joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099768
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x10015b24
mov eax, dword [esp + 0xc]
add eax, 0xfffffff6
cmp ax, 1
ja 0x10015b24
movsd xmm0, qword [esp + 0x14]
jmp 0x10015b27
xorps xmm0, xmm0
lea ecx, [esp + 0xc]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
fld qword [esp + 4]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10015b60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x10015bc4
xor esi, esi
jmp 0x10015bd4
cmp word [esp + 0xc], 1
mov esi, 0x100a4cdc
cmove esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4
Function at 0x10015c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
xor esi, esi
test eax, eax
je 0x10015c81
mov eax, 0x8000
cmp word [esp + 0xc], ax
cmove esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10015cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
xor esi, esi
test eax, eax
je 0x10015d31
mov eax, 0x8001
cmp word [esp + 0xc], ax
cmove esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10015da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
neg eax
lea ecx, [esp + 0xc]
sbb esi, esi
and esi, dword [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4
Function at 0x10015e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x10015ea4
xor esi, esi
jmp 0x10015ea9
movzx esi, word [esp + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov ax, si
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10016060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
xor esi, esi
test eax, eax
je 0x100160cd
cmp word [esp + 0xc], 0xe
cmove esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10016100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0xe], ax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], 0
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
mov esi, eax
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100161b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movsd qword [esp + 0x14], xmm0
movss xmm0, dword [ebp + 0x10]
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0xe], ax
mov dword [esp + 0x1c], eax
movss dword [esp + 0x14], xmm0
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
mov esi, eax
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10016260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [ebp + 0x10]
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0xe], ax
mov dword [esp + 0x1c], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
mov esi, eax
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10016300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test edx, edx
jns 0x1001634a
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
jmp 0x10016352
push edx
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
xorps xmm0, xmm0
mov dword [esp + 0xc], 1
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], 0
lea edx, [esp + 0xc]
mov eax, dword [esi]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
mov esi, eax
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100163c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push eax
call sym.HncFoundation.dll_public:_void___thiscall_CHncParam::constructor_char_const___int_
mov dword [esp + 0x38], 0
cmp word [esp + 0xc], 1
je 0x1001641b
xor esi, esi
jmp 0x1001642d
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100997c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
test esi, esi
je 0x100164ee
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100164c6
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0xc]
jmp 0x100164c8
xor eax, eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0xc]
mov eax, dword [edi]
mov ecx, 0x8002
push edx
push dword [ebp + 8]
mov word [esp + 0x14], cx
mov dword [esp + 0x24], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
jmp 0x100164f0
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10016530
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0xe], ax
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], 0
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
mov esi, eax
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100165e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x10016652
mov eax, 0x8002
cmp word [esp + 0xc], ax
jne 0x10016652
mov esi, dword [esp + 0x14]
jmp 0x10016654
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10016690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x100166f4
xor ebx, ebx
jmp 0x1001670e
mov eax, dword [esp + 0xc]
xor ecx, ecx
add eax, 0xfffffffe
cmp ax, 7
cmovbe ecx, dword [esp + 0x14]
xor ebx, ebx
cmp ecx, dword [ebp + 0xc]
setne bl
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 8
Function at 0x10016920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
xor esi, esi
test eax, eax
je 0x10016992
mov eax, dword [esp + 0xc]
add eax, 0xfffffffe
cmp ax, 7
cmovbe esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x100169d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099768
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x10016a4a
mov eax, dword [esp + 0xc]
add eax, 0xfffffff6
cmp ax, 1
ja 0x10016a4a
movss xmm0, dword [esp + 0x14]
movss dword [esp + 8], xmm0
jmp 0x10016a52
mov dword [esp + 8], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
fld dword [esp + 8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4
Function at 0x10016a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099768
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x10016b04
mov eax, dword [esp + 0xc]
add eax, 0xfffffff6
cmp ax, 1
ja 0x10016b04
movsd xmm0, qword [esp + 0x14]
jmp 0x10016b07
xorps xmm0, xmm0
lea ecx, [esp + 0xc]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
fld qword [esp + 4]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4

Function at 0x10016b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099738
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x10016ba4
xor esi, esi
jmp 0x10016bb4
cmp word [esp + 0xc], 1
mov esi, 0x100a4cdc
cmove esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sym.HncFoundation.dll_public:_void___thiscall_tagHNCPARAM::ParamClear_void_
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 4