joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090290
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
cmp dword [0x140185cd8], 0
mov rsi, rcx
je 0x1400903a1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x140183f98]
mov edi, eax
call qword [0x140183a20]
mov rbx, qword [0x140183fa0]
xor ebp, ebp
mov edx, ebp
test rbx, rbx
je 0x1400902f4
nop word [rax + rax]
cmp dword [rbx], edi
je 0x140090368
mov rdx, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400902e0
mov ecx, 0x18
call qword [fcn.140061120]
mov rbx, rax
test rax, rax
je 0x140090331
mov ecx, 1
lock xadd dword [0x140181b40], ecx
test rax, rax
je 0x140090331
mov rcx, qword [0x140183fa0]
mov qword [rax + 0x10], rcx
mov dword [rax], edi
mov qword [rax + 8], rsi
mov qword [0x140183fa0], rax
mov rcx, qword [0x140183f98]
call qword [0x140183a30]
mov rdi, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x30]
jne 0x14009035b
lea rcx, str.Out_of_memory
call fcn.14005ec50
mov ebp, eax
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test rsi, rsi
je 0x140090373
mov qword [rbx + 8], rsi
jmp 0x140090331
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x140090382
mov qword [rdx + 0x10], rax
jmp 0x140090389
mov qword [0x140183fa0], rax
mov rcx, rbx
call qword [fcn.1400614b0]
mov eax, 0xffffffff
lock xadd dword [0x140181b40], eax
jmp 0x140090331
mov ecx, dword [0x14017e6fc]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400903c5
lea rcx, str.TlsSetValue___failed
add rsp, 0x20
pop rsi
jmp fcn.14005ec50
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140095910
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
xor r10d, r10d
lea rcx, [rsp + 0x22]
mov r8d, r10d
lea r9, [0x140139290]
mov edx, 1
nop dword [rax + rax]
movzx eax, word [r9]
inc r8d
mov word [rcx], ax
lea r9, [r9 + 2]
mov word [rcx - 2], dx
mov dword [rcx + 2], edx
mov qword [rcx + 6], r10
lea rcx, [rcx + 0x10]
cmp r8d, edx
jb 0x140095930
mov r8d, 0x10
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140095973
lea rcx, str.Couldnt_unregister_for_raw_input_events
call fcn.14005ec50
mov rcx, qword [0x140185df0]
test rcx, rcx
je 0x140095985
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
mov rcx, qword [0x140185de8]
test rcx, rcx
je 0x140095997
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [0x140185db0]
mov rcx, qword [0x140185dd8]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp dword [0x140185d90], 0
jne 0x1400959bf
add rsp, 0x38
jmp qword [sym.imp.ole32.dll_CoUninitialize]
add rsp, 0x38
ret
Function at 0x140096d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x70
cmp qword [rcx + 0x48], 0
mov rbx, rcx
jne 0x140096ed6
movups xmm0, xmmword [rcx + 0x20]
mov rcx, qword [rcx]
lea rdx, [rax - 0x18]
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x28], xmm0
mov byte [rax - 0x1a], 0
movaps xmm1, xmmword [rax - 0x28]
movdqa xmmword [rax - 0x18], xmm1
call fcn.1400478d0
test eax, eax
je 0x140096d86
xor edi, edi
jmp 0x140096e71
movzx edx, word [rbx + 0x10]
mov eax, 0x28de
cmp dx, ax
je 0x140096dbd
cmp word [rbx + 0x40], 2
jb 0x140096da2
xor edi, edi
jmp 0x140096e71
movzx eax, word [rbx + 0x42]
cmp ax, 8
ja 0x140096db6
mov ecx, 0x131
bt ecx, eax
jb 0x140096dbd
xor edi, edi
jmp 0x140096e71
mov eax, dword [rbx + 0x3c]
mov r9d, dword [rbx + 0x30]
movzx r8d, word [rbx + 0x12]
mov rcx, qword [rbx]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x98], r14
call fcn.140047320
mov r14d, eax
lea rsi, [0x1401372d0]
xor ebp, ebp
mov rdi, qword [rsi]
cmp dword [rdi + 8], 0
je 0x140096e4c
mov ecx, dword [rbx + 0x3c]
mov edx, r14d
mov eax, dword [rbx + 0x34]
movzx r9d, word [rbx + 0x12]
movzx r8d, word [rbx + 0x10]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rbx + 0x38]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rbx]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
movzx eax, word [rbx + 0x14]
mov word [rsp + 0x20], ax
call qword [rdi + 0x10]
test eax, eax
jne 0x140096e59
inc ebp
add rsi, 8
cmp ebp, 9
jb 0x140096e07
xor edi, edi
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov qword [rbx + 0x48], rdi
test rdi, rdi
je 0x140096eb3
movzx edx, word [rbx + 0x12]
movzx ecx, word [rbx + 0x10]
call qword [rdi + 0x18]
mov rdi, rax
test rax, rax
je 0x140096eb3
mov rcx, qword [rbx]
test rcx, rcx
je 0x140096ea8
call qword [fcn.1400614b0]
mov ecx, 0xffffffff
lock xadd dword [0x140181b40], ecx
mov rcx, rdi
call fcn.140039dc0
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov rdi, qword [rsp + 0x90]
test rax, rax
je 0x140096ed6
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x140096ed6
mov qword [rbx + 0x48], 0
add rsp, 0x70
pop rbx
ret
Function at 0x14009c170
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 0x5c0]
mov qword [rsp + 0x38], rsi
xor esi, esi
mov dword [rbx + 0x38], esi
lea ecx, [rsi + 0x40]
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
mov dword [rbx + 0x50], esi
mov qword [rbx + 0x58], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov dword [rbx + 0x80], 0x40
call qword [fcn.140061120]
test rax, rax
je 0x14009c1c6
mov ecx, 1
lock xadd dword [0x140181b40], ecx
mov qword [rbx + 0x78], rax
lea rdx, [rbx + 0xd4]
mov word [rax], si
mov r8d, 0x10
mov word [rbx + 0x84], si
mov r9d, r8d
mov qword [rbx + 0xa4], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0xc0], rsi
mov dword [rbx + 0xc8], esi
mov qword [rbx + 0xcc], 1
mov qword [rsp + 0x20], rdi
test dl, 3
je 0x14009c236
nop dword [rax + rax]
mov rax, r9
dec r9
test rax, rax
je 0x14009c275
mov byte [rdx], sil
inc rdx
test dl, 3
jne 0x14009c220
mov r10, r9
shr r9, 2
and r10d, 3
test r9, r9
je 0x14009c254
mov rdi, rdx
xor eax, eax
mov rcx, r9
lea rdx, [rdx + r9*4]
rep stosd dword [rdi], eax
sub r10, 1
je 0x14009c272
sub r10, 1
je 0x14009c26c
cmp r10, 1
jne 0x14009c275
mov byte [rdx], sil
inc rdx
mov byte [rdx], sil
inc rdx
mov byte [rdx], sil
lea rdx, [rbx + 0xe4]
test dl, 3
je 0x14009c297
mov rax, r8
dec r8
test rax, rax
je 0x14009c2d6
mov byte [rdx], sil
inc rdx
test dl, 3
jne 0x14009c281
mov r9, r8
shr r8, 2
and r9d, 3
test r8, r8
je 0x14009c2b5
mov rdi, rdx
xor eax, eax
mov rcx, r8
lea rdx, [rdx + r8*4]
rep stosd dword [rdi], eax
sub r9, 1
je 0x14009c2d3
sub r9, 1
je 0x14009c2cd
cmp r9, 1
jne 0x14009c2d6
mov byte [rdx], sil
inc rdx
mov byte [rdx], sil
inc rdx
mov byte [rdx], sil
mov qword [rbx + 0xf4], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0x108], rsi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0x120], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x138], rsi
mov dword [rbx + 0x140], esi
mov qword [rbx + 0x148], rsi
mov qword [rbx + 0x150], 0xffffffffffffffff
mov qword [rbx + 0x158], 0xffffffffffffffff
mov qword [rbx + 0x160], rsi
mov qword [rbx + 0x168], rsi
call fcn.14009c410
lea rax, str.Menu
mov ecx, 0x14
mov qword [str.Application], rax
lea rax, str.Left_Windows
mov qword [str.Left_GUI], rax
lea rax, str.Right_Windows
mov qword [str.Right_GUI], rax
call qword [sym.imp.USER32.dll_GetKeyState]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test al, 1
je 0x14009c3a1
mov eax, 0x2000
or word [0x140184af8], ax
jmp 0x14009c3ad
mov eax, 0xdfff
and word [0x140184af8], ax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x14009c3ca
mov eax, 0x1000
or word [0x140184af8], ax
jmp 0x14009c3d6
mov eax, 0xefff
and word [0x140184af8], ax
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x14009c3f6
mov eax, 0x8000
or word [0x140184af8], ax
add rsp, 0x28
ret
mov eax, 0x7fff
and word [0x140184af8], ax
add rsp, 0x28
ret
Function at 0x14009c410
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x820
lea rcx, [rsp + 0x20]
mov r8d, 0x800
lea rax, [0x1401362a0]
or rax, rcx
lea rdx, [0x1401362a0]
lea rcx, [rsp + 0x20]
call fcn.140119470
xor ebx, ebx
mov qword [rsp + 0x830], rdi
lea rsi, [0x1401392b0]
movsxd rcx, dword [rsi]
test ecx, ecx
je 0x14009c4a7
lea rdi, [rsp + 0x20]
test dword [rdi + rcx*4], 0x40000000
lea rdi, [rdi + rcx*4]
jne 0x14009c4a7
lea eax, [rcx - 0x1e]
cmp eax, 9
jbe 0x14009c4a7
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x14009c4a7
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x14009c4a7
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14009c4a5
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x14009c454
mov r8d, 0x800
lea rdx, [rsp + 0x20]
lea rcx, [0x140184efc]
call fcn.140039560
movdqa xmm0, xmmword [0x1401682d0]
mov rdi, qword [rsp + 0x830]
mov rbx, qword [rsp + 0x838]
movdqa xmmword [0x140184f80], xmm0
mov dword [0x140184f98], 0x30
mov dword [0x140184f74], 0x31
mov dword [0x140184f78], 0x32
mov dword [0x140184f7c], 0x33
mov dword [0x140184f90], 0x38
mov dword [0x140184f94], 0x39
add rsp, 0x820
pop rsi
ret

Function at 0x14009c540
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x150
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
lea ecx, [rdx + 0x20]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test eax, eax
je 0x14009c5be
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rsi
xor esi, esi
mov ebx, esi
nop dword [rax]
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
mov edx, edi
mov ecx, 0x20
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jg 0x14009c5ae
inc ebx
cmp ebx, 5
jl 0x14009c580
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x14009cea0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, word [rcx + 0x100]
mov rbx, rcx
mov esi, 0x3ff
xor ecx, ecx
and edi, esi
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [rbx + 0x100]
xor edx, edx
cmp rax, rcx
je 0x14009cf01
movzx ecx, ax
mov qword [rbx + 0x100], rax
and cx, si
cmp cx, 0x12
je 0x14009cef6
mov ecx, 0x804
cmp ax, cx
lea ecx, [rdx + 1]
jne 0x14009cef8
mov ecx, edx
mov dword [rbx + 0xcc], ecx
mov rcx, rax
cmp dword [rbx + 0x140], edx
jne 0x14009cf1a
mov eax, 0xe0060404
cmp rcx, rax
setne dl
mov dword [rbx + 0xc8], edx
mov rcx, rbx
call fcn.14009d2c0
movzx eax, word [rbx + 0x100]
and eax, esi
cmp edi, eax
je 0x14009cf37
mov rcx, rbx
call fcn.14009d3f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009d390
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp rax, qword [rbx + 0x100]
je 0x14009d3e5
movzx edx, ax
mov qword [rbx + 0x100], rax
mov ecx, 0x3ff
and dx, cx
cmp dx, 0x12
je 0x14009d3dd
mov ecx, 0x804
cmp ax, cx
je 0x14009d3dd
mov eax, 1
mov dword [rbx + 0xcc], eax
add rsp, 0x20
pop rbx
ret
xor eax, eax
mov dword [rbx + 0xcc], eax
add rsp, 0x20
pop rbx
ret
Function at 0x14009d4a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
movzx ebp, word [rcx + 0x100]
mov esi, r8d
mov r12, rdx
mov rdi, rcx
mov edx, esi
mov rcx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rbx, eax
mov r13d, 0xffffffff
lea r15d, [r13 + 2]
test eax, eax
jle 0x14009d535
cmp dword [rdi + 0x80], ebx
jge 0x14009d535
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x14009d50a
call qword [fcn.1400614b0]
mov eax, r13d
lock xadd dword [0x140181b40], eax
mov rcx, rbx
add rcx, 2
cmove rcx, r15
call qword [fcn.140061120]
test rax, rax
je 0x14009d52b
mov ecx, r15d
lock xadd dword [0x140181b40], ecx
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], ebx
mov r9d, dword [rdi + 0x80]
mov edx, esi
mov r8, qword [rdi + 0x78]
mov rcx, r12
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
xor ebx, ebx
mov edx, 0x80
test eax, eax
mov rcx, r12
cmovs eax, ebx
xor r9d, r9d
movsxd rsi, eax
xor r8d, r8d
shr rsi, 1
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movzx ecx, ax
lea eax, [rbp - 0x404]
mov dword [rdi + 0xa4], ecx
test eax, 0xfffffbff
jne 0x14009d5d9
test ecx, ecx
je 0x14009d5d9
movsxd rax, dword [rdi + 0x80]
shr rax, 1
cmp ecx, eax
jge 0x14009d5d9
mov rax, qword [rdi + 0x78]
movzx edx, word [rax]
mov eax, 0x3000
cmp dx, ax
je 0x14009d5ab
cmp dx, 0x20
jne 0x14009d5d9
lea edx, [rcx + 1]
movsxd r8, esi
cmp rdx, r8
jge 0x14009d5d7
nop word [rax + rax]
mov rax, qword [rdi + 0x78]
lea rcx, [rax + rdx*2]
inc rdx
movzx eax, word [rcx]
mov word [rcx - 2], ax
cmp rdx, r8
jl 0x14009d5c0
dec esi
mov rax, qword [rdi + 0x78]
movsxd rcx, esi
mov word [rax + rcx*2], bx
cmp dword [rdi + 0xa4], ebx
jne 0x14009d6b2
test esi, esi
jle 0x14009d6b2
xor r9d, r9d
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov rcx, r12
lea edx, [r9 + 0x10]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd r14, eax
test eax, eax
jle 0x14009d6a7
mov rcx, r14
cmove rcx, r15
call qword [fcn.140061120]
mov rbp, rax
test rax, rax
je 0x14009d639
lock xadd dword [0x140181b40], r15d
mov r9d, r14d
mov r8, rbp
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test r14d, r14d
jle 0x14009d669
mov rcx, rbx
movzx eax, byte [rcx + rbp]
dec al
test al, 0xfd
je 0x14009d669
inc ebx
inc rcx
cmp rcx, r14
jl 0x14009d655
movsxd rcx, ebx
mov edx, ebx
cmp rcx, r14
jge 0x14009d687
movzx eax, byte [rcx + rbp]
dec al
test al, 0xfd
jne 0x14009d687
inc edx
inc rcx
cmp rcx, r14
jl 0x14009d673
cmp ebx, r14d
cmove edx, r14d
mov ebx, edx
test rbp, rbp
je 0x14009d6a7
mov rcx, rbp
call qword [fcn.1400614b0]
lock xadd dword [0x140181b40], r13d
mov r14, qword [rsp + 0x50]
mov dword [rdi + 0xa4], ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a17b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400a1886
mov rax, qword [rdi + 0x2e0]
test rax, rax
je 0x1400a17e9
mov rax, qword [rax + 0xd8]
mov rcx, qword [rax + 8]
jmp 0x1400a17ec
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400a1886
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400a1859
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
cmp word [rax], bx
je 0x1400a182d
nop
lea rcx, [rcx + 2]
inc rbx
cmp word [rcx], 0
jne 0x1400a1820
lea r9, [rbx*2 + 2]
mov r8, rax
lea rdx, str.UTF_16LE
lea rcx, str.UTF_8
call fcn.140058f60
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1400a186d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Couldnt_get_clipboard_data
call fcn.140075890
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x1400a1886
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140159cae]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140039dc0
Function at 0x1400b3010
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9d, dword [0x14017e7d4]
mov esi, r8d
and esi, 0x3f3
xor edi, edi
mov r15d, r8d
mov r14d, edx
mov ebp, ecx
cmp r9d, 0x7fffffff
jne 0x1400b30ea
mov r8d, dword [0x140185710]
lea rcx, str.SDL_BLIT_CPU_FEATURES
mov rdx, qword [0x140185718]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1400b315f
cmp rbx, qword [0x140185710]
jbe 0x1400b30b5
mov rcx, qword [0x140185718]
mov edx, ebx
call fcn.140061da0
test rax, rax
je 0x1400b315f
mov r8d, ebx
mov qword [0x140185718], rax
mov rdx, rax
mov qword [0x140185710], rbx
lea rcx, str.SDL_BLIT_CPU_FEATURES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, qword [0x140185718]
mov dword [0x14017e7d4], edi
test rcx, rcx
je 0x1400b3165
lea r8, [0x14017e7d4]
lea rdx, [0x14015f4d8]
call fcn.14003a8d0
mov r9d, dword [0x14017e7d4]
mov rbx, qword [rsp + 0x40]
cmp qword [0x14017d7a0], rdi
je 0x1400b3149
mov rdx, rdi
lea r8, [0x14017d790]
mov rcx, rdi
cmp ebp, dword [rcx + r8]
jne 0x1400b3130
cmp r14d, dword [rcx + r8 + 4]
jne 0x1400b3130
mov eax, dword [rcx + r8 + 8]
and eax, r15d
and eax, 0x3f3
cmp eax, esi
jne 0x1400b3130
mov ecx, dword [rcx + r8 + 0xc]
mov eax, ecx
and eax, r9d
cmp eax, ecx
je 0x1400b31c9
inc rdx
inc edi
lea rax, [rdx + rdx*2]
lea rcx, [rax*8]
cmp qword [rcx + r8 + 0x10], 0
jne 0x1400b3100
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov dword [0x14017e7d4], edi
call fcn.14005a9c0
test al, 4
je 0x1400b3175
or dword [0x14017e7d4], 1
call fcn.14005a9c0
test al, 8
je 0x1400b3185
or dword [0x14017e7d4], 2
call fcn.14005a9c0
test al, 0x10
je 0x1400b3195
or dword [0x14017e7d4], 4
call fcn.14005a9c0
test al, 0x20
je 0x1400b31a5
or dword [0x14017e7d4], 8
call fcn.14005a9c0
test al, 2
je 0x1400b30de
mov r9d, dword [0x14017e7d4]
or r9d, 0x10
mov dword [0x14017e7d4], r9d
jmp 0x1400b30e5
movsxd rax, edi
lea rax, [rax + rax*2]
mov rax, qword [r8 + rax*8 + 0x10]
jmp 0x1400b314b
Function at 0x1400b3d00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1400b3d86
mov r8d, dword [0x140185710]
lea rcx, str.SDL_OPENGL_LIBRARY
mov rdx, qword [0x140185718]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1400b3d7f
cmp rbx, qword [0x140185710]
jbe 0x1400b3d73
mov rcx, qword [0x140185718]
mov edx, ebx
call fcn.140061da0
test rax, rax
je 0x1400b3d7f
mov r8d, ebx
mov qword [0x140185718], rax
mov rdx, rax
mov qword [0x140185710], rbx
lea rcx, str.SDL_OPENGL_LIBRARY
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rbx, qword [0x140185718]
test rbx, rbx
jne 0x1400b3d86
lea rbx, str.OPENGL32.DLL
mov rcx, rbx
call fcn.140068540
mov qword [rdi + 0x478], rax
test rax, rax
jne 0x1400b3daa
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
cmp byte [rbx], al
je 0x1400b3dd3
nop word [rax + rax]
inc rax
cmp byte [rax + rbx], 0
jne 0x1400b3dc0
mov esi, 0xff
cmp rax, rsi
jae 0x1400b3dd6
mov rsi, rax
mov r8, rsi
lea rcx, [rdi + 0x374]
mov rdx, rbx
call fcn.140039560
mov ebx, 1
mov byte [rsi + rdi + 0x374], 0
mov ecx, ebx
mov edx, 0x68
call qword [0x140181b28]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
test rax, rax
je 0x1400b3e19
lock xadd dword [0x140181b40], ebx
mov qword [rdi + 0x5c8], rax
test rax, rax
jne 0x1400b3e3b
lea rcx, str.Out_of_memory
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14005ec50
mov rbx, qword [rdi + 0x478]
lea rdx, str.wglGetProcAddress
mov rcx, rbx
call fcn.1400686b0
mov rcx, qword [rdi + 0x5c8]
lea rdx, str.wglCreateContext
mov qword [rcx + 0x20], rax
mov rcx, rbx
call fcn.1400686b0
mov rdx, qword [rdi + 0x5c8]
mov rcx, rbx
mov qword [rdx + 0x28], rax
lea rdx, str.wglDeleteContext
call fcn.1400686b0
mov rdx, qword [rdi + 0x5c8]
mov rcx, rbx
mov qword [rdx + 0x30], rax
lea rdx, str.wglMakeCurrent
call fcn.1400686b0
mov rdx, qword [rdi + 0x5c8]
mov rcx, rbx
mov qword [rdx + 0x38], rax
lea rdx, str.wglShareLists
call fcn.1400686b0
mov rcx, qword [rdi + 0x5c8]
mov qword [rcx + 0x40], rax
mov rax, qword [rdi + 0x5c8]
cmp qword [rax + 0x20], 0
je 0x1400b3f08
cmp qword [rax + 0x28], 0
je 0x1400b3f08
cmp qword [rax + 0x30], 0
je 0x1400b3f08
cmp qword [rax + 0x38], 0
je 0x1400b3f08
inc dword [rdi + 0x370]
mov rcx, rdi
call fcn.1400b4450
dec dword [rdi + 0x370]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Could_not_retrieve_OpenGL_functions
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14005ec50
Function at 0x1400b5dd0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov rdi, rcx
mov ecx, 0x400
lea edx, [r9 + 0x49]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov r9d, 0x10
lea r8, [rsp + 0x30]
mov ecx, 0x400
mov ebx, eax
lea edx, [r9 + 0x4a]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edx, eax
test ebx, ebx
jne 0x1400b5e30
lea rcx, str.Couldnt_obtain_language_info
call fcn.14005ec50
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
test edx, edx
lea rcx, [0x140159cae]
lea r8, [0x140162fb0]
mov edx, 0x80
lea rax, [rsp + 0x30]
cmove rax, rcx
lea r9, [rsp + 0x40]
cmovne rcx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, str._s_s_s
mov rcx, rdi
call fcn.14003b010
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x30
cmp qword [0x140185f50], 0
mov r14, rcx
jne 0x1400b5eca
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140185f50], rax
test rax, rax
je 0x1400b5eca
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185f58], rax
jmp 0x1400b5ed1
mov rax, qword [0x140185f58]
test rax, rax
jne 0x1400b5ee4
mov rcx, r14
add rsp, 0x30
pop r14
jmp 0x1400b5dd0
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x48]
xor ebx, ebx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x50], ebx
lea ecx, [rbx + 8]
mov dword [rsp + 0x48], ebx
call rax
mov ecx, dword [rsp + 0x48]
mov edi, 1
add rcx, rcx
mov esi, 0x80
test rcx, rcx
cmove rcx, rdi
call qword [fcn.140061120]
mov rbp, rax
test rax, rax
je 0x1400b5f42
lock xadd dword [0x140181b40], edi
mov rdi, qword [rsp + 0x20]
test rbp, rbp
jne 0x1400b5f5d
lea rcx, str.Out_of_memory
call fcn.14005ec50
jmp 0x1400b5fe6
lea r9, [rsp + 0x48]
mov r8, rbp
lea rdx, [rsp + 0x50]
mov ecx, 8
call qword [0x140185f58]
test eax, eax
jne 0x1400b5f83
mov rcx, r14
call 0x1400b5dd0
jmp 0x1400b5fd0
mov eax, dword [rsp + 0x48]
dec eax
cmp eax, esi
ja 0x1400b5f93
mov esi, eax
test eax, eax
je 0x1400b5fc9
mov r9, r14
mov r8, rbp
mov eax, ebx
mov r10d, 0x5f
movzx edx, byte [r8]
test dl, dl
jne 0x1400b5faf
mov ebx, eax
mov cl, 0x2c
jmp 0x1400b5fb9
cmp dl, 0x2d
movzx ecx, dl
cmove ecx, r10d
mov byte [r9], cl
inc eax
inc r9
add r8, 2
cmp eax, esi
jb 0x1400b5fa1
mov eax, ebx
mov byte [rax + r14], 0
mov rcx, rbp
call qword [fcn.1400614b0]
mov eax, 0xffffffff
lock xadd dword [0x140181b40], eax
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x28]
add rsp, 0x30
pop r14
ret