joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c9b36c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x74]
mov byte [esp + 0x3a], bl
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x7c]
movzx edx, byte [esp + 0x28]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x34], al
movzx eax, byte [esp + 0x2c]
mov byte [esp + 0x39], dl
mov byte [esp + 0x3b], al
test ecx, ecx
je 0x6c9b38f8
mov ebp, dword [ecx + 4]
movzx esi, byte [ebp + 8]
mov ecx, esi
cmp cl, 7
jbe 0x6c9b38e0
mov edi, dword [esp + 0x24]
sub edi, 1
cmp edi, 1
jbe 0x6c9b3828
mov eax, esi
cmp al, 0x10
je 0x6c9b3877
cmp al, 0x20
je 0x6c9b38b8
cmp al, 0xf
je 0x6c9b3898
mov edx, dword [ebp + 0x18]
mov eax, fcn.6c9b1a40
test edx, edx
mov edx, fcn.6c9af0b0
cmove eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x6c9b3908
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x30]
xor esi, esi
lea ebp, [esp + 0x40]
mov dword [esp + 0x28], 0
lea edi, [eax + 0x24]
movzx eax, byte [esp + 0x3b]
mov dword [esp + 0x30], eax
movzx eax, byte [esp + 0x34]
mov dword [esp + 0x34], eax
lea esi, [esi]
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.6ca16ed0
test eax, eax
je 0x6c9b380b
mov eax, dword [esp + 0x30]
mov dword [esp + 4], ebp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 0x3a]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x39]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
call eax
mov dword [esp + 0x28], eax
add esi, 1
add ebx, 0x10
cmp dword [esp + 0x1c], esi
jne 0x6c9b37b8
mov eax, dword [esp + 0x28]
add esp, 0x50
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, byte [esp + 0x2c]
movzx eax, byte [esp + 0x28]
mov edi, 0x80808081
movzx ebx, bl
imul eax, ecx
mov dword [esp + 0x28], ecx
imul ebx, ecx
movzx ecx, byte [esp + 0x3c]
imul ecx, dword [esp + 0x28]
mul edi
mov eax, ebx
shr edx, 7
mov byte [esp + 0x39], dl
mul edi
mov eax, ecx
shr edx, 7
mov byte [esp + 0x3a], dl
mul edi
mov eax, esi
shr edx, 7
mov byte [esp + 0x34], dl
cmp al, 0x10
jne 0x6c9b3754
cmp dword [ebp + 0xc], 0xf800
mov dword [esp + 0x2c], fcn.6c9acd20
jne 0x6c9b3764
jmp 0x6c9b377a
cmp dword [ebp + 0xc], 0x7c00
mov dword [esp + 0x2c], fcn.6c9ac090
jne 0x6c9b3764
jmp 0x6c9b377a
cmp dword [ebp + 0xc], 0xff0000
jne 0x6c9b3764
mov ecx, dword [ebp + 0x18]
mov edx, fcn.6c9ada30
mov eax, fcn.6c9ae490
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x2c], eax
jmp 0x6c9b377a
mov dword [esp + 0x64], str.SDL_BlendFillRects__:_Unsupported_surface_format
add esp, 0x50
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c942590
mov dword [esp + 0x64], 0x6ca8e160
jmp 0x6c9b38e8
mov dword [esp + 0x28], 0
jmp 0x6c9b3817
Function at 0x6c9cec50
Capabilities:
Hash data with crc32

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x6c9ced37
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add ebx, ecx
lea esi, [esi]
movzx eax, byte [ecx]
xor eax, edx
movzx esi, al
and eax, 1
cmp al, 1
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
and esi, 1
cmp esi, 1
mov edi, eax
sbb eax, eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
and edi, 1
cmp edi, 1
mov esi, eax
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
and esi, 1
cmp esi, 1
mov edi, eax
sbb eax, eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
and edi, 1
cmp edi, 1
mov esi, eax
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
and esi, 1
cmp esi, 1
sbb esi, esi
shr eax, 1
and esi, 0xedb88320
xor esi, eax
and eax, 1
cmp eax, 1
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
shr edx, 8
xor eax, esi
shr eax, 1
xor edx, eax
and esi, 1
je 0x6c9ced20
add ecx, 1
xor edx, 0xff000000
cmp ebx, ecx
jne 0x6c9cec70
pop ebx
mov eax, edx
pop esi
pop edi
ret
add ecx, 1
xor edx, 0x12b88320
cmp ebx, ecx
jne 0x6c9cec70
pop ebx
mov eax, edx
pop esi
pop edi
ret
mov edx, dword [esp + 0x10]
pop ebx
pop esi
pop edi
mov eax, edx
ret

Function at 0x6c9cedf0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x6c9cee78
mov dword [esp], ebx
call fcn.6c9d7ad0
test eax, eax
je 0x6c9cee78
mov eax, dword [0x6cb1c568]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [0x6cb1c56c]
mov dword [esp + 4], eax
call edi
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6c9cee78
mov eax, dword [0x6cb1c56c]
cmp dword [0x6cb1c568], esi
jae 0x6c9cee7a
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6c9d3ad0
test eax, eax
je 0x6c9cee78
mov dword [0x6cb1c568], esi
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [0x6cb1c56c], eax
mov dword [esp + 4], eax
call edi
mov eax, dword [0x6cb1c56c]
sub esp, 0xc
add esp, 0xc
pop ebx
pop esi
pop edi
ret
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
ret
Function at 0x6ca227b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x30]
and eax, 0x45
cmp eax, 5
je 0x6ca227c0
ret
mov edx, 1
mov eax, ecx
jmp fcn.6ca1f4d0

Function at 0x6ca227d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
jmp fcn.6ca1f4d0

Function at 0x6ca228c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
jmp fcn.6ca1f4d0

Function at 0x6ca228d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x30]
and eax, 0x45
cmp eax, 5
je 0x6ca228e0
ret
mov edx, 1
mov eax, ecx
jmp fcn.6ca1f4d0
Function at 0x6ca3f1d0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x6cb1c990]
test eax, eax
je 0x6ca3f1e8
add dword [0x6cb1c98c], 1
xor eax, eax
ret
push ebx
sub esp, 8
mov dword [esp], str.hid.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6cb1c990], eax
sub esp, 4
test eax, eax
je 0x6ca3f390
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.HidD_GetManufacturerString
mov dword [0x6cb1c98c], 1
mov dword [esp], eax
call ebx
mov dword [0x6cb1c988], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidD_GetProductString
mov dword [esp], eax
call ebx
mov dword [0x6cb1c984], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidD_GetPreparsedData
mov dword [esp], eax
call ebx
mov dword [0x6cb1c980], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidD_FreePreparsedData
mov dword [esp], eax
call ebx
mov dword [0x6cb1c97c], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidP_GetCaps
mov dword [esp], eax
call ebx
mov dword [0x6cb1c978], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidP_GetButtonCaps
mov dword [esp], eax
call ebx
mov dword [0x6cb1c974], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidP_GetValueCaps
mov dword [esp], eax
call ebx
mov dword [0x6cb1c970], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidP_MaxDataListLength
mov dword [esp], eax
call ebx
mov dword [0x6cb1c96c], eax
mov eax, dword [0x6cb1c990]
sub esp, 8
mov dword [esp + 4], str.HidP_GetData
mov dword [esp], eax
call ebx
mov ecx, dword [0x6cb1c988]
mov dword [0x6cb1c968], eax
sub esp, 8
test ecx, ecx
je 0x6ca3f360
mov edx, dword [0x6cb1c984]
test edx, edx
je 0x6ca3f360
mov ebx, dword [0x6cb1c980]
test ebx, ebx
je 0x6ca3f360
mov ecx, dword [0x6cb1c97c]
test ecx, ecx
je 0x6ca3f360
mov edx, dword [0x6cb1c978]
test edx, edx
je 0x6ca3f360
mov ebx, dword [0x6cb1c974]
test ebx, ebx
je 0x6ca3f360
mov ecx, dword [0x6cb1c970]
test ecx, ecx
je 0x6ca3f360
mov edx, dword [0x6cb1c96c]
test edx, edx
je 0x6ca3f360
test eax, eax
je 0x6ca3f360
xor eax, eax
add esp, 8
pop ebx
ret
mov edx, dword [0x6cb1c990]
test edx, edx
je 0x6ca3f390
sub dword [0x6cb1c98c], 1
jne 0x6ca3f390
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x6cb1c990], 0
sub esp, 4
lea esi, [esi]
mov eax, 0xffffffff
jmp 0x6ca3f354
Function at 0x6ca3f9e0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x6cb1c9ac]
test eax, eax
je 0x6ca3f9f8
add dword [0x6cb1c9a8], 1
xor eax, eax
ret
push ebx
sub esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp], str.XInput1_4.dll
call ebx
mov edx, 0x10004
mov dword [0x6cb1c9ac], eax
sub esp, 4
test eax, eax
je 0x6ca3fad8
mov dword [0x6cb1c994], edx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6cb1c9a8], 1
mov dword [esp + 4], 0x64
mov dword [esp], eax
call ebx
mov dword [0x6cb1c9a4], eax
sub esp, 8
test eax, eax
je 0x6ca3fb30
mov eax, dword [0x6cb1c9ac]
mov dword [esp + 4], str.XInputSetState
mov dword [esp], eax
call ebx
mov dword [0x6cb1c9a0], eax
mov eax, dword [0x6cb1c9ac]
sub esp, 8
mov dword [esp + 4], str.XInputGetCapabilities
mov dword [esp], eax
call ebx
mov dword [0x6cb1c99c], eax
mov eax, dword [0x6cb1c9ac]
sub esp, 8
mov dword [esp + 4], str.XInputGetBatteryInformation
mov dword [esp], eax
call ebx
mov ebx, dword [0x6cb1c9a4]
mov dword [0x6cb1c998], eax
sub esp, 8
test ebx, ebx
je 0x6ca3fb4f
mov ecx, dword [0x6cb1c9a0]
test ecx, ecx
je 0x6ca3fb4f
mov edx, dword [0x6cb1c99c]
test edx, edx
je 0x6ca3fb4f
xor eax, eax
add esp, 8
pop ebx
ret
mov dword [esp], str.XInput1_3.dll
call ebx
mov dword [0x6cb1c9ac], eax
sub esp, 4
test eax, eax
jne 0x6ca3fb78
mov dword [esp], str.binXInput1_3.dll
call ebx
mov dword [0x6cb1c9ac], eax
sub esp, 4
test eax, eax
jne 0x6ca3fb78
mov dword [esp], str.XInput9_1_0.dll
call ebx
mov edx, 0x10003
mov dword [0x6cb1c9ac], eax
sub esp, 4
test eax, eax
jne 0x6ca3fa20
mov eax, 0xffffffff
jmp 0x6ca3facd
mov eax, dword [0x6cb1c9ac]
mov dword [esp + 4], str.XInputGetState
mov dword [esp], eax
call ebx
mov dword [0x6cb1c9a4], eax
sub esp, 8
jmp 0x6ca3fa53
mov edx, dword [0x6cb1c9ac]
test edx, edx
je 0x6ca3fb24
sub dword [0x6cb1c9a8], 1
jne 0x6ca3fb24
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x6cb1c9ac], 0
push eax
jmp 0x6ca3fb24
mov edx, 0x10003
jmp 0x6ca3fa20
Function at 0x6ca40b10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x28
mov esi, dword [eax + 0xa4]
mov edi, dword [esi + 4]
call fcn.6c971be0
cmp ebx, eax
sete al
mov ebp, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebp
cmp eax, edi
sete dl
cmp cl, dl
je 0x6ca40b7a
cmp eax, edi
je 0x6ca40b88
mov dword [esi + 0x54], 1
lea ebx, [esp + 0x18]
mov dword [esp], 0
call fcn.6c971bf0
call fcn.6ca45350
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_GetClipCursor]
sub esp, 4
test eax, eax
jne 0x6ca40cc0
mov dword [esi + 0x54], 0
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
mov dword [esp + 0x14], eax
mov dword [esp], 1
call ebp
sub esp, 4
test ax, ax
je 0x6ca40bc3
cmp dword [esp + 0x14], 1
sbb eax, eax
and eax, 0xfffffffd
add eax, 4
or byte [esi + 0x44], al
mov dword [esp], 2
call ebp
sub esp, 4
test ax, ax
je 0x6ca40be4
cmp dword [esp + 0x14], 1
sbb eax, eax
and eax, 3
add eax, 1
or byte [esi + 0x44], al
mov dword [esp], 4
call ebp
sub esp, 4
test ax, ax
je 0x6ca40bf9
or byte [esi + 0x44], 2
mov dword [esp], 5
call ebp
sub esp, 4
test ax, ax
je 0x6ca40c0e
or byte [esi + 0x44], 8
mov dword [esp], 6
call ebp
sub esp, 4
test ax, ax
je 0x6ca40c23
or byte [esi + 0x44], 0x10
mov dword [esp], ebx
call fcn.6c971bf0
call fcn.6c973540
mov eax, dword [eax + 0x54]
test eax, eax
je 0x6ca40d10
mov eax, esi
call fcn.6ca407d0
mov dword [esp], ebx
call fcn.6ca4e6a0
mov eax, dword [esi + 0x74]
mov dword [esp], eax
call fcn.6ca40350
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0x14
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x2000
call fcn.6c972500
mov dword [esp], 0x90
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x1000
call fcn.6c972500
mov dword [esp], 0x91
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x8000
call fcn.6c972500
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esi + 0x58]
mov dword [esp + 8], 0x10
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.6c9d7a80
test eax, eax
jne 0x6ca40b73
mov dword [esp], 0
call dword [sym.imp.USER32.dll_ClipCursor]
sub esp, 4
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.6c9d74f0
jmp 0x6ca40b73
lea ebp, [esp + 0x18]
mov dword [esp], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
sub esp, 4
mov dword [esp + 4], ebp
mov dword [esp], edi
call dword [sym.imp.USER32.dll_ScreenToClient]
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.6c973c50
jmp 0x6ca40c3b
Function at 0x6ca44ec0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, 1
sub esp, 0x80c
lea ebp, [esp + 0xc]
mov dword [esp], ebp
call fcn.6c971b10
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
jmp 0x6ca44ef3
add ebx, 1
cmp ebx, 0x80
je 0x6ca44f53
mov esi, dword [ebx*4 + 0x6ca96d80]
test esi, esi
je 0x6ca44ee8
test byte [esp + esi*4 + 0xf], 0x40
jne 0x6ca44ee8
lea eax, [esi - 0x1e]
cmp eax, 9
jbe 0x6ca44ee8
mov dword [esp + 4], 1
mov dword [esp], ebx
call edi
sub esp, 8
test eax, eax
je 0x6ca44ee8
mov dword [esp + 4], 2
mov dword [esp], eax
call edi
sub esp, 8
and eax, 0x7fff
je 0x6ca44ee8
lea ecx, [eax - 0x41]
lea edx, [eax + 0x20]
cmp ecx, 0x1a
cmovb eax, edx
add ebx, 1
mov dword [esp + esi*4 + 0xc], eax
cmp ebx, 0x80
jne 0x6ca44ef3
mov dword [esp + 4], ebp
mov dword [esp + 8], 0x200
mov dword [esp], 0
call fcn.6c971b40
add esp, 0x80c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6ca44f80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push ebx
push ecx
lea ecx, [ebp + 8]
sub esp, 0xc
mov eax, dword [ecx]
mov ebx, dword [eax + 0x414]
xor eax, eax
mov word [ebx + 0x40], ax
lea eax, [ebx + 0xa8]
mov word [ebx + 0x80], dx
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov dword [esp + 8], 0x1400
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.6c9d74f0
mov eax, 1
xor edx, edx
xorps xmm0, xmm0
mov dword [ebx + 0x14bc], eax
lea eax, [ebx + 0x14c4]
mov dword [ebx + 0x14c0], edx
movups xmmword [ebx + 0x14a8], xmm0
mov dword [ebx + 0x14b8], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.6c9d74f0
lea eax, [ebx + 0x14d4]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.6c9d74f0
xorps xmm0, xmm0
mov dword [ebx + 0x14e4], 0
movups xmmword [ebx + 0x14f4], xmm0
movaps xmm0, xmmword [0x6ca96f80]
mov dword [ebx + 0x14e8], 0
mov dword [ebx + 0x14ec], 0
mov dword [ebx + 0x14f0], 0
mov dword [ebx + 0x1504], 0
mov dword [ebx + 0x1508], 0
mov dword [ebx + 0x150c], 0
mov dword [ebx + 0x1510], 0
mov dword [ebx + 0x1524], 0
mov dword [ebx + 0x1528], 0
movups xmmword [ebx + 0x1514], xmm0
call fcn.6ca44ec0
mov dword [esp + 4], str.Menu
mov dword [esp], 0x65
call fcn.6c971bc0
mov dword [esp + 4], str.Left_Windows
mov dword [esp], 0xe3
call fcn.6c971bc0
mov dword [esp + 4], str.Right_Windows
mov dword [esp], 0xe7
call fcn.6c971bc0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0x14
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x2000
call fcn.6c972500
mov dword [esp], 0x90
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x1000
call fcn.6c972500
mov dword [esp], 0x91
call ebx
sub esp, 4
and eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x8000
call fcn.6c972500
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
ret
Function at 0x6ca45350
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x138
lea edi, [esp + 0x38]
mov dword [esp], edi
call dword [sym.imp.USER32.dll_GetKeyboardState]
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], 0x20
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
test eax, eax
je 0x6ca453c6
mov esi, eax
mov ebx, 5
lea ebp, [esp + 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], 0x20
call dword [sym.imp.USER32.dll_ToUnicode]
sub esp, 0x18
test eax, eax
jg 0x6ca453c6
sub ebx, 1
jne 0x6ca45391
add esp, 0x138
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6ca56ea0
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 0x50001
mov dword [esp + 0x10], 0x2100
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov edx, eax
sub esp, 0xc
mov eax, 1
test edx, edx
je 0x6ca56ef0
add esp, 0x18
ret
mov dword [esp], str.Couldnt_register_for_raw_input_events
call fcn.6c942590
xor eax, eax
add esp, 0x18
ret

Function at 0x6ca56f10
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x18
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x50001
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0xc
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
sub esp, 0xc
test eax, eax
je 0x6ca56f58
add esp, 0x18
ret
mov dword [esp], str.Couldnt_unregister_for_raw_input_events
call fcn.6c942590
add esp, 0x18
ret

Function at 0x6ca5f660
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ebx + 0x98]
mov dword [ebx + 0xa8], esi
mov dword [esp + 0x18], 0
test edx, edx
setne al
shl eax, 0x10
test ecx, ecx
je 0x6ca5f6d0
lea esi, [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6ca5f630
mov dword [esp + 4], edx
mov dword [esp], 0
call ecx
mov dword [ebx + 4], eax
test eax, eax
je 0x6ca5f708
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6ca5f600
mov dword [esp + 4], edx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 4], eax
sub esp, 0x18
jmp 0x6ca5f6bb
mov dword [esp + 0x28], 0x6ca9ba08
add esp, 0x1c
pop ebx
pop esi
jmp fcn.6c942590
Function at 0x6ca5f950
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 4
call sub.KERNEL32.dll_GetCurrentThreadId
mov edx, dword [0x6cb1c81c]
mov esi, eax
test edx, edx
je 0x6c9db108
mov eax, dword [0x6cb1c81c]
mov dword [esp], eax
call fcn.6ca5ef20
mov ebx, dword [0x6cb1c818]
test ebx, ebx
jne 0x6c9db0e7
jmp 0x6c9db0ee
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x6c9db0ee
cmp dword [ebx], esi
jne 0x6c9db0e0
mov ebx, dword [ebx + 4]
mov eax, dword [0x6cb1c81c]
mov dword [esp], eax
call fcn.6ca5ef40
add esp, 4
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], 0x6cb1c810
call fcn.6c943ce0
mov eax, dword [0x6cb1c81c]
test eax, eax
je 0x6c9db12b
mov dword [esp], 0x6cb1c810
call fcn.6c943d50
jmp 0x6c9db0c6
call fcn.6ca5ee20
mov ebx, eax
mov dword [0x6cb1c81c], eax
test eax, eax
jne 0x6c9db11d
mov dword [esp], 0x6cb1c810
call fcn.6c943d50
jmp 0x6c9db0fb
sub esp, 4
cmp dword [0x6ca65900], 0xffffffff
mov eax, dword [0x6cb1d384]
je 0x6ca5f980
mov eax, dword [0x6cb1d384]
test eax, eax
jne 0x6ca5f984
mov eax, dword [0x6ca65900]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
add esp, 4
ret
test eax, eax
je 0x6ca5f990
add esp, 4
jmp 0x6c9db0b0
mov dword [esp], 0x6cb1d380
call fcn.6c943ce0
cmp dword [0x6ca65900], 0xffffffff
je 0x6ca5f9b8
mov dword [esp], 0x6cb1d380
call fcn.6c943d50
jmp 0x6ca5f961
mov edx, dword [0x6cb1d384]
test edx, edx
jne 0x6ca5f9a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6ca5f9d4
mov dword [0x6ca65900], eax
jmp 0x6ca5f9a5
mov dword [0x6cb1d384], 1
jmp 0x6ca5f9a5

Function at 0x6ca5f9e0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 8
mov edx, dword [0x6cb1d384]
mov eax, dword [esp + 0xc]
test edx, edx
jne 0x6ca5fa10
mov dword [esp + 4], eax
mov eax, dword [0x6ca65900]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6ca5fa20
xor eax, eax
add esp, 8
ret
add esp, 8
jmp fcn.6c9db150
mov dword [esp + 0xc], str.TlsSetValue___failed
add esp, 8
jmp fcn.6c942590

Function at 0x6ca5ff10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x18
mov eax, dword [0x6cb1d3a0]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x6ca5ff80
lea eax, [ebp - 0x18]
mov edi, 0x3e8
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub esp, 4
sub eax, dword [0x6cb1d398]
sbb edx, dword [0x6cb1d39c]
imul ecx, edx, 0x3e8
mov ebx, dword [0x6cb1d394]
mul edi
mov dword [esp + 0xc], ebx
add edx, ecx
mov ecx, dword [0x6cb1d390]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.6ca613f0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6ca5fdf0
mov dword [esp], str.SDL_TIMER_RESOLUTION
mov dword [0x6cb1d3a0], 1
call fcn.6c942ab0
mov dword [esp], 0x6cb1d390
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esp, 4
mov dword [esp], 0x6cb1d398
call ebx
sub esp, 4
jmp 0x6ca5ff29