joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020da1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10020e29
cmp dword [ebp + 8], 0
je 0x10020e29
test edi, edi
jne 0x10020dce
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10020e06
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10020dd2
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10020e25
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10020dc7
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.100214d8
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x10020e67
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10020eef
cmp dword [ebp + 8], 0
je 0x10020eef
test edi, edi
jne 0x10020e94
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10020ecc
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10020e98
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10020eeb
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10020e8d
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.1000180e
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3
Function at 0x10020f2d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10020fb3
cmp dword [ebp + 8], 0
je 0x10020fb3
test edi, edi
jne 0x10020f5a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10020f90
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10020f5e
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10020faf
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10020f53
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.10001802
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x10020ff1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10021079
cmp dword [ebp + 8], 0
je 0x10021079
test edi, edi
jne 0x1002101e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10021056
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10021022
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10021075
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10021017
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.10001820
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3
Function at 0x100210da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10021162
cmp dword [ebp + 8], 0
je 0x10021162
test edi, edi
jne 0x10021107
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x1002113f
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x1002110b
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1002115e
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10021100
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.10001826
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x100211d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10021258
cmp dword [ebp + 8], 0
je 0x10021258
test edi, edi
jne 0x100211fd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10021235
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10021201
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10021254
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x100211f6
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.10001814
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3
Function at 0x10021296
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1002131e
cmp dword [ebp + 8], 0
je 0x1002131e
test edi, edi
jne 0x100212c3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0x7e0000
shl eax, 3
cmp eax, 0x3f00000
lea eax, [ecx + edi*8]
cmovb esi, ebx
push esi
push 8
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x100212fb
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x100212c7
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x1002131a
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x100212bc
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.1000181a
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x1002fd10
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1002fd37
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.10030420
add esp, 8
xor eax, eax
ret
mov dword [ecx], 1
mov eax, 1
ret

Function at 0x100300f0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x1011b218], 0
jne 0x1003019d
push 0x2220
push 0
push 0x1011b218
call fcn.10054410
movq xmm0, qword [section..data]
add esp, 0xc
mov eax, dword [0x10114008]
movq qword [0x1011b21c], xmm0
mov dword [0x1011b224], eax
call fcn.10030670
test eax, eax
je 0x100301a3
push 0x1011c4c4
call fcn.1002fcf0
add esp, 4
test eax, eax
je 0x100301a3
push 0x1011c4b4
call fcn.1002fd10
add esp, 4
test eax, eax
je 0x100301a3
push 0x1011c4bc
call fcn.1002fd10
add esp, 4
test eax, eax
je 0x100301a3
push 0x1011d438
push 0x1011c4b4
call fcn.1002fdc0
add esp, 8
call fcn.10031ec0
mov dword [0x1011b218], 1
call fcn.10033890
mov dword [0x1011c4e0], eax
mov dword [0x1011c4e4], edx
call fcn.10031600
mov eax, 1
ret
call fcn.100301d0
xor eax, eax
ret
Function at 0x10030b10
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x164
mov eax, dword [0x1011a040]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
push 0x100
lea eax, [esp + 0x74]
push 0
push eax
call fcn.10054410
push 0x6d1
push 0
push 0x1011cbea
call fcn.10054410
mov eax, 0x1011cc8a
lea ebx, [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0x10], eax
mov esi, 0x20
sub ebx, 0x480
movsx edi, word [esi*2 + 0x1011c930]
cmp edi, 0xffffffff
je 0x10030c6d
cmp esi, 0x140
jb 0x10030c0a
cmp esi, 0x14e
ja 0x10030c0a
mov dword [esp + 0x14], 0x60
mov dword [esp + 0x18], 0x61
mov dword [esp + 0x1c], 0x62
mov dword [esp + 0x20], 0x63
mov dword [esp + 0x24], 0x64
mov dword [esp + 0x28], 0x65
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], 0x67
mov dword [esp + 0x34], 0x68
mov dword [esp + 0x38], 0x69
mov dword [esp + 0x3c], 0x6e
mov dword [esp + 0x40], 0x6f
mov dword [esp + 0x44], 0x6a
mov dword [esp + 0x48], 0x6d
mov dword [esp + 0x4c], 0x6b
mov ebp, dword [ebx]
jmp 0x10030c15
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x10030c46
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x10030c69
push 0
push 0
push 5
push dword [esp + 0x1c]
lea eax, [esp + 0x60]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
inc esi
add eax, 5
add ebx, 4
mov dword [esp + 0x10], eax
cmp esi, 0x15c
jle 0x10030b65
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10052950
add esp, 0x164
ret
Function at 0x10030f70
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1011a040]
xor eax, esp
mov dword [esp + 0x18], eax
push 0x1011c518
push 0x1011b218
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10030fb7
push 0x10097b18
push 0x10008
call fcn.10030420
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10052950
add esp, 0x1c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebx
mov dword [0x1011d2f8], eax
test eax, eax
jne 0x10030ff2
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.10030420
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10052950
add esp, 0x1c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x1011d2f8]
mov dword [0x1011d2fc], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x1011d2f8]
mov dword [0x1011d300], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x1011d2f8]
mov dword [0x1011d304], eax
call edi
push str.GetDpiForWindow
push dword [0x1011d2f8]
mov dword [0x1011d308], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x1011d2f8]
mov dword [0x1011d30c], eax
call edi
push str.GetSystemMetricsForDpi
push dword [0x1011d2f8]
mov dword [0x1011d310], eax
call edi
push str.dinput8.dll
mov dword [0x1011d314], eax
call ebx
mov dword [0x1011d2e0], eax
test eax, eax
je 0x1003108f
push str.DirectInput8Create
push eax
call edi
mov dword [0x1011d2e4], eax
push esi
mov dword [esp + 0xc], str.xinput1_4.dll
xor esi, esi
mov dword [esp + 0x10], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [esp + 0x14], str.xinput9_1_0.dll
mov dword [esp + 0x18], str.xinput1_2.dll
mov dword [esp + 0x1c], str.xinput1_1.dll
mov dword [esp + 0x20], 0
push eax
call ebx
mov dword [0x1011d2ec], eax
test eax, eax
jne 0x100310de
mov eax, dword [esp + esi*4 + 0x10]
inc esi
test eax, eax
jne 0x100310c7
jmp 0x100310fd
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x1011d2ec]
mov dword [0x1011d2f0], eax
call edi
mov dword [0x1011d2f4], eax
push str.dwmapi.dll
call ebx
mov dword [0x1011d318], eax
pop esi
test eax, eax
je 0x10031151
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x1011d318]
mov dword [0x1011d31c], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x1011d318]
mov dword [0x1011d320], eax
call edi
push str.DwmGetColorizationColor
push dword [0x1011d318]
mov dword [0x1011d324], eax
call edi
mov dword [0x1011d328], eax
push str.shcore.dll
call ebx
mov dword [0x1011d32c], eax
test eax, eax
je 0x10031180
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x1011d32c]
mov dword [0x1011d330], eax
call edi
mov dword [0x1011d334], eax
push str.ntdll.dll
call ebx
mov dword [0x1011d338], eax
test eax, eax
je 0x1003119d
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x1011d33c], eax
mov ecx, dword [esp + 0x20]
mov eax, 1
pop edi
pop ebx
xor ecx, esp
call fcn.10052950
add esp, 0x1c
ret
Function at 0x100317f0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1011b218], 0
jne 0x10031809
push 0
push 0x10001
call fcn.1002fdf0
add esp, 8
ret
jmp fcn.100374a0

Function at 0x10031940
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1011b218], 0
jne 0x10031959
push 0
push 0x10001
call fcn.1002fdf0
add esp, 8
ret
jmp 0x10037be0
call dword [sym.imp.USER32.dll_WaitMessage]
jmp fcn.100374a0
Function at 0x10036d30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x10
mov eax, dword [0x1011a040]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [0x1011d414], 0
mov dword [esp], str.libOSMesa.dll
mov dword [esp + 4], str.OSMesa.dll
mov dword [esp + 8], 0
je 0x10036d72
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10052950
add esp, 0x10
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov ecx, eax
mov dword [0x1011d414], ecx
test ecx, ecx
jne 0x10036dc2
mov eax, dword [esp + esi*4 + 0xc]
inc esi
test eax, eax
jne 0x10036d81
test ecx, ecx
jne 0x10036dc2
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.1002fdf0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10052950
add esp, 0x10
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push ecx
call esi
push str.OSMesaCreateContextAttribs
push dword [0x1011d414]
mov dword [0x1011d418], eax
call esi
push str.OSMesaDestroyContext
push dword [0x1011d414]
mov dword [0x1011d41c], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x1011d414]
mov dword [0x1011d420], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x1011d414]
mov dword [0x1011d424], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x1011d414]
mov dword [0x1011d428], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x1011d414]
mov dword [0x1011d42c], eax
call esi
cmp dword [0x1011d418], 0
mov dword [0x1011d430], eax
je 0x10036e88
cmp dword [0x1011d420], 0
je 0x10036e88
cmp dword [0x1011d424], 0
je 0x10036e88
cmp dword [0x1011d428], 0
je 0x10036e88
cmp dword [0x1011d42c], 0
je 0x10036e88
test eax, eax
je 0x10036e88
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10052950
add esp, 0x10
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.1002fdf0
mov eax, dword [0x1011d414]
add esp, 8
test eax, eax
je 0x10036eb4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1011d414], 0
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10052950
add esp, 0x10
ret
Function at 0x10037020
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push ebp
push esi
call fcn.10037f20
add esp, 0xc
test eax, eax
je 0x10037151
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x100370c4
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x1003706d
call fcn.10034fb0
test eax, eax
je 0x10037151
push ebx
push edi
push esi
call fcn.10034bb0
jmp 0x100370a7
cmp eax, 0x36002
jne 0x1003708b
call fcn.100361e0
test eax, eax
je 0x10037151
push ebx
push edi
push esi
call fcn.10035d50
jmp 0x100370a7
cmp eax, 0x36003
jne 0x100370b2
call fcn.10036d30
test eax, eax
je 0x10037151
push ebx
push edi
push esi
call fcn.10036b20
add esp, 0xc
test eax, eax
je 0x10037151
push edi
push esi
call fcn.1002f4a0
add esp, 8
test eax, eax
je 0x10037151
cmp dword [esi + 0x3c], 0
je 0x10037124
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.10037ce0
push esi
call fcn.10038690
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x10037147
push esi
call fcn.10031e30
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0x10], 0
je 0x10037147
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x10037147
push esi
call fcn.10037210
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100383d0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x14
mov eax, dword [0x1011a040]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
mov dword [0x1011d2d0], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1003842e
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [esp + 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x1011d2c0], xmm0
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x1011d2c8], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x10038453
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x10038443
push dword [eax + 4]
jmp 0x10038455
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x10038455
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.10031e30
add esp, 4
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x100384ea
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x14], 0x20001
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x100384ea
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.10030420
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.10052950
add esp, 0x14
ret

Function at 0x10038500
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x20001
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10038540
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.10030420
add esp, 8
add esp, 0xc
ret
Function at 0x10038550
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x1e8], 0
je 0x1003859e
push 0xc
push 1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x20001
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1003859e
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.10030420
add esp, 8
push 0
mov dword [0x1011d2d0], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x1011d2c8]
cvttsd2si ecx, qword [0x1011d2c0]
mov dword [esp + 8], eax
mov dword [esi + 0x2dc], eax
lea eax, [esp + 4]
push eax
push dword [esi + 0x2ac]
mov dword [esp + 0xc], ecx
mov dword [esi + 0x2d8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x68], 0x34001
jne 0x1003862a
mov eax, dword [esi + 0x40]
test eax, eax
je 0x10038611
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret

Function at 0x10038640
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push 0xc
push 1
mov dword [esp + 8], 0x20001
mov eax, dword [eax + 0x2ac]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10038686
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.10030420
add esp, 8
add esp, 0xc
ret

Function at 0x100387b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebp
movzx esi, ax
push 0x11
shr esi, 0xf
call ebp
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebp
mov ebx, edi
or ebx, 4
test ax, ax
push 0x5c
cmovns ebx, edi
call ebp
push 0x5b
mov si, ax
call ebp
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
call ebp
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebp
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret