joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa610
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
push esi
push edi
push 0x10
call ebx
movsx esi, ax
push 0x11
shr esi, 0x1f
call ebx
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebx
mov ebp, edi
or ebp, 4
test ax, ax
push 0x5c
cmovns ebp, edi
call ebx
push 0x5b
movsx esi, ax
call ebx
movsx ecx, ax
or ecx, esi
jge 0x4aa657
or ebp, 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x4aa6e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
push 0x10
call ebx
movsx esi, ax
push 0x11
shr esi, 0x1f
call ebx
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebx
mov ebp, edi
or ebp, 4
test ax, ax
push 0x5c
cmovns ebp, edi
call ebx
push 0x5b
movsx esi, ax
call ebx
movsx ecx, ax
or ecx, esi
jge 0x4aa727
or ebp, 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x4ab900
Capabilities:
Allocate thread local storage

Disassembly:
call fcn.004acc90
test eax, eax
jne 0x4ab90c
xor eax, eax
ret
push 0
push 0x7be02c
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 2
push 0
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
call fcn.004abdb0
test eax, eax
je 0x4ab909
call fcn.004abb00
mov eax, dword [0x7be780]
test eax, eax
je 0x4ab94e
push 2
call eax
jmp 0x4ab959
mov eax, dword [0x7be768]
test eax, eax
je 0x4ab959
call eax
call fcn.004aa1f0
test eax, eax
je 0x4ab909
call fcn.004aba30
mov dword [0x7be028], eax
test eax, eax
je 0x4ab909
call fcn.004a9bb0
call fcn.004abf50
call fcn.004ac150
mov eax, 1
ret

Function at 0x4aba30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3c
mov eax, dword [0x5e0ce8]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0xfffffffffffffffd
push 1
push 1
push 0
push 0
push 0x6000000
push str.GLFW_helper_window
push str.GLFW30
push 0x300
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x4abaa0
push str.Win32:_Failed_to_create_helper_window
push 0x10008
call fcn.004a8de0
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057516e
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
movups xmm0, xmmword [0x582510]
push 0
push eax
push esi
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x20], 5
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0057516e
mov esp, ebp
pop ebp
ret
Function at 0x4abdb0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5e0ce8]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x582520
call edi
mov dword [0x7be744], eax
test eax, eax
jne 0x4abdf9
push str.Win32:_Failed_to_load_winmm.dll
push 0x10008
call fcn.004a8de0
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0057516e
add esp, 0x1c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x58254c
push eax
call ebx
push str.user32.dll
mov dword [0x7be748], eax
call edi
mov dword [0x7be764], eax
test eax, eax
jne 0x4abe42
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.004a8de0
add esp, 8
xor eax, eax
pop ebx
pop edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0057516e
add esp, 0x1c
ret
push str.SetProcessDPIAware
push eax
call ebx
push str.ChangeWindowMessageFilterEx
push dword [0x7be764]
mov dword [0x7be768], eax
call ebx
push str.dinput8.dll
mov dword [0x7be76c], eax
call edi
mov dword [0x7be74c], eax
test eax, eax
je 0x4abe7e
push str.DirectInput8Create
push eax
call ebx
mov dword [0x7be750], eax
push esi
mov dword [esp + 0xc], str.xinput1_4.dll
xor esi, esi
mov dword [esp + 0x10], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [esp + 0x14], str.xinput9_1_0.dll
mov dword [esp + 0x18], str.xinput1_2.dll
mov dword [esp + 0x1c], str.xinput1_1.dll
mov dword [esp + 0x20], 0
push eax
call edi
mov dword [0x7be758], eax
test eax, eax
jne 0x4abecd
mov eax, dword [esp + esi*4 + 0x10]
inc esi
test eax, eax
jne 0x4abeb6
jmp 0x4abeec
push 0x582628
push eax
call ebx
push 0x582640
push dword [0x7be758]
mov dword [0x7be75c], eax
call ebx
mov dword [0x7be760], eax
push str.dwmapi.dll
call edi
mov dword [0x7be770], eax
pop esi
test eax, eax
je 0x4abf1c
push str.DwmIsCompositionEnabled
push eax
call ebx
push str.DwmFlush
push dword [0x7be770]
mov dword [0x7be774], eax
call ebx
mov dword [0x7be778], eax
push str.shcore.dll
call edi
mov dword [0x7be77c], eax
test eax, eax
je 0x4abf39
push str.SetProcessDpiAwareness
push eax
call ebx
mov dword [0x7be780], eax
mov ecx, dword [esp + 0x20]
mov eax, 1
pop ebx
pop edi
xor ecx, esp
call fcn.0057516e
add esp, 0x1c
ret

Function at 0x4acc90
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7beb7c], eax
cmp eax, 0xffffffff
jne 0x4accb5
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.004a8de0
add esp, 8
xor eax, eax
ret
mov dword [0x7beb78], 1
mov eax, 1
ret
Function at 0x4b9460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5e8c28]
sub esp, 0x238
test eax, eax
je 0x4b947e
inc eax
mov dword [0x5e8c28], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4b94bb
mov eax, dword [0x5e8c08]
test eax, eax
jne 0x4b95ad
mov dword [0x5e8c0c], 0x1020
mov edi, str.SDL_app
test esi, esi
je 0x4b94ae
mov eax, esi
jmp 0x4b94b6
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x5e8c10], eax
push edi
call fcn.004b6e60
inc eax
push eax
push edi
push str.UTF_8
push str.UTF_16LE
call fcn.004e1f10
mov ecx, dword [ebp + 0xc]
add esp, 0x14
mov dword [0x5e8c08], eax
mov dword [0x5e8c0c], ecx
test esi, esi
jne 0x4b94f6
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov eax, dword [0x5e8c08]
mov dword [0x5e8c10], esi
mov dword [ebp - 8], eax
mov eax, dword [0x5e8c0c]
push str.SDL_WINDOWS_INTRESOURCE_ICON
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0x4b9f70
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.004ccc80
add esp, 4
test eax, eax
je 0x4b95b8
cmp byte [eax], 0
je 0x4b95b8
push eax
call fcn.004b6a40
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
add esp, 4
movzx eax, ax
push eax
push dword [0x5e8c10]
call esi
push str.SDL_WINDOWS_INTRESOURCE_ICON_SMALL
mov dword [ebp - 0x18], eax
call fcn.004ccc80
add esp, 4
test eax, eax
je 0x4b95e9
cmp byte [eax], 0
je 0x4b95e9
push eax
call fcn.004b6a40
add esp, 4
movzx eax, ax
push eax
push dword [0x5e8c10]
call esi
mov dword [ebp - 4], eax
jmp 0x4b95e9
mov esi, dword [0x5e8c10]
jmp 0x4b94fc
push 0x104
lea eax, [ebp - 0x238]
push eax
push dword [0x5e8c10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
pop edi
pop esi
test ax, ax
jne 0x4b960b
push str.Couldnt_register_application_class
call fcn.004b58a0
add esp, 4
mov esp, ebp
pop ebp
ret
call fcn.004b93c0
mov dword [0x5e8c14], eax
xor eax, eax
mov dword [0x5e8c28], 1
mov esp, ebp
pop ebp
ret
Function at 0x4b9a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
call fcn.004d52a0
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 8
mov edi, eax
push 1
call ebx
bt ax, 0xf
mov esi, dword [ebp + 8]
jb 0x4b9a3d
push 0
push 1
mov eax, edi
push esi
and eax, 1
push eax
push 0
call fcn.004b9c30
add esp, 0x14
push 2
call ebx
bt ax, 0xf
jb 0x4b9a5d
push 0
push 3
mov eax, edi
push esi
and eax, 4
push eax
push 0
call fcn.004b9c30
add esp, 0x14
push 4
call ebx
bt ax, 0xf
jb 0x4b9a7d
push 0
push 2
mov eax, edi
push esi
and eax, 2
push eax
push 0
call fcn.004b9c30
add esp, 0x14
push 5
call ebx
bt ax, 0xf
jb 0x4b9a9d
push 0
push 4
mov eax, edi
push esi
and eax, 8
push eax
push 0
call fcn.004b9c30
add esp, 0x14
push 6
call ebx
bt ax, 0xf
jb 0x4b9abb
push 0
push 5
push esi
and edi, 0x10
push edi
push 0
call fcn.004b9c30
add esp, 0x14
pop edi
mov dword [esi + 0x24], 0
pop esi
pop ebx
pop ebp
ret

Function at 0x4b9e10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov ebx, eax
cmp dword [0x5ddde0], esi
je 0x4b9e9b
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x1c]
push 1
push esi
push esi
push esi
push eax
call edi
test eax, eax
je 0x4b9e9b
mov ecx, dword [0x5e8c20]
test ecx, ecx
je 0x4b9e66
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [0x5e8c24]
call ecx
add esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, ebx
sub eax, dword [ebp - 0xc]
test eax, eax
jg 0x4b9e89
inc esi
cmp esi, 3
jg 0x4b9e9b
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
jne 0x4b9e40
push 0
call fcn.004cf1b0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, eax
add esp, 4
cmp byte [esi + 0xe1], 1
jne 0x4b9ed3
push 0xa0
call edi
bt ax, 0xf
jb 0x4b9ed3
push 0xe1
push 0
call fcn.004cf380
add esp, 8
cmp byte [esi + 0xe5], 1
jne 0x4b9ef9
push 0xa1
call edi
bt ax, 0xf
jb 0x4b9ef9
push 0xe5
push 0
call fcn.004cf380
add esp, 8
call fcn.004b9f30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x18
push edi
push esi
call fcn.004b6b40
add esp, 0xc
cmp dword [edi], 0
jne 0x4c1372
push str.SDL_AUDIO_FREQUENCY
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c136c
push eax
call fcn.004b6a40
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4c1372
mov dword [esi], 0x5622
cmp word [edi + 4], 0
jne 0x4c13a5
push str.SDL_AUDIO_FORMAT
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c139c
push eax
call fcn.004c03e0
add esp, 4
mov word [esi + 4], ax
test ax, ax
jne 0x4c13a5
mov eax, 0x8010
mov word [esi + 4], ax
movzx eax, byte [edi + 6]
cmp eax, 8
ja case.0x4c13b9.3
movzx eax, byte [eax + 0x4c146c]
jmp dword [eax*4 + 0x4c1460]
push str.SDL_AUDIO_CHANNELS
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c13e1
push eax
call fcn.004b6a40
add esp, 4
mov byte [esi + 6], al
test al, al
jne case.0x4c13b9.1
mov byte [esi + 6], 2
cmp word [edi + 8], 0
jne 0x4c143a
push str.SDL_AUDIO_SAMPLES
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c1412
push eax
call fcn.004b6a40
movzx eax, ax
add esp, 4
mov word [esi + 8], ax
test ax, ax
jne 0x4c143a
mov eax, 0x10624dd3
imul dword [esi]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x2e
mov eax, 1
cmp ecx, eax
jle 0x4c1436
nop
add eax, eax
cmp eax, ecx
jl 0x4c1430
mov word [esi + 8], ax
push esi
call fcn.004bfc50
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
push str.Unsupported_number_of_audio_channels.
call fcn.004b58a0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4c13c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x18
push edi
push esi
call fcn.004b6b40
add esp, 0xc
cmp dword [edi], 0
jne 0x4c1372
push str.SDL_AUDIO_FREQUENCY
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c136c
push eax
call fcn.004b6a40
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4c1372
mov dword [esi], 0x5622
cmp word [edi + 4], 0
jne 0x4c13a5
push str.SDL_AUDIO_FORMAT
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c139c
push eax
call fcn.004c03e0
add esp, 4
mov word [esi + 4], ax
test ax, ax
jne 0x4c13a5
mov eax, 0x8010
mov word [esi + 4], ax
movzx eax, byte [edi + 6]
cmp eax, 8
ja case.0x4c13b9.3
movzx eax, byte [eax + 0x4c146c]
jmp dword [eax*4 + 0x4c1460]
push str.SDL_AUDIO_CHANNELS
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c13e1
push eax
call fcn.004b6a40
add esp, 4
mov byte [esi + 6], al
test al, al
jne case.0x4c13b9.1
mov byte [esi + 6], 2
cmp word [edi + 8], 0
jne 0x4c143a
push str.SDL_AUDIO_SAMPLES
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4c1412
push eax
call fcn.004b6a40
movzx eax, ax
add esp, 4
mov word [esi + 8], ax
test ax, ax
jne 0x4c143a
mov eax, 0x10624dd3
imul dword [esi]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x2e
mov eax, 1
cmp ecx, eax
jle 0x4c1436
nop
add eax, eax
cmp eax, ecx
jl 0x4c1430
mov word [esi + 8], ax
push esi
call fcn.004bfc50
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
push str.Unsupported_number_of_audio_channels.
call fcn.004b58a0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4c1b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x7fff
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x8060402
mov al, byte [esi]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0x8060402
mov dword [ebp - 0xc4], 0x80007
mov dword [ebp - 0xc0], 0xa0009
mov dword [ebp - 0xbc], 0xc000b
mov dword [ebp - 0xb8], 0xe000d
mov dword [ebp - 0xb4], 0x110010
mov dword [ebp - 0xb0], 0x150013
mov dword [ebp - 0xac], 0x190017
mov dword [ebp - 0xa8], 0x1f001c
mov dword [ebp - 0xa4], 0x250022
mov dword [ebp - 0xa0], 0x2d0029
mov dword [ebp - 0x9c], 0x370032
mov dword [ebp - 0x98], 0x42003c
mov dword [ebp - 0x94], 0x500049
mov dword [ebp - 0x90], 0x610058
mov dword [ebp - 0x8c], 0x76006b
mov dword [ebp - 0x88], 0x8f0082
mov dword [ebp - 0x84], 0xad009d
mov dword [ebp - 0x80], 0xd100be
mov dword [ebp - 0x7c], 0xfd00e6
mov dword [ebp - 0x78], 0x1330117
mov dword [ebp - 0x74], 0x1730151
mov dword [ebp - 0x70], 0x1c10198
mov dword [ebp - 0x6c], 0x22001ee
mov dword [ebp - 0x68], 0x2920256
mov dword [ebp - 0x64], 0x31c02d4
mov dword [ebp - 0x60], 0x3c3036c
mov dword [ebp - 0x5c], 0x48e0424
mov dword [ebp - 0x58], 0x5830502
mov dword [ebp - 0x54], 0x6ab0610
mov dword [ebp - 0x50], 0x8120756
mov dword [ebp - 0x4c], 0x9c308e0
mov dword [ebp - 0x48], 0xbd00abd
mov dword [ebp - 0x44], 0xe4c0cff
mov dword [ebp - 0x40], 0x114c0fba
mov dword [ebp - 0x3c], 0x14ee1307
mov dword [ebp - 0x38], 0x19541706
mov dword [ebp - 0x34], 0x1ea51bdc
mov dword [ebp - 0x30], 0x251521b6
mov dword [ebp - 0x2c], 0x2cdf28ca
mov dword [ebp - 0x28], 0x364b315b
mov dword [ebp - 0x24], 0x41b23bb9
mov dword [ebp - 0x20], 0x4f7e4844
mov dword [ebp - 0x1c], 0x602f5771
mov dword [ebp - 0x18], 0x746269ce
cmp al, 0x58
jle 0x4c1d34
mov dl, 0x58
jmp 0x4c1d3e
xor ecx, ecx
movzx edx, al
test al, al
cmovs edx, ecx
mov bl, byte [ebp + 0x10]
movsx eax, dl
movzx ecx, word [ebp + eax*2 - 0xc4]
movzx eax, bl
mov al, byte [ebp + eax - 0x10]
add al, dl
mov edx, ecx
shr edx, 3
mov byte [esi], al
test bl, 4
je 0x4c1d63
add edx, ecx
test bl, 2
je 0x4c1d6e
mov eax, ecx
shr eax, 1
add edx, eax
test bl, 1
je 0x4c1d78
shr ecx, 2
add edx, ecx
movsx eax, word [ebp + 0xc]
mov ecx, edx
neg ecx
test bl, 8
pop esi
cmove ecx, edx
add ecx, eax
pop ebx
cmp ecx, 0x7fff
jle 0x4c1d9b
mov eax, 0x7fff
mov esp, ebp
pop ebp
ret
mov eax, 0xffff8000
cmp ecx, eax
cmovl ecx, eax
mov ax, cx
mov esp, ebp
pop ebp
ret
Function at 0x4c8350
Capabilities:
Terminate process

Disassembly:
push esi
push str.SDL_EVENT_QUEUE_STATISTICS
call fcn.004ccc80
mov esi, eax
add esp, 4
mov eax, dword [0x5ddf98]
test eax, eax
je 0x4c8372
push eax
call fcn.004d6130
add esp, 4
push 0
push 0x5ddf9c
call fcn.004bf8f0
add esp, 8
test esi, esi
je 0x4c83a5
push esi
call fcn.004b6a40
add esp, 4
test eax, eax
je 0x4c83a5
push dword [0x5ddfa4]
push str.SDL_EVENT_QUEUE:_Maximum_events_in_flight:__d_n
call fcn.004b5ff0
add esp, 8
mov eax, dword [0x5ddfa8]
test eax, eax
je 0x4c83c2
mov edi, edi
mov esi, dword [eax + 0x54]
push eax
call fcn.004dedf0
add esp, 4
mov eax, esi
test esi, esi
jne 0x4c83b0
mov eax, dword [0x5ddfb0]
test eax, eax
je 0x4c83e2
jmp 0x4c83d0
mov esi, dword [eax + 0x54]
push eax
call fcn.004dedf0
add esp, 4
mov eax, esi
test esi, esi
jne 0x4c83d0
mov eax, dword [0x5ddfb4]
test eax, eax
je 0x4c8402
jmp 0x4c83f0
mov esi, dword [eax + 0x18]
push eax
call fcn.004dedf0
add esp, 4
mov eax, esi
test esi, esi
jne 0x4c83f0
mov eax, dword [0x5ddfb8]
test eax, eax
je 0x4c8422
jmp 0x4c8410
mov esi, dword [eax + 0x18]
push eax
call fcn.004dedf0
add esp, 4
mov eax, esi
test esi, esi
jne 0x4c8410
push 0
push 0x5ddfa0
call fcn.004bf8f0
add esp, 8
mov dword [0x5ddfa4], 0
mov dword [0x5ddfa8], 0
xor esi, esi
mov dword [0x5ddfac], 0
mov dword [0x5ddfb0], 0
mov dword [0x5ddfb4], 0
mov dword [0x5ddfb8], 0
nop
push dword [esi + 0x5e8d90]
call fcn.004dedf0
mov dword [esi + 0x5e8d90], 0
add esp, 4
add esi, 4
cmp esi, 0x400
jb 0x4c8470
mov eax, dword [0x5e8d70]
pop esi
test eax, eax
je 0x4c84b0
push eax
call fcn.004d6110
add esp, 4
mov dword [0x5e8d70], 0
mov eax, dword [0x5e8d80]
test eax, eax
je 0x4c84d6
push eax
call fcn.004dedf0
add esp, 4
mov dword [0x5e8d80], 0
mov dword [0x5e8d84], 0
push 0xc
push 0
push 0x5e8d74
call fcn.004b6c20
mov eax, dword [0x5ddf98]
add esp, 0xc
test eax, eax
je 0x4c850e
push eax
call fcn.004d61a0
push dword [0x5ddf98]
call fcn.004d6110
add esp, 8
mov dword [0x5ddf98], 0
ret
Function at 0x4ca580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bh, bh
xor bl, bl
push edi
mov al, byte [esi]
cmp al, 0x2b
je 0x4ca59a
cmp al, 0x2d
jne 0x4ca59d
mov bl, al
inc esi
push esi
call fcn.004c9110
push esi
mov edi, eax
call fcn.004c9420
add esp, 8
cmp edi, 0xffffffff
je 0x4ca601
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], edi
cmp edi, 4
je 0x4ca5f1
cmp edi, 5
je 0x4ca5f1
cmp bl, 0x2b
je 0x4ca5f1
cmp bl, 0x2d
jne 0x4ca5e1
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffff8000
jmp 0x4ca614
mov dword [ebp - 8], 0xffff8000
mov dword [ebp - 4], 0x7fff
jmp 0x4ca614
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x7fff
jmp 0x4ca614
cmp eax, 0xffffffff
je 0x4ca778
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 0x10]
mov al, byte [esi]
cmp al, 0x2b
je 0x4ca621
cmp al, 0x2d
jne 0x4ca624
mov bh, al
inc esi
push esi
call fcn.004b6e60
add esp, 4
lea edi, [esi + 1]
cmp byte [esi], 0x61
mov bl, byte [eax + esi - 1]
jne 0x4ca691
movsx eax, byte [edi]
push eax
call fcn.004b50c0
add esp, 4
test eax, eax
je 0x4ca691
push edi
mov dword [ebp - 0x20], 2
call fcn.004b6a40
add esp, 4
mov dword [ebp - 0x1c], eax
cmp bh, 0x2b
jne 0x4ca665
xor ecx, ecx
jmp 0x4ca678
cmp bh, 0x2d
jne 0x4ca673
xor ecx, ecx
mov eax, 0xffff8000
jmp 0x4ca67d
mov ecx, 0xffff8000
mov eax, 0x7fff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp bl, 0x7e
jne 0x4ca712
mov dword [ebp - 0x14], ecx
jmp 0x4ca70f
cmp byte [esi], 0x62
jne 0x4ca6bb
movsx eax, byte [edi]
push eax
call fcn.004b50c0
add esp, 4
test eax, eax
je 0x4ca6bb
push edi
mov dword [ebp - 0x20], 1
call fcn.004b6a40
add esp, 4
mov dword [ebp - 0x1c], eax
jmp 0x4ca712
cmp byte [esi], 0x68
jne 0x4ca763
movsx eax, byte [edi]
push eax
call fcn.004b50c0
add esp, 4
test eax, eax
je 0x4ca763
cmp byte [esi + 2], 0x2e
jne 0x4ca763
movsx eax, byte [esi + 3]
lea ebx, [esi + 3]
push eax
call fcn.004b50c0
add esp, 4
test eax, eax
je 0x4ca763
push edi
mov dword [ebp - 0x20], 3
call fcn.004b6a40
push ebx
mov dword [ebp - 0x1c], eax
call fcn.004b6a40
add esp, 8
mov dword [ebp - 0x18], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
shl eax, 5
push eax
push dword [esi + 0x10]
call fcn.004dee60
mov ecx, eax
add esp, 8
mov dword [esi + 0x10], ecx
test ecx, ecx
jne 0x4ca747
push eax
mov dword [esi + 0xc], eax
call fcn.004b5620
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0xc]
lea esi, [ebp - 0x20]
shl edi, 5
add edi, 0xffffffe0
add edi, ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.Unexpected_joystick_element:__s
call fcn.004b58a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.Unexpected_controller_element__s
call fcn.004b58a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb380
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, 0x1505
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
fld dword [edi + esi*8]
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, edx
shl eax, 5
add eax, edx
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov edx, ecx
fldcw word [ebp - 2]
shl edx, 5
add edx, ecx
fld dword [edi + esi*8 + 4]
inc esi
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
add edx, dword [ebp - 0xc]
fldcw word [ebp - 2]
cmp esi, 0x40
jl 0x4cb392
pop edi
pop esi
mov eax, edx
mov esp, ebp
pop ebp
ret

Function at 0x4cc7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004cca30
add esp, 4
test eax, eax
je 0x4cc866
test dword [edi + 0x10], 0x1000
jne 0x4cc7f6
push str.Haptic:_Device_does_not_support_setting_gain.
call fcn.004b58a0
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp esi, 0x64
ja 0x4cc855
push str.SDL_HAPTIC_GAIN_MAX
call fcn.004e0760
add esp, 4
test eax, eax
je 0x4cc83d
push eax
call fcn.004b6a40
mov ecx, eax
add esp, 4
test ecx, ecx
jns 0x4cc81f
xor ecx, ecx
jmp 0x4cc829
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
imul ecx, esi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
push edi
call fcn.004f6c40
add esp, 8
xor ecx, ecx
test eax, eax
setns cl
pop edi
pop esi
lea eax, [ecx - 1]
pop ebp
ret
push str.Haptic:_Gain_must_be_between_0_and_100.
call fcn.004b58a0
add esp, 4
pop edi
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x4cd6b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], str.DS4Windows.exe
push esi
push 2
mov dword [ebp - 8], str.InputMapper.exe
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x4cd743
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], pe_nt_image_headers32
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4cd73c
push edi
lea esp, [esp]
xor edi, edi
lea ebx, [edi + 1]
push dword [ebp + edi*4 - 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.004b6ce0
add esp, 8
test eax, eax
cmove esi, ebx
inc edi
cmp edi, 2
jb 0x4cd705
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x134]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4cd73b
test esi, esi
je 0x4cd700
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret