joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400506e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140050714
cmp ecx, r10d
jge 0x140050702
mov rcx, rbx
call fcn.14004fee0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14005074e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x140050730
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x140050776
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1400507a5
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14005078f
xor dl, dl
jmp 0x140050798
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140050786
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140050752
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14005080f
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140050829
mov rcx, rbx
call fcn.140050030
test eax, eax
je 0x140050802
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14005a9f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x160
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1400fddb8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdx, qword [0x140101c80]
mov rsi, rcx
cmp dword [rdx + 0x4090], 0
mov rax, qword [rdx + 0x3fe0]
movss xmm6, dword [rax + 0x118]
movss xmm7, dword [rax + 0x11c]
je 0x14005aa6b
movups xmm1, xmmword [rdx + 0x40bc]
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xff
unpcklps xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0x20], xmm1
shufps xmm0, xmm0, 0x55
movaps xmm6, xmm1
movaps xmm7, xmm0
lea r9, str.dropdown1
mov edx, 0xff
lea r8, str.DropDown__s
lea rcx, [rsp + 0x30]
call fcn.140004580
xor dil, dil
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x14005aa97
mov ebx, 0xffffffff
test eax, eax
je 0x14005aadc
lea rdx, [rsp + 0x30]
movsxd r8, eax
lea r10, [0x1400a11d0]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
sub r8, 1
jne 0x14005aac0
jmp 0x14005ab26
movzx r9d, byte [rsp + 0x30]
lea r8, [rsp + 0x31]
mov edx, ebx
test r9b, r9b
je 0x14005ab24
lea r10, [0x1400a11d0]
cmp r9b, 0x23
jne 0x14005ab07
cmp byte [r8], r9b
jne 0x14005ab07
cmp byte [r8 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r10 + rcx*4]
test r9b, r9b
jne 0x14005aaf5
mov ebx, edx
mov rax, qword [0x140102410]
not ebx
mov rcx, qword [0x140102418]
cmp rax, rcx
je 0x14005ab53
nop dword [rax + rax]
cmp dword [rax], ebx
je 0x14005ab4f
add rax, 8
cmp rax, rcx
jne 0x14005ab40
jmp 0x14005ab53
movzx edi, byte [rax + 4]
cmp byte [rsi], 0
je 0x14005ab66
test dil, dil
jne 0x14005abf4
mov dil, 1
jmp 0x14005ab6f
test dil, dil
je 0x14005abf4
mov rax, qword [0x140101c80]
xor ecx, ecx
xor edx, edx
mov r8d, 0x200147
or dword [rax + 0x40f0], 1
mov qword [rax + 0x410c], rcx
lea rcx, [rsp + 0x30]
movss dword [rax + 0x4104], xmm6
movss dword [rax + 0x4108], xmm7
mov dword [rax + 0x40f4], 1
mov byte [rax + 0x412c], 1
call fcn.140010420
mov rdx, qword [0x140102430]
cmp rdx, qword [0x140102438]
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x24], dil
je 0x14005abe6
mov rax, qword [rsp + 0x20]
mov qword [rdx], rax
mov al, 1
add qword [0x140102430], 8
jmp 0x14005abf6
lea r8, [rsp + 0x20]
call fcn.14005ac30
mov al, 1
jmp 0x14005abf6
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140095500
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140072050
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140072078
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14007209e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400720a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400720f9
test ecx, ecx
jle 0x1400720d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400720f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400720f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140072120
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140072142
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140072158
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140072174
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140072176
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400721b2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14007224e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400721ed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14007222e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14007224e
cmp rbx, rax
ja 0x140072200
test rbx, rbx
je 0x14007224e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140072660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400fddb8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14007268d
xor eax, eax
jmp 0x1400727ea
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400726b8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400726b8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400727ea
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400727dd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400726fb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140072726
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400727e2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140072795
sub eax, 1
je 0x140072795
cmp eax, 2
jne 0x1400727dd
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400727e2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400727c3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400727dd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400727e2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140095500
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140072bd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400fddb8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140072ca3
cmp byte [rcx + 0x71], 0
je 0x140072ca3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140072c9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140072c64
sub eax, 1
je 0x140072c68
cmp eax, 2
jne 0x140072c9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140095500
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140072c96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140072c9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140072c4c
xor al, al
jmp 0x140072c4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140095500
add rsp, 0x60
pop rbx
ret
Function at 0x1400856a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400856f7
jmp 0x1400857e9
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140085730
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.140093d00
jmp 0x1400857e9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140085769
lea rdx, [0x1400f7f20]
mov ecx, 0x10008
call fcn.140093d00
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400857e9
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1400fffc0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400857cd
lea rdx, [0x1400f7f48]
mov ecx, 0x10008
call fcn.140093d00
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400857e9
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret
Function at 0x140085800
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [0x1400fffc0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14008583e
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140093d00
xor eax, eax
jmp 0x1400858da
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140085871
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140093d00
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400858da
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400858a4
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.140093d00
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400858da
mov rcx, qword [0x1400fffd8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.140093930
mov qword [0x1400fffd8], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1400fffd8]
add rsp, 0x30
pop rdi
ret
Function at 0x1400873a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x120
mov rdi, rsp
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400fddb8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140087446
cmp dword [rsp + 0x40], 0x12
jne 0x14008742e
mov rax, qword [0x1400fed00]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x14008742c
mov rcx, qword [rsp + 0x80]
call fcn.140083030
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
jmp 0x1400873ff
jmp 0x140087444
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400873ca
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400875d4
lea rdx, str.GLFW
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetPropW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400875d4
mov dword [rsp + 0x98], 0xa0
mov dword [rsp + 0x9c], 0x154
mov dword [rsp + 0xa0], 0xa1
mov dword [rsp + 0xa4], 0x158
mov dword [rsp + 0xa8], 0x5b
mov dword [rsp + 0xac], 0x157
mov dword [rsp + 0xb0], 0x5c
mov dword [rsp + 0xb4], 0x15b
mov dword [rsp + 0x88], 0
jmp 0x1400874fb
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 4
jge 0x1400875d4
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 1
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rsp + 0xc8]
lea rcx, [0x1401003e0]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0xcc], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140087585
jmp 0x1400874eb
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
movsx eax, byte [rcx + rax + 0x88]
cmp eax, 1
je 0x1400875a7
jmp 0x1400874eb
call fcn.1400889e0
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
call fcn.14007e9e0
jmp 0x1400874eb
mov rax, qword [0x140100d80]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140087677
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd4]
mov rcx, qword [rsp + 0x80]
call fcn.140085fb0
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x388], eax
jne 0x140087647
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x38c], eax
je 0x140087677
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm0, eax
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm1, eax
movaps xmm2, xmm0
mov rcx, qword [rsp + 0x80]
call fcn.140085230
mov rcx, rsp
lea rdx, [0x14009ba08]
call fcn.1400960e4
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140095500
add rsp, 0x120
pop rdi
ret
Function at 0x140088370
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x350]
mov qword [rsp + 0x30], rax
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400883e6
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.140093d00
mov rcx, rsp
lea rdx, [0x14009bdf0]
call fcn.1400960e4
add rsp, 0x50
pop rdi
ret

Function at 0x140088410
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x14008847e
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.140093d00
mov rcx, rsp
lea rdx, [0x14009be50]
call fcn.1400960e4
add rsp, 0x50
pop rdi
ret

Function at 0x1400889e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov dword [rsp + 0x20], 0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140088a1d
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140088a3d
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140088a5d
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x140088a95
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140088ab3
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140088ad1
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14008b850
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x14008b894
mov r8d, 0x29
lea rdx, [0x1400f82c0]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x14008b8c2
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.140093d00
xor eax, eax
jmp 0x14008b8d2
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14008b940
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14008b984
mov r8d, 0x40
lea rdx, [0x1400f83a0]
lea rcx, [0x1400f8410]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x14008b9a0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14008b9e9
mov r8d, 0x46
lea rdx, [0x1400f8460]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret