joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400984f0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140098525
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140048cd0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x140098666
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1400985e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140098655
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14009861d
mov r10, qword [rdx]
cmp r10, rax
je 0x140098617
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140098655
cmp r9, rdx
je 0x140098631
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140098677
cmp r9, rdx
jne 0x140098622
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x140098590
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140098655
Function at 0x1400986a0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14009848c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14009841a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400986a0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14009845a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1400b6f14
mov rcx, rbx
test rbx, rbx
jne 0x140098440
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.14004a810
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400987a4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400b6f14
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400987b0
cmp rbx, rbp
jne 0x140098750
cmp qword [rsp + 0x20], r14
jne 0x14009877d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400987bf
mov qword [r15], r12
mov rax, r12
jmp 0x1400987c2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14009877d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400b6f14
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140098856
cmp rbx, rbp
jne 0x140098830
jmp 0x14009877a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400987d0
jmp 0x14009877d
Function at 0x1400a7540
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400a7583
jmp 0x1400a7675
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400a75bc
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.1400b0650
jmp 0x1400a7675
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400a75f5
lea rdx, [0x140103138]
mov ecx, 0x10008
call fcn.1400b0650
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400a7675
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x14010b958]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400a7659
lea rdx, [0x140103160]
mov ecx, 0x10008
call fcn.1400b0650
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400a7675
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret

Function at 0x1400a7690
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rcx, qword [0x14010b958]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400a76bf
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.1400b0650
xor eax, eax
jmp 0x1400a775b
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400a76f2
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.1400b0650
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400a775b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400a7725
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.1400b0650
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400a775b
mov rcx, qword [0x14010b970]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.1400b02a0
mov qword [0x14010b970], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x14010b970]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a90c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x30]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140109720]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400a9168
cmp dword [rsp + 0x40], 0x12
jne 0x1400a9150
mov rax, qword [0x14010a690]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400a914e
mov rcx, qword [rsp + 0x80]
call fcn.1400a43f0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
jmp 0x1400a9121
jmp 0x1400a9166
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400a90ec
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400a92f6
lea rdx, str.GLFW
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetPropW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400a92f6
mov dword [rsp + 0x98], 0xa0
mov dword [rsp + 0x9c], 0x154
mov dword [rsp + 0xa0], 0xa1
mov dword [rsp + 0xa4], 0x158
mov dword [rsp + 0xa8], 0x5b
mov dword [rsp + 0xac], 0x157
mov dword [rsp + 0xb0], 0x5c
mov dword [rsp + 0xb4], 0x15b
mov dword [rsp + 0x88], 0
jmp 0x1400a921d
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 4
jge 0x1400a92f6
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 1
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rsp + 0xc8]
lea rcx, [0x14010bd78]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0xcc], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400a92a7
jmp 0x1400a920d
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
movsx eax, byte [rcx + rax + 0x88]
cmp eax, 1
je 0x1400a92c9
jmp 0x1400a920d
call fcn.1400aa640
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
call fcn.1400a0200
jmp 0x1400a920d
mov rax, qword [0x14010c718]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400a9399
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd4]
mov rcx, qword [rsp + 0x80]
call fcn.1400a7e40
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x388], eax
jne 0x1400a9369
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x38c], eax
je 0x1400a9399
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm0, eax
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm1, eax
movaps xmm2, xmm0
mov rcx, qword [rsp + 0x80]
call fcn.1400a7150
mov rcx, rsp
lea rdx, [0x1400bdbd8]
call fcn.1400b75a0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b69d0
add rsp, 0x120
pop rdi
ret
Function at 0x1400a9ff0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x350]
mov qword [rsp + 0x30], rax
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400aa068
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400b0650
mov rcx, rsp
lea rdx, [0x1400bdfc0]
call fcn.1400b75a0
add rsp, 0x50
pop rdi
ret

Function at 0x1400aa090
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400aa100
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400b0650
mov rcx, rsp
lea rdx, [0x1400be020]
call fcn.1400b75a0
add rsp, 0x50
pop rdi
ret

Function at 0x1400aa640
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400aa66e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400aa68e
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400aa6ae
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x1400aa6e6
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400aa704
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400aa722
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ace60
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x1400ace90
mov r8d, 0x29
lea rdx, [0x140103320]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x1400acebe
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.1400b0650
xor eax, eax
jmp 0x1400acece
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400acf20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x1400acf50
mov r8d, 0x40
lea rdx, [0x140103420]
lea rcx, [0x1401034b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x1400acf70
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x1400acfa5
mov r8d, 0x46
lea rdx, [0x140103500]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b07a0
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140109720]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x14010c032]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x20
jmp 0x1400b0805
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x1400b0a09
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x14010bd78]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x1400b0836
jmp 0x1400b07fb
cmp dword [rsp + 0x40], 0x140
jl 0x1400b0912
cmp dword [rsp + 0x40], 0x14e
jg 0x1400b0912
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], 0x69
mov dword [rsp + 0x1e0], 0x6e
mov dword [rsp + 0x1e4], 0x6f
mov dword [rsp + 0x1e8], 0x6a
mov dword [rsp + 0x1ec], 0x6d
mov dword [rsp + 0x1f0], 0x6b
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x1400b092b
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x1400b09a5
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x1400b09b4
jmp 0x1400b07fb
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x14010c032]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1400b07fb
mov rcx, rsp
lea rdx, [0x1400bf6b0]
call fcn.1400b75a0
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400b69d0
add rsp, 0x220
pop rdi
ret
Function at 0x1400b5b10
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140109720]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x14010c948], 0
je 0x1400b5b6b
mov eax, 1
jmp 0x1400b5ceb
mov dword [rsp + 0x20], 0
jmp 0x1400b5b7f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x1400b5bb1
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14010c948], rax
cmp qword [0x14010c948], 0
je 0x1400b5baf
jmp 0x1400b5bb1
jmp 0x1400b5b75
cmp qword [0x14010c948], 0
jne 0x1400b5bd3
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400a6490
xor eax, eax
jmp 0x1400b5ceb
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c950], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c958], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c960], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c968], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c970], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c978], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x14010c948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010c980], rax
cmp qword [0x14010c950], 0
je 0x1400b5ccc
cmp qword [0x14010c960], 0
je 0x1400b5ccc
cmp qword [0x14010c968], 0
je 0x1400b5ccc
cmp qword [0x14010c970], 0
je 0x1400b5ccc
cmp qword [0x14010c978], 0
je 0x1400b5ccc
cmp qword [0x14010c980], 0
jne 0x1400b5ce6
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400a6490
call fcn.1400b5d20
xor eax, eax
jmp 0x1400b5ceb
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400bfdd0]
call fcn.1400b75a0
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b69d0
add rsp, 0x70
pop rdi
ret

Function at 0x1400b7998
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b79e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b79e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b79e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b79e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b79e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b79e4
xor al, al
add rsp, 0x28
ret
Function at 0x140001080
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rdx, [0x140001070]
movabs rax, 0x140001070
cmp rdx, rax
je 0x1400010ad
lea rcx, [0x140002260]
call fcn.140001010
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [0x140002278]
call fcn.140001010
call fcn.1400010f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [0x140002290]
call fcn.140001010
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400019f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a40
xor al, al
add rsp, 0x28
ret