.140009784
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140007b5c
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140007ccd
cmp word [rcx], di
je 0x140007ccd
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.140009574
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call fcn.140009120
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x140007c02
cmp word [rsp + 0x22], 0x3a
jne 0x140007c02
cmp edx, 2
jne 0x140007be2
lea rdx, [0x1400afb9c]
lea rcx, [rsp + 0x20]
call fcn.1400090d8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140007ccd
mov rbx, 0xfffffffffffffffe
jmp 0x140007ccd
cmp word [rcx], 0x5c
je 0x140007c0e
cmp word [rcx], 0x2f
jne 0x140007c17
mov word [rcx], di
sub rcx, 2
jmp 0x140007c02
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x140007c5e
test byte [rbp + 0x130], 0x10
je 0x140007c43
mov rbx, 0xfffffffffffffffe
jmp 0x140007c56
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140007ccd
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x140007c73
cmp ax, cx
je 0x140007c89
cmp cx, 0x2f
jne 0x140007c7e
cmp ax, cx
je 0x140007c89
cmp cx, 0x2e
jne 0x140007ccd
cmp ax, cx
jne 0x140007ccd
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007cae
not eax
mov rbx, 0xfffffffffffffffe
shr rax, 4
and eax, 1
or rbx, rax
jmp 0x140007ccd
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140007d04
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov edi, 0x104
mov ecx, edi
call fcn.1400095c0
mov rdx, rax
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x140007d53
lea edx, [rbx - 1]
movsxd r8, edx
lea eax, [rbp + 0x5c]
cmp word [rsi + r8*2], ax
je 0x140007d53
mov word [rsi + rbx*2], ax
inc ebx
sub edi, ebx
mov ecx, edi
call fcn.140009650
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rsi + rax*2], bp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007dc8
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140007de0
test rdx, rdx
je 0x140007de0
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cdqe
jmp 0x140007de2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140007de8
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140007dfb
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x140007dfd
xor eax, eax
add rsp, 0x28
ret
Function at 0x140007e10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140007e54
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x140007e60
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x1400c3988]
jne 0x140007e80
add rsp, 0x30
pop rdi
jmp fcn.14001737c
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.140009758
mov rbx, rax
test rax, rax
je 0x140007ef5
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140007edd
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x140007eca
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x1400c2978]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400c3988]
mov rdx, rdi
call fcn.140009784
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140007f40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, rcx
xor edi, edi
mov rcx, qword [0x1400c3988]
mov dword [rsp + 0x50], edi
call fcn.140009758
mov rbx, rax
test rax, rax
je 0x140007fe5
cmp qword [rax + 8], rdi
je 0x140007fa7
lea r8d, [rdi + 1]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.14001e6a0
test rax, rax
je 0x140007f94
inc dword [rbx + 0x14]
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edi, 1
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007ff5
cmp dword [rsp + 0x58], edi
je 0x140007ff5
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
cdqe
add rsp, 0x30
pop rdi
ret
Function at 0x140008f34
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140008fb0
movsxd rdx, ecx
lea rcx, [0x140009038]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x1400c39d0]
test rbx, rbx
je 0x140009023
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140008fa6
cmp byte [rbx + 0x20], 0
je 0x140008fa6
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140008f6c
jmp 0x140009023
mov rbx, qword [0x1400c39d0]
test rbx, rbx
je 0x140009023
mov rsi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000901b
cmp byte [rbx + 0x21], 0
je 0x140008fdf
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000900b
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
or rdx, 0xffffffffffffffff
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400c39d0]
call fcn.140009884
mov rbx, rsi
test rsi, rsi
jne 0x140008fbc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000f510
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
cmp r8, rax
mov rsi, rdx
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x14000f5b5
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.140026a90
not eax
lea rdx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x40], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140026a90
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x14000f542
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140016390
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [rsp + 0x60]
mov rsi, r9
cmp r8, rbx
mov r14, rdx
mov rdi, rcx
cmovb ebx, r8d
test ebx, ebx
je 0x140016457
mov qword [rsp + 0x40], rbp
sub r14, r9
mov ebp, ebx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r14 + rsi]
mov r8d, 1
mov eax, dword [rdi + 8]
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsi], cl
mov ecx, dword [rdi]
not ecx
call fcn.140026a90
not eax
lea rdx, [rsp + 0x50]
mov dword [rdi], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x50], cl
mov ecx, dword [rdi + 8]
not ecx
call fcn.140026a90
lea rsi, [rsi + 1]
not eax
mov dword [rdi + 8], eax
sub rbp, 1
jne 0x1400163d0
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140016470
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0xf8]
mov rbp, rcx
call fcn.14003b990
mov rsi, rax
test rax, rax
jne 0x1400164b6
lea r8, str.Encryption_needs_passphrase
mov rcx, rbp
lea rdx, [rax - 1]
call fcn.14002a390
lea eax, [rsi - 0x19]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov edx, 0xb
lea rcx, [rsp + 0x20]
call fcn.14003aa90
test eax, eax
je 0x1400164f1
lea r8, str.Cant_generate_random_number_for_encryption
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call fcn.14002a390
mov eax, 0xffffffe2
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140016500
mov dword [rdi + 0x50], 0x12345678
mov dword [rdi + 0x54], 0x23456789
mov dword [rdi + 0x58], 0x34567890
test rbx, rbx
je 0x140016580
mov ecx, dword [rdi + 0x50]
lea rdx, [rsp + 0x60]
movzx eax, byte [rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x60], al
call fcn.140026a90
not eax
lea rdx, [rsp + 0x68]
mov dword [rdi + 0x50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 0x54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 0x54], ecx
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, dword [rdi + 0x58]
not ecx
call fcn.140026a90
lea rsi, [rsi + 1]
not eax
mov dword [rdi + 0x58], eax
sub rbx, 1
jne 0x140016523
movzx eax, byte [rdi + 0x5d]
xor ebx, ebx
mov byte [rsp + 0x2b], al
lea esi, [rbx + 0xc]
nop dword [rax]
movzx edx, byte [rsp + rbx + 0x20]
mov r8d, 1
mov eax, dword [rdi + 0x58]
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsp + rbx + 0x30], cl
mov ecx, dword [rdi + 0x50]
not ecx
call fcn.140026a90
not eax
lea rdx, [rsp + 0x68]
mov dword [rdi + 0x50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 0x54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 0x54], ecx
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, dword [rdi + 0x58]
not ecx
call fcn.140026a90
lea rbx, [rbx + 1]
not eax
mov dword [rdi + 0x58], eax
sub rsi, 1
jne 0x140016590
lea r8d, [rsi + 0xc]
mov rcx, rbp
lea rdx, [rsp + 0x30]
call fcn.14003b350
test eax, eax
jne 0x140016628
add qword [rdi + 0xb0], 0xc
add qword [rdi + 0x18], 0xc
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a514
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r12d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x14001a5c5
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14001a5c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x14001a5c5
mov rcx, qword [0x1400c3ab8]
lea rdx, [rsi - 1]
call fcn.140009758
mov rbx, rax
lea ebp, [r12 - 8]
cmp dword [rax + 0x20], 0
jle 0x14001a5c5
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r12w
jne 0x14001a5b5
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x14001a5c3
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x14001a5c5
jmp 0x14001a5a2
xor ebp, ebp
mov sil, 0x80
test rdi, rdi
je 0x14001a695
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001a695
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001a695
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001a695
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001a695
mov r8d, 0x10
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x14001a695
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call fcn.14001dc9c
test eax, eax
je 0x14001a665
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call fcn.14001dc9c
test eax, eax
jne 0x14001a680
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x14001a6fc
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call fcn.14003e4a8
test eax, eax
je 0x14001a6fc
test r14, r14
je 0x14001a6d7
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001a6ca
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001a6ca
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001a6d7
mov edx, 1
mov rcx, r14
call fcn.14001a88c
test rdi, rdi
je 0x14001a6f1
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x14001a6fc
test rbx, rbx
je 0x14001a6fc
mov rax, qword [rbx + 0x10]
jmp 0x14001a6fe
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x14001cb10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14003fca0
sub rsp, rax
mov rax, qword [0x1400c0b80]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140024584
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001cb5f
mov rax, rbp
jmp 0x14001cc67
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xc40e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14003f720
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xc40e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001cc63
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cc63
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14003f720
test rax, rax
js 0x14001cc63
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001cc63
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14001cc55
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14001cc55
cmp byte [rcx], 0xd
jne 0x14001cc3b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14001cc4a
cmp byte [rcx + 1], 0xa
jne 0x14001cc4a
inc rcx
jmp 0x14001cc4a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xc13d0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14001cc1d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14001cc67
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400247f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001e608
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [r11 + 0x10]
mov edx, ecx
mov qword [r11 - 0x18], rax
xor esi, esi
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov ebx, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x14001e67a
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x14001e66f
mov rcx, rdi
call fcn.140009120
mov rbx, rax
test eax, eax
je 0x14001e66f
movsxd rax, ebx
lea ecx, [rsi + 0x5c]
cmp word [rdi + rax*2 - 2], cx
je 0x14001e66f
mov word [rdi + rax*2], cx
inc ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movsxd rax, ebx
mov word [rdi + rax*2], si
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001e6a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x14001e6d7
call fcn.140007e10
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x14001e750
mov rax, rdi
sub rax, 1
je 0x14001e741
sub rax, 1
je 0x14001e72e
cmp rax, 2
je 0x14001e71d
mov r8, rdi
mov rcx, r15
call fcn.14001df90
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14001e7ca
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14001e7ca
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14001e7ca
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14001e7ca
mov r8, rbx
mov rcx, r15
call fcn.14001df90
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x14001e790
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x14001e7c8
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.14001df90
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001e7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r12d, edx
mov r14, rcx
mov r15d, 0x1000
mov rcx, qword [0x1400c2978]
mov r8d, r15d
xor edx, edx
mov r13, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14001e9cb
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
mov qword [rsp + 0x78], rdi
cmp rsi, 0xffffffffffffffff
je 0x14001e857
test rsi, rsi
je 0x14001e920
dec rsi
cmp qword [r14 + 8], 0
lea rdi, [r14 + 8]
lea rdx, [rsp + 0x30]
je 0x14001e87b
mov r8d, 1
mov rcx, r14
call fcn.14001e6a0
mov dword [rsp + 0x34], eax
jmp 0x14001e89c
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x14001e924
test r8b, r8b
je 0x14001e8b8
mov byte [rbx], r8b
inc rbx
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
lea eax, [r15 - 1]
sub rdx, rbp
movsxd rcx, eax
cmp rdx, rcx
jle 0x14001e8fa
mov rcx, qword [0x1400c2978]
add r15d, 0x1000
movsxd r9, r15d
mov r8, rbp
mov edx, 8
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
mov rbp, rax
movsxd rbx, ebx
add rbx, rax
test r8b, r8b
je 0x14001e924
test r12d, r12d
jne 0x14001e845
cmp r8b, 0xd
je 0x14001e92d
cmp r8b, 0xa
jne 0x14001e845
dec rbx
jmp 0x14001e9b1
lea rdi, [r14 + 8]
test r12d, r12d
jne 0x14001e9b1
cmp r8b, 0xa
jne 0x14001e938
dec rbx
jmp 0x14001e9b1
cmp r8b, 0xd
jne 0x14001e9b1
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi], 0
je 0x14001e960
mov r8d, 1
mov rcx, r14
call fcn.14001e6a0
mov dword [rsp + 0x34], eax
jmp 0x14001e97d
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14001e9b1
cmp qword [rdi], 0
je 0x14001e990
inc dword [r14 + 0x14]
jmp 0x14001e9b1
mov rcx, qword [r14]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
sub rax, rbp
mov qword [r13], rax
mov rax, rbp
mov byte [rbx], 0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret