joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499674
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49967c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49986e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x499884
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404ad4
lea ecx, [ebp - 0x10]
mov edx, 0x499898
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404ad4
lea ecx, [ebp - 0x14]
mov edx, 0x4998b0
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404ad4
lea ecx, [ebp - 0x18]
mov edx, 0x4998cc
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404ad4
lea ecx, [ebp - 0x1c]
mov edx, 0x4998e8
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404ad4
lea ecx, [ebp - 0x24]
mov edx, 0x499900
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408f88
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004093e4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x499918
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x28]
call fcn.0048a490
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x499928
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x2c]
call fcn.0048a490
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x499940
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004093e4
inc eax
je 0x499811
lea ecx, [ebp - 0x34]
mov edx, 0x499940
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x34]
call fcn.004093a8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
call fcn.0040aea0
fstp qword [ebp - 0x3c]
wait
call fcn.0040b208
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x49982c
lea ecx, [ebp - 0x40]
mov edx, 0x499940
mov eax, esi
call fcn.0048c9e4
mov eax, dword [ebp - 0x40]
call fcn.0048a490
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x499950
mov eax, esi
call fcn.0048c9e4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404ad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499875
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404aa4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404aa4
ret
Function at 0x49ed3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x109]
push eax
push 0
push 0
push 0x801c
push 0
call sub.shell32.dll_SHGetFolderPathA
test eax, eax
jne 0x49ed78
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404cf0
jmp 0x49ed80
mov eax, dword [ebp - 4]
call fcn.00404a80
mov esp, ebp
pop ebp
ret

Function at 0x49ed84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x109]
push eax
push 0
push 0
push 0x801a
push 0
call sub.shell32.dll_SHGetFolderPathA
test eax, eax
jne 0x49edc0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404cf0
jmp 0x49edc8
mov eax, dword [ebp - 4]
call fcn.0049ed3c
mov esp, ebp
pop ebp
ret

Function at 0x49ef54
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f34
xor eax, eax
push ebp
push 0x49f042
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x18], eax
test byte [ebp - 0x15], 0x80
sete byte [ebp - 0x19]
cmp byte [ebp - 0x19], 0
je 0x49f01f
mov eax, 0x104
call fcn.0040a09c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0
call sub.kernel32.dll_SetLastError
push 0
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00404c78
push dword [ebp - 0x24]
push 0x49f058
push dword [ebp - 4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404e04
mov eax, dword [ebp - 0x20]
call fcn.00404f44
push eax
call sub.kernel32.dll_CreateDirectoryA_1
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x49f00b
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x49f00f
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.0049eef0
mov eax, dword [ebp - 0x14]
call fcn.0040a0e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f049
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404aa4
lea eax, [ebp - 4]
call fcn.00404a80
ret

Function at 0x49ff38
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x58
call fcn.00403470
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret
Function at 0x4a2368
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404f34
xor eax, eax
push ebp
push 0x4a23c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov cx, word [0x4a23cc]
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00433dd8
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a23c7
lea eax, [ebp - 8]
call fcn.00404a80
ret

Function at 0x4a3bb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404f34
mov eax, dword [ebp - 0xc]
call fcn.00404f34
xor eax, eax
push ebp
push 0x4a3cbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x4a99c0]
cmp dword [eax], 6
jge 0x4a3c22
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404f44
push eax
mov eax, dword [ebp - 8]
call fcn.00404f44
push eax
push 0x4a3ccc
mov eax, dword [ebp - 4]
call fcn.004492a4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a3c96
xor eax, eax
push ebp
push 0x4a3c8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, dword [ebp - 4]
call fcn.004492a4
mov dword [ebp - 0x44], eax
mov eax, 0x4a3cd4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.00404f44
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
call fcn.00404f44
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3c96
push 0x3e8
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3cc2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404aa4
ret
Function at 0x4a3cec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404f34
xor eax, eax
push ebp
push 0x4a3e87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a9708], 0
je 0x4a3e5c
lea edx, [ebp - 0x10]
mov eax, 0x4a1f78
call fcn.00406b58
xor eax, eax
push ebp
push 0x4a3e43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a99c0]
cmp dword [eax], 6
jge 0x4a3dea
xor eax, eax
push ebp
push 0x4a3de3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x2001f
mov dl, 1
mov eax, dword [0x424588]
call fcn.004246cc
mov dword [ebp - 0xc], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00424764
lea edx, [ebp - 0x18]
mov eax, 0x4a3ce4
call fcn.00406b58
mov edx, dword [ebp - 0x18]
mov cl, 1
mov eax, dword [ebp - 0xc]
call fcn.004247c8
lea eax, [ebp - 0x1c]
mov ecx, 0x4a3ea0
mov edx, dword [ebp - 8]
call fcn.00404d90
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00424b1c
mov eax, dword [ebp - 0xc]
call fcn.00424734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3e39
cmp dword [ebp - 0xc], 0
je 0x4a3de2
mov eax, dword [ebp - 0xc]
call fcn.00403b5c
ret
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4a3cdc
call fcn.00406b58
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
pop eax
call fcn.0040a578
mov eax, dword [ebp - 0x20]
call fcn.00404f44
push eax
push 0x4a3ea4
push 0x4a3eb4
mov eax, dword [ebp - 4]
call fcn.004492a4
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3e8e
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404aa4
lea eax, [ebp - 0x10]
call fcn.00404a80
lea eax, [ebp - 8]
call fcn.00404a80
ret
Function at 0x29a09125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x29a09134
pop dword [ebp - 8]
mov eax, 0xaea3d44d
add eax, 0x7afcbce7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x4392a031
sub dword [ebp - 0x18], 0xf5405ae6
mov dword [ebp - 0x14], 0xde4f1030
add dword [ebp - 0x14], 0x53e43c15
mov dword [ebp - 0x10], 0x579f6af1
sub dword [ebp - 0x10], 0xb5326c3
mov dword [ebp - 0xc], 0x158fecaa
add dword [ebp - 0xc], 0xea701356
lea eax, [ebp - 0x18]
push eax
mov eax, 0x868a6163
add eax, 0xa316df29
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xed03c178
add dword [ebp - 0x18], 0x876ea7de
mov dword [ebp - 0x14], 0x5add5b93
sub dword [ebp - 0x14], 0x1970fa1e
mov dword [ebp - 0x10], 0xabbcff32
add dword [ebp - 0x10], 0xb7b26d3a
mov dword [ebp - 0xc], 0x8d2aa12c
sub dword [ebp - 0xc], 0x8d2aa12c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5c9ef411
sub eax, 0x32fdb3cd
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39e87
push 0
call eax
mov ecx, 0xa3559828
add ecx, 0x5caaae6d
xor edi, edi
add edi, eax
mov ebx, 0x29a22000
add ebx, dword [ebp - 8]
mov edx, 0x1ab9a840
add dword [ebp - 4], esi
mov esi, dword [ebx]
xor dword [ebp - 4], 0x277ba359
sub esi, edx
sub dword [ebp - 4], 0x98d0e09a
mov dword [edi], esi
xor dword [ebp - 4], eax
add edi, 4
add ebx, 0x714abc56
sub ebx, 0x714abc52
loop 0x29a0924c
add eax, 0x915334f3
add eax, 0x6eadd834
xor ebx, ebx
add ebx, eax
add eax, 0x9d0a2ddf
add eax, 0x62f5d226
mov ecx, 0xa0dfffe0
sub ecx, 0x773fffe0
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10002800
Capabilities:
Print debug messages
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13bc
call fcn.1009fd80
mov eax, dword [0x100f3010]
xor eax, esp
mov dword [esp + 0x13b8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [ebp + 0x14]
mov ebx, edx
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
cmp esi, 2
jne 0x1000286c
push dword [0x100f9564]
lea eax, [esp + 0x24]
push dword [0x100f9560]
push str._s___d__:
push 0x139b
push eax
call fcn.100027b0
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x10002889
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
mov edx, 0x139b
lea ecx, [esp + 0x28]
push eax
sub edx, edi
add ecx, edi
call fcn.10002730
add esp, 0xc
cmp eax, 0xffffffff
jne 0x100028a3
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x13b8]
xor ecx, esp
call fcn.10079386
mov esp, ebp
pop ebp
ret
cmp esi, 2
jne 0x100028be
add eax, edi
lea ecx, [esp + 0x20]
add eax, ecx
push 0x100ce1f8
push eax
call fcn.10002770
add esp, 8
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x1c], eax
mov eax, dword [0x100f9224]
mov dword [esp + 0x14], 0x100f3cd0
mov dword [esp + 0x18], ebx
cmp eax, 0xffffffff
je 0x100028e9
lea ecx, [esp + 0x14]
push ecx
push eax
call edi
lea eax, [esp + 0x20]
push eax
push 0x100cdda0
call fcn.10002700
add esp, 8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebx, ebx
cmp esi, 2
je 0x10002914
cmp esi, 3
sete bl
inc ebx
mov eax, dword [0x100f9224]
cmp eax, 0xffffffff
je 0x10002923
push 0
push eax
call edi
mov eax, ebx
sub eax, 0
je 0x10002931
sub eax, 2
je 0x1000294e
jmp 0x10002937
cmp esi, 2
je 0x10002937
int3
mov ecx, dword [esp + 0x13c4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10079386
mov esp, ebp
pop ebp
ret
push str.Exiting_on_SPEW_ABORT_n
call fcn.10002ae0
add esp, 4
push 0
call fcn.10083a1b
int3

Function at 0x100029f0
Capabilities:
Print debug messages
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13b4
call fcn.1009fd80
mov eax, dword [0x100f3010]
xor eax, esp
mov dword [esp + 0x13b0], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [0x100f793c], esi
jl 0x10002a90
lea eax, [ebp + 0x10]
mov edx, 0x139b
push eax
push ecx
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
call fcn.10002730
add esp, 0xc
cmp eax, 0xffffffff
je 0x10002a90
mov eax, dword [0x100f9224]
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 4], 0x100f3cd0
mov dword [esp + 8], str.developer
cmp eax, 0xffffffff
je 0x10002a64
lea ecx, [esp + 4]
push ecx
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x100cdda0
call fcn.10002700
add esp, 8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x100f9224]
cmp eax, 0xffffffff
je 0x10002a90
push 0
push eax
call esi
mov ecx, dword [esp + 0x13b4]
pop esi
xor ecx, esp
call fcn.10079386
mov esp, ebp
pop ebp
ret
Function at 0x10003080
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x100f799c]
push esi
mov esi, edx
test eax, eax
jne 0x10003099
push esi
push eax
push ecx
call fcn.1007b780
add esp, 0xc
pop esi
ret
push eax
push esi
push 1
push ecx
call fcn.100898c4
mov eax, dword [0x100f7980]
add esp, 0x10
mov ecx, dword [0x100f7978]
add eax, esi
mov dword [0x100f7980], eax
cmp eax, ecx
jle 0x100030db
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.10003020
mov eax, dword [0x100f7980]
add esp, 8
mov ecx, dword [0x100f7978]
cmp eax, ecx
jl 0x10003097
pop esi
jmp dword [0x100f3a9c]

Function at 0x10035bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xd0]
mov dword [esi], vtable.vgui::Menu.0
test ecx, ecx
je 0x10035bce
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
lea ecx, [esi + 0x134]
call fcn.10008f50
mov eax, dword [esi + 0x128]
mov dword [esi + 0x12c], 0
test eax, eax
js 0x10035c1a
mov ecx, dword [esi + 0x120]
test ecx, ecx
je 0x10035c10
push ecx
call fcn.1007e8a3
mov dword [esi + 0x120], 0
add esp, 4
mov eax, dword [esi + 0x128]
mov dword [esi + 0x124], 0
mov ecx, dword [esi + 0x120]
mov dword [esi + 0x130], ecx
test eax, eax
js 0x10035c4b
test ecx, ecx
je 0x10035c41
push ecx
call fcn.1007e8a3
add esp, 4
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov eax, dword [esi + 0x114]
mov dword [esi + 0x118], 0
test eax, eax
js 0x10035c8c
mov ecx, dword [esi + 0x10c]
test ecx, ecx
je 0x10035c82
push ecx
call fcn.1007e8a3
mov dword [esi + 0x10c], 0
add esp, 4
mov eax, dword [esi + 0x114]
mov dword [esi + 0x110], 0
mov ecx, dword [esi + 0x10c]
mov dword [esi + 0x11c], ecx
test eax, eax
js 0x10035cbd
test ecx, ecx
je 0x10035cb3
push ecx
call fcn.1007e8a3
add esp, 4
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov eax, dword [esi + 0x100]
mov dword [esi + 0x104], 0
test eax, eax
js 0x10035cfe
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x10035cf4
push ecx
call fcn.1007e8a3
mov dword [esi + 0xf8], 0
add esp, 4
mov eax, dword [esi + 0x100]
mov dword [esi + 0xfc], 0
mov ecx, dword [esi + 0xf8]
mov dword [esi + 0x108], ecx
test eax, eax
js 0x10035d2f
test ecx, ecx
je 0x10035d25
push ecx
call fcn.1007e8a3
add esp, 4
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
lea ecx, [esi + 0xd4]
call fcn.10031a60
cmp dword [esi + 0xdc], 0
jl 0x10035d6a
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x10035d60
push eax
call fcn.1007e8a3
add esp, 4
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0
pop edi
mov ecx, esi
pop esi
jmp fcn.1003f830
Function at 0x1003f830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3600
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100f3010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.vgui::Panel.0
call fcn.100415e0
cmp eax, 0xffffffff
je 0x1003f8b8
push dword [esi + 0x40]
call fcn.1003df50
mov edi, eax
test edi, edi
je 0x1003f8b8
mov edx, dword [edi + 0x14]
xor ecx, ecx
test edx, edx
jle 0x1003f8b8
mov ebx, dword [edi + 8]
mov eax, ebx
cmp dword [eax], esi
je 0x1003f891
inc ecx
add eax, 4
cmp ecx, edx
jl 0x1003f883
jmp 0x1003f8b8
cmp ecx, 0xffffffff
je 0x1003f8b8
sub edx, ecx
dec edx
test edx, edx
jle 0x1003f8b5
lea eax, [edx*4]
lea ecx, [ebx + ecx*4]
push eax
lea eax, [ecx + 4]
push eax
push ecx
call fcn.1007b940
add esp, 0xc
dec dword [edi + 0x14]
mov eax, dword [esi + 0x24]
cmp byte [eax + 1], 0
je 0x1003f8ce
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.10046780
mov ax, word [esi + 0x50]
mov ecx, 0xffbf
and ax, cx
mov ecx, esi
or ax, 1
push 0
mov word [esi + 0x50], ax
call fcn.100405f0
mov ecx, dword [0x100f79f0]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
je 0x1003f94a
nop dword [eax]
mov ecx, dword [0x100f79f0]
push 0
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [0x100f79f0]
mov edi, eax
push edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x74]
call edx
mov ecx, dword [0x100f79f0]
test al, al
mov eax, dword [ecx]
je 0x1003f932
push edi
call dword [eax + 0x78]
jmp 0x1003f938
push 0
push edi
call dword [eax + 0x40]
mov ecx, dword [0x100f79f0]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x1003f900
mov ecx, dword [0x100f79e8]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x24]
push dword [esi + 0x48]
call fcn.100793c5
mov edi, dword [esi + 0x24]
add esp, 4
mov dword [esi + 0x44], 0
test edi, edi
je 0x1003f9dd
mov ecx, dword [edi + 0x34]
mov dword [edi + 0x38], 0
mov eax, dword [edi + 0x2c]
test ecx, ecx
js 0x1003f9c7
test eax, eax
je 0x1003f999
push eax
call fcn.1007e8a3
mov dword [edi + 0x2c], 0
add esp, 4
mov ecx, dword [edi + 0x34]
mov dword [edi + 0x30], 0
mov eax, dword [edi + 0x2c]
mov dword [edi + 0x3c], eax
test ecx, ecx
js 0x1003f9ca
test eax, eax
je 0x1003f9be
push eax
call fcn.1007e8a3
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
jmp 0x1003f9ca
mov dword [edi + 0x3c], eax
lea ecx, [edi + 0x18]
call fcn.10008f50
push 0x5c
push edi
call fcn.10079394
add esp, 8
lea ecx, [esi + 0x54]
call fcn.10008f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10055ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x178]
mov dword [esi], vtable.vgui::TextEntry.0
test ecx, ecx
je 0x10055cfd
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
mov ecx, dword [esi + 0x388]
test ecx, ecx
je 0x10055d11
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
mov eax, dword [esi + 0xfc]
mov dword [esi + 0x100], 0
test eax, eax
js 0x10055d52
mov ecx, dword [esi + 0xf4]
test ecx, ecx
je 0x10055d48
push ecx
call fcn.1007e8a3
mov dword [esi + 0xf4], 0
add esp, 4
mov eax, dword [esi + 0xfc]
mov dword [esi + 0xf8], 0
mov ecx, dword [esi + 0xf4]
mov dword [esi + 0x104], ecx
test eax, eax
js 0x10055d83
test ecx, ecx
je 0x10055d79
push ecx
call fcn.1007e8a3
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
lea ecx, [esi + 0xe0]
call fcn.10008f50
lea ecx, [esi + 0xcc]
call fcn.10008f50
mov ecx, esi
pop esi
jmp fcn.1003f830

Function at 0x1005c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6f2e
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x100f3010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x814], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x818], edi
mov dword [edi], vtable.vgui::Image.0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov eax, dword [edi]
push 0xffffffffffffffff
mov dword [edi + 0x14], 0xffffffff
call dword [eax + 0x48]
mov dword [ebp - 4], 0
mov dword [edi], vtable.vgui::TextImage.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], eax
mov byte [ebp - 4], 1
xor eax, eax
mov dword [edi + 0x20], eax
mov ebx, 0x100cdda3
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x1c], eax
mov al, byte [edi + 0x34]
and al, 0xfd
mov dword [edi + 0x18], 0
and al, 0xfb
mov dword [edi + 0x2c], 0xffffffff
and al, 0xf7
mov dword [edi + 0x44], 0
test esi, esi
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], al
cmovne ebx, esi
cmp byte [ebx], 0x23
jne 0x1005c7dd
mov ecx, dword [0x100f79e0]
lea eax, [ebx + 1]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov dword [edi + 0x2c], eax
cmp eax, 0xffffffff
je 0x1005c7dd
mov ecx, dword [0x100f79e0]
push eax
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov edx, dword [edi]
mov ecx, edi
push 0
push eax
call dword [edx + 0x68]
jmp 0x1005c805
mov ecx, dword [0x100f79e0]
lea edx, [ebp - 0x810]
push 0x800
push edx
push ebx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi]
lea ecx, [ebp - 0x810]
push 0
push ecx
mov ecx, edi
call dword [eax + 0x68]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10079386
mov esp, ebp
pop ebp
ret 4