joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425a30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x425a49
cmp byte [edi + 0x2d24], 0
je 0x425a61
push 0xea7
push str.C:Users_adeptDesktopMAADeditorMAADeditorCodeimGUIimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], str.Window
mov al, 0x57
mov esi, 0x48bff1
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x425a8e
cmp byte [esi], al
jne 0x425a8e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x483828]
test al, al
jne 0x425a80
mov esi, dword [edi + 0x2d38]
not edx
mov ecx, dword [edi + 0x2d3c]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x433240
mov dword [ebp - 0x10], 0x4332a0
mov dword [ebp - 0xc], 0x433370
cmp esi, ecx
jne 0x425b5e
inc esi
test ecx, ecx
je 0x425ae5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x425aea
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x425b5e
mov eax, dword [0x498230]
test eax, eax
je 0x425b02
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [edi + 0x2d40]
add esp, 4
mov dword [ebp - 4], eax
test ebx, ebx
je 0x425b52
mov ecx, dword [edi + 0x2d38]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x498230]
add esp, 0xc
test eax, eax
je 0x425b45
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [edi + 0x2d40], eax
mov dword [edi + 0x2d3c], esi
mov eax, dword [edi + 0x2d38]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d40]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d38]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427760
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x42779f
cmp bl, 0x23
jne 0x427781
cmp byte [esi], bl
jne 0x427781
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x483828]
test bl, bl
jne 0x427772
mov ebx, dword [0x498230]
not eax
mov esi, dword [ebx + 0x199c]
mov edi, dword [ebx + 0x19a4]
mov ecx, edi
test esi, esi
je 0x4277e4
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x4277d8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x4277da
mov esi, edx
test esi, esi
jne 0x4277c0
mov ecx, dword [ebx + 0x19a4]
mov edx, dword [ebx + 0x199c]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x4277fc
cmp dword [edi], eax
jne 0x4277fc
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42d190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x498230]
push ebx
push esi
push edi
mov esi, dword [eax + 0x19ac]
mov eax, dword [esi + 0xbc]
add esi, 0xbc
mov dword [ebp - 4], ecx
test eax, eax
jg 0x42d1cf
push 0x4f3
push str.C:Users_adeptDesktopMAADeditorMAADeditorCodeimGUIimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [esi]
add esp, 0xc
mov ebx, dword [esi + 8]
lea edx, [ebp - 4]
mov edi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x483828]
sub edi, 1
jne 0x42d1e0
mov edi, dword [esi + 4]
not ebx
mov ecx, dword [esi]
cmp ecx, edi
jne 0x42d229
inc ecx
test edi, edi
je 0x42d215
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x42d21a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00433ca0
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x498230]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [edi + 0x2d28], 0
test eax, eax
je 0x43323b
push esi
lea esi, [edi + 0x2d2c]
mov dword [edi + 0x2d28], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x433177
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041ada0
mov ecx, dword [esi + 4]
xor edx, edx
mov dword [esi], 0
test ecx, ecx
jne 0x43318e
push 8
mov ecx, esi
call fcn.0041ada0
mov edx, dword [esi]
mov eax, dword [esi + 8]
push ebx
xor ebx, ebx
mov byte [edx + eax], 0
inc dword [esi]
mov eax, dword [edi + 0x2d38]
mov ecx, dword [esi]
test eax, eax
jle 0x4331f3
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x4331ca
push 0x4e9
push str.C:Users_adeptDesktopMAADeditorMAADeditorCodeimGUIimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [edi + 0x2d40]
add eax, ecx
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [edi + 0x2d38]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x4331ca
mov ecx, dword [esi]
lea eax, [ecx - 1]
mov edx, 0x48dc18
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x2d34]
test eax, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 8]
mov edi, 0x49822c
cmovne edi, eax
call fcn.00420b90
mov esi, eax
pop ebx
test esi, esi
je 0x43323a
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4571e0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x495f48], 0
jne 0x4571f9
push 0
push 0x10001
call fcn.0045b820
add esp, 8
ret
jmp fcn.004590d0

Function at 0x4590d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49594c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x30]
push 1
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x459144
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x2c], 0x12
jne 0x459122
mov esi, dword [0x496310]
test esi, esi
je 0x459132
push esi
call fcn.00456a80
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x459111
jmp 0x459132
lea eax, [ebp - 0x30]
push eax
call ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call edi
test eax, eax
jne 0x459101
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x4591d4
push str.GLFW
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, eax
test ebx, ebx
je 0x4591d4
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call esi
push 0xa1
movzx edi, ax
call esi
movzx eax, ax
cmp edi, 0x8000
jae 0x4591a6
cmp byte [ebx + 0x1c4], 1
jne 0x4591a6
call fcn.0045a460
push eax
movsx eax, word [0x49710c]
push 0
push eax
push 0x154
jmp 0x4591cb
cmp eax, 0x8000
jae 0x4591d4
cmp byte [ebx + 0x1c8], 1
jne 0x4591d4
call fcn.0045a460
push eax
movsx eax, word [0x497114]
push 0
push eax
push 0x158
push ebx
call fcn.00457a30
add esp, 0x14
mov esi, dword [0x497800]
test esi, esi
je 0x459247
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2a4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
cmp dword [esi + 0x2c8], ecx
jne 0x459212
mov eax, edi
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 0x2cc], eax
je 0x459247
mov eax, edi
mov dword [ebp - 0xc], ecx
cdq
sub eax, edx
mov dword [esi + 0x2c8], ecx
sar eax, 1
mov dword [ebp - 8], eax
mov dword [esi + 0x2cc], eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
Function at 0x459270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x4592de
push esi
lea ecx, [edi + edi]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4592b9
push str.Win32:_Failed_to_allocate_global_handle_for_clipboard
push 0x10008
call fcn.004600b0
add esp, 8
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x4592e1
push str.Win32:_Failed_to_lock_global_handle
push 0x10008
call fcn.004600b0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebp
ret
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x496a50]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x459313
push str.Win32:_Failed_to_open_clipboard
jmp 0x4592c9
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x459430
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [0x497800], eax
jne 0x45948d
cmp dword [ebp + 0xc], 0
je 0x459454
push eax
call fcn.0045a390
add esp, 4
mov esp, ebp
pop ebp
ret
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45948d
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.004600b0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x45a190
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49594c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov dword [0x497800], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x45a1ea
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x4977f0], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x4977f8], xmm0
cmp dword [edi + 0x64], 0x34001
jne 0x45a20f
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x45a1ff
push dword [eax + 4]
jmp 0x45a211
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x45a211
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push edi
call fcn.00457790
add esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [edi + 0x1e0], 0
je 0x45a29e
mov eax, dword [edi + 0x2a4]
push 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0x10], 0x20001
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45a29e
push 0x4657b8
push 0x10008
call fcn.004600b0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00461fbb
mov esp, ebp
pop ebp
ret

Function at 0x45a2b0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1e0], 0
je 0x45a2fc
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45a2fc
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.004600b0
add esp, 8
push 0
mov dword [0x497800], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x4977f8]
cvttsd2si ecx, qword [0x4977f0]
mov dword [ebp - 4], eax
mov dword [esi + 0x2cc], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2a4]
mov dword [ebp - 8], ecx
mov dword [esi + 0x2c8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x64], 0x34001
jne 0x45a383
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45a36a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45a390
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push 0xc
push 1
mov dword [ebp - 0xc], 0x20001
mov eax, dword [eax + 0x2a4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45a3d4
push 0x4657b8
push 0x10008
call fcn.004600b0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x45a460
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
push 0x11
shr esi, 0xf
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 2
and ax, cx
push 0x12
cmove edi, esi
call ebx
mov ebx, edi
mov ecx, 0x8000
or ebx, 4
and ax, cx
push 0x5c
cmove ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call edi
push 0x5b
mov si, ax
call edi
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call ebx
mov esi, edi
or esi, 0x10
and al, 1
push 0x90
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x20
and al, 1
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x45a580
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
push 0x11
shr esi, 0xf
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 2
and ax, cx
push 0x12
cmove edi, esi
call ebx
mov ebx, edi
mov ecx, 0x8000
or ebx, 4
and ax, cx
push 0x5c
cmove ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push 0x5b
mov si, ax
call edi
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
call ebx
mov esi, edi
or esi, 0x10
and al, 1
push 0x90
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x20
and al, 1
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x45c900
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x45c92a
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.004600b0
add esp, 8
xor eax, eax
pop ebp
ret
mov dword [ecx], 1
mov eax, 1
pop ebp
ret
Function at 0x45fcd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x49594c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x497940], 0
mov dword [ebp - 0x10], str.libOSMesa.dll
mov dword [ebp - 0xc], str.OSMesa.dll
mov dword [ebp - 8], 0
je 0x45fd11
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov dword [0x497940], eax
test eax, eax
jne 0x45fd59
mov eax, dword [ebp + esi*4 - 0xc]
inc esi
test eax, eax
jne 0x45fd20
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.0045b820
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push eax
call esi
push str.OSMesaCreateContextAttribs
push dword [0x497940]
mov dword [0x497944], eax
call esi
push str.OSMesaDestroyContext
push dword [0x497940]
mov dword [0x497948], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x497940]
mov dword [0x49794c], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x497940]
mov dword [0x497950], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x497940]
mov dword [0x497954], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x497940]
mov dword [0x497958], eax
call esi
cmp dword [0x497944], 0
mov dword [0x49795c], eax
je 0x45fe1e
cmp dword [0x49794c], 0
je 0x45fe1e
cmp dword [0x497950], 0
je 0x45fe1e
cmp dword [0x497954], 0
je 0x45fe1e
cmp dword [0x497958], 0
je 0x45fe1e
test eax, eax
je 0x45fe1e
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.0045b820
mov eax, dword [0x497940]
add esp, 8
test eax, eax
je 0x45fe4a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x497940], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
Function at 0x460710
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x49594c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x124]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x6d1
push 0
push 0x49711e
call sub.VCRUNTIME140.dll_memset
mov eax, 0x4971be
lea ebx, [ebp - 0x160]
add esp, 0x18
mov dword [ebp - 0x164], eax
mov esi, 0x20
sub ebx, 0x480
nop dword [eax]
movsx edi, word [esi*2 + 0x496e64]
cmp edi, 0xffffffff
je 0x4608a4
cmp esi, 0x140
jl 0x460833
cmp esi, 0x14e
jg 0x460833
mov dword [ebp - 0x160], 0x60
mov dword [ebp - 0x15c], 0x61
mov dword [ebp - 0x158], 0x62
mov dword [ebp - 0x154], 0x63
mov dword [ebp - 0x150], 0x64
mov dword [ebp - 0x14c], 0x65
mov dword [ebp - 0x148], 0x66
mov dword [ebp - 0x144], 0x67
mov dword [ebp - 0x140], 0x68
mov dword [ebp - 0x13c], 0x69
mov dword [ebp - 0x138], 0x6e
mov dword [ebp - 0x134], 0x6f
mov dword [ebp - 0x130], 0x6a
mov dword [ebp - 0x12c], 0x6d
mov dword [ebp - 0x128], 0x6b
mov eax, dword [ebx]
jmp 0x46083c
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x10
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x168], eax
push ecx
lea ecx, [ebp - 0x124]
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x46087a
push 0
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push dword [ebp - 0x168]
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x46089e
push 0
push 0
push 5
push dword [ebp - 0x164]
lea eax, [ebp - 0x24]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x164]
inc esi
add eax, 5
add ebx, 4
mov dword [ebp - 0x164], eax
cmp esi, 0x15c
jle 0x460770
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
Function at 0x460b80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49594c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x482c24
call ebx
mov dword [0x497810], eax
test eax, eax
jne 0x460bca
push str.Win32:_Failed_to_load_winmm.dll
push 0x10008
call fcn.004600b0
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push eax
call edi
push str.user32.dll
mov dword [0x497814], eax
call ebx
mov dword [0x497830], eax
test eax, eax
jne 0x460c12
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.004600b0
add esp, 8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461fbb
mov esp, ebp
pop ebp
ret
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x497830]
mov dword [0x497834], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x497830]
mov dword [0x497838], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x497830]
mov dword [0x49783c], eax
call edi
push str.GetDpiForWindow
push dword [0x497830]
mov dword [0x497840], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x497830]
mov dword [0x497844], eax
call edi
push str.dinput8.dll
mov dword [0x497848], eax
call ebx
mov dword [0x497818], eax
test eax, eax
je 0x460c96
push str.DirectInput8Create
push eax
call edi
mov dword [0x49781c], eax
push esi
mov dword [ebp - 0x1c], str.xinput1_4.dll
xor esi, esi
mov dword [ebp - 0x18], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [ebp - 0x14], str.xinput9_1_0.dll
mov dword [ebp - 0x10], str.xinput1_2.dll
mov dword [ebp - 0xc], str.xinput1_1.dll
mov dword [ebp - 8], 0
push eax
call ebx
mov dword [0x497824], eax
test eax, eax
jne 0x460cdf
mov eax, dword [ebp + esi*4 - 0x18]
inc esi
test eax, eax
jne 0x460cc8
jmp 0x460cfe
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x497824]
mov dword [0x497828], eax
call edi
mov dword [0x49782c], eax
push str.dwmapi.dll
call ebx
mov dword [0x49784c], eax
pop esi
test eax, eax
je 0x460d40
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x49784c]
mov dword [0x497850], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x49784c]
mov dword [0x497854], eax
call edi
mov dword [0x497858], eax
push str.shcore.dll
call ebx
mov dword [0x49785c], eax
test eax, eax
je 0x460d6f
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x49785c]
mov dword [0x497860], eax
call edi
mov dword [0x497864], eax
push str.ntdll.dll
call ebx
mov dword [0x497868], eax
test eax, eax
je 0x460d8c
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x49786c], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.00461fbb
mov esp, ebp
pop ebp
ret