joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1160
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5d1235
movdqa xmm0, xmmword [0x00764030]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5d11a1
movdqa xmm0, xmmword [0x00764040]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5d12b7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5d128b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00763cb8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00764050]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5dca60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5dcbfb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5dca81
inc rcx
cmp rbx, rcx
jle 0x5dcbf1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5dca7e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
call fcn.004dfce0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rdi
mov rdx, qword [0x00bada38]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005d9240
mov rdx, qword [rsp + 0x50]
test rdx, rdx
mov rdx, qword [rsp + 0x58]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x68]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5dcbe5
test rdx, rdx
je 0x5dcbda
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x00c4bbb8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5dcba9
xor eax, eax
lea rbx, [0x00762148]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006df3d7]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x58]
call fcn.00447ce0
jmp 0x5dcbd0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007622a0]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
call fcn.00447c20
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005dca60
Function at 0x61cc00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61cd02
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00564680
test rdi, rdi
jne 0x61cc53
mov rbx, qword [0x00bc47e8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0068ca20]
call fcn.00411580
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x78]
call fcn.0061cba0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x00c4bbb8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x61ccd5
xor eax, eax
lea rbx, [0x00762148]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006df3d7]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x50]
call fcn.00447ce0
jmp 0x61ccfc
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007622a0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
call fcn.00447c20
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045a0c0
mov rax, qword [rsp + 8]
jmp fcn.0061cc00
Function at 0x14000cdc4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000cb08
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000ce1a
mov ecx, 1
call fcn.14000cb08
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov dl, 0xca
loope 0x1400253c2
sub esi, dword [rdi]
invalid
sub byte [rsi + rsi*8 - 0x22], bh
mov ebx, 0x8b4bf19d
sub eax, 0x4bcb6769
or ebx, 4
xchg esp, eax
mov ch, 0x72
mov ebp, dword [rsp + rdx*4 - 0x4f]
xchg esp, eax
cmp byte [rsi - 0x751f9c7d], ah
stosb byte [rdi], al
jne 0x140025428
invalid
invalid
Function at 0x1800015a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test ecx, ecx
je 0x180001622
cmp qword [0x180034d28], 0
jne 0x180001663
lea rcx, str.SetHook_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x180022f80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor r9d, r9d
lea rdx, [0x180001580]
mov r8, rax
lea ecx, [r9 + 5]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x180034d28], rax
test rax, rax
jne 0x180001600
lea rcx, str.SetHook_SetWindowsHookEx_WH_CBT_fail___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, str.ISR_C5333BDF_7B2B_41A7_8AC5_A85E8D58D42F_GAME64
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x180034d30], rax
xor eax, eax
add rsp, 0x28
ret
cmp qword [0x180034d28], 0
je 0x180001651
lea rcx, str.UnhookWindowsHookEx_WH_CBT___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x180034d28]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [0x180034d28], 0
mov rcx, qword [0x180034d30]
test rcx, rcx
je 0x180001663
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800018c0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [0x180034e38], 0
je 0x180001916
mov rcx, qword [0x180034e48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x180034e38]
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180001909
mov rcx, qword [0x180034e38]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x180034e38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180034e48]
test rcx, rcx
je 0x180001928
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180034e40]
test rcx, rcx
je 0x18000193a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [0x180034d80]
mov edi, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add rbx, 0x28
sub rdi, 1
jne 0x180001946
lea rcx, [0x180034df8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor edx, edx
lea rcx, [0x180034d80]
mov r8d, 0xe8
call fcn.18000ee40
mov rcx, qword [0x180034d68]
xor ebx, ebx
test rcx, rcx
je 0x180001995
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [0x180034d68], rbx
mov rcx, qword [0x180034d70]
test rcx, rcx
je 0x1800019ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180034d70], rbx
mov rcx, qword [0x180034a40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x180034b74], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180001c60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, r9d
lea rcx, str.capture_init_shtex
mov esi, r8d
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, rbx
mov ecx, 4
call fcn.1800026d0
test al, al
jne 0x180001cb2
lea rcx, str.capture_init_shtex:_Failed_to_initialize_memory
call fcn.1800023b0
xor al, al
jmp 0x180001d8a
mov rcx, qword [0x180034d68]
mov eax, dword [rsp + 0x60]
mov qword [r14], rcx
mov dword [rcx], eax
mov rax, qword [0x180034a30]
mov ecx, dword [rsp + 0x50]
mov dword [rax], 1
mov rax, qword [0x180034a30]
mov dword [rax + 4], 4
mov rax, qword [0x180034a30]
mov dword [rax + 0xc], ebx
mov rax, qword [0x180034a30]
mov dword [rax + 8], 1
mov rax, qword [0x180034a30]
mov dword [rax + 0x10], ecx
mov rax, qword [0x180034a30]
movzx ecx, byte [rsp + 0x58]
mov byte [rax + 0x30], cl
mov rcx, qword [0x180034a30]
mov eax, dword [0x180034d54]
mov dword [rcx + 0x28], eax
mov rax, qword [0x180034a30]
mov dword [rax + 0x2c], 4
mov rax, qword [0x180034a30]
mov dword [rax + 0x14], esi
mov rax, qword [0x180034a30]
mov dword [rax + 0x18], edi
mov rax, qword [0x180034a30]
mov dword [rax + 0x1c], esi
mov rax, qword [0x180034a30]
mov dword [rax + 0x20], edi
mov rcx, qword [0x180034a50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x180001d81
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.capture_init_shtex:_Failed_to_signal_ready:__d
call fcn.1800023b0
xor al, al
jmp 0x180001d8a
mov byte [0x180034b74], 1
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1800023b0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x180034018]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rdi, [r11 + 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.18000ee40
call fcn.180001850
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.180014df4
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
test eax, eax
jle 0x180002460
movsxd r8, eax
lea rdx, [rsp + 0x30]
inc r8
lea rcx, [0x180034a38]
call fcn.18000d7c0
test al, al
jne 0x180002455
lea rcx, [0x180034a38]
call fcn.18000d6b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.18000db30
add rsp, 0x448
pop rdi
pop rbx
ret
Function at 0x180002650
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180034018]
xor rax, rsp
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, str.CaptureHook_Pipe_64
lea rdx, str._s_lu
lea rcx, [rsp + 0x20]
call fcn.180003690
lea rdx, [rsp + 0x20]
lea rcx, [0x180034a38]
call fcn.18000d6e0
test al, al
jne 0x1800026ba
lea rcx, str.Failed_to_open_pipe_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000db30
add rsp, 0x78
ret
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000db30
add rsp, 0x78
ret
Function at 0x180003b70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
mov qword [rcx], rax
mov rbx, rdx
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
lea r8d, [rax + 0x40]
mov qword [rcx + 0x20], r9
lea rcx, [rdx - 5]
lea edx, [rax + 0x13]
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [rbx]
movsd qword [rdi + 0x30], xmm0
mov eax, dword [rbx + 8]
mov dword [rdi + 0x38], eax
movzx eax, word [rbx + 0xc]
mov rbx, qword [rsp + 0x38]
mov word [rdi + 0x3c], ax
add rsp, 0x20
pop rdi
ret

Function at 0x180003bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x2d], 0
mov rbx, rcx
je 0x180003c75
cmp dword [rcx + 0x28], 2
mov qword [rsp + 0x38], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x40], rdi
mov edi, 5
jne 0x180003c1e
add rsi, 0xfffffffffffffffb
jmp 0x180003c2b
cmp byte [rcx + 0x2c], 0
mov eax, 0xe
cmovne rdi, rax
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbx + 0x3e]
mov r8, rdi
mov rdx, rsi
call fcn.18000ea30
cmp dword [rbx + 0x28], 0
mov rsi, qword [rsp + 0x38]
jne 0x180003c6c
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x30]
mov r8, rdi
call fcn.18000ea30
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x2d], 0
add rsp, 0x20
pop rbx
ret

Function at 0x180003c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x180034018]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r10, rcx
lea rcx, [rsp + 0x30]
sub rcx, rdx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180003cb0
xor eax, eax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
cmp byte [rsp + 0x30], al
je 0x180003d17
mov ecx, eax
test eax, eax
jns 0x180003cd9
lea ecx, [rax + 1]
sar ecx, 1
mov r8d, eax
movsxd rcx, ecx
movzx edx, byte [rsp + rcx + 0x20]
movzx ecx, dl
and dl, 0xf
shr cl, 4
and r8b, 1
movzx edx, dl
lea r8d, [rax + 1]
movzx ecx, cl
cmovne edx, ecx
xor byte [r9], dl
mov edx, eax
xor eax, eax
inc r9
cmp edx, 0xf
cmovne eax, r8d
cmp byte [r9], 0
jne 0x180003cd0
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000db30
add rsp, 0xc8
ret
Function at 0x180004000
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov edx, dword [0x1800350e4]
mov ebx, ecx
mov ecx, 0x8ca9
call qword [0x180034f18]
call qword [0x180034e98]
test eax, eax
je 0x18000402f
lea r8, str.failed_to_bind_FBO
jmp 0x180004133
mov edx, ebx
mov ecx, 0xde1
call qword [0x180034f00]
call qword [0x180034e98]
test eax, eax
je 0x180004052
lea r8, str.failed_to_bind_texture
jmp 0x180004133
mov edx, 0x8ce0
mov dword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0xde1
lea ecx, [rdx - 0x37]
call qword [0x180034f28]
call qword [0x180034e98]
test eax, eax
je 0x180004087
lea r8, str.failed_to_set_frame_buffer
jmp 0x180004133
mov ecx, 0x405
call qword [0x180034e80]
call qword [0x180034e98]
cmp eax, 0x502
jne 0x1800040ba
lea rdx, str.Darkest.exe
lea rcx, [0x180034b80]
call fcn.18001504c
test eax, eax
jne 0x1800040ba
mov al, 1
jmp 0x1800040bc
xor al, al
mov ecx, 0x8ce0
mov byte [0x1800350c0], al
call qword [0x180034e88]
call qword [0x180034e98]
test eax, eax
je 0x1800040e0
lea r8, str.failed_to_set_draw_buffer
jmp 0x180004133
mov r9d, dword [0x1800350dc]
xor edx, edx
mov r8d, dword [0x1800350d8]
xor ecx, ecx
mov dword [rsp + 0x48], 0x2601
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [0x180034f20]
call qword [0x180034e98]
test eax, eax
je 0x18000414e
lea r8, str.failed_to_blit
mov r9d, eax
lea rdx, str.gl_copy_backbuffer
lea rcx, str._s:__s:__lu
add rsp, 0x50
pop rbx
jmp fcn.1800023b0
add rsp, 0x50
pop rbx
ret
Function at 0x180004160
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call fcn.1800018c0
cmp byte [0x1800350e8], 0
je 0x18000421f
mov rdx, qword [0x180035120]
test rdx, rdx
je 0x18000418f
mov rcx, qword [0x180035118]
call qword [0x180034f50]
mov rcx, qword [0x180035118]
test rcx, rcx
je 0x1800041a1
call qword [0x180034f40]
cmp dword [0x180035138], 0
je 0x1800041bc
lea rdx, [0x180035138]
mov ecx, 1
call qword [0x180034ed0]
mov rcx, qword [0x180035108]
test rcx, rcx
je 0x1800041ce
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035100]
test rcx, rcx
je 0x1800041e0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1800350f8]
test rcx, rcx
je 0x1800041f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035110]
test rcx, rcx
je 0x180004204
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035130]
test rcx, rcx
je 0x1800042b6
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1800042b6
mov qword [rsp + 0x30], rbx
lea rbx, [0x18003510c]
mov qword [rsp + 0x38], rbp
lea rbp, [0x18003511b]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rdi
xor edi, edi
mov edx, dword [rbx - 0xc]
test edx, edx
je 0x180004282
cmp byte [rdi + rbp], 0
je 0x180004273
mov ecx, 0x88eb
call qword [0x180034ef8]
mov ecx, 0x88eb
call qword [0x180034ef0]
xor edx, edx
mov ecx, 0x88eb
call qword [0x180034ef8]
lea rdx, [rbx - 0xc]
mov ecx, 1
call qword [0x180034ec8]
cmp dword [rbx], 0
je 0x180004295
mov rdx, rbx
mov ecx, 1
call qword [0x180034ed0]
inc rdi
add rbx, 4
cmp rdi, 3
jb 0x180004243
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp dword [0x1800350e4], 0
je 0x1800042d1
lea rdx, [0x1800350e4]
mov ecx, 1
call qword [0x180034f10]
call qword [0x180034e98]
test eax, eax
je 0x1800042f8
mov r9d, eax
lea r8, str.GL_error_occurred_on_free
lea rdx, str.gl_free
lea rcx, str._s:__s:__lu
call fcn.1800023b0
xorps xmm0, xmm0
lea rcx, str.___________________gl_capture_freed___________________
movups xmmword [0x1800350d0], xmm0
movups xmmword [0x1800350e0], xmm0
movups xmmword [0x1800350f0], xmm0
movups xmmword [0x180035100], xmm0
movups xmmword [0x180035110], xmm0
movups xmmword [0x180035120], xmm0
movups xmmword [0x180035130], xmm0
add rsp, 0x28
jmp fcn.1800023b0
Function at 0x180005af0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.wglDXSetResourceShareHandleNV
call qword [0x180034ea0]
test rax, rax
jne 0x180005b1a
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXSetResourceShareHandleNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXOpenDeviceNV
mov qword [0x180034f30], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005b47
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXOpenDeviceNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXCloseDeviceNV
mov qword [0x180034f38], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005b74
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXCloseDeviceNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXRegisterObjectNV
mov qword [0x180034f40], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005ba1
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXRegisterObjectNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXUnregisterObjectNV
mov qword [0x180034f48], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005bce
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXUnregisterObjectNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXObjectAccessNV
mov qword [0x180034f50], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005bfb
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXObjectAccessNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXLockObjectsNV
mov qword [0x180034f58], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005c28
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXLockObjectsNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wglDXUnlockObjectsNV
mov qword [0x180034f60], rax
call qword [0x180034ea0]
test rax, rax
jne 0x180005c55
mov rcx, qword [0x1800350c8]
lea rdx, str.wglDXUnlockObjectsNV
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x180034f30], 0
mov qword [0x180034f68], rax
je 0x180005cbe
cmp qword [0x180034f38], 0
je 0x180005cbe
cmp qword [0x180034f40], 0
je 0x180005cbe
cmp qword [0x180034f48], 0
je 0x180005cbe
cmp qword [0x180034f50], 0
je 0x180005cbe
cmp qword [0x180034f58], 0
je 0x180005cbe
cmp qword [0x180034f60], 0
je 0x180005cbe
test rax, rax
je 0x180005cbe
lea rcx, str.Shared_texture_OpenGL_capture_available
mov byte [0x1800350c2], 1
add rsp, 0x28
jmp fcn.1800023b0
mov byte [0x1800350c2], 0
add rsp, 0x28
ret
Function at 0x180006100
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.1800018c0
xor edi, edi
lea rsi, [0x180035220]
mov ebx, edi
nop
mov rcx, qword [rbx + rsi]
test rcx, rcx
je 0x180006132
call fcn.180014e04
mov qword [rbx + rsi], rdi
add rbx, 8
cmp rbx, 0x18
jb 0x180006120
xorps xmm0, xmm0
lea rcx, str.__________________d3d8_capture_freed__________________
xor eax, eax
movups xmmword [0x1800351f0], xmm0
mov qword [0x180035240], rax
movups xmmword [0x180035200], xmm0
movups xmmword [0x180035210], xmm0
movups xmmword [0x180035220], xmm0
movups xmmword [0x180035230], xmm0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800023b0
Function at 0x180006ca0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
call fcn.1800018c0
cmp byte [0x180035410], 0
lea rdi, [0x1800353f0]
je 0x180006d05
mov rcx, qword [0x180035430]
test rcx, rcx
je 0x180006ccd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035428]
test rcx, rcx
je 0x180006cdf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035420]
test rcx, rcx
je 0x180006cf1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035418]
test rcx, rcx
je 0x180006d53
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180006d53
mov qword [rsp + 0x30], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, qword [rdi + rbx*8 + 0x60]
test rcx, rcx
je 0x180006d35
cmp byte [rdi + rbx + 0x98], 0
je 0x180006d2f
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rdi + rbx*8 + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + rbx*8 + 0x78]
test rcx, rcx
je 0x180006d45
mov rax, qword [rcx]
call qword [rax + 0x10]
inc rbx
cmp rbx, 3
jb 0x180006d10
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0xb0
mov rcx, rdi
call fcn.18000ee40
lea rcx, str.__________________d3d9_capture_freed__________________
add rsp, 0x20
pop rdi
jmp fcn.1800023b0