joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020c30
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.10020ea0
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 4], 1
nop dword [eax + eax]
movsd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 1
call fcn.10107c60
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
nop dword [eax + eax]
rdtsc
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
test eax, eax
jle 0x10020ca7
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
add esp, 8
sub esi, 1
jne 0x10020c94
rdtsc
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.100fbbf0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
movsd qword [ebp - 0xc], xmm0
call fcn.100fbbf0
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
subsd xmm1, xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
test eax, eax
je 0x10020cfc
push 1
sub esp, 8
movsd qword [esp], xmm1
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm1, qword [ebp - 0xc]
add esp, 0x10
xorps xmm0, xmm0
comisd xmm0, xmm1
ja 0x10020c54
cmp dword [ebp - 0x10], 0
jne 0x10020d1a
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmm1
jbe 0x10020d1f
movsd qword [ebp - 0x20], xmm1
mov dword [ebp - 0x10], 0
call fcn.10107c60
sub eax, dword [ebp - 0x18]
movd xmm0, eax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x1011f3d0]
test eax, eax
je 0x10020d61
push 1
sub esp, 8
movsd qword [esp], xmm0
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm0, qword [ebp - 0xc]
add esp, 0x10
comisd xmm0, xmmword [0x1019f1c8]
ja 0x10020d7b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 8
jl 0x10020c80
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmmword [0x1011f3d8]
jae 0x10020da0
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
add eax, eax
mov dword [ebp - 4], eax
jne 0x10020c60
jmp 0x10020c54
push 0
push dword [ebp + 0xc]
call fcn.10020ea0
movd xmm0, dword [ebp - 4]
add esp, 8
movsd xmm1, qword [ebp - 0x20]
cvtdq2pd xmm0, xmm0
pop edi
pop esi
pop ebx
divsd xmm1, xmm0
movsd qword [ebp - 0x30], xmm1
fld qword [ebp - 0x30]
mov esp, ebp
pop ebp
ret
Function at 0x100232c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
ret

Function at 0x100f2270
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x101ab9c0], 0
jne 0x100f231d
push 0x2220
push 0
push 0x101ab9c0
call fcn.100fd2b0
movq xmm0, qword [0x101a6dc0]
add esp, 0xc
mov eax, dword [0x101a6dc8]
movq qword [0x101ab9c4], xmm0
mov dword [0x101ab9cc], eax
call fcn.100f3a70
test eax, eax
je 0x100f2323
push 0x101acc6c
call fcn.100f2a60
add esp, 4
test eax, eax
je 0x100f2323
push 0x101acc5c
call fcn.100f2a80
add esp, 4
test eax, eax
je 0x100f2323
push 0x101acc64
call fcn.100f2a80
add esp, 4
test eax, eax
je 0x100f2323
push 0x101adbe0
push 0x101acc5c
call fcn.100f2b30
add esp, 8
call fcn.100f2d60
mov dword [0x101ab9c0], 1
call fcn.100f51f0
mov dword [0x101acc88], eax
mov dword [0x101acc8c], edx
call fcn.100f28c0
mov eax, 1
ret
call fcn.100f2340
xor eax, eax
ret
Function at 0x100f2a10
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x101ab9c0], 0
jne 0x100f2a29
push 0
push 0x10001
call fcn.100f1f70
add esp, 8
ret
jmp 0x100f5bf0
sub esp, 0x40
mov eax, dword [0x101a7664]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [esp + 0x10]
push 1
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x100f5c6a
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x14], 0x12
jne 0x100f5c49
mov esi, dword [0x101abd88]
test esi, esi
je 0x100f5c57
push esi
call fcn.100f24a0
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x100f5c38
jmp 0x100f5c57
lea eax, [esp + 0x10]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
call ebp
push 1
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
jne 0x100f5c27
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x100f5cdb
push str.GLFW
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, eax
test ebx, ebx
je 0x100f5cdb
movaps xmm0, xmmword [0x10157260]
xor esi, esi
movups xmmword [esp + 0x2c], xmm0
movaps xmm0, xmmword [0x10157270]
movups xmmword [esp + 0x3c], xmm0
mov edi, dword [esp + esi*8 + 0x30]
push dword [esp + esi*8 + 0x2c]
movsx ebp, word [edi*2 + 0x101ad0d8]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100f5cd5
cmp byte [edi + ebx + 0x74], 1
jne 0x100f5cd5
call fcn.100f6d80
push eax
push 0
push ebp
push edi
push ebx
call fcn.100f2f60
add esp, 0x14
inc esi
cmp esi, 4
jl 0x100f5ca0
mov esi, dword [0x101ada78]
test esi, esi
je 0x100f5d56
lea eax, [esp + 0x2c]
push eax
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp dword [esi + 0x2d8], edi
jne 0x100f5d1c
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 0x2dc], eax
je 0x100f5d56
mov eax, ebx
mov dword [esp + 0x2c], edi
cdq
sub eax, edx
mov dword [esi + 0x2d8], edi
sar eax, 1
mov dword [esp + 0x30], eax
mov dword [esi + 0x2dc], eax
lea eax, [esp + 0x2c]
push eax
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100fb279
add esp, 0x40
ret

Function at 0x100f2a80
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x100f2aa7
push 0x1013e6d0
push 0x10008
call fcn.100f3820
add esp, 8
xor eax, eax
ret
mov dword [ecx], 1
mov eax, 1
ret
Function at 0x100f3f10
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x164
mov eax, dword [0x101a7664]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
push 0x100
lea eax, [esp + 0x74]
push 0
push eax
call fcn.100fd2b0
push 0x6d1
push 0
push 0x101ad392
call fcn.100fd2b0
mov eax, 0x101ad432
lea ebx, [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0x10], eax
mov esi, 0x20
sub ebx, 0x480
movsx edi, word [esi*2 + 0x101ad0d8]
cmp edi, 0xffffffff
je 0x100f406d
cmp esi, 0x140
jb 0x100f400a
cmp esi, 0x14e
ja 0x100f400a
mov dword [esp + 0x14], 0x60
mov dword [esp + 0x18], 0x61
mov dword [esp + 0x1c], 0x62
mov dword [esp + 0x20], 0x63
mov dword [esp + 0x24], 0x64
mov dword [esp + 0x28], 0x65
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], 0x67
mov dword [esp + 0x34], 0x68
mov dword [esp + 0x38], 0x69
mov dword [esp + 0x3c], 0x6e
mov dword [esp + 0x40], 0x6f
mov dword [esp + 0x44], 0x6a
mov dword [esp + 0x48], 0x6d
mov dword [esp + 0x4c], 0x6b
mov ebp, dword [ebx]
jmp 0x100f4015
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x100f4046
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x100f4069
push 0
push 0
push 5
push dword [esp + 0x1c]
lea eax, [esp + 0x60]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
inc esi
add eax, 5
add ebx, 4
mov dword [esp + 0x10], eax
cmp esi, 0x15c
jle 0x100f3f65
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100fb279
add esp, 0x164
ret
Function at 0x100f4350
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101a7664]
xor eax, esp
mov dword [esp + 0x18], eax
push 0x101accc0
push 0x101ab9c0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x100f4397
push 0x10156cc0
push 0x10008
call fcn.100f3820
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100fb279
add esp, 0x1c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebx
mov dword [0x101adaa0], eax
test eax, eax
jne 0x100f43d2
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.100f3820
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100fb279
add esp, 0x1c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x101adaa0]
mov dword [0x101adaa4], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x101adaa0]
mov dword [0x101adaa8], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x101adaa0]
mov dword [0x101adaac], eax
call edi
push str.GetDpiForWindow
push dword [0x101adaa0]
mov dword [0x101adab0], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x101adaa0]
mov dword [0x101adab4], eax
call edi
push str.GetSystemMetricsForDpi
push dword [0x101adaa0]
mov dword [0x101adab8], eax
call edi
push str.dinput8.dll
mov dword [0x101adabc], eax
call ebx
mov dword [0x101ada88], eax
test eax, eax
je 0x100f446f
push str.DirectInput8Create
push eax
call edi
mov dword [0x101ada8c], eax
push esi
mov dword [esp + 0xc], str.xinput1_4.dll
xor esi, esi
mov dword [esp + 0x10], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [esp + 0x14], str.xinput9_1_0.dll
mov dword [esp + 0x18], str.xinput1_2.dll
mov dword [esp + 0x1c], str.xinput1_1.dll
mov dword [esp + 0x20], 0
push eax
call ebx
mov dword [0x101ada94], eax
test eax, eax
jne 0x100f44be
mov eax, dword [esp + esi*4 + 0x10]
inc esi
test eax, eax
jne 0x100f44a7
jmp 0x100f44dd
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x101ada94]
mov dword [0x101ada98], eax
call edi
mov dword [0x101ada9c], eax
push str.dwmapi.dll
call ebx
mov dword [0x101adac0], eax
pop esi
test eax, eax
je 0x100f4531
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x101adac0]
mov dword [0x101adac4], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x101adac0]
mov dword [0x101adac8], eax
call edi
push str.DwmGetColorizationColor
push dword [0x101adac0]
mov dword [0x101adacc], eax
call edi
mov dword [0x101adad0], eax
push str.shcore.dll
call ebx
mov dword [0x101adad4], eax
test eax, eax
je 0x100f4560
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x101adad4]
mov dword [0x101adad8], eax
call edi
mov dword [0x101adadc], eax
push str.ntdll.dll
call ebx
mov dword [0x101adae0], eax
test eax, eax
je 0x100f457d
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x101adae4], eax
mov ecx, dword [esp + 0x20]
mov eax, 1
pop edi
pop ebx
xor ecx, esp
call fcn.100fb279
add esp, 0x1c
ret
Function at 0x100f57f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push ebp
push esi
call fcn.100f6590
add esp, 0xc
test eax, eax
je 0x100f5921
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x100f5894
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x100f583d
call fcn.100f9150
test eax, eax
je 0x100f5921
push ebx
push edi
push esi
call fcn.100f8d40
jmp 0x100f5877
cmp eax, 0x36002
jne 0x100f585b
call fcn.100fa380
test eax, eax
je 0x100f5921
push ebx
push edi
push esi
call fcn.100f9ef0
jmp 0x100f5877
cmp eax, 0x36003
jne 0x100f5882
call fcn.100faee0
test eax, eax
je 0x100f5921
push ebx
push edi
push esi
call fcn.100facc0
add esp, 0xc
test eax, eax
je 0x100f5921
push edi
push esi
call fcn.100f1710
add esp, 8
test eax, eax
je 0x100f5921
cmp dword [esi + 0x3c], 0
je 0x100f58f4
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.100f6350
push esi
call fcn.100f6c60
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x100f5917
push esi
call fcn.100f2cd0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0x10], 0
je 0x100f5917
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x100f5917
push esi
call fcn.100f59e0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100f6a40
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x14
mov eax, dword [0x101a7664]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
mov dword [0x101ada78], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100f6a9e
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [esp + 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x101ada68], xmm0
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x101ada70], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x100f6ac3
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x100f6ab3
push dword [eax + 4]
jmp 0x100f6ac5
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x100f6ac5
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.100f2cd0
add esp, 4
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x100f6b5a
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x14], 0x20001
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x100f6b5a
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.100f3820
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.100fb279
add esp, 0x14
ret

Function at 0x100f6b70
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x1e8], 0
je 0x100f6bbe
push 0xc
push 1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x20001
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x100f6bbe
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.100f3820
add esp, 8
push 0
mov dword [0x101ada78], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x101ada70]
cvttsd2si ecx, qword [0x101ada68]
mov dword [esp + 8], eax
mov dword [esi + 0x2dc], eax
lea eax, [esp + 4]
push eax
push dword [esi + 0x2ac]
mov dword [esp + 0xc], ecx
mov dword [esi + 0x2d8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x68], 0x34001
jne 0x100f6c4a
mov eax, dword [esi + 0x40]
test eax, eax
je 0x100f6c31
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
Function at 0x100f6d80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebp
movzx esi, ax
push 0x11
shr esi, 0xf
call ebp
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebp
mov ebx, edi
or ebx, 4
test ax, ax
push 0x5c
cmovns ebx, edi
call ebp
push 0x5b
mov si, ax
call ebp
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
call ebp
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebp
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret
Function at 0x100faee0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x10
mov eax, dword [0x101a7664]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [0x101adbbc], 0
mov dword [esp], str.libOSMesa.dll
mov dword [esp + 4], str.OSMesa.dll
mov dword [esp + 8], 0
je 0x100faf22
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100fb279
add esp, 0x10
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov ecx, eax
mov dword [0x101adbbc], ecx
test ecx, ecx
jne 0x100faf72
mov eax, dword [esp + esi*4 + 0xc]
inc esi
test eax, eax
jne 0x100faf31
test ecx, ecx
jne 0x100faf72
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.100f1f70
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100fb279
add esp, 0x10
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push ecx
call esi
push str.OSMesaCreateContextAttribs
push dword [0x101adbbc]
mov dword [0x101adbc0], eax
call esi
push str.OSMesaDestroyContext
push dword [0x101adbbc]
mov dword [0x101adbc4], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x101adbbc]
mov dword [0x101adbc8], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x101adbbc]
mov dword [0x101adbcc], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x101adbbc]
mov dword [0x101adbd0], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x101adbbc]
mov dword [0x101adbd4], eax
call esi
cmp dword [0x101adbc0], 0
mov dword [0x101adbd8], eax
je 0x100fb038
cmp dword [0x101adbc8], 0
je 0x100fb038
cmp dword [0x101adbcc], 0
je 0x100fb038
cmp dword [0x101adbd0], 0
je 0x100fb038
cmp dword [0x101adbd4], 0
je 0x100fb038
test eax, eax
je 0x100fb038
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100fb279
add esp, 0x10
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.100f1f70
mov eax, dword [0x101adbbc]
add esp, 8
test eax, eax
je 0x100fb064
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x101adbbc], 0
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.100fb279
add esp, 0x10
ret

Function at 0x1010a20f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1010a24e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010a24e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010a24e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1010a24e
cmp dword [ecx + 0x74], 0xe
jbe 0x1010a24e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1010cd1c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1015b128
push 0x1015b120
push str.FlsAlloc
push 0x1f
call fcn.1010cbdb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010cd50
push dword [ebp + 8]
mov ecx, esi
call dword [0x1011f308]
call esi
jmp 0x1010cd56
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1010cd9a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1015b138
push 0x1015b130
push str.FlsGetValue
push 0x21
call fcn.1010cbdb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010cdd1
push dword [ebp + 8]
mov ecx, esi
call dword [0x1011f308]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1010cdd9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1015b140
push 0x1015b138
push str.FlsSetValue
push 0x22
call fcn.1010cbdb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010ce13
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1011f308]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1010d9f1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100fbc70
mov eax, dword [0x101a7664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10102722
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1010da33
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1010db8f
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1011bd30
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x101ae568]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1010d609
mov ecx, dword [esi*4 + 0x101ae568]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1010db88
cmp eax, dword [ecx + edi + 0x24]
jne 0x1010db88
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1010db88
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1010d609
add esp, 0x14
test edx, edx
jl 0x1010db88
jg 0x1010dafe
test eax, eax
jb 0x1010db88
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1010db88
jl 0x1010db18
cmp dword [ebp - 0x1008], eax
ja 0x1010db88
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1010db36
test ebx, ebx
je 0x1010db6f
cmp ecx, edi
jae 0x1010db6f
mov al, byte [ecx]
cmp al, 0xd
jne 0x1010db50
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1010db5c
cmp byte [ecx + 1], 0xa
jne 0x1010db5c
inc ecx
jmp 0x1010db5c
movzx eax, al
movsx eax, byte [eax + 0x101a7870]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1010db36
cmp edx, ebx
jne 0x1010db36
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1010db8d
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100fb279
leave
ret