joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4135e0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446a4d
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
push esi
push edi
mov eax, dword [0x461264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x1058], bl
je 0x413689
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x1058], bl
cmp dword [ebp + 8], ebx
je 0x4136ae
cmp dword [ebp + 0xc], ebx
je 0x4136ae
mov edx, dword [esi + 0x1064]
mov edi, dword [esi + 0x1070]
mov dword [ebp - 4], 0xffffffff
test edx, edx
je 0x413651
mov edx, dword [edx]
mov ecx, dword [edx + 8]
mov eax, edi
shr eax, 2
dec ecx
and ecx, eax
and edi, 3
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edi*4]
add dword [esi + 0x1074], 0xffffffff
jne 0x413679
mov dword [esi + 0x1070], ebx
jmp 0x41367f
inc dword [esi + 0x1070]
test ecx, ecx
je 0x413689
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x1074], ebx
je 0x413801
mov edi, dword [esi + 0x105c]
cmp edi, 0xffffffff
je 0x41370e
mov eax, dword [esi + 0x1064]
test eax, eax
jne 0x413724
xor edx, edx
jmp 0x413726
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00410400
cmp eax, 2
jg 0x4136fe
push 2
push 0x1ac
push str.f:360work_vpn_turbowin_master_baseipcipc_channel_win.cc
lea ecx, [ebp - 0xc0]
call fcn.0040f260
mov ebx, 8
mov dword [ebp - 4], 3
push esi
add eax, ebx
mov dword [ebp - 0x10], ebx
push str.pipe_error:
push eax
call fcn.004026f0
add esp, 8
mov ecx, eax
call fcn.0040a0a0
test bl, 8
je 0x41370e
lea ecx, [ebp - 0xc0]
call fcn.0040f420
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [eax]
mov ecx, dword [edx + 8]
mov eax, dword [esi + 0x1070]
dec ecx
shr eax, 2
and ecx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x1070]
and eax, 3
mov dword [ebp + 8], eax
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
lea eax, [esi + 0x1040]
push eax
lea eax, [ebp + 0xc]
add ecx, dword [edx]
push eax
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4137fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
je 0x4137fa
call fcn.00410400
cmp eax, 2
jg 0x4137d1
push 2
push 0x1ce
push str.f:360work_vpn_turbowin_master_baseipcipc_channel_win.cc
lea ecx, [ebp - 0xc0]
call fcn.0040f260
push edi
add eax, 8
mov dword [ebp - 4], 7
push str.pipe_error:
mov ebx, 0x80
push eax
mov dword [ebp - 0x10], ebx
call fcn.004026f0
add esp, 8
mov ecx, eax
call fcn.0040a0a0
test bl, bl
jns 0x41370e
lea ecx, [ebp - 0xc0]
call fcn.0040f420
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esi + 0x1058], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446a8c
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [0x461264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [esi + 0x105c]
cmp ecx, 0xffffffff
je 0x4138e5
lea eax, [esi + 0x1024]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4138fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
je 0x4138fe
call fcn.00410400
cmp eax, 2
jg 0x4138d5
push 2
push 0x84
push str.f:360work_vpn_turbowin_master_baseipcipc_channel_win.cc
lea ecx, [ebp - 0xc4]
call fcn.0040f260
push edi
mov dword [ebp - 4], ebx
add eax, 8
push str.pipe_error:
mov ebx, 1
push eax
mov dword [ebp - 0x14], ebx
call fcn.004026f0
add esp, 8
mov ecx, eax
call fcn.0040a0a0
test bl, 1
je 0x4138e5
lea ecx, [ebp - 0xc4]
call fcn.0040f420
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 2
mov byte [esi + 0x103c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4140c1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4140fc
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4140e3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4140f4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4140fe
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4140d9
xor eax, eax
pop edi
pop esi
ret
Function at 0x417f20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447057
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x461264]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
mov esi, dword [ebp + 0xc]
je 0x417fd4
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push 0
push 0xffffffffffffffff
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x417f7e
xor al, al
jmp 0x4180bc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00401330
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.0040a610
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040a650
lea ecx, [ebp - 0x230]
call fcn.004012d0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.004012d0
jmp 0x417fe3
push esi
push 0x6c
call fcn.0040b7d0
add esp, 8
test al, al
je 0x417f77
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0x449cc8
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x264], 9
push eax
mov ecx, esi
call fcn.0040a7c0
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0040a650
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xffffffff
call fcn.004012d0
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], str.Internet_Explorer
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x264], 0x11
push eax
mov ecx, esi
call fcn.0040a7c0
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0040a650
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xffffffff
call fcn.004012d0
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], str.Quick_Launch
push eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x26c], 0xc
push eax
mov ecx, esi
call fcn.0040a7c0
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0040a650
lea ecx, [ebp - 0x260]
call fcn.004012d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004299e7
mov esp, ebp
pop ebp
ret

Function at 0x418930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447281
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x461264]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4189f3
cmp eax, 0x104
ja 0x4189f3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401330
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x260]
call fcn.0040a610
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0040aaf0
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040a650
lea ecx, [ebp - 0x248]
call fcn.004012d0
lea ecx, [ebp - 0x260]
call fcn.004012d0
lea ecx, [ebp - 0x230]
call fcn.004012d0
mov al, 1
jmp 0x4189f5
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004299e7
mov esp, ebp
pop ebp
ret
Function at 0x420cc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447e5a
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push esi
mov eax, dword [0x461264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x420dbb
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.00406970
push 0x458290
push 0xffffffffffffffff
push str._vs.
push dword [esi]
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0
push 0x45829c
push str.slot_____DWORD_0xFFFFFFFF_
push eax
call fcn.004026f0
add esp, 8
push eax
call fcn.004026f0
add esp, 8
mov ecx, eax
call fcn.0040a0a0
push eax
call fcn.004026f0
add esp, 8
mov ecx, eax
call fcn.0040a0a0
push eax
call fcn.004026f0
push 0x18
call fcn.004299f8
add esp, 0xc
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x420d85
push eax
lea ecx, [ebp - 0xa4]
call fcn.004068b0
mov esi, eax
jmp 0x420d87
xor esi, esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.00404940
test esi, esi
je 0x420dbb
push esi
push 0x12
push str.f:360work_vpn_turbowin_master_base_threading_thread_local_win.cc
lea ecx, [ebp - 0x154]
call fcn.0040f2f0
lea ecx, [ebp - 0x154]
call fcn.0040f420
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420df0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445fcc
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
mov eax, dword [0x461264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x420e7a
call fcn.00410400
cmp eax, 4
jg 0x420e6a
push 4
push 0x24
push str.f:360work_vpn_turbowin_master_base_threading_thread_local_win.cc
lea ecx, [ebp - 0xc0]
call fcn.0040f260
mov dword [ebp - 4], ebx
add eax, 8
push str.Failed_to_TlsSetValue__.
mov ebx, 1
push eax
mov dword [ebp - 0x10], ebx
call fcn.004026f0
add esp, 8
test bl, 1
je 0x420e7a
lea ecx, [ebp - 0xc0]
call fcn.0040f420
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4277f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx]
sub eax, esi
sar eax, 2
test eax, eax
je 0x427861
push ebx
push edi
mov edi, eax
mov ebx, dword [esi]
lea esi, [esi + 4]
movzx edx, al
movzx ecx, bl
xor edx, ecx
shr eax, 8
mov ecx, ebx
shr ecx, 8
xor eax, dword [edx*4 + 0x44a840]
movzx edx, cl
movzx ecx, al
xor edx, ecx
shr eax, 8
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
xor eax, dword [edx*4 + 0x44a840]
movzx edx, cl
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x44a840]
movzx ecx, al
xor ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x44a840]
sub edi, 1
jne 0x427803
pop edi
pop ebx
pop esi
ret

Function at 0x428120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x461264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x428143
test eax, eax
jne 0x4281e9
mov eax, dword [0x4611d0]
cmp eax, 0xffffffff
je 0x4281e9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4281e8
push esi
push edi
lea eax, [ebp - 0x104]
mov ecx, 0x40
push eax
push dword [0x4611d0]
mov esi, ebx
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00429a59
add esp, 4
mov edi, 0x40
mov esi, dword [0x463210]
xor dl, dl
test esi, esi
jle 0x4281cf
mov ecx, dword [ebp + esi*4 - 0x104]
test ecx, ecx
je 0x4281ca
mov eax, dword [esi*4 + 0x463218]
test eax, eax
je 0x4281ca
push ecx
mov dword [ebp + esi*4 - 0x104], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x4281a1
dec edi
test edi, edi
jle 0x4281d8
test dl, dl
jne 0x428195
push 0
push dword [0x4611d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004299e7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428200
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x461264]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4611d0], 0xffffffff
push ebx
push esi
push edi
jne 0x428241
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, eax
mov esi, 0x4611d0
mov ecx, edx
or eax, 0xffffffff
lock cmpxchg dword [esi], ecx
cmp eax, 0xffffffff
je 0x428241
push edx
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0042c090
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push dword [0x4611d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x100
call fcn.00429a5e
add esp, 4
lea esi, [ebp - 0x104]
mov ebx, eax
mov ecx, 0x40
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [0x4611d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004299e7
mov esp, ebp
pop ebp
ret
Function at 0x6d04d7ee
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.J2D_TRACE_LEVEL
call esi
and dword [0x6d0f6ec8], 0
pop ecx
test eax, eax
je 0x6d04d834
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ecx
push 0x6d0b71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
test eax, eax
jle 0x6d04d834
mov eax, dword [ebp - 4]
cmp eax, 5
ja 0x6d04d834
mov dword [0x6d0f6ec8], eax
push str.J2D_TRACE_FILE
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x6d04d867
push 0x6d0b7190
push esi
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [0x6d0f9534], eax
test eax, eax
jne 0x6d04d87e
push esi
push str._E_:_Error_opening_trace_file__s_n
call dword [sym.imp.MSVCR100.dll_printf]
pop ecx
pop ecx
cmp dword [0x6d0f9534], 0
jne 0x6d04d87e
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
mov dword [0x6d0f9534], eax
pop esi
leave
ret

Function at 0x6d0506c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.IMLIB_DEBUG
call esi
add esp, 4
mov ebx, 1
test eax, eax
je 0x6d050702
call sym.awt.dll_awt_setMlibStartTimer
mov dword [0x6d0f9578], eax
call sym.awt.dll_awt_setMlibStartTimer
cmp dword [0x6d0f9578], 0
mov dword [0x6d0f957c], eax
je 0x6d050702
test eax, eax
je 0x6d050702
mov dword [0x6d0f9568], ebx
push str.IMLIB_PRINT
call esi
add esp, 4
test eax, eax
je 0x6d050716
mov dword [0x6d0f956c], ebx
push str.IMLIB_START
call esi
add esp, 4
test eax, eax
je 0x6d050738
push 0x6d0f9570
push 0x6d0b71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
push str.IMLIB_NOMLIB
call esi
add esp, 4
test eax, eax
je 0x6d050753
pop esi
mov dword [0x6d0f9574], ebx
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0xc]
push 0x6d0f955c
push 0x6d0f6ecc
push eax
call fcn.6d08901e
add esp, 0xc
test eax, eax
jne 0x6d050746
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x6d053110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
mov dword [esp + 0x10], ecx
cmp ebp, ecx
jge 0x6d05312f
xor ebp, ebp
jmp 0x6d05313c
cmp ebp, 0xff
jle 0x6d053140
mov ebp, 0xff
mov dword [esp + 0x18], ebp
cmp ebx, ecx
jge 0x6d053148
xor ebx, ebx
jmp 0x6d053155
cmp ebx, 0xff
jle 0x6d053155
mov ebx, 0xff
cmp eax, ecx
jge 0x6d05315d
xor eax, eax
jmp 0x6d053169
cmp eax, 0xff
jle 0x6d05316d
mov eax, 0xff
mov dword [esp + 0x1c], eax
cmp ebp, ebx
jne 0x6d0531ce
cmp ebx, eax
jne 0x6d0531ce
mov ebx, dword [esp + 0x20]
mov edi, 0x100
cmp ebx, ecx
jle 0x6d053224
add esi, 2
lea esp, [esp]
mov al, byte [esi - 1]
mov dl, byte [esi]
cmp al, dl
jne 0x6d0531b4
cmp dl, byte [esi + 1]
jne 0x6d0531b4
movzx eax, al
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
je 0x6d0531c6
cmp eax, edi
jge 0x6d0531b4
mov dword [esp + 0x10], ecx
mov edi, eax
inc ecx
add esi, 4
cmp ecx, ebx
jl 0x6d053190
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
xor eax, eax
mov edi, 0x1000000
cmp dword [esp + 0x20], ecx
jle 0x6d053224
add esi, 2
mov edi, edi
movzx ecx, byte [esi - 1]
sub ecx, ebp
imul ecx, ecx
cmp ecx, edi
jge 0x6d05321a
movzx edx, byte [esi]
sub edx, ebx
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d053216
movzx edx, byte [esi + 1]
sub edx, dword [esp + 0x1c]
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d053216
test ecx, ecx
je 0x6d053228
mov dword [esp + 0x10], eax
mov edi, ecx
mov ebp, dword [esp + 0x18]
inc eax
add esi, 4
cmp eax, dword [esp + 0x20]
jl 0x6d0531e0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6d05a4e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push str.OGLFuncs_InitPlatformFuncs
inc ebx
push ebx
push 3
call fcn.6d08901e
mov eax, dword [0x6d0f95e0]
add esp, 0xc
test eax, eax
jne 0x6d05a517
push str.OGLFuncs_InitPlatformFuncs:_library_not_yet_initialized
push ebx
push ebx
call fcn.6d08901e
add esp, 0xc
xor al, al
pop ebx
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, str.wglCreateContext
push edi
push eax
call esi
mov dword [0x6d0fbd20], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglDeleteContext
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbcc0], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglMakeCurrent
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbdf0], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetCurrentContext
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe18], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetCurrentDC
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe14], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetProcAddress
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe2c], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglShareLists
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbca4], eax
test eax, eax
jne 0x6d05a5ce
push edi
push ebx
push ebx
call fcn.6d08901e
add esp, 0xc
xor al, al
jmp 0x6d05a5d0
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x6d062ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov edx, dword [esp + 4]
mov dword [eax], vtable.D3DContext.0
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
movzx ecx, byte [edx + 0xc]
mov byte [eax + 0xc], cl
push esi
fld dword [edx + 0x10]
push edi
fstp dword [eax + 0x10]
movzx ecx, byte [edx + 0x14]
mov byte [eax + 0x14], cl
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [edx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x34], ecx
mov ecx, dword [edx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [edx + 0x40]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x44]
mov dword [eax + 0x44], ecx
mov ecx, dword [edx + 0x48]
mov dword [eax + 0x48], ecx
mov ecx, dword [edx + 0x4c]
mov dword [eax + 0x4c], ecx
mov ecx, dword [edx + 0x50]
mov dword [eax + 0x50], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0x54], ecx
mov ecx, dword [edx + 0x58]
mov dword [eax + 0x58], ecx
mov ecx, dword [edx + 0x5c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [edx + 0x60]
mov dword [eax + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [eax + 0x64], ecx
mov ecx, dword [edx + 0x68]
mov dword [eax + 0x68], ecx
mov ecx, dword [edx + 0x6c]
mov dword [eax + 0x6c], ecx
mov ecx, dword [edx + 0x70]
mov dword [eax + 0x70], ecx
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x74], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x78], ecx
mov ecx, dword [edx + 0x7c]
mov dword [eax + 0x7c], ecx
mov ecx, dword [edx + 0x80]
mov dword [eax + 0x80], ecx
mov ecx, dword [edx + 0x84]
mov dword [eax + 0x84], ecx
mov ecx, dword [edx + 0x88]
mov dword [eax + 0x88], ecx
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
lea esi, [edx + 0x94]
lea edi, [eax + 0x94]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0xcc]
lea edi, [eax + 0xcc]
mov ecx, 0x4c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x1fc]
mov dword [eax + 0x1fc], ecx
mov ecx, dword [edx + 0x200]
mov dword [eax + 0x200], ecx
mov ecx, dword [edx + 0x204]
mov dword [eax + 0x204], ecx
mov ecx, dword [edx + 0x208]
mov dword [eax + 0x208], ecx
mov ecx, dword [edx + 0x20c]
mov dword [eax + 0x20c], ecx
mov ecx, dword [edx + 0x210]
mov dword [eax + 0x210], ecx
mov edx, dword [edx + 0x214]
pop edi
mov dword [eax + 0x214], edx
pop esi
ret 4
Function at 0x6d063060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov edx, dword [esp + 4]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
movzx ecx, byte [edx + 0xc]
mov byte [eax + 0xc], cl
push esi
fld dword [edx + 0x10]
push edi
fstp dword [eax + 0x10]
movzx ecx, byte [edx + 0x14]
mov byte [eax + 0x14], cl
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [edx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x34], ecx
mov ecx, dword [edx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [edx + 0x40]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x44]
mov dword [eax + 0x44], ecx
mov ecx, dword [edx + 0x48]
mov dword [eax + 0x48], ecx
mov ecx, dword [edx + 0x4c]
mov dword [eax + 0x4c], ecx
mov ecx, dword [edx + 0x50]
mov dword [eax + 0x50], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0x54], ecx
mov ecx, dword [edx + 0x58]
mov dword [eax + 0x58], ecx
mov ecx, dword [edx + 0x5c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [edx + 0x60]
mov dword [eax + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [eax + 0x64], ecx
mov ecx, dword [edx + 0x68]
mov dword [eax + 0x68], ecx
mov ecx, dword [edx + 0x6c]
mov dword [eax + 0x6c], ecx
mov ecx, dword [edx + 0x70]
mov dword [eax + 0x70], ecx
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x74], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x78], ecx
mov ecx, dword [edx + 0x7c]
mov dword [eax + 0x7c], ecx
mov ecx, dword [edx + 0x80]
mov dword [eax + 0x80], ecx
mov ecx, dword [edx + 0x84]
mov dword [eax + 0x84], ecx
mov ecx, dword [edx + 0x88]
mov dword [eax + 0x88], ecx
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
lea esi, [edx + 0x94]
lea edi, [eax + 0x94]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0xcc]
lea edi, [eax + 0xcc]
mov ecx, 0x4c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x1fc]
mov dword [eax + 0x1fc], ecx
mov ecx, dword [edx + 0x200]
mov dword [eax + 0x200], ecx
mov ecx, dword [edx + 0x204]
mov dword [eax + 0x204], ecx
mov ecx, dword [edx + 0x208]
mov dword [eax + 0x208], ecx
mov ecx, dword [edx + 0x20c]
mov dword [eax + 0x20c], ecx
mov ecx, dword [edx + 0x210]
mov dword [eax + 0x210], ecx
mov edx, dword [edx + 0x214]
pop edi
mov dword [eax + 0x214], edx
pop esi
ret 4