joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012c634
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140196180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x140311cb0]
mov rax, qword gs:[0x58]
mov edx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140311660], ecx
jg 0x14012c716
mov eax, ebx
cmp rbx, rax
jne 0x14012c6d8
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x14012c6d8
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x140311658]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14012c759
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140134110
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140004898
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14012c364
lea rdx, [0x1401919e0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x140311660]
call fcn.140134250
cmp dword [0x140311660], 0xffffffff
jne 0x14012c680
lea rcx, [0x140311658]
call fcn.14012c278
lea rcx, [0x14013c9f8]
call fcn.1401344f0
nop
lea rcx, [0x140311660]
call fcn.1401341e4
jmp 0x14012c680
mov ecx, eax
call fcn.14012c79c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x14015f3b8]
lea rcx, [rsp + 0x20]
call fcn.140004898
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14012c364
lea rdx, [0x1401919e0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14012dba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x14012dc13
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x14012dbd2
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x14012dc55
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x14012dc41
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14012dc70
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14012dd36
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x14012dd01
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x14012dcb6
test rbx, rbx
je 0x14012dd1e
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14012dd0c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14012dd38
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14012dde5
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x14012ddbd
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14012dd75
test rbx, rbx
je 0x14012ddd3
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14012ddc5
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140133d04
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140133d53
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140133d2a
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x140135190
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401351da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401351da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401351da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401351da
cmp dword [rcx + 0x84], 0xe
jbe 0x1401351da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401351dc
xor al, al
add rsp, 0x28
ret

Function at 0x1401353c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401353fa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401353ff
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140135448
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140160c40]
cmp byte [rcx + rax], 0
je 0x140135448
dec r8
sub rdx, 1
jne 0x14013542e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140135c0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1401354d8
mov ebx, eax
test eax, eax
jne 0x140135c3c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140135c9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140135c96
test al, 0x10
je 0x140135c96
bt eax, 0xa
jae 0x140135c8f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140135cb0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140135c8b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140135c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140135c96
and dword [rsp + 0x3c], 0
jmp 0x140135c9b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400017d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1401572c0], 0
jne 0x1400017f0
xor edx, edx
mov ecx, 0x10001
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140003b90
sub rsp, 0x28
mov rcx, qword [0x140158928]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140003bbd
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
mov ecx, recv
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140003bf8
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140004d20
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x140158938]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.140009c70
mov rcx, rbx
mov qword [0x140158938], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x140158938]
test rax, rax
jne 0x140003c4b
lea rdx, str.Win32:_Failed_to_convert_wide_string_to_UTF_8
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [0x140157c48]
jmp 0x1400017d0

Function at 0x140002270
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1401572c0], 0
jne 0x140002285
xor edx, edx
mov ecx, 0x10001
jmp fcn.140004d20
jmp fcn.140004a90

Function at 0x140002980
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
mov eax, 1
test ecx, 0x80000000
lea ecx, [rax + 0x10]
cmovne edi, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400029b7
or edi, 2
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400029ca
or edi, 4
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movsx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
or ecx, ebx
jns 0x1400029ed
or edi, 8
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002a00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
mov eax, 1
test ecx, 0x80000000
lea ecx, [rax + 0x10]
cmovne edi, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002a37
or edi, 2
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002a4a
or edi, 4
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x5b
movsx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
or ecx, ebx
jns 0x140002a6d
or edi, 8
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003b90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1401572c0], 0
jne 0x1400017f0
xor edx, edx
mov ecx, 0x10001
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140003b90
sub rsp, 0x28
mov rcx, qword [0x140158928]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140003bbd
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
mov ecx, recv
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140003bf8
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140004d20
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x140158938]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.140009c70
mov rcx, rbx
mov qword [0x140158938], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x140158938]
test rax, rax
jne 0x140003c4b
lea rdx, str.Win32:_Failed_to_convert_wide_string_to_UTF_8
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [0x140157c48]
jmp 0x1400017d0
Function at 0x140004a90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140154440]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140004b2a
nop dword [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x140004af5
mov rbx, qword [0x1401588a8]
test rbx, rbx
je 0x140004b0b
mov rcx, rbx
call fcn.140001b80
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140004ae3
jmp 0x140004b0b
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140004ad0
mov rdi, qword [0x1401588b0]
test rdi, rdi
je 0x140004c4d
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
call fcn.140002a00
mov ecx, 0xa0
mov ebp, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xa1
movzx ebx, ax
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
shr esi, 0xf
test ebx, ebx
jne 0x140004b97
cmp byte [rdi + 0x1e0], 1
jne 0x140004b97
xor r9d, r9d
xor r8d, r8d
mov edx, 0x154
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call fcn.140001100
test esi, esi
mov rsi, qword [rsp + 0x98]
jne 0x140004bc3
cmp byte [rdi + 0x1e4], 1
jne 0x140004bc3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x158
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call fcn.140001100
cmp dword [rdi + 0x80], 0x34003
mov rbp, qword [rsp + 0x90]
jne 0x140004c4d
mov rcx, qword [rdi + 0x2c0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
cmp dword [rdi + 0x2e0], eax
jne 0x140004c10
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [rdi + 0x2e4], eax
je 0x140004c4d
mov eax, ecx
mov rcx, qword [rdi + 0x2c0]
mov dword [rsp + 0x60], r8d
cdq
mov dword [rdi + 0x2e0], r8d
sub eax, edx
lea rdx, [rsp + 0x60]
sar eax, 1
mov dword [rsp + 0x64], eax
mov dword [rdi + 0x2e4], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010bec0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x140005520
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [0x1401572c0], 0
jne 0x140005535
xor edx, edx
mov ecx, 0x10001
jmp fcn.140004d20
test rcx, rcx
je 0x14000554f
cmp dword [rcx + 0x1f0], 0
jne 0x14000554f
xor edx, edx
mov ecx, 0x1000a
jmp fcn.140004d20
jmp fcn.140007db0
Function at 0x140007980
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.opengl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1401590c0], rax
test rax, rax
jne 0x1400079b5
lea rdx, str.WGL:_Failed_to_load_opengl32.dll
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
lea rdx, str.wglCreateContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401590c0]
lea rdx, str.wglDeleteContext
mov qword [0x1401590c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401590c0]
lea rdx, str.wglGetProcAddress
mov qword [0x1401590d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401590c0]
lea rdx, str.wglMakeCurrent
mov qword [0x1401590d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401590c0]
lea rdx, str.wglShareLists
mov qword [0x1401590e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401590e8], rax
mov eax, 1
add rsp, 0x28
ret

Function at 0x140007db0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140007dec
mov rdx, qword [rcx + 0x238]
mov rcx, qword [rcx + 0x230]
call qword [0x1401590e0]
test eax, eax
je 0x140007de3
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140008650
lea rdx, str.WGL:_Failed_to_make_context_current
jmp 0x140007e01
xor edx, edx
xor ecx, ecx
call qword [0x1401590e0]
test eax, eax
jne 0x140007e0b
lea rdx, str.WGL:_Failed_to_clear_current_context
mov ecx, 0x10008
call fcn.140004d20
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp 0x140008650
mov rdx, rcx
mov ecx, dword [0x14015975c]
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x1400085e0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14015975c], eax
cmp eax, 0xffffffff
jne 0x14000860d
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
mov dword [0x140159758], 1
mov eax, 1
add rsp, 0x28
ret
Function at 0x140009240
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x58
lea rcx, str.winmm.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140159040], rax
test rax, rax
jne 0x140009275
lea rdx, str.Win32:_Failed_to_load_winmm.dll
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x58
ret
lea rdx, str.timeGetTime
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x140159048], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140159080], rax
test rax, rax
jne 0x1400092bd
lea rdx, str.Win32:_Failed_to_load_user32.dll
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x58
ret
lea rdx, str.SetProcessDPIAware
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140159080]
lea rdx, str.ChangeWindowMessageFilterEx
mov qword [0x140159088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.dinput8.dll
mov qword [0x140159090], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140159050], rax
test rax, rax
je 0x140009324
lea rdx, str.DirectInput8Create
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140159058], rax
lea rcx, str.xinput1_3.dll
lea rax, str.xinput1_4.dll
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea rcx, str.xinput9_1_0.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
lea rcx, str.xinput1_2.dll
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
lea rcx, str.xinput1_1.dll
mov qword [rsp + 0x40], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140159068], rax
test rax, rax
jne 0x14000938b
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x140009367
jmp 0x1400093bd
lea rdx, str.XInputGetCapabilities
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140159068]
lea rdx, str.XInputGetState
mov qword [0x140159070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140159078], rax
lea rcx, [0x1401185a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, qword [rsp + 0x50]
mov qword [0x140159098], rax
test rax, rax
je 0x14000940d
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140159098]
lea rdx, str.DwmFlush
mov qword [0x1401590a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401590a8], rax
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1401590b0], rax
test rax, rax
je 0x14000943d
lea rdx, [0x140118550]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401590b8], rax
mov eax, 1
add rsp, 0x58
ret
Function at 0x14000dc00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000dc5d
lea rbx, [0x14011c520]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000dc44
cmp r10, 2
jb 0x14000dc44
cmp byte [r9], r8b
jne 0x14000dc44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000dc20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000dc9f
lea rbx, [0x14011c520]
cmp r8b, 0x23
jne 0x14000dc83
cmp byte [r9], r8b
jne 0x14000dc83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000dc70
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000de60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000de8f
mov r8d, 0x5ec
lea rdx, str.E:ReposSimHapticlibsimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000de9b
mov qword [rdi], 0
lea rdx, [0x14011c1d0]
mov rcx, rbx
call fcn.14000dcb0
mov rbx, rax
test rax, rax
jne 0x14000debd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000df94
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000df94
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14000df94
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000df94
cmp rsi, 0xffffffffffffffff
je 0x14000df94
mov rax, qword [0x140157940]
test rax, rax
je 0x14000df31
inc dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x14000df94
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x14000df81
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140157940]
test rax, rax
je 0x14000df76
dec dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000df9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000df8f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000df9f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400103d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x140010406
mov r8d, 0x588
lea rdx, str.E:ReposSimHapticlibsimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x14011c520]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140157940]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1ad8], edx
jne 0x140010480
mov dword [rax + 0x1adc], edx
cmp dword [rax + 0x1b18], edx
jne 0x14001048f
mov byte [rax + 0x1b1c], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret