joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100586a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009dbcd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10113900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0x10
call fcn.1006f97f
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
lea ebx, [edi + 4]
mov dword [ebp - 4], 0
push ebx
push 0
push esi
push 0x1005e340
push 0
push 0
call fcn.100793f3
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x10058739
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006f8b7
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebx], 0
call fcn.1006e7f0
int3
Function at 0x1005a4f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009de8d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x10113900]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movups xmm0, xmmword [ecx]
mov esi, dword [ebx + 0xc]
movups xmm1, xmmword [edx + 0x10]
mov eax, dword [ebx + 8]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x80], eax
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x78], xmm1
movups xmmword [ebp - 0xa4], xmm0
movups xmm0, xmmword [ecx + 0x20]
psrldq xmm1, 4
movups xmmword [ebp - 0x94], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [ebp - 0x68], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [ebp - 0x58], xmm0
movups xmm0, xmmword [edx + 0x40]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [edx + 0x50]
movq qword [ebp - 0x38], xmm0
movss xmm0, dword [edx + 0xc]
mulss xmm0, dword [esi]
movd edx, xmm1
movss dword [ebp - 0x18], xmm0
mov dword [ebp - 0x7c], edx
cmp edx, 0x3fffffff
ja 0x1005a6a3
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x1005a5b5
mov ecx, eax
jmp 0x1005a600
lea ecx, [edx*4]
cmp ecx, 0x20000
ja 0x1005a5d5
lea eax, [ecx + 0xf]
call fcn.10070700
lea ecx, [esp + 0xf]
and ecx, 0xfffffff0
jmp 0x1005a5fd
xor eax, eax
add ecx, 0x10
setb al
neg eax
or eax, ecx
push eax
call fcn.10081e11
add esp, 4
test eax, eax
je 0x1005a6a3
mov ecx, eax
and ecx, 0xfffffff0
add ecx, 0x10
mov dword [ecx - 4], eax
mov edx, dword [ebp - 0x7c]
lea esi, [edx*4]
mov dword [ebp - 0x1c], 0
cmp esi, 0x20000
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
seta al
mov dword [ebp - 0x20], edx
xor edi, edi
mov byte [ebp - 0x1c], al
cmp dword [ebp - 0x78], edi
cmove edi, ecx
mov dword [ebp - 0x24], edi
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x9c]
push edx
mov edx, dword [ebp - 0x80]
push 1
push dword [edx]
mov edx, dword [ebp - 0xb0]
push 1
push ecx
push dword [eax + 4]
mov ecx, dword [ebp - 0xac]
push dword [ebp - 0xb4]
call fcn.1005b390
add esp, 0x1c
cmp esi, 0x20000
jbe 0x1005a67f
test edi, edi
je 0x1005a67f
push dword [edi - 4]
call fcn.10080ff6
add esp, 4
lea esp, [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006f8b7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10002cb0
int3
Function at 0x1005d3d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009de8d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x10113900]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movups xmm0, xmmword [ecx]
mov esi, dword [ebx + 0xc]
movups xmm1, xmmword [edx + 0x10]
mov eax, dword [ebx + 8]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x80], eax
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x78], xmm1
movups xmmword [ebp - 0xa4], xmm0
movups xmm0, xmmword [ecx + 0x20]
psrldq xmm1, 4
movups xmmword [ebp - 0x94], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [ebp - 0x68], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [ebp - 0x58], xmm0
movups xmm0, xmmword [edx + 0x40]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [edx + 0x50]
movq qword [ebp - 0x38], xmm0
movss xmm0, dword [edx + 0xc]
mulss xmm0, dword [esi]
movd edx, xmm1
movss dword [ebp - 0x18], xmm0
mov dword [ebp - 0x7c], edx
cmp edx, 0x3fffffff
ja 0x1005d57c
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x1005d495
mov ecx, eax
jmp 0x1005d4e0
lea ecx, [edx*4]
cmp ecx, 0x20000
ja 0x1005d4b5
lea eax, [ecx + 0xf]
call fcn.10070700
lea ecx, [esp + 0xf]
and ecx, 0xfffffff0
jmp 0x1005d4dd
xor eax, eax
add ecx, 0x10
setb al
neg eax
or eax, ecx
push eax
call fcn.10081e11
add esp, 4
test eax, eax
je 0x1005d57c
mov ecx, eax
and ecx, 0xfffffff0
add ecx, 0x10
mov dword [ecx - 4], eax
mov edx, dword [ebp - 0x7c]
lea esi, [edx*4]
mov dword [ebp - 0x1c], 0
cmp esi, 0x20000
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
seta al
mov dword [ebp - 0x20], edx
xor edi, edi
mov byte [ebp - 0x1c], al
cmp dword [ebp - 0x78], edi
cmove edi, ecx
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xb0]
push eax
mov eax, dword [ebp - 0x80]
push 1
push dword [eax]
push 1
push ecx
mov ecx, dword [ebp - 0xac]
push 3
push dword [ebp - 0xb4]
call fcn.1005b390
add esp, 0x1c
cmp esi, 0x20000
jbe 0x1005d558
test edi, edi
je 0x1005d558
push dword [edi - 4]
call fcn.10080ff6
add esp, 4
lea esp, [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006f8b7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10002cb0
int3
Function at 0x10065ef0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1012a278], 0
jne 0x10065f09
push 0
push 0x10001
call fcn.100662f0
add esp, 8
ret
jmp fcn.10066d70

Function at 0x10065f70
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1012a278], 0
jne 0x10065f89
push 0
push 0x10001
call fcn.100662f0
add esp, 8
ret
jmp 0x10067480
call dword [sym.imp.USER32.dll_WaitMessage]
jmp fcn.10066d70

Function at 0x100665f0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x1012a278], 0
jne 0x1006669d
push 0x2220
push 0
push 0x1012a278
call fcn.10071a10
movq xmm0, qword [0x101135b4]
add esp, 0xc
mov eax, dword [0x101135bc]
movq qword [0x1012a27c], xmm0
mov dword [0x1012a284], eax
call fcn.1006b030
test eax, eax
je 0x100666a3
push 0x1012b524
call fcn.10066810
add esp, 4
test eax, eax
je 0x100666a3
push 0x1012b514
call fcn.10066830
add esp, 4
test eax, eax
je 0x100666a3
push 0x1012b51c
call fcn.10066830
add esp, 4
test eax, eax
je 0x100666a3
push 0x1012c498
push 0x1012b514
call fcn.100668e0
add esp, 8
call fcn.10064720
mov dword [0x1012a278], 1
call fcn.1006a070
mov dword [0x1012b540], eax
mov dword [0x1012b544], edx
call fcn.10065d50
mov eax, 1
ret
call fcn.100666d0
xor eax, eax
ret

Function at 0x10066830
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x10066857
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.1006ade0
add esp, 8
xor eax, eax
ret
mov dword [ecx], 1
mov eax, 1
ret
Function at 0x10066910
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push ebp
push esi
call fcn.100677c0
add esp, 0xc
test eax, eax
je 0x10066a41
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x100669b4
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x1006695d
call fcn.1006bf90
test eax, eax
je 0x10066a41
push ebx
push edi
push esi
call fcn.1006bb80
jmp 0x10066997
cmp eax, 0x36002
jne 0x1006697b
call fcn.1006d1c0
test eax, eax
je 0x10066a41
push ebx
push edi
push esi
call fcn.1006cd30
jmp 0x10066997
cmp eax, 0x36003
jne 0x100669a2
call fcn.1006dd10
test eax, eax
je 0x10066a41
push ebx
push edi
push esi
call fcn.1006db00
add esp, 0xc
test eax, eax
je 0x10066a41
push edi
push esi
call fcn.10063c80
add esp, 8
test eax, eax
je 0x10066a41
cmp dword [esi + 0x3c], 0
je 0x10066a14
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.10067580
push esi
call fcn.10067f30
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x10066a37
push esi
call fcn.10064690
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0x10], 0
je 0x10066a37
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x10066a37
push esi
call fcn.10066b00
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10067c70
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x14
mov eax, dword [0x10113900]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
mov dword [0x1012c330], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10067cce
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [esp + 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x1012c320], xmm0
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x1012c328], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x10067cf3
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x10067ce3
push dword [eax + 4]
jmp 0x10067cf5
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x10067cf5
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.10064690
add esp, 4
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x10067d8a
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x14], 0x20001
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10067d8a
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.1006ade0
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.1006f8b7
add esp, 0x14
ret

Function at 0x10067da0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x20001
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10067de0
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.1006ade0
add esp, 8
add esp, 0xc
ret
Function at 0x10067df0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x1e8], 0
je 0x10067e3e
push 0xc
push 1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x20001
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10067e3e
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.1006ade0
add esp, 8
push 0
mov dword [0x1012c330], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x1012c328]
cvttsd2si ecx, qword [0x1012c320]
mov dword [esp + 8], eax
mov dword [esi + 0x2dc], eax
lea eax, [esp + 4]
push eax
push dword [esi + 0x2ac]
mov dword [esp + 0xc], ecx
mov dword [esi + 0x2d8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x68], 0x34001
jne 0x10067eca
mov eax, dword [esi + 0x40]
test eax, eax
je 0x10067eb1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
add esp, 0xc
ret

Function at 0x10067ee0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push 0xc
push 1
mov dword [esp + 8], 0x20001
mov eax, dword [eax + 0x2ac]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10067f26
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.1006ade0
add esp, 8
add esp, 0xc
ret

Function at 0x10068050
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebp
movzx esi, ax
push 0x11
shr esi, 0xf
call ebp
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebp
mov ebx, edi
or ebx, 4
test ax, ax
push 0x5c
cmovns ebx, edi
call ebp
push 0x5b
mov si, ax
call ebp
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
call ebp
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebp
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret
Function at 0x1006b4d0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x164
mov eax, dword [0x10113900]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
push 0x100
lea eax, [esp + 0x74]
push 0
push eax
call fcn.10071a10
push 0x6d1
push 0
push 0x1012bc4a
call fcn.10071a10
mov eax, 0x1012bcea
lea ebx, [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0x10], eax
mov esi, 0x20
sub ebx, 0x480
movsx edi, word [esi*2 + 0x1012b990]
cmp edi, 0xffffffff
je 0x1006b62d
cmp esi, 0x140
jb 0x1006b5ca
cmp esi, 0x14e
ja 0x1006b5ca
mov dword [esp + 0x14], 0x60
mov dword [esp + 0x18], 0x61
mov dword [esp + 0x1c], 0x62
mov dword [esp + 0x20], 0x63
mov dword [esp + 0x24], 0x64
mov dword [esp + 0x28], 0x65
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], 0x67
mov dword [esp + 0x34], 0x68
mov dword [esp + 0x38], 0x69
mov dword [esp + 0x3c], 0x6e
mov dword [esp + 0x40], 0x6f
mov dword [esp + 0x44], 0x6a
mov dword [esp + 0x48], 0x6d
mov dword [esp + 0x4c], 0x6b
mov ebp, dword [ebx]
jmp 0x1006b5d5
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x1006b606
push 0
push 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
push ebp
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1006b629
push 0
push 0
push 5
push dword [esp + 0x1c]
lea eax, [esp + 0x60]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
inc esi
add eax, 5
add ebx, 4
mov dword [esp + 0x10], eax
cmp esi, 0x15c
jle 0x1006b525
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006f8b7
add esp, 0x164
ret
Function at 0x1006b910
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10113900]
xor eax, esp
mov dword [esp + 0x18], eax
push 0x1012b578
push 0x1012a278
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x1006b957
push 0x100bd53c
push 0x10008
call fcn.1006ade0
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1006f8b7
add esp, 0x1c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebx
mov dword [0x1012c358], eax
test eax, eax
jne 0x1006b992
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.1006ade0
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1006f8b7
add esp, 0x1c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x1012c358]
mov dword [0x1012c35c], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x1012c358]
mov dword [0x1012c360], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x1012c358]
mov dword [0x1012c364], eax
call edi
push str.GetDpiForWindow
push dword [0x1012c358]
mov dword [0x1012c368], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x1012c358]
mov dword [0x1012c36c], eax
call edi
push str.GetSystemMetricsForDpi
push dword [0x1012c358]
mov dword [0x1012c370], eax
call edi
push str.dinput8.dll
mov dword [0x1012c374], eax
call ebx
mov dword [0x1012c340], eax
test eax, eax
je 0x1006ba2f
push str.DirectInput8Create
push eax
call edi
mov dword [0x1012c344], eax
push esi
mov dword [esp + 0xc], str.xinput1_4.dll
xor esi, esi
mov dword [esp + 0x10], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [esp + 0x14], str.xinput9_1_0.dll
mov dword [esp + 0x18], str.xinput1_2.dll
mov dword [esp + 0x1c], str.xinput1_1.dll
mov dword [esp + 0x20], 0
push eax
call ebx
mov dword [0x1012c34c], eax
test eax, eax
jne 0x1006ba7e
mov eax, dword [esp + esi*4 + 0x10]
inc esi
test eax, eax
jne 0x1006ba67
jmp 0x1006ba9d
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x1012c34c]
mov dword [0x1012c350], eax
call edi
mov dword [0x1012c354], eax
push str.dwmapi.dll
call ebx
mov dword [0x1012c378], eax
pop esi
test eax, eax
je 0x1006baf1
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x1012c378]
mov dword [0x1012c37c], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x1012c378]
mov dword [0x1012c380], eax
call edi
push str.DwmGetColorizationColor
push dword [0x1012c378]
mov dword [0x1012c384], eax
call edi
mov dword [0x1012c388], eax
push str.shcore.dll
call ebx
mov dword [0x1012c38c], eax
test eax, eax
je 0x1006bb20
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x1012c38c]
mov dword [0x1012c390], eax
call edi
mov dword [0x1012c394], eax
push str.ntdll.dll
call ebx
mov dword [0x1012c398], eax
test eax, eax
je 0x1006bb3d
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x1012c39c], eax
mov ecx, dword [esp + 0x20]
mov eax, 1
pop edi
pop ebx
xor ecx, esp
call fcn.1006f8b7
add esp, 0x1c
ret
Function at 0x1006dd10
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x10
mov eax, dword [0x10113900]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [0x1012c474], 0
mov dword [esp], str.libOSMesa.dll
mov dword [esp + 4], str.OSMesa.dll
mov dword [esp + 8], 0
je 0x1006dd52
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1006f8b7
add esp, 0x10
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov ecx, eax
mov dword [0x1012c474], ecx
test ecx, ecx
jne 0x1006dda2
mov eax, dword [esp + esi*4 + 0xc]
inc esi
test eax, eax
jne 0x1006dd61
test ecx, ecx
jne 0x1006dda2
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.100662f0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1006f8b7
add esp, 0x10
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push ecx
call esi
push str.OSMesaCreateContextAttribs
push dword [0x1012c474]
mov dword [0x1012c478], eax
call esi
push str.OSMesaDestroyContext
push dword [0x1012c474]
mov dword [0x1012c47c], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x1012c474]
mov dword [0x1012c480], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x1012c474]
mov dword [0x1012c484], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x1012c474]
mov dword [0x1012c488], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x1012c474]
mov dword [0x1012c48c], eax
call esi
cmp dword [0x1012c478], 0
mov dword [0x1012c490], eax
je 0x1006de68
cmp dword [0x1012c480], 0
je 0x1006de68
cmp dword [0x1012c484], 0
je 0x1006de68
cmp dword [0x1012c488], 0
je 0x1006de68
cmp dword [0x1012c48c], 0
je 0x1006de68
test eax, eax
je 0x1006de68
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1006f8b7
add esp, 0x10
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.100662f0
mov eax, dword [0x1012c474]
add esp, 8
test eax, eax
je 0x1006de94
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1012c474], 0
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1006f8b7
add esp, 0x10
ret
Function at 0x10074f74
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10070be0
mov eax, dword [0x10113900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10085825
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10074fb6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10075112
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10097740
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1012d478]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.10085a34
mov ecx, dword [esi*4 + 0x1012d478]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1007510b
cmp eax, dword [ecx + edi + 0x24]
jne 0x1007510b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007510b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10085a34
add esp, 0x14
test edx, edx
jl 0x1007510b
jg 0x10075081
test eax, eax
jb 0x1007510b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1007510b
jl 0x1007509b
cmp dword [ebp - 0x1008], eax
ja 0x1007510b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100750b9
test ebx, ebx
je 0x100750f2
cmp ecx, edi
jae 0x100750f2
mov al, byte [ecx]
cmp al, 0xd
jne 0x100750d3
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100750df
cmp byte [ecx + 1], 0xa
jne 0x100750df
inc ecx
jmp 0x100750df
movzx eax, al
movsx eax, byte [eax + 0x10113b80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100750b9
cmp edx, ebx
jne 0x100750b9
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10075110
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1006f8b7
leave
ret

Function at 0x10084440
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1008447f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008447f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008447f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1008447f
cmp dword [ecx + 0x74], 0xe
jbe 0x1008447f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret