joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14006a69d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x14006a6a2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14006a6cd
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14006a6cd
mov rcx, qword [rax + 0x388]
test rcx, rcx
je 0x14006a6cd
mov eax, dword [rcx + 8]
mov dword [rsp + 0x28], eax
jmp 0x14006a6d2
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14006a6ec
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x14006a6f1
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], sil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], ax
mov eax, dword [rbp + 0x20]
cmp eax, r8d
jne 0x14006a777
lea ecx, [rax + 1]
test r8d, r8d
je 0x14006a75f
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14006a764
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.14006ba80
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
cdqe
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14006a7b4
lea r8d, [rsi + 1]
mov rcx, rbp
call fcn.14006a650
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14006a7c4
inc esi
jmp 0x14006a680
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14007b650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x70
mov r8, rcx
movaps xmmword [rsp + 0x30], xmm9
movzx ecx, word [rsp + 0xa8]
movaps xmm9, xmm2
mov rsi, rdx
mov qword [rsp + 0x20], r9
movsxd rax, dword [r8 + 0x18]
cmp rcx, rax
jb 0x14007b686
mov rbx, qword [r8 + 0x38]
jmp 0x14007b6aa
mov rax, qword [r8 + 0x20]
movzx ecx, word [rax + rcx*2]
mov eax, 0xffff
cmp cx, ax
jne 0x14007b69e
mov rbx, qword [r8 + 0x38]
jmp 0x14007b6aa
mov rax, qword [r8 + 0x30]
lea rcx, [rcx + rcx*4]
lea rbx, [rax + rcx*8]
test rbx, rbx
je 0x14007b86c
mov ecx, dword [rbx]
test cl, 2
je 0x14007b86c
mov qword [rsp + 0x80], rdi
xorps xmm0, xmm0
mov edi, dword [rsp + 0xa0]
or edi, 0xffffff
movaps xmmword [rsp + 0x60], xmm6
and cl, 1
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm8
cmove edi, dword [rsp + 0xa0]
comiss xmm9, xmm0
jb 0x14007b6ff
divss xmm9, dword [r8 + 0x14]
jmp 0x14007b708
movss xmm9, dword [0x1400db8a0]
cvttss2si eax, dword [rsp + 0x20]
mov edx, 6
mov rcx, rsi
lea r8d, [rdx - 2]
movd xmm6, eax
cvttss2si eax, dword [rsp + 0x24]
cvtdq2ps xmm6, xmm6
movd xmm7, eax
cvtdq2ps xmm7, xmm7
call fcn.140074570
movzx edx, word [rsi + 0x34]
mov rax, qword [rsi + 0x50]
movss xmm8, dword [rbx + 0x24]
movaps xmm1, xmm9
mulss xmm1, dword [rbx + 0x10]
lea ecx, [rdx + 1]
movss xmm4, dword [rbx + 0x20]
movaps xmm3, xmm9
mulss xmm3, dword [rbx + 0x14]
movaps xmm2, xmm9
mulss xmm2, dword [rbx + 8]
addss xmm1, xmm6
mulss xmm9, dword [rbx + 0xc]
addss xmm3, xmm7
movss xmm5, dword [rbx + 0x18]
addss xmm2, xmm6
movss xmm0, dword [rbx + 0x1c]
mov word [rax], dx
addss xmm9, xmm7
mov rax, qword [rsi + 0x50]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rsi + 0x50]
mov word [rax + 4], cx
mov rax, qword [rsi + 0x50]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rsi + 0x50]
mov word [rax + 8], cx
mov rax, qword [rsi + 0x50]
mov word [rax + 0xa], dx
mov rax, qword [rsi + 0x48]
movss dword [rax], xmm2
movss dword [rax + 4], xmm9
mov rax, qword [rsi + 0x48]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x10], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm9
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x1c], xmm4
movss dword [rax + 0x20], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x24], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x28], xmm1
movss dword [rax + 0x2c], xmm3
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x30], xmm4
movss dword [rax + 0x34], xmm8
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x38], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x3c], xmm2
movss dword [rax + 0x40], xmm3
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm8
mov rax, qword [rsi + 0x48]
movaps xmm8, xmmword [rsp + 0x40]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x70
pop rsi
ret
Function at 0x14009a4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14009a506
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14009a4d6
cmp byte [rax], cl
jne 0x14009a502
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14009a4c7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r8]
cmp cl, 0x25
jne 0x14009a4e6
cmp byte [r8 + 1], cl
je 0x14009a4e6
lea r11, [rsp + 0x20]
mov r9, r8
movzx edx, cl
nop dword [rax]
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14009a53d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14009a565
sub dl, 0x61
cmp dl, 0x19
ja 0x14009a557
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14009a565
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14009a520
jmp 0x14009a568
inc r9
cmp r8, r9
jae 0x14009a59f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14009a594
bt rdx, rax
jb 0x14009a59a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14009a580
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140048300
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14009a5d8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14009a5d0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14009a65b
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14009a5fa
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x14009a608
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x14009a646
movss xmm2, dword [0x1400db940]
nop
cmp al, 0x39
ja 0x14009a646
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14009a620
cmp r9b, 0x2d
jne 0x14009a668
xorps xmm1, xmmword [0x1400dc0c0]
movaps xmm0, xmm1
jmp 0x14009a4e9
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14009a4e9
Function at 0x14009a670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14009a6d6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14009a6a6
cmp byte [rax], cl
jne 0x14009a6d2
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14009a697
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r8]
cmp cl, 0x25
jne 0x14009a6b6
cmp byte [r8 + 1], cl
je 0x14009a6b6
lea r11, [rsp + 0x20]
mov r9, r8
movzx edx, cl
nop dword [rax]
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14009a70d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14009a735
sub dl, 0x61
cmp dl, 0x19
ja 0x14009a727
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14009a735
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14009a6f0
jmp 0x14009a738
inc r9
cmp r8, r9
jae 0x14009a76f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14009a764
bt rdx, rax
jb 0x14009a76a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14009a750
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140048300
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14009a7a8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14009a7a0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14009a829
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14009a7ca
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x14009a7d8
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x14009a814
movsd xmm2, qword [0x1400db8f0]
nop
cmp al, 0x39
ja 0x14009a814
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14009a7f0
cmp r9b, 0x2d
jne 0x14009a832
xorps xmm1, xmmword [0x1400dc0b0]
movaps xmm0, xmm1
jmp 0x14009a6b9
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14009a6b9
Function at 0x1400a1ab0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1400f04e0], 0
jne 0x1400a1ac5
xor edx, edx
mov ecx, 0x10001
jmp fcn.1400a61f0
jmp 0x1400a36d0
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400a376a
nop word [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x1400a3735
mov rbx, qword [0x1400f08d0]
test rbx, rbx
je 0x1400a374b
mov rcx, rbx
call fcn.1400a1270
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400a3723
jmp 0x1400a374b
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400a3710
call qword [sym.imp.USER32.dll_GetActiveWindow]
test rax, rax
je 0x1400a3867
lea rdx, str.GLFW
mov qword [rsp + 0xc0], rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rdi, rax
test rax, rax
je 0x1400a385f
movdqa xmm0, xmmword [0x1400b1e60]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400b1e70]
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
lea r15, [0x1400f1838]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
nop word [rax + rax]
movsxd rbp, dword [rsp + rbx*8 + 0x64]
mov ecx, dword [rsp + rbx*8 + 0x60]
movsx r14d, word [r15 + rbp*2]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x1400a382e
cmp byte [rbp + rdi + 0x80], 1
jne 0x1400a382e
call fcn.1400a4e80
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov edx, ebp
mov rcx, rdi
call fcn.14009f6c0
inc rbx
cmp rbx, 4
jl 0x1400a37f0
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [0x1400f21d8]
test rbx, rbx
je 0x1400a38e9
mov rcx, qword [rbx + 0x348]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cmp dword [rbx + 0x380], eax
jne 0x1400a38ad
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp dword [rbx + 0x384], eax
je 0x1400a38e9
mov eax, r8d
mov dword [rsp + 0x60], ecx
cdq
mov dword [rbx + 0x380], ecx
mov rcx, qword [rbx + 0x348]
sub eax, edx
sar eax, 1
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov dword [rbx + 0x384], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0xa0
pop rbx
ret

Function at 0x1400a2c80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1400f04e0], 0
jne 0x1400a2ca0
xor edx, edx
mov ecx, 0x10001
call fcn.1400a61f0
xor eax, eax
add rsp, 0x28
ret
lea rcx, [0x1400f137c]
add rsp, 0x28
jmp fcn.1400a8770
Function at 0x1400a36d0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1400f04e0], 0
jne 0x1400a1ac5
xor edx, edx
mov ecx, 0x10001
jmp fcn.1400a61f0
jmp 0x1400a36d0
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400a376a
nop word [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x1400a3735
mov rbx, qword [0x1400f08d0]
test rbx, rbx
je 0x1400a374b
mov rcx, rbx
call fcn.1400a1270
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400a3723
jmp 0x1400a374b
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400a3710
call qword [sym.imp.USER32.dll_GetActiveWindow]
test rax, rax
je 0x1400a3867
lea rdx, str.GLFW
mov qword [rsp + 0xc0], rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rdi, rax
test rax, rax
je 0x1400a385f
movdqa xmm0, xmmword [0x1400b1e60]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400b1e70]
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
lea r15, [0x1400f1838]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
nop word [rax + rax]
movsxd rbp, dword [rsp + rbx*8 + 0x64]
mov ecx, dword [rsp + rbx*8 + 0x60]
movsx r14d, word [r15 + rbp*2]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x1400a382e
cmp byte [rbp + rdi + 0x80], 1
jne 0x1400a382e
call fcn.1400a4e80
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov edx, ebp
mov rcx, rdi
call fcn.14009f6c0
inc rbx
cmp rbx, 4
jl 0x1400a37f0
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [0x1400f21d8]
test rbx, rbx
je 0x1400a38e9
mov rcx, qword [rbx + 0x348]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cmp dword [rbx + 0x380], eax
jne 0x1400a38ad
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp dword [rbx + 0x384], eax
je 0x1400a38e9
mov eax, r8d
mov dword [rsp + 0x60], ecx
cdq
mov dword [rbx + 0x380], ecx
mov rcx, qword [rbx + 0x348]
sub eax, edx
sar eax, 1
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov dword [rbx + 0x384], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0xa0
pop rbx
ret
Function at 0x1400a4bf0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [0x1400f21d8], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400a4c45
mov rcx, qword [rbx + 0x348]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [rsp + 0x40]
movd xmm1, dword [rsp + 0x44]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
movsd qword [0x1400f21c8], xmm0
movsd qword [0x1400f21d0], xmm1
cmp dword [rbx + 0x74], 0x34001
jne 0x1400a4c6f
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400a4c5d
mov rcx, qword [rcx + 8]
jmp 0x1400a4c71
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
jmp 0x1400a4c71
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, rbx
call fcn.14009f470
mov rcx, rbx
call fcn.1400a5010
cmp dword [rbx + 0x1f0], 0
je 0x1400a4cce
mov rax, qword [rbx + 0x348]
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400a4cce
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400ab170
add rsp, 0x30
pop rbx
ret

Function at 0x1400a4ce0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x1f0], 0
mov rbx, rcx
je 0x1400a4d30
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400a4d30
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400ab170
xor ecx, ecx
mov qword [0x1400f21d8], 0
call fcn.1400a5010
cvttsd2si ecx, qword [0x1400f21c8]
lea rdx, [rsp + 0x40]
cvttsd2si eax, qword [0x1400f21d0]
mov dword [rsp + 0x40], ecx
mov dword [rbx + 0x380], ecx
mov rcx, qword [rbx + 0x348]
mov dword [rsp + 0x44], eax
mov dword [rbx + 0x384], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [rbx + 0x74], 0x34001
jne 0x1400a4dc4
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400a4da8
mov rcx, qword [rcx + 8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
Function at 0x1400a4e80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, 0x11
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov esi, 0x8000
or edi, 2
mov ecx, 0x12
and ax, si
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, si
mov ecx, 0x5c
mov esi, edi
or esi, 4
test ax, ax
cmove esi, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, esi
mov ecx, 0x14
or edi, 8
or bx, ax
cmovns edi, esi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ecx, 0x90
or ebx, 0x10
and al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov rsi, qword [rsp + 0x38]
mov ecx, ebx
or ecx, 0x20
and al, 1
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x1400a7270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r10d, r10d
test rdx, rdx
je 0x1400a727b
mov dword [rdx], r10d
test r8, r8
je 0x1400a7283
mov dword [r8], r10d
test r9, r9
je 0x1400a728b
mov dword [r9], r10d
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400a7298
mov dword [rax], r10d
cmp dword [0x1400f04e0], r10d
jne 0x1400a72ad
xor edx, edx
mov ecx, 0x10001
jmp fcn.1400a61f0
mov qword [rsp + 0x28], rax
jmp 0x1400ac3f0
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx + 0x88]
xorps xmm0, xmm0
mov rbx, qword [rsp + 0xa0]
mov r14, rdx
xor eax, eax
mov dword [rsp + 0x20], 0x28
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x44], eax
movups xmmword [rsp + 0x24], xmm0
mov rsi, r9
mov rdi, r8
movups xmmword [rsp + 0x34], xmm0
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
mov edx, dword [rsp + 0x34]
test r14, r14
je 0x1400ac453
mov dword [r14], edx
mov ecx, dword [rsp + 0x38]
test rdi, rdi
je 0x1400ac45e
mov dword [rdi], ecx
test rsi, rsi
je 0x1400ac46b
mov eax, dword [rsp + 0x3c]
sub eax, edx
mov dword [rsi], eax
test rbx, rbx
je 0x1400ac478
mov eax, dword [rsp + 0x40]
sub eax, ecx
mov dword [rbx], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a86c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
jne 0x1400a86f0
lea rdx, [0x1400ce610]
mov ecx, 0x10008
call fcn.1400ab170
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400aac90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1400f2408], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x1400aace5
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400f2408], rax
test rax, rax
jne 0x1400aad28
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x1400aacf0
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400a61f0
jmp 0x1400aae4d
lea rdx, str.OSMesaCreateContextExt
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x1400f2410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaDestroyContext
mov qword [0x1400f2418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x1400f2420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x1400f2428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x1400f2430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2408]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x1400f2438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400f2410], 0
mov qword [0x1400f2440], rax
je 0x1400aae1f
cmp qword [0x1400f2420], 0
je 0x1400aae1f
cmp qword [0x1400f2428], 0
je 0x1400aae1f
cmp qword [0x1400f2430], 0
je 0x1400aae1f
cmp qword [0x1400f2438], 0
je 0x1400aae1f
test rax, rax
je 0x1400aae1f
mov eax, 1
jmp 0x1400aae4f
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400a61f0
mov rcx, qword [0x1400f2408]
test rcx, rcx
je 0x1400aae4d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400f2408], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0x48
ret