joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054fe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140154f00]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005500d
xor eax, eax
jmp 0x140055162
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140055038
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140055038
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140055162
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140055155
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14005507b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400550a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005515a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055115
sub eax, 1
je 0x140055115
cmp eax, 2
jne 0x140055155
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005515a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140055143
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140055155
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14005515a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008da00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140055a60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140154f00]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140055b33
cmp byte [rcx + 0x71], 0
je 0x140055b33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140055b2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055af4
sub eax, 1
je 0x140055af8
cmp eax, 2
jne 0x140055b2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008da00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140055b26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140055b2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140055adc
xor al, al
jmp 0x140055adc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008da00
add rsp, 0x60
pop rbx
ret
Function at 0x140058550
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140058581
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rdi
mov rdi, qword [0x14015e908]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x14015e918]
lea rdx, [rbx + rbx]
call fcn.1400563f0
mov rdx, qword [0x14015e908]
lea r9, [rbx - 1]
mov qword [0x14015e930], r9
mov qword [0x14015e938], rbx
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x140058726
mov qword [rsp + 0x30], rsi
mov rcx, rdx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rbx
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rbx
xor r11, rax
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x14015e918]
mov r10, qword [r11]
cmp r10, rdi
jne 0x14005866c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400586e7
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400586a9
mov r10, qword [rax]
cmp r10, rcx
je 0x1400586a3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400586e7
mov r8, rax
cmp r10, rax
je 0x1400586c3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1400586fb
cmp r10, rax
jne 0x1400586b1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
je 0x140058721
mov r9, qword [0x14015e930]
jmp 0x1400585f1
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400586e7
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x1400623e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140062423
jmp 0x140062515
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14006245c
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.14006c820
jmp 0x140062515
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140062495
lea rdx, [0x14014af80]
mov ecx, 0x10008
call fcn.14006c820
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140062515
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x140156c28]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400624f9
lea rdx, [0x14014afa8]
mov ecx, 0x10008
call fcn.14006c820
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140062515
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret

Function at 0x140062530
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rcx, qword [0x140156c28]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14006255f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14006c820
xor eax, eax
jmp 0x1400625fb
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140062592
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.14006c820
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400625fb
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400625c5
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.14006c820
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400625fb
mov rcx, qword [0x140156c40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.14006c470
mov qword [0x140156c40], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x140156c40]
add rsp, 0x30
pop rdi
ret
Function at 0x140064040
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x30]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140154f00]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400640e8
cmp dword [rsp + 0x40], 0x12
jne 0x1400640d0
mov rax, qword [0x140155960]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400640ce
mov rcx, qword [rsp + 0x80]
call fcn.14005fe00
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
jmp 0x1400640a1
jmp 0x1400640e6
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14006406c
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x140064276
lea rdx, str.GLFW
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetPropW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140064276
mov dword [rsp + 0x98], 0xa0
mov dword [rsp + 0x9c], 0x154
mov dword [rsp + 0xa0], 0xa1
mov dword [rsp + 0xa4], 0x158
mov dword [rsp + 0xa8], 0x5b
mov dword [rsp + 0xac], 0x157
mov dword [rsp + 0xb0], 0x5c
mov dword [rsp + 0xb4], 0x15b
mov dword [rsp + 0x88], 0
jmp 0x14006419d
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 4
jge 0x140064276
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 1
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rsp + 0xc8]
lea rcx, [0x140157048]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0xcc], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140064227
jmp 0x14006418d
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
movsx eax, byte [rcx + rax + 0x90]
cmp eax, 1
je 0x140064249
jmp 0x14006418d
call fcn.140065720
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
call fcn.14005bc00
jmp 0x14006418d
mov rax, qword [0x1401579e8]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140064319
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd4]
mov rcx, qword [rsp + 0x80]
call fcn.140062c80
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x394], eax
jne 0x1400642e9
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x398], eax
je 0x140064319
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm0, eax
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm1, eax
movaps xmm2, xmm0
mov rcx, qword [rsp + 0x80]
call fcn.140061fa0
mov rcx, rsp
lea rdx, [0x140093ba0]
call fcn.14008e5a8
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.14008da00
add rsp, 0x120
pop rdi
ret
Function at 0x1400650d0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x358]
mov qword [rsp + 0x30], rax
mov r8d, sendto
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140065148
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.14006c820
mov rcx, rsp
lea rdx, [0x140093e90]
call fcn.14008e5a8
add rsp, 0x50
pop rdi
ret

Function at 0x140065170
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, sendto
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400651e0
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.14006c820
mov rcx, rsp
lea rdx, [0x140093ee0]
call fcn.14008e5a8
add rsp, 0x50
pop rdi
ret

Function at 0x140065720
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, sendto
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14006574e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, sendto
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14006576e
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, sendto
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14006578e
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x1400657c6
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400657e4
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140065802
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14006ab40
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x14006ab70
mov r8d, 0x29
lea rdx, [0x14014bfe0]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x14006ab9e
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.14006c820
xor eax, eax
jmp 0x14006abae
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14006ac00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14006ac30
mov r8d, 0x40
lea rdx, [0x14014c0b0]
lea rcx, [0x14014c110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x14006ac50
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14006ac85
mov r8d, 0x46
lea rdx, [0x14014c160]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x14006c970
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140154f00]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x140157302]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x20
jmp 0x14006c9d5
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x14006cbd9
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140157048]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x14006ca06
jmp 0x14006c9cb
cmp dword [rsp + 0x40], 0x140
jl 0x14006cae2
cmp dword [rsp + 0x40], 0x14e
jg 0x14006cae2
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], WSAStartup
mov dword [rsp + 0x1e0], WSAStartup
mov dword [rsp + 0x1e4], WSAStartup
mov dword [rsp + 0x1e8], WSAStartup
mov dword [rsp + 0x1ec], WSAStartup
mov dword [rsp + 0x1f0], WSAStartup
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x14006cafb
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], sendto
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x14006cb75
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], sendto
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x14006cb84
jmp 0x14006c9cb
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x140157302]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x14006c9cb
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14008e5a8
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14008da00
add rsp, 0x220
pop rdi
ret
Function at 0x140072670
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140154f00]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x140157c58], 0
je 0x1400726cb
mov eax, 1
jmp 0x14007284b
mov dword [rsp + 0x20], 0
jmp 0x1400726df
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x140072711
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140157c58], rax
cmp qword [0x140157c58], 0
je 0x14007270f
jmp 0x140072711
jmp 0x1400726d5
cmp qword [0x140157c58], 0
jne 0x140072733
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400616d0
xor eax, eax
jmp 0x14007284b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c60], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c68], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c70], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c78], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c80], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c88], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x140157c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140157c90], rax
cmp qword [0x140157c60], 0
je 0x14007282c
cmp qword [0x140157c70], 0
je 0x14007282c
cmp qword [0x140157c78], 0
je 0x14007282c
cmp qword [0x140157c80], 0
je 0x14007282c
cmp qword [0x140157c88], 0
je 0x14007282c
cmp qword [0x140157c90], 0
jne 0x140072846
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400616d0
call fcn.140072880
xor eax, eax
jmp 0x14007284b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140095f90]
call fcn.14008e5a8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008da00
add rsp, 0x70
pop rdi
ret