joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b5ab90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10bc7f1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x4c]
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x34]
push ebp
push ecx
call fcn.10b5c040
add esp, 0xc
mov esi, eax
lea edx, [esp + 0x5c]
mov ecx, esi
push edx
mov dword [esp + 0x54], 0
call fcn.10b3af70
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.10b723d0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 3
call fcn.10b5c7b0
add esi, 0xc
lea ecx, [esp + 0x24]
push esi
mov byte [esp + 0x54], 4
call fcn.10b3a2d0
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [edi + 0x10]
mov byte [esp + 0x58], 5
call fcn.10b5be80
mov cl, byte [esp + 0x14]
test cl, cl
lea ecx, [esp + 0x24]
sete bl
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], 6
call fcn.10bbe020
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 7
call fcn.10bbe020
lea edx, [esp + 0x3c]
mov dword [esp + 0x5c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 8
call fcn.10bbe020
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], 9
call fcn.10bbe020
test bl, bl
mov dword [esp + 0x50], reloc.ole32.dll_CoCreateGuid
je 0x10b5ac92
mov eax, 2
jmp 0x10b5acd5
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x38]
add edi, 0x30
cmp eax, ecx
je 0x10b5acc1
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], eax
test eax, eax
mov dword [esp + 0x50], 0xa
je 0x10b5acbb
push ebp
mov ecx, eax
call fcn.10b3a2d0
add dword [edi + 4], 0xc
jmp 0x10b5acd3
push 1
lea ecx, [esp + 0x60]
push 1
push ecx
push ebp
push eax
mov ecx, edi
call fcn.10b5ba90
xor eax, eax
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 8
Function at 0x10b5d220
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10bc83d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x38]
push esi
mov esi, ecx
cmp eax, ebx
push edi
mov dword [esp + 0x14], esi
je 0x10b5d257
mov dword [esi + 4], 0x10be1ab0
mov dword [esi + 0x2c], 0x10be1aa8
lea ecx, [esi + 0x28]
lea eax, [esp + 0x40]
mov dword [esp + 0x20], ebx
push eax
call fcn.10b5efe0
mov dword [esi + 0x24], vtable.clPointerList_class_clGameMessage__.0
push 1
lea ecx, [esi + 0x30]
mov dword [esp + 0x24], 1
call fcn.10b624e0
push 1
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 2
call fcn.10b62170
push 0x10
mov dword [esi], vtable.clConnectElem.0
call fcn.10a714d0
mov dword [esp + 0x40], eax
cmp eax, ebx
mov byte [esp + 0x20], 4
je 0x10b5d2be
push 1
push 1
mov ecx, eax
call fcn.10b61b90
jmp 0x10b5d2c0
xor eax, eax
mov dword [esi + 0x50], eax
mov byte [esi + 0x54], bl
mov ecx, dword [0x10c38720]
mov byte [esp + 0x20], 3
mov dword [esi + 0x60], ecx
mov ecx, dword [0x10c38720]
mov al, byte [0x10c74f14]
inc ecx
cmp al, bl
mov dword [0x10c38720], ecx
jne 0x10b5d300
push ebx
call sub.MSVCR70.dll_time
push eax
call sub.MSVCR70.dll_srand
add esp, 8
mov byte [0x10c74f14], 1
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp edi, ebx
je 0x10b5d324
lea edx, [esp + 0x10]
lea eax, [esi + 0x64]
push edx
push eax
mov ecx, edi
call fcn.10b6fed0
push ebp
mov ecx, edi
call fcn.10b6fca0
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x38]
mov dl, byte [esp + 0x34]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov byte [esi + 0x11], al
mov dword [esi + 0x18], edi
mov word [esi + 0x68], bx
mov dword [esi + 8], ebx
mov byte [esi + 0x10], dl
mov dword [esi + 0x14], ebp
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c
Function at 0x10b5d4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc84df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov dword [esp + 8], 0
mov esi, ecx
mov dword [esp + 0x14], 0x10be12d4
mov dword [esp + 0x24], 0x10be12cc
mov dword [esp + 0x18], 3
mov dword [esp + 0x10], vtable.clData.0
lea eax, [esp + 7]
lea ecx, [esp + 0x20]
push eax
mov dword [esp + 0x34], 1
call fcn.10b5efe0
mov dword [esp + 0x10], vtable.clDataList.1.0
mov dword [esp + 0x1c], vtable.clDataList.0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 2
push ecx
push str.Send_UDPConnectID:__d_n
call fcn.10968f20
add esp, 8
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
call fcn.10b71640
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 8
push 2
push 6
call fcn.10b5dd20
mov dword [esp + 0x10], vtable.clDataList.1.0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 3
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], vtable.clPointerList_class_clData__.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call fcn.10b5ee00
lea edx, [esp + 0x20]
mov dword [esp + 0xc], edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 5
call fcn.10b5f010
mov eax, dword [esp + 0x20]
push 1
push eax
lea ecx, [esp + 0x28]
call fcn.10bc0f80
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x10b5e850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc8767
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor eax, eax
mov ebx, vtable.clData.0
push esi
mov dword [esp + 8], eax
push edi
mov esi, ecx
mov dword [esp + 0x2c], 0x10be12d4
mov dword [esp + 0x3c], 0x10be12cc
mov dword [esp + 0x30], 3
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
call fcn.10b39be0
mov edi, vtable.clDataList.1.0
mov dword [esp + 0x34], vtable.clDataList.0
mov dword [esp + 0x28], edi
mov dword [esp + 0x48], 1
mov dword [esp + 0x14], 0x10be12d4
mov dword [esp + 0x24], 0x10be12cc
mov dword [esp + 0x18], 3
mov dword [esp + 0x10], ebx
push 0
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.10b39be0
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], vtable.clDataList.0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
mov byte [esp + 0x4c], 3
mov dword [esp + 0x10], 2
call fcn.10b71640
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x14]
call fcn.10b71640
lea edx, [esp + 0x58]
lea ecx, [esp + 0x10]
push edx
call fcn.10b71640
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10b713a0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
push edx
call fcn.10b71560
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push 2
push 8
push 0xdb
call fcn.10b5dd20
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], vtable.clDataList.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 4
call fcn.10b39a60
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], edi
mov ebx, 5
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x34], vtable.clPointerList_class_clData__.0
mov byte [esp + 0x48], 6
lea ecx, [esp + 0x34]
call fcn.10b5ee00
lea ecx, [esp + 0x38]
mov byte [esp + 0x48], bl
call fcn.10b3c1d0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 0xc
Function at 0x10b5e9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc8767
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor eax, eax
mov ebx, vtable.clData.0
push esi
mov dword [esp + 8], eax
push edi
mov esi, ecx
mov dword [esp + 0x2c], 0x10be12d4
mov dword [esp + 0x3c], 0x10be12cc
mov dword [esp + 0x30], 3
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
call fcn.10b39be0
mov edi, vtable.clDataList.1.0
mov dword [esp + 0x34], vtable.clDataList.0
mov dword [esp + 0x28], edi
mov dword [esp + 0x48], 1
mov dword [esp + 0x14], 0x10be12d4
mov dword [esp + 0x24], 0x10be12cc
mov dword [esp + 0x18], 3
mov dword [esp + 0x10], ebx
push 0
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.10b39be0
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], vtable.clDataList.0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
mov byte [esp + 0x4c], 3
mov dword [esp + 0x10], 1
call fcn.10b71640
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x14]
call fcn.10b71640
lea edx, [esp + 0x58]
lea ecx, [esp + 0x10]
push edx
call fcn.10b71640
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10b713a0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
push edx
call fcn.10b71560
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push 2
push 8
push 0xdb
call fcn.10b5dd20
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], vtable.clDataList.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 4
call fcn.10b39a60
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], edi
mov ebx, 5
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x34], vtable.clPointerList_class_clData__.0
mov byte [esp + 0x48], 6
lea ecx, [esp + 0x34]
call fcn.10b5ee00
lea ecx, [esp + 0x38]
mov byte [esp + 0x48], bl
call fcn.10b3c1d0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 0xc
Function at 0x10b5f1f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc87ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x30]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
je 0x10b5f22f
mov dword [edi + 4], 0x10be1b10
mov dword [esp + 8], 1
mov eax, dword [esp + 0x20]
mov dword [edi + 8], eax
mov cl, byte [esp + 0x24]
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x2c]
mov esi, dword [esp + 0x34]
mov byte [edi + 0xd], cl
mov cl, byte [esp + 0x30]
push 0x18
mov dword [esp + 0x1c], 1
mov dword [edi], vtable.clGSMessage.0
mov byte [edi + 0xc], 0
mov byte [edi + 0xe], dl
mov byte [edi + 0x10], al
mov byte [edi + 0x11], cl
call fcn.10a714d0
test esi, esi
je 0x10b5f296
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x18], 2
je 0x10b5f28f
push 1
push esi
mov ecx, eax
call fcn.10b706c0
mov dword [edi + 0x14], eax
jmp 0x10b5f2e8
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0x10b5f2e8
mov esi, eax
test esi, esi
je 0x10b5f2e3
mov dword [esi + 4], 0x10be12d4
mov dword [esi + 0x14], 0x10be12cc
mov dword [esi + 8], 3
mov dword [esi], vtable.clData.0
push 0xc
mov dword [esi + 0x10], 0
call fcn.10a714d0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], vtable.clPointerList_class_clData__.0
mov dword [esi], vtable.clDataList.1.0
mov dword [esi + 0xc], vtable.clDataList.0
jmp 0x10b5f2e5
xor esi, esi
mov dword [edi + 0x14], esi
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c

Function at 0x10b64710
Capabilities:
Encrypt data using blowfish

Disassembly:
push ecx
mov eax, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
mov dword [esp], 0
je 0x10b6472a
mov dword [eax + 4], 0x10be1cc0
push esi
push edi
mov dword [eax], vtable.CBlowFish.0
mov edx, 0x10c39b48
lea esi, reloc.ole32.dll_CoCreateGuid
mov ecx, dword [edx]
add edx, 4
mov dword [esi], ecx
add esi, 4
cmp edx, 0x10c39b90
jl 0x10b6473d
mov edx, 0x10c39b90
lea esi, reloc.ole32.dll_CoCreateGuid
mov edi, 0x100
mov ecx, dword [edx]
add edx, 4
mov dword [esi], ecx
add esi, 4
dec edi
jne 0x10b6475f
cmp edx, 0x10c3ab90
jl 0x10b6475a
pop edi
pop esi
pop ecx
ret 4

Function at 0x10b64870
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push ebx
push ebp
mov eax, dword [eax]
push esi
mov esi, dword [edx]
push edi
lea edi, [ecx + 8]
mov ebp, 0x10
xor eax, dword [edi]
push eax
mov ebx, eax
call fcn.10b64810
xor eax, esi
add edi, 4
dec ebp
mov esi, ebx
jne 0x10b64888
mov edx, dword [ecx + 0x48]
pop edi
xor edx, eax
mov eax, dword [ecx + 0x4c]
mov ecx, dword [esp + 0x10]
xor eax, esi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
pop ebx
mov dword [eax], edx
ret 8
Function at 0x10b65170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc8d06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x30]
mov esi, ecx
cmp eax, edi
mov dword [esp + 0x10], esi
mov ebx, 1
je 0x10b651af
mov dword [esi + 4], 0x10be1d40
mov dword [esp + 0xc], ebx
mov dword [esi + 8], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
sub eax, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], vtable.PRNGModule_MGF1.0
je 0x10b651fa
dec eax
jne 0x10b65221
push 0x28
call fcn.10a714d0
mov dword [esp + 0x30], eax
cmp eax, edi
mov byte [esp + 0x1c], 3
je 0x10b65218
push ebx
mov ecx, eax
call fcn.10b64c40
jmp 0x10b6521a
push 0x24
call fcn.10a714d0
mov dword [esp + 0x30], eax
cmp eax, edi
mov byte [esp + 0x1c], 2
je 0x10b65218
push ebx
mov ecx, eax
call fcn.10b64ee0
jmp 0x10b6521a
xor eax, eax
mov byte [esp + 0x1c], bl
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
push eax
mov dword [esi + 0x20], eax
call fcn.10a714d0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.10b652f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x10b65800
Capabilities:
Hash data using sha1

Disassembly:
mov edx, ecx
push esi
push edi
mov ecx, 0x17
lea esi, [edx + 8]
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi], reloc.ole32.dll_CoCreateGuid
pop edi
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
mov dword [edx + 0x18], 0xc3d2e1f0
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
pop esi
ret

Function at 0x10b67710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
shr esi, 2
je 0x10b67744
mov edx, dword [esp + 8]
mov eax, dword [edx]
add edx, 4
mov ecx, eax
shl ecx, 8
shr eax, 8
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
shl eax, 0x10
or ecx, eax
dec esi
mov dword [edx - 4], ecx
jne 0x10b6771e
pop esi
ret 8

Function at 0x10b67860
Capabilities:
Hash data with md5

Disassembly:
mov edx, ecx
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [edx + 0x20]
mov byte [edx + 0x70], al
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
rep stosd dword es:[edi], eax
lea ecx, [edx + 0x60]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
ret
Function at 0x10b6bf70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc9105
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov ecx, dword [esi + 4]
call fcn.10bbaa20
test al, al
jne 0x10b6bfbc
mov ecx, esi
call fcn.10b6bcc0
test al, al
jne 0x10b6bfbc
pop esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
mov eax, 1
push ebx
push edi
mov dword [esp + 0x34], 0x10be12d4
mov dword [esp + 0x44], 0x10be12cc
mov dword [esp + 0xc], eax
mov ebx, 3
mov dword [esp + 0x30], vtable.clData.0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x3c]
push 0
lea ecx, [esp + 0x44]
mov dword [esp + 0x14], eax
call fcn.10b39be0
mov edi, vtable.clDataList.1.0
mov dword [esp + 0x3c], vtable.clDataList.0
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], 0x10be12d4
mov dword [esp + 0x28], 0x10be12cc
mov dword [esp + 0xc], 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], vtable.clData.0
lea ecx, [esp + 0x20]
mov ebx, 5
mov dword [esp + 0x10], ecx
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], ebx
call fcn.10b39be0
mov dword [esp + 0x54], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], vtable.clDataList.0
push 0x10be1ddc
lea ecx, [esp + 0x34]
mov byte [esp + 0x58], 7
call fcn.10b71640
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x5c]
and edx, 0xff
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], edx
call fcn.10b71640
lea ecx, [esi + 0x98]
push ecx
lea ecx, [esp + 0x18]
call fcn.10b71250
lea edx, [esi + 0xa4]
lea ecx, [esp + 0x14]
push edx
call fcn.10b71250
lea eax, [esi + 0xb0]
lea ecx, [esp + 0x14]
push eax
call fcn.10b71250
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call fcn.10b71560
mov ecx, dword [esi + 4]
lea edx, [esp + 0x30]
push edx
push 0xdd
call fcn.10b5dde0
mov bl, al
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], vtable.clDataList.0
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 8
call fcn.10b39a60
mov dword [esp + 0x14], vtable.clData.0
mov dword [esp + 0x30], edi
lea eax, [esp + 0x3c]
mov dword [esp + 0x54], 9
mov dword [esp + 0x5c], eax
mov dword [esp + 0x3c], vtable.clPointerList_class_clData__.0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x54], 0xa
call fcn.10b5ee00
lea ecx, [esp + 0x40]
mov byte [esp + 0x54], 9
call fcn.10b3c1d0
mov ecx, dword [esp + 0x4c]
mov al, bl
pop edi
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
Function at 0x10b6c650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10bc9231
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [esp + 4], 0
push edi
mov eax, dword [esi + 0x84]
mov dword [esp + 0x14], 0x10be12d4
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0x10be12cc
lea ecx, [eax + 1]
mov dword [esp + 0x18], 3
mov dword [esi + 0x84], ecx
mov dword [esp + 0x10], vtable.clData.0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0
call fcn.10b39e70
mov dword [esp + 0x10], vtable.clDataList.1.0
mov dword [esp + 0x1c], vtable.clDataList.0
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x38]
and edx, 0xffff
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 1
mov dword [esp + 0x3c], edx
call fcn.10b71640
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
call fcn.10b71640
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push edx
call fcn.10b71560
push 0x20
call fcn.10a714d0
mov edi, eax
mov dword [esp + 0x3c], edi
test edi, edi
mov byte [esp + 0x30], 2
je 0x10b6c73d
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [edi + 8]
mov dword [edi], 0x10be1e40
mov word [edi + 4], 0xcc
call fcn.10b706c0
jmp 0x10b6c73f
xor edi, edi
lea ecx, [esp + 0x3c]
add esi, 0x8c
push ecx
mov ecx, esi
mov byte [esp + 0x34], 1
mov dword [esp + 0x3c], edi
call fcn.10b3c730
lea edx, [esp + 0x38]
mov ecx, esi
push edx
call fcn.10b3c740
mov esi, dword [esp + 0x3c]
mov edx, dword [esi + 4]
lea ecx, [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx], eax
mov esi, dword [esp + 8]
mov dword [esp + 0x10], vtable.clDataList.1.0
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 3
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], vtable.clPointerList_class_clData__.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call fcn.10b5ee00
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 5
call fcn.10b5f010
mov edx, dword [esp + 0x20]
push 1
push edx
lea ecx, [esp + 0x28]
call fcn.10bc0f80
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x10b6c7f0
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x8c]
mov esi, dword [eax]
cmp esi, eax
je 0x10b6c856
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x10b6c85c
cmp eax, 2
je 0x10b6c81c
mov eax, dword [esi + 8]
cmp word [eax + 4], 0xcc
jne 0x10b6c81c
mov esi, dword [esi]
jmp 0x10b6c84e
mov eax, dword [esi + 8]
mov cx, word [eax + 4]
add eax, 8
push eax
push 0xb
push 8
push ecx
mov ecx, edi
call fcn.10b5dd20
test al, al
je 0x10b6c85c
push ecx
lea ecx, [edi + 0x88]
mov eax, esp
mov dword [eax], esi
mov edx, dword [ecx]
lea eax, [esp + 0xc]
push eax
call dword [edx + 0x14]
mov esi, dword [eax]
cmp esi, dword [edi + 0x8c]
jne 0x10b6c801
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x10b6ca30
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebx, ecx
call fcn.10b5c980
mov eax, dword [ebx + 0x7c]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x14], ebp
je 0x10b6cbd2
mov ecx, ebx
call fcn.10b6c7f0
test al, al
je 0x10b6cbcb
mov ecx, ebx
call fcn.10b5d700
test al, al
je 0x10b6cbcb
push esi
push edi
mov ecx, ebx
call fcn.10b5e180
mov esi, eax
cmp esi, ebp
je 0x10b6cbbf
push esi
push 0x10c3afa8
push str.PROXY
push 0x10c74eec
push 5
mov ecx, ebx
call fcn.10b6d0d0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov edi, dword [esi + 0x14]
mov dword [esp + 0x10], ebp
mov al, byte [esi + 0xd]
cmp al, 0x26
je 0x10b6cb16
cmp al, 0xcc
jne 0x10b6cb8d
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, edi
call fcn.10b71c90
test al, al
je 0x10b6cb8d
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, edi
call fcn.10b71ba0
test al, al
je 0x10b6cb8d
lea edx, [esp + 0x10]
push 2
push edx
mov ecx, edi
call fcn.10b71940
test al, al
je 0x10b6cb8d
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov dx, word [ebx + 0x98]
push ecx
push edx
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x10b6cb8d
push ebp
lea eax, [esp + 0x18]
push 1
push eax
mov ecx, edi
call fcn.10b71e80
test al, al
je 0x10b6cb8d
lea ecx, [esp + 0x10]
push 1
push ecx
mov ecx, edi
call fcn.10b718c0
test al, al
je 0x10b6cb8d
mov eax, dword [esp + 0x14]
and eax, 0xffff
cmp eax, 0x4d
je 0x10b6cb7b
cmp eax, 0x5d
je 0x10b6cb67
cmp eax, 0x66
jne 0x10b6cb8d
movzx ax, byte [esi + 0xd]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push edx
push eax
call fcn.10b6cbe0
jmp 0x10b6cb8d
movzx dx, byte [esi + 0xd]
mov ecx, dword [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.10b6cd80
jmp 0x10b6cb8d
movzx cx, byte [esi + 0xd]
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.10b6d020
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
call fcn.10b5c980
mov ecx, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov dword [esp + 0x1c], ecx
ja 0x10b6cbbf
mov ecx, ebx
call fcn.10b5e180
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x10b6ca7e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 4