joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005be7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
push edi
mov edi, edx
test ebx, ebx
je 0x1005bebb
mov ecx, dword [ebp + 0xc]
mov edx, ebx
add ecx, 0xfffffffe
test ecx, ecx
je 0x1005bea5
add esi, ecx
mov eax, esi
sub edx, 1
jne 0x1005be9f
test esi, esi
je 0x1005bebb
cmp eax, 0x2aaaaaaa
jg 0x1005bfc1
mov eax, dword [edi + 8]
imul eax, dword [edi + 4]
imul ecx, esi, 3
mov dword [ebp - 8], ecx
cmp ecx, eax
je 0x1005beee
mov eax, dword [edi]
test eax, eax
je 0x1005bede
push dword [eax - 4]
call fcn.10084d26
pop ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jle 0x1005beeb
call fcn.1003acc1
mov dword [edi], eax
jmp 0x1005beee
and dword [edi], 0
mov dword [edi + 4], esi
xor esi, esi
mov dword [edi + 8], 3
mov dword [ebp - 4], esi
test ebx, ebx
je 0x1005bfba
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, eax
mov dword [ebp - 0x20], ecx
shl edx, 2
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x10]
lea esi, [eax - 2]
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], edx
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
test esi, esi
je 0x1005bfa3
mov eax, edx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov ecx, dword [edi]
add dword [ebp - 0x1c], 4
mov dword [ecx + edx*4], eax
add edx, dword [edi + 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov esi, dword [edi]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4 + 4]
mov dword [esi + edx*4], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
xor eax, 1
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov dword [ebp - 0xc], eax
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
lea ecx, [esi + ecx*2]
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + eax*4 + 4]
mov esi, dword [ebp - 0x24]
mov dword [edx + ecx*4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
inc edx
inc eax
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
jb 0x1005bf38
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x28]
add ecx, eax
sub ebx, 1
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp + 8], ebx
jne 0x1005bf21
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
call fcn.100022bd
int3
Function at 0x1005ca6c
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a206d
call fcn.100739ea
mov edi, edx
push 0x10
call fcn.10072dfe
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10060980
push eax
push eax
mov dword [ebp - 4], eax
call fcn.1007cbc0
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1005cacb
call fcn.10073999
ret
and dword [ebx], 0
push 6
call fcn.10071c63
int3

Function at 0x1005d61e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a206d
call fcn.100739ea
mov edi, edx
push 0x10
call fcn.10072dfe
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x100612a5
push eax
push eax
mov dword [ebp - 4], eax
call fcn.1007cbc0
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1005d67d
call fcn.10073999
ret
and dword [ebx], 0
push 6
call fcn.10071c63
int3

Function at 0x1005d688
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a206d
call fcn.100739ea
mov edi, edx
push 0x10
call fcn.10072dfe
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10061311
push eax
push eax
mov dword [ebp - 4], eax
call fcn.1007cbc0
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1005d6e7
call fcn.10073999
ret
and dword [ebx], 0
push 6
call fcn.10071c63
int3
Function at 0x1005da62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1011d900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [eax - 1]
mov dword [ebp - 0xc], edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov ecx, dword [ebp + 0xc]
sar ebx, 1
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
jge 0x1005dac9
lea esi, [ecx + ecx]
lea ecx, [edi + 8]
lea ecx, [ecx + esi*4]
lea eax, [ecx - 4]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.1005ce63
mov edx, dword [ebp - 0xc]
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + ecx*4]
mov dword [edi + edx*4], eax
cmp ecx, ebx
jl 0x1005da97
mov eax, dword [ebp - 0x18]
mov esi, ecx
cmp ecx, ebx
jne 0x1005dadd
test al, 1
jne 0x1005dadd
mov eax, dword [edi + eax*4 - 4]
mov esi, dword [ebp - 8]
mov dword [edi + ecx*4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], esi
jge 0x1005db0d
push dword [ebp - 0x14]
lea ebx, [esi - 1]
sar ebx, 1
lea ecx, [ebp - 8]
lea eax, [edi + ebx*4]
push eax
call fcn.1005ce63
test al, al
je 0x1005db0d
mov eax, dword [edi + ebx*4]
mov dword [edi + esi*4], eax
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jl 0x1005dae8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
mov dword [edi + esi*4], eax
pop edi
pop esi
pop ebx
call fcn.10072cfd
leave
ret

Function at 0x1005de28
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a206d
call fcn.100739ea
mov edi, edx
push 0x10
call fcn.10072dfe
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x100622b9
push eax
push eax
mov dword [ebp - 4], eax
call fcn.1007cbc0
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1005de87
call fcn.10073999
ret
and dword [ebx], 0
push 6
call fcn.10071c63
int3

Function at 0x1005eeb8
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a206d
call fcn.100739ea
mov edi, edx
push 0x10
call fcn.10072dfe
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10062312
push eax
push eax
mov dword [ebp - 4], eax
call fcn.1007cbc0
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1005ef17
call fcn.10073999
ret
and dword [ebx], 0
push 6
call fcn.10071c63
int3
Function at 0x10069370
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x10134318], 0
jne 0x10069389
push 0
push 0x10001
call fcn.10069770
add esp, 8
ret
jmp fcn.1006a1f0

Function at 0x100693f0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x10134318], 0
jne 0x10069409
push 0
push 0x10001
call fcn.10069770
add esp, 8
ret
jmp 0x1006a910
call dword [sym.imp.USER32.dll_WaitMessage]
jmp fcn.1006a1f0

Function at 0x10069a70
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x10134318], 0
jne 0x10069b1d
push 0x2220
push 0
push 0x10134318
call fcn.10075050
movq xmm0, qword [0x1011d5b4]
add esp, 0xc
mov eax, dword [0x1011d5bc]
movq qword [0x1013431c], xmm0
mov dword [0x10134324], eax
call fcn.1006e4c0
test eax, eax
je 0x10069b23
push 0x101355c4
call fcn.10069c90
add esp, 4
test eax, eax
je 0x10069b23
push 0x101355b4
call fcn.10069cb0
add esp, 4
test eax, eax
je 0x10069b23
push 0x101355bc
call fcn.10069cb0
add esp, 4
test eax, eax
je 0x10069b23
push 0x10136538
push 0x101355b4
call fcn.10069d60
add esp, 8
call fcn.10067ba0
mov dword [0x10134318], 1
call fcn.1006d500
mov dword [0x101355e0], eax
mov dword [0x101355e4], edx
call fcn.100691d0
mov eax, 1
ret
call fcn.10069b50
xor eax, eax
ret

Function at 0x10069cb0
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x10069cd7
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.1006e270
add esp, 8
xor eax, eax
ret
mov dword [ecx], 1
mov eax, 1
ret
Function at 0x10069d90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push ebp
push esi
call fcn.1006ac50
add esp, 0xc
test eax, eax
je 0x10069ec1
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x10069e34
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x10069ddd
call fcn.1006f410
test eax, eax
je 0x10069ec1
push ebx
push edi
push esi
call fcn.1006f010
jmp 0x10069e17
cmp eax, 0x36002
jne 0x10069dfb
call fcn.10070640
test eax, eax
je 0x10069ec1
push ebx
push edi
push esi
call fcn.100701b0
jmp 0x10069e17
cmp eax, 0x36003
jne 0x10069e22
call fcn.100711a0
test eax, eax
je 0x10069ec1
push ebx
push edi
push esi
call fcn.10070f90
add esp, 0xc
test eax, eax
je 0x10069ec1
push edi
push esi
call fcn.10067100
add esp, 8
test eax, eax
je 0x10069ec1
cmp dword [esi + 0x3c], 0
je 0x10069e94
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.1006aa10
push esi
call fcn.1006b3c0
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x10069eb7
push esi
call fcn.10067b10
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0x10], 0
je 0x10069eb7
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x10069eb7
push esi
call fcn.10069f80
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1006b100
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x14
mov eax, dword [0x1011d900]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
mov dword [0x101363d0], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1006b15e
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [esp + 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x101363c0], xmm0
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x101363c8], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x1006b183
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1006b173
push dword [eax + 4]
jmp 0x1006b185
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x1006b185
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.10067b10
add esp, 4
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x1006b21a
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x14], 0x20001
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1006b21a
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.1006e270
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.10072cfd
add esp, 0x14
ret

Function at 0x1006b230
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x20001
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1006b270
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.1006e270
add esp, 8
add esp, 0xc
ret
Function at 0x1006b280
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x1e8], 0
je 0x1006b2ce
push 0xc
push 1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x20001
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1006b2ce
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.1006e270
add esp, 8
push 0
mov dword [0x101363d0], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x101363c8]
cvttsd2si ecx, qword [0x101363c0]
mov dword [esp + 8], eax
mov dword [esi + 0x2dc], eax
lea eax, [esp + 4]
push eax
push dword [esi + 0x2ac]
mov dword [esp + 0xc], ecx
mov dword [esi + 0x2d8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x68], 0x34001
jne 0x1006b35a
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1006b341
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret

Function at 0x1006b370
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push 0xc
push 1
mov dword [esp + 8], 0x20001
mov eax, dword [eax + 0x2ac]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1006b3b6
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.1006e270
add esp, 8
add esp, 0xc
ret

Function at 0x1006b4e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebp
movzx esi, ax
push 0x11
shr esi, 0xf
call ebp
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebp
mov ebx, edi
or ebx, 4
test ax, ax
push 0x5c
cmovns ebx, edi
call ebp
push 0x5b
mov si, ax
call ebp
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
call ebp
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebp
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret
Function at 0x1006e960
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x164
mov eax, dword [0x1011d900]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
push 0x100
lea eax, [esp + 0x74]
push 0
push eax
call fcn.10075050
push 0x6d1
push 0
push 0x10135cea
call fcn.10075050
mov eax, 0x10135d8a
lea ebx, [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0x10], eax
mov esi, 0x20
sub ebx, 0x480
movsx edi, word [esi*2 + 0x10135a30]
cmp edi, 0xffffffff
je 0x1006eabd
cmp esi, 0x140
jb 0x1006ea5a
cmp esi, 0x14e
ja 0x1006ea5a
mov dword [esp + 0x14], 0x60
mov dword [esp + 0x18], 0x61
mov dword [esp + 0x1c], 0x62
mov dword [esp + 0x20], 0x63
mov dword [esp + 0x24], 0x64
mov dword [esp + 0x28], 0x65
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], 0x67
mov dword [esp + 0x34], 0x68
mov dword [esp + 0x38], 0x69
mov dword [esp + 0x3c], 0x6e
mov dword [esp + 0x40], 0x6f
mov dword [esp + 0x44], 0x6a
mov dword [esp + 0x48], 0x6d
mov dword [esp + 0x4c], 0x6b
mov ebp, dword [ebx]
jmp 0x1006ea65
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x1006ea96
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1006eab9
push 0
push 0
push 5
push dword [esp + 0x1c]
lea eax, [esp + 0x60]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
inc esi
add eax, 5
add ebx, 4
mov dword [esp + 0x10], eax
cmp esi, 0x15c
jle 0x1006e9b5
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10072cfd
add esp, 0x164
ret
Function at 0x1006eda0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1011d900]
xor eax, esp
mov dword [esp + 0x18], eax
push 0x10135618
push 0x10134318
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x1006ede7
push 0x100c15cc
push 0x10008
call fcn.1006e270
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10072cfd
add esp, 0x1c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebx
mov dword [0x101363f8], eax
test eax, eax
jne 0x1006ee22
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.1006e270
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10072cfd
add esp, 0x1c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x101363f8]
mov dword [0x101363fc], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x101363f8]
mov dword [0x10136400], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x101363f8]
mov dword [0x10136404], eax
call edi
push str.GetDpiForWindow
push dword [0x101363f8]
mov dword [0x10136408], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x101363f8]
mov dword [0x1013640c], eax
call edi
push str.GetSystemMetricsForDpi
push dword [0x101363f8]
mov dword [0x10136410], eax
call edi
push str.dinput8.dll
mov dword [0x10136414], eax
call ebx
mov dword [0x101363e0], eax
test eax, eax
je 0x1006eebf
push str.DirectInput8Create
push eax
call edi
mov dword [0x101363e4], eax
push esi
mov dword [esp + 0xc], str.xinput1_4.dll
xor esi, esi
mov dword [esp + 0x10], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [esp + 0x14], str.xinput9_1_0.dll
mov dword [esp + 0x18], str.xinput1_2.dll
mov dword [esp + 0x1c], str.xinput1_1.dll
mov dword [esp + 0x20], 0
push eax
call ebx
mov dword [0x101363ec], eax
test eax, eax
jne 0x1006ef0e
mov eax, dword [esp + esi*4 + 0x10]
inc esi
test eax, eax
jne 0x1006eef7
jmp 0x1006ef2d
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x101363ec]
mov dword [0x101363f0], eax
call edi
mov dword [0x101363f4], eax
push str.dwmapi.dll
call ebx
mov dword [0x10136418], eax
pop esi
test eax, eax
je 0x1006ef81
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x10136418]
mov dword [0x1013641c], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x10136418]
mov dword [0x10136420], eax
call edi
push str.DwmGetColorizationColor
push dword [0x10136418]
mov dword [0x10136424], eax
call edi
mov dword [0x10136428], eax
push str.shcore.dll
call ebx
mov dword [0x1013642c], eax
test eax, eax
je 0x1006efb0
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x1013642c]
mov dword [0x10136430], eax
call edi
mov dword [0x10136434], eax
push str.ntdll.dll
call ebx
mov dword [0x10136438], eax
test eax, eax
je 0x1006efcd
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x1013643c], eax
mov ecx, dword [esp + 0x20]
mov eax, 1
pop edi
pop ebx
xor ecx, esp
call fcn.10072cfd
add esp, 0x1c
ret
Function at 0x100711a0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x10
mov eax, dword [0x1011d900]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [0x10136514], 0
mov dword [esp], str.libOSMesa.dll
mov dword [esp + 4], str.OSMesa.dll
mov dword [esp + 8], 0
je 0x100711e2
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10072cfd
add esp, 0x10
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov ecx, eax
mov dword [0x10136514], ecx
test ecx, ecx
jne 0x10071232
mov eax, dword [esp + esi*4 + 0xc]
inc esi
test eax, eax
jne 0x100711f1
test ecx, ecx
jne 0x10071232
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.10069770
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10072cfd
add esp, 0x10
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push ecx
call esi
push str.OSMesaCreateContextAttribs
push dword [0x10136514]
mov dword [0x10136518], eax
call esi
push str.OSMesaDestroyContext
push dword [0x10136514]
mov dword [0x1013651c], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x10136514]
mov dword [0x10136520], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x10136514]
mov dword [0x10136524], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x10136514]
mov dword [0x10136528], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x10136514]
mov dword [0x1013652c], eax
call esi
cmp dword [0x10136518], 0
mov dword [0x10136530], eax
je 0x100712f8
cmp dword [0x10136520], 0
je 0x100712f8
cmp dword [0x10136524], 0
je 0x100712f8
cmp dword [0x10136528], 0
je 0x100712f8
cmp dword [0x1013652c], 0
je 0x100712f8
test eax, eax
je 0x100712f8
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10072cfd
add esp, 0x10
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.10069770
mov eax, dword [0x10136514]
add esp, 8
test eax, eax
je 0x10071324
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10136514], 0
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10072cfd
add esp, 0x10
ret