joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f85c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10190782
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 4], 0x101e5bb4
mov eax, 1
mov dword [esi + 0x30], vtable.ert_RefCounter.0
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 4]
mov dword [esi], vtable.ebs_Object.1.0
mov edx, dword [ecx + 4]
mov dword [esp + 8], eax
mov dword [edx + esi + 4], vtable.ebs_Object.0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
mov dword [esi], vtable.vde_DetInfo.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.vde_DetInfo.1.0
lea ecx, [esi + 8]
call fcn.1004b3d0
mov eax, esi
mov byte [esp + 0x14], 2
call fcn.100f8520
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 0x28]
push eax
mov ecx, esi
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x10109ca0
Capabilities:
Enumerate pe sections

Disassembly:
cmp eax, ecx
je 0x10109cf1
movzx edx, byte [ecx]
mov byte [eax], dl
movzx edx, byte [ecx + 1]
mov byte [eax + 1], dl
movzx edx, byte [ecx + 2]
mov byte [eax + 2], dl
movzx edx, byte [ecx + 3]
mov byte [eax + 3], dl
movzx edx, byte [ecx + 4]
mov byte [eax + 4], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov dx, word [ecx + 6]
mov word [eax + 6], dx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x14], edx
mov cl, byte [ecx + 5]
mov byte [eax + 5], cl
ret

Function at 0x1010cea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10193e37
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 4], 0x101cc204
mov eax, 1
mov dword [esi + 0x2c], vtable.ert_RefCounter.0
mov dword [esi + 0x30], eax
mov ecx, dword [esi + 4]
mov dword [esi], vtable.ebs_Object.1.0
mov edx, dword [ecx + 4]
mov dword [esp + 8], eax
mov dword [edx + esi + 4], vtable.ebs_Object.0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
mov dword [esi], vtable.vcf_Patch.0
mov ecx, dword [eax + 4]
mov eax, esi
mov dword [ecx + esi + 4], vtable.vcf_Patch.1.0
call fcn.1010cde0
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 0x28]
push eax
mov ecx, esi
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x10112700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a0715
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x6c]
mov esi, dword [ebp + 0xc]
mov edx, dword [esi]
push eax
mov eax, dword [edx]
mov ecx, esi
call eax
mov ebx, dword [ebp + 8]
push ebx
lea ecx, [esp + 0x34]
call fcn.100e27b0
or ecx, 0xffffffff
lea eax, [esp + 0x18]
mov dword [esp + 0x70], 0
call fcn.10065e40
mov byte [esp + 0x70], 1
fldz
mov edx, dword [edi]
mov eax, dword [edx + 0x30]
push ecx
mov ecx, edi
fstp dword [esp]
call eax
mov edx, dword [edi]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
mov eax, dword [edx + 0x2c]
push ecx
mov ecx, edi
fmul qword [0x101e9328]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
push ecx
lea eax, [esp + 0x2c]
fmul qword [0x101e9328]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fstp dword [esp]
call fcn.1004b450
mov edi, eax
push ecx
lea ecx, [esp + 0x1c]
mov eax, esp
mov byte [esp + 0x74], 3
mov dword [esp + 0x18], esp
call fcn.10065e30
push esi
push edi
lea ecx, [esp + 0x3c]
push ecx
push esi
call fcn.1000d590
or ecx, 0xffffffff
lea eax, [esp + 0x18]
call fcn.10065e40
fldz
sub esp, 0xc
fst dword [esp + 8]
fst dword [esp + 4]
lea eax, [esp + 0x2c]
fstp dword [esp]
call fcn.1004b450
mov edi, eax
push ecx
mov byte [esp + 0x74], 4
fld dword [ebx + 0x14]
lea ecx, [esp + 0x1c]
fstp dword [esp + 0x18]
mov eax, esp
mov dword [esp + 0x20], esp
call fcn.10065e30
push esi
fld dword [esp + 0x1c]
push edi
push ecx
fstp dword [esp]
call fcn.1000d960
push ecx
or ecx, 0xffffffff
mov eax, esp
mov dword [esp + 0x20], esp
call fcn.10065e40
fldz
sub esp, 0xc
fstp dword [esp + 8]
fld dword [ebx + 0x10]
lea eax, [esp + 0x30]
fstp dword [esp + 4]
fld dword [ebx + 0xc]
fstp dword [esp]
call fcn.1004b450
push eax
mov eax, esi
mov byte [esp + 0x78], 5
call fcn.1000d2a0
lea eax, [esi + 0x7c]
lea ecx, [esp + 0x30]
call fcn.1004e890
lea ecx, [esp + 0x5c]
call fcn.1004e870
mov al, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10113790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10193e37
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 4], 0x101cc204
mov eax, 1
mov dword [esi + 0x2c], vtable.ert_RefCounter.0
mov dword [esi + 0x30], eax
mov ecx, dword [esi + 4]
mov dword [esi], vtable.ebs_Object.1.0
mov edx, dword [ecx + 4]
mov dword [esp + 8], eax
mov dword [edx + esi + 4], vtable.ebs_Object.0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
mov dword [esi], vtable.vcf_Specs.0
mov ecx, dword [eax + 4]
mov eax, esi
mov dword [ecx + esi + 4], vtable.vcf_Specs.1.0
call fcn.101136e0
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 0x28]
push eax
mov ecx, esi
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x10118b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195e7c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi - 0x338]
mov dword [esi - 0x33c], 0x101d7f84
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x338], 0x101d7fd0
lea edi, [esi - 8]
mov ecx, edi
mov dword [esp + 0x18], 8
call fcn.10117eb0
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0xc8]
push edi
mov byte [esp + 0x1c], 7
call fcn.10001b50
lea ecx, [esi - 0xd0]
mov dword [edi + 0x1c], vtable.ert_RefCounter.0
call fcn.100817b0
lea edi, [esi - 0x110]
push edi
mov dword [ecx], vtable.ert_RefCounter.0
mov byte [esp + 0x1c], 5
call fcn.1002ce10
mov dword [edi + 0x30], vtable.ert_RefCounter.0
lea edi, [esi - 0x118]
mov ecx, edi
mov byte [esp + 0x18], 4
call fcn.10019760
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0x228]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.1000ab00
lea ecx, [esi - 0x308]
mov dword [edi], vtable.ert_RefCounter.0
mov byte [esp + 0x18], 2
call fcn.10063be0
lea ecx, [esi - 0x320]
mov byte [esp + 0x18], 1
call fcn.10063be0
add esi, 0xfffffccc
mov ecx, esi
mov byte [esp + 0x18], 0
call fcn.10063be0
mov ecx, esi
call fcn.1011f230
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1011c400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195d74
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esi - 0x2f0]
mov dword [esi - 0x2f4], 0x101d84c4
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x2f0], 0x101d8510
lea edi, [esi - 0x24]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x20], 9
je 0x1011c45f
lea eax, [edi + 0x14]
jmp 0x1011c461
xor eax, eax
lea ecx, [eax + 8]
call fcn.1005e680
cmp byte [edi + 0x11], bl
mov dword [edi], vtable.ert_TmplArr_unsigned_char_.0
je 0x1011c484
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x1011c484
push eax
call fcn.10178e5d
add esp, 4
mov ebp, vtable.ert_RefCounter.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x11], bl
mov dword [edi + 0x1c], ebp
lea edi, [esi - 0x48]
push edi
mov byte [esp + 0x24], 8
call fcn.10001b50
lea ecx, [esi - 0x50]
mov dword [edi + 0x1c], ebp
call fcn.100817b0
lea edi, [esi - 0x90]
push edi
mov dword [ecx], ebp
mov byte [esp + 0x24], 6
call fcn.1002ce10
mov dword [edi + 0x30], ebp
lea edi, [esi - 0xc8]
push edi
mov byte [esp + 0x24], 5
call fcn.1002ce10
mov dword [edi + 0x30], ebp
lea edi, [esi - 0xd0]
mov ecx, edi
mov byte [esp + 0x20], 4
call fcn.10019760
mov dword [edi], ebp
lea edi, [esi - 0x1e0]
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.1000ab00
lea ecx, [esi - 0x2c0]
mov dword [edi], ebp
mov byte [esp + 0x20], 2
call fcn.10063be0
lea ecx, [esi - 0x2d8]
mov byte [esp + 0x20], 1
call fcn.10063be0
add esi, 0xfffffd14
mov ecx, esi
mov byte [esp + 0x20], bl
call fcn.10063be0
mov ecx, esi
call fcn.1011f230
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1011df00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195cc9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi - 0x35c]
mov dword [esi - 0x360], 0x101d8734
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x35c], 0x101d8780
lea edi, [esi - 0x24]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x1c], 9
je 0x1011df5e
lea eax, [edi + 0x14]
jmp 0x1011df60
xor eax, eax
lea ecx, [eax + 8]
call fcn.1005e680
cmp byte [edi + 0x11], bl
mov dword [edi], vtable.ert_TmplArr_unsigned_char_.0
je 0x1011df83
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x1011df83
push eax
call fcn.10178e5d
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x11], bl
mov dword [edi + 0x1c], vtable.ert_RefCounter.0
lea edi, [esi - 0x2c]
mov ecx, edi
mov byte [esp + 0x1c], 8
call fcn.10117eb0
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0xec]
push edi
mov byte [esp + 0x20], 7
call fcn.10001b50
lea ecx, [esi - 0xf4]
mov dword [edi + 0x1c], vtable.ert_RefCounter.0
call fcn.100817b0
lea edi, [esi - 0x134]
push edi
mov dword [ecx], vtable.ert_RefCounter.0
mov byte [esp + 0x20], 5
call fcn.1002ce10
mov dword [edi + 0x30], vtable.ert_RefCounter.0
lea edi, [esi - 0x13c]
mov ecx, edi
mov byte [esp + 0x1c], 4
call fcn.10019760
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0x24c]
mov ecx, edi
mov byte [esp + 0x1c], 3
call fcn.1000ab00
lea ecx, [esi - 0x32c]
mov dword [edi], vtable.ert_RefCounter.0
mov byte [esp + 0x1c], 2
call fcn.10063be0
lea ecx, [esi - 0x344]
mov byte [esp + 0x1c], 1
call fcn.10063be0
add esi, 0xfffffca8
mov ecx, esi
mov byte [esp + 0x1c], bl
call fcn.10063be0
mov ecx, esi
call fcn.1011f230
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10126110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1c90
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.1005e6c0
lea eax, [esp + 0x1c]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x101261bf
sub esp, 0x18
mov eax, esp
mov ecx, 0x10222b28
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
mov esi, dword [esp + 0x14]
mov byte [esp + 0x38], 0
mov eax, dword [esi + 0x1c]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x1c]
push ebx
call edx
mov eax, dword [esi + 0x40]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x40]
push ebx
call edx
jmp 0x10126265
mov edi, str.est_FloatLinEstResult_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x1c]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x10222b28
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov ecx, esi
push ecx
mov edi, eax
mov byte [esp + 0x54], 4
call fcn.10068050
mov esi, dword [esp + 0x14]
xor eax, eax
lea edx, [esi + 8]
test edx, edx
mov byte [esp + 0x38], al
je 0x10126213
lea eax, [esi + 0x1c]
mov edi, str.in_offset_vector_
mov dword [esp + 0x14], eax
call fcn.1005b870
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push ebx
call eax
lea ecx, [esi + 0x2c]
test ecx, ecx
je 0x1012623d
lea edx, [esi + 0x40]
mov dword [esp + 0x14], edx
jmp 0x10126245
mov dword [esp + 0x14], 0
mov edi, str.out_offset_vector_
call fcn.1005b870
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push ebx
call edx
mov edi, str.matrix_
call fcn.1005b870
mov eax, dword [esi + 0x50]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x50]
push ebx
call edx
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10127740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x10]
xor esi, esi
cmp eax, esi
je 0x101277a6
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
add dword [edx + eax + 8], 0xffffffff
cmp dword [edx + eax + 8], esi
lea eax, [edx + eax + 4]
jne 0x101277a3
mov eax, dword [edi + 0x10]
cmp eax, esi
mov dword [edi + 0x10], esi
je 0x101277a6
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
jmp 0x101277a6
mov dword [edi + 0x10], esi
mov eax, dword [edi + 0x14]
mov edx, dword [eax + 0x1c]
lea ecx, [edi + 0x14]
call edx
mov eax, dword [edi + 0x38]
mov edx, dword [eax + 0x1c]
lea ecx, [edi + 0x38]
call edx
mov eax, dword [edi + 0x5c]
mov edx, dword [eax + 0x1c]
lea ecx, [edi + 0x5c]
call edx
mov eax, dword [edi + 0xb8]
mov edx, dword [eax + 0x1c]
lea ecx, [edi + 0xb8]
call edx
mov eax, dword [edi + 0xdc]
mov edx, dword [eax + 0x1c]
lea ecx, [edi + 0xdc]
call edx
fldz
lea eax, [esp + 0xc]
fstp dword [edi + 0xf4]
push eax
mov dword [edi + 0xec], esi
mov dword [edi + 0xf0], esi
call fcn.1004aca0
mov dword [esp + 0x38], esi
lea esi, [edi + 0xf8]
lea eax, [esp + 0xc]
call fcn.1004ade0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.1004ad70
fldz
fstp dword [edi + 0x11c]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x10128220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a01a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call fcn.1005e6c0
lea eax, [esp + 0x14]
call fcn.10067d70
mov dword [esp + 0x30], 0
cmp dword [ebx + 0xc], 2
je 0x101282a2
sub esp, 0x18
mov eax, esp
mov ecx, 0x10222b40
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x48], 2
mov ecx, ebx
lea esi, [esp + 0x2c]
call fcn.10067f30
push eax
mov byte [esp + 0x4c], 3
jmp 0x101282dd
mov edi, str.est_LinearEstimator_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x14]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x10222b40
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov ecx, esi
mov byte [esp + 0x48], 4
push ecx
mov edi, eax
call fcn.10068050
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1012fbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, eax
mov eax, ebx
imul eax, ebp
push edi
push esi
call fcn.1012fb10
xor ecx, ecx
fld qword [esp + 0x60]
xor edi, edi
test ebx, ebx
fld1
mov dword [esp + 0x14], ecx
jle 0x1012fcd0
test ecx, ecx
fld st(1)
mov eax, ecx
jge 0x1012fbec
neg eax
fld st(1)
test al, 1
je 0x1012fbf4
fmul st(1)
shr eax, 1
je 0x1012fbfe
fld st(1)
fmulp st(2)
jmp 0x1012fbee
test ecx, ecx
fstp st(1)
jge 0x1012fc06
fdivr st(1)
fmul qword [esp + 0x58]
xor ebx, ebx
test ebp, ebp
mov dword [esp + 0x10], ebx
fstp qword [esp + 0x20]
jle 0x1012fcbb
fstp st(0)
fstp st(0)
fild dword [esp + 0x54]
fstp qword [esp + 0x28]
fld qword [esp + 0x70]
fstp dword [esp + 0x18]
fld qword [esp + 0x68]
fstp dword [esp + 0x1c]
fild dword [esp + 0x10]
fmul qword [0x101e9400]
fdiv qword [esp + 0x28]
fst qword [esp + 0x30]
call fcn.1018a940
fmul qword [esp + 0x20]
push ecx
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
fld qword [esp + 0x34]
call fcn.1018aa70
fmul qword [esp + 0x24]
push ecx
lea eax, [esp + 0x44]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fstp dword [esp]
call fcn.100489e0
fld dword [esp + 0x18]
sub esp, 8
fstp dword [esp + 4]
mov ecx, eax
fld dword [esp + 0x24]
fstp dword [esp]
call fcn.1012fb60
lea ecx, [esp + 0x3c]
add edi, 1
call fcn.10048a00
add ebx, 1
cmp ebx, ebp
mov dword [esp + 0x10], ebx
jl 0x1012fc38
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
fld1
add ecx, 1
cmp ecx, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
jl 0x1012fbe2
mov ebx, dword [esp + 0x50]
fld qword [esp + 0x58]
mov dword [esi + 0x78], ebx
fstp dword [esi + 0x80]
mov dword [esi + 0x7c], ebp
fxch st(1)
mov byte [esi + 0x74], 1
fst dword [esi + 0x84]
fld qword [esp + 0x68]
fstp dword [esi + 0x88]
fld qword [esp + 0x70]
fstp dword [esi + 0x8c]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1012fd1b
mov eax, 1
mov byte [esi + 0x75], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x28
pop edi
xor eax, eax
mov byte [esi + 0x75], al
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x28
Function at 0x1013a430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10192698
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
fldz
push 1
lea ecx, [esp + 0x10]
fstp dword [esi + 8]
call fcn.10060510
mov edi, eax
lea eax, [esi + 0xc]
mov dword [esp + 0x38], 0
call fcn.10060770
lea esi, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.10002000
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x1013a4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195862
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 4], 0x101e5bb4
mov dword [esi + 0x30], vtable.ert_RefCounter.0
mov dword [esi + 0x34], 1
push 0
mov eax, esi
mov dword [esp + 0xc], 1
call fcn.10039ef0
mov dword [esp + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], vtable.egc_DispCueArrThrWgtRelator.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.egc_DispCueArrThrWgtRelator.1.0
push 1
lea ecx, [esi + 0xc]
call fcn.10060510
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.1013a430
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10147240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101956c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
lea esi, [esp + 0xc]
call fcn.101470b0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], 0
call fcn.100676d0
mov dword [esp + 0x38], 0xffffffff
cmp byte [esp + 0x1d], 0
mov esi, eax
mov dword [esp + 0xc], vtable.ert_TmplArr_char_.0
je 0x101472ae
mov eax, dword [esp + 0x10]
test eax, eax
je 0x101472ac
push eax
call fcn.10178e5d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x1014d030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10198cfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [edi + 4], 0x101e21d8
mov dword [edi + 0x5ac], 0x101aaeb8
mov dword [edi + 0x5b0], 1
mov eax, dword [edi + 4]
mov dword [edi], vtable.ebs_Object.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + edi + 4], vtable.ebs_Object.0
mov edx, dword [edi + 4]
mov dword [edi], vtable.vbf_LocalDetector.0
mov eax, dword [edx + 4]
mov dword [esp + 0xc], 1
mov dword [eax + edi + 4], vtable.vbf_LocalDetector.1.0
mov dword [esp + 0x18], 1
mov ecx, dword [edi + 4]
mov dword [edi], vtable.vbf_AdvancedLocalScanDetector.0
mov edx, dword [ecx + 4]
lea ecx, [edi + 0x24]
mov dword [edx + edi + 4], vtable.vbf_AdvancedLocalScanDetector.1.0
call fcn.10063b00
push 1
lea ecx, [edi + 0x30]
call fcn.10013d80
lea ecx, [edi + 0x54]
call fcn.10063b00
lea ecx, [edi + 0x60]
call fcn.10063b00
lea ecx, [edi + 0x74]
call fcn.10063b00
lea eax, [edi + 0x84]
call fcn.1006c630
lea eax, [edi + 0x94]
call fcn.1006c630
push 1
lea eax, [edi + 0xa8]
push eax
mov byte [esp + 0x20], 8
call fcn.1000a870
push 1
lea ecx, [edi + 0x184]
call fcn.10013d80
push 1
lea ecx, [edi + 0x1a8]
call fcn.10013d80
push 1
lea ecx, [edi + 0x1cc]
call fcn.10013d80
lea eax, [edi + 0x1f0]
call fcn.10074380
lea esi, [edi + 0x228]
call fcn.10161570
push 1
lea ecx, [edi + 0x3c0]
call fcn.10060510
push 1
lea ecx, [edi + 0x3e4]
call fcn.1005eca0
lea ecx, [edi + 0x408]
push ecx
mov byte [esp + 0x1c], 0x10
call fcn.10019500
lea eax, [edi + 0x518]
call fcn.1006ba70
lea eax, [edi + 0x53c]
call fcn.1006d890
lea eax, [edi + 0x560]
call fcn.1006ba70
lea eax, [edi + 0x584]
call fcn.1006ba70
mov eax, edi
call fcn.1014ba70
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4