joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c40c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
lea eax, [ebx + 0x3c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
call sub.user32.dll_GetWindowRect
push 0
mov eax, dword [ebx + 0x2c]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x2c]
push eax
call sub.user32.dll_CloseWindow
mov eax, dword [ebx + 0x2c]
push eax
call sub.user32.dll_DestroyWindow
pop ebx
pop ebp
ret

Function at 0x50c8cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [eax + 0x38], 0
je 0x50c8e2
push 4
mov eax, dword [eax + 0x2c]
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret
push 0
mov eax, dword [eax + 0x2c]
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret

Function at 0x50f068
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, 0x607860
cmp dword [0x60785c], 0
je 0x50f0e2
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ebx + 4]
jne 0x50f09b
cmp eax, dword [ebx]
jae 0x50f0af
jmp 0x50f09d
jge 0x50f0af
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add eax, 0xffffffff
adc edx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
cmp edx, 0
jne 0x50f0c8
cmp eax, 0xfa0
jb 0x50f0ca
jmp 0x50f0d8
jge 0x50f0d8
mov eax, dword [sym.imp.vcl250.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl250.bpl__Vcl_Forms_TApplication_ProcessMessages_qqrv
jmp 0x50f07d
mov eax, 0x60785c
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5126e4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51288f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [0x603a1c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xc]
test al, al
je 0x5127c2
xor eax, eax
push ebp
push 0x512795
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x511f98]
call fcn.005124f0
lea ecx, [ebp - 4]
mov eax, dword [0x603a1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
xor eax, eax
push ebp
push 0x512784
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x51276e
mov byte [ebp - 0xd], 1
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51286c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51278b
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
mov dl, 1
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_]
call sub.rtl250.bpl__System_Win_Registry_TRegistry__bctr_qqrv
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x512865
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call sub.rtl250.bpl__System_Win_Registry_TRegistry_SetRootKey_qqrp6HKEY__
xor ecx, ecx
mov edx, 0x5128b0
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_OpenKey_qqrx20System_UnicodeStringo
test al, al
je 0x51284f
xor edx, edx
push ebp
push 0x512848
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
mov eax, dword [0x511f98]
call fcn.00512478
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_ValueExists_qqrx20System_UnicodeString
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51284f
mov eax, dword [ebp - 0x14]
call sub.rtl250.bpl__System_Win_Registry_TRegistry_CloseKey_qqrv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51286c
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512896
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
Function at 0x527ddc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x527f3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
cmp word [ebp + 0x12], 0
je 0x527e16
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
call dword [ebp + 0x10]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x527f29
test esi, esi
jne 0x527e2b
call sub.rtl250.bpl__System_Sysutils_TEncoding_GetUTF8_qqrv
mov esi, eax
xor edx, edx
push ebp
push 0x527f0f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Classes_TStringList_]
call sub.rtl250.bpl__System_Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x527efe
push dword fs:[eax]
mov dword fs:[eax], esp
movzx edx, byte [ebp + 8]
mov eax, dword [ebp - 0xc]
call sub.rtl250.bpl__System_Classes_TStrings_SetWriteBOM_qqrxo
lea ecx, [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.00528ab4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 0xc]
add eax, 0xc
mov edx, 0x527f60
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0xff20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Classes_TFileStream_]
call sub.rtl250.bpl__System_Classes_TFileStream__bctr_qqrx20System_UnicodeStringus
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x527ee1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call sub.rtl250.bpl__System_Classes_TStream_SetPosition_qqrxj
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527ee8
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527f46
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x52ae20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x52ae36
add esp, 0xfffffff0
call sub.rtl250.bpl__System__ClassCreate_qqrpvzc
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x52aef2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x64
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0051e9d8
xor eax, eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
lea eax, [ebp - 4]
call fcn.004847fc
mov edx, dword [ebp - 4]
lea eax, [esi + 0x50]
call sub.rtl250.bpl__System__IntfCopy_qqrr44System__DelphiInterface_17System_IInterface_x44System__DelphiInterface_17System_IInterf
push esi
push 0x52b3f0
mov dl, 1
mov eax, dword [0x52a324]
call fcn.0052ced8
mov edx, eax
test edx, edx
je 0x52ae8f
sub edx, 0xffffffe8
lea eax, [esi + 0x54]
call sub.rtl250.bpl__System__IntfCopy_qqrr44System__DelphiInterface_17System_IInterface_x44System__DelphiInterface_17System_IInterf
mov edx, dword [esi + 0x54]
mov eax, dword [esi + 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov dl, 0xb
mov eax, dword [0x517ea4]
call fcn.005190ec
push eax
mov edx, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_Project_Productinfo_ProductInfo_FApplicationDataPath]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x52af24
call sub.rtl250.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov ecx, dword [ebp - 8]
mov eax, dword [esi + 0x50]
mov edx, 0x52af3c
mov edi, dword [eax]
call dword [edi + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52aef9
lea eax, [ebp - 8]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret

Function at 0x530ab0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x530b4e
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x530b2b
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, ebx
call fcn.00530fd8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x530b68
call sub.rtl250.bpl__System_Sysutils_Format_qqrx20System_UnicodeStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
mov edx, esi
mov eax, ebx
call fcn.00530fd8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov eax, ebx
pop edx
call fcn.00532558
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530b55
lea eax, [ebp - 0x14]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret
Function at 0x55b7c4
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov edx, dword [0x491dc8]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x55b96b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x25], 1
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x55b94f
cmp dword [ebp - 0x2c], 0xffffffff
je 0x55b94f
xor edx, edx
push ebp
push 0x55b948
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x52dca4]
call fcn.005305f8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 2
mov eax, 0x603410
mov dword [ebp - 0x40], eax
push 0xf01ff
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x55b914
cmp dword [ebp - 0x30], 0xffffffff
je 0x55b914
xor edx, edx
push ebp
push 0x55b90d
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x55b8d1
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
call fcn.00530d54
cmp dword [ebp - 0x20], 4
jne 0x55b8c4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
mov eax, dword [ebp - 0x30]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
je 0x55b8c7
inc dword [ebp - 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55b8f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b914
mov eax, dword [ebp - 0x30]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
add dword [ebp - 0x40], 4
dec dword [ebp - 0x38]
jne 0x55b843
lea eax, [ebp - 0x34]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
cmp dword [ebp - 0x3c], 2
sete byte [ebp - 0x25]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b94f
mov eax, dword [ebp - 0x2c]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b972
lea eax, [ebp - 0x24]
mov edx, dword [0x491dc8]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret
Function at 0x5d9dd4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d9e63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
test al, al
jne 0x5d9e4d
test esi, esi
jge 0x5d9e01
xor esi, esi
jmp 0x5d9e0b
cmp esi, 0x64
jle 0x5d9e0b
mov esi, 0x64
cmp dword [ebx + 0x14], 0
je 0x5d9e1e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x14]
cmp eax, 0x32
jb 0x5d9e4d
lea eax, [ebp - 4]
mov edx, ebx
test edx, edx
je 0x5d9e2a
sub edx, 0xfffffff8
mov ecx, 0x5d9e70
call sub.rtl250.bpl__System__IntfCast_qqrr44System__DelphiInterface_17System_IInterface_x44System__DelphiInterface_17System_IInterf
mov eax, dword [ebp - 4]
push eax
call fcn.005d9d60
mov ecx, esi
pop edx
call sub.AxComponentsRTL.bpl__Axrtl_Project_Eventnotifier_EventNotifier_NotifySync_qqruiuii
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9e6a
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
Function at 0x10002800
Capabilities:
Print debug messages
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13bc
call fcn.1009f8a0
mov eax, dword [0x100f3040]
xor eax, esp
mov dword [esp + 0x13b8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [ebp + 0x14]
mov ebx, edx
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
cmp esi, 2
jne 0x1000286c
push dword [0x100f95d4]
lea eax, [esp + 0x24]
push dword [0x100f95d0]
push str._s___d__:
push 0x139b
push eax
call fcn.100027b0
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x10002889
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
mov edx, 0x139b
lea ecx, [esp + 0x28]
push eax
sub edx, edi
add ecx, edi
call fcn.10002730
add esp, 0xc
cmp eax, 0xffffffff
jne 0x100028a3
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x13b8]
xor ecx, esp
call fcn.10078fd6
mov esp, ebp
pop ebp
ret
cmp esi, 2
jne 0x100028be
add eax, edi
lea ecx, [esp + 0x20]
add eax, ecx
push 0x100cd1f8
push eax
call fcn.10002770
add esp, 8
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x1c], eax
mov eax, dword [0x100f9294]
mov dword [esp + 0x14], 0x100f3d40
mov dword [esp + 0x18], ebx
cmp eax, 0xffffffff
je 0x100028e9
lea ecx, [esp + 0x14]
push ecx
push eax
call edi
lea eax, [esp + 0x20]
push eax
push 0x100ccda0
call fcn.10002700
add esp, 8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebx, ebx
cmp esi, 2
je 0x10002914
cmp esi, 3
sete bl
inc ebx
mov eax, dword [0x100f9294]
cmp eax, 0xffffffff
je 0x10002923
push 0
push eax
call edi
mov eax, ebx
sub eax, 0
je 0x10002931
sub eax, 2
je 0x1000294e
jmp 0x10002937
cmp esi, 2
je 0x10002937
int3
mov ecx, dword [esp + 0x13c4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10078fd6
mov esp, ebp
pop ebp
ret
push str.Exiting_on_SPEW_ABORT_n
call fcn.10002ae0
add esp, 4
push 0
call fcn.1008365b
int3

Function at 0x100029f0
Capabilities:
Print debug messages
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13b4
call fcn.1009f8a0
mov eax, dword [0x100f3040]
xor eax, esp
mov dword [esp + 0x13b0], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [0x100f79ac], esi
jl 0x10002a90
lea eax, [ebp + 0x10]
mov edx, 0x139b
push eax
push ecx
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
call fcn.10002730
add esp, 0xc
cmp eax, 0xffffffff
je 0x10002a90
mov eax, dword [0x100f9294]
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 4], 0x100f3d40
mov dword [esp + 8], str.developer
cmp eax, 0xffffffff
je 0x10002a64
lea ecx, [esp + 4]
push ecx
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x100ccda0
call fcn.10002700
add esp, 8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x100f9294]
cmp eax, 0xffffffff
je 0x10002a90
push 0
push eax
call esi
mov ecx, dword [esp + 0x13b4]
pop esi
xor ecx, esp
call fcn.10078fd6
mov esp, ebp
pop ebp
ret
Function at 0x10003080
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x100f7a0c]
push esi
mov esi, edx
test eax, eax
jne 0x10003099
push esi
push eax
push ecx
call fcn.1007b3c0
add esp, 0xc
pop esi
ret
push eax
push esi
push 1
push ecx
call fcn.10089504
mov eax, dword [0x100f79f0]
add esp, 0x10
mov ecx, dword [0x100f79e8]
add eax, esi
mov dword [0x100f79f0], eax
cmp eax, ecx
jle 0x100030db
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.10003020
mov eax, dword [0x100f79f0]
add esp, 8
mov ecx, dword [0x100f79e8]
cmp eax, ecx
jl 0x10003097
pop esi
jmp dword [0x100f3b0c]

Function at 0x10035b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xd0]
mov dword [esi], vtable.vgui::Menu.0
test ecx, ecx
je 0x10035b9e
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
lea ecx, [esi + 0x134]
call fcn.10008f50
cmp dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
jl 0x10035be3
mov eax, dword [esi + 0x120]
test eax, eax
je 0x10035bd9
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
cmp dword [esi + 0x128], 0
mov eax, dword [esi + 0x120]
mov dword [esi + 0x130], eax
jl 0x10035c19
test eax, eax
je 0x10035c0f
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
cmp dword [esi + 0x114], 0
mov dword [esi + 0x118], 0
jl 0x10035c53
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x10035c49
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
cmp dword [esi + 0x114], 0
mov eax, dword [esi + 0x10c]
mov dword [esi + 0x11c], eax
jl 0x10035c89
test eax, eax
je 0x10035c7f
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
cmp dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
jl 0x10035cc3
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x10035cb9
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
cmp dword [esi + 0x100], 0
mov eax, dword [esi + 0xf8]
mov dword [esi + 0x108], eax
jl 0x10035cf9
test eax, eax
je 0x10035cef
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
lea ecx, [esi + 0xd4]
call fcn.100319a0
cmp dword [esi + 0xdc], 0
jl 0x10035d34
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x10035d2a
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0
pop edi
mov ecx, esi
pop esi
jmp fcn.1003f7f0
Function at 0x1003f7f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3120
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100f3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.vgui::Panel.0
call fcn.10041570
cmp eax, 0xffffffff
je 0x1003f878
push dword [esi + 0x40]
call fcn.1003df20
mov edi, eax
test edi, edi
je 0x1003f878
mov edx, dword [edi + 0x14]
xor ecx, ecx
test edx, edx
jle 0x1003f878
mov ebx, dword [edi + 8]
mov eax, ebx
cmp dword [eax], esi
je 0x1003f851
inc ecx
add eax, 4
cmp ecx, edx
jl 0x1003f843
jmp 0x1003f878
cmp ecx, 0xffffffff
je 0x1003f878
sub edx, ecx
dec edx
test edx, edx
jle 0x1003f875
lea eax, [edx*4]
lea ecx, [ebx + ecx*4]
push eax
lea eax, [ecx + 4]
push eax
push ecx
call fcn.1007b580
add esp, 0xc
dec dword [edi + 0x14]
mov eax, dword [esi + 0x24]
cmp byte [eax + 1], 0
je 0x1003f88e
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.100467d0
mov ax, word [esi + 0x50]
mov ecx, 0xffbf
and ax, cx
mov ecx, esi
or ax, 1
push 0
mov word [esi + 0x50], ax
call fcn.10040580
mov ecx, dword [0x100f7a60]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
je 0x1003f90a
nop dword [eax]
mov ecx, dword [0x100f7a60]
push 0
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [0x100f7a60]
mov edi, eax
push edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x74]
call edx
mov ecx, dword [0x100f7a60]
test al, al
mov eax, dword [ecx]
je 0x1003f8f2
push edi
call dword [eax + 0x78]
jmp 0x1003f8f8
push 0
push edi
call dword [eax + 0x40]
mov ecx, dword [0x100f7a60]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x1003f8c0
mov ecx, dword [0x100f7a58]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x24]
push dword [esi + 0x48]
call fcn.10079017
mov edi, dword [esi + 0x24]
add esp, 4
mov dword [esi + 0x44], 0
test edi, edi
je 0x1003f996
cmp dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
jl 0x1003f95c
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x1003f955
push eax
call fcn.1007e4e3
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
cmp dword [edi + 0x34], 0
mov eax, dword [edi + 0x2c]
mov dword [edi + 0x3c], eax
jl 0x1003f983
test eax, eax
je 0x1003f97c
push eax
call fcn.1007e4e3
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x18]
call fcn.10008f50
push 0x5c
push edi
call fcn.10078fe4
add esp, 8
lea ecx, [esi + 0x54]
call fcn.10008f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10055cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x178]
mov dword [esi], vtable.vgui::TextEntry.0
test ecx, ecx
je 0x10055ccd
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
mov ecx, dword [esi + 0x388]
test ecx, ecx
je 0x10055ce1
mov eax, dword [ecx]
push 1
call dword [eax + 0x220]
cmp dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
jl 0x10055d1b
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x10055d11
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
cmp dword [esi + 0xfc], 0
mov eax, dword [esi + 0xf4]
mov dword [esi + 0x104], eax
jl 0x10055d51
test eax, eax
je 0x10055d47
push eax
call fcn.1007e4e3
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
lea ecx, [esi + 0xe0]
call fcn.10008f50
lea ecx, [esi + 0xcc]
call fcn.10008f50
mov ecx, esi
pop esi
jmp fcn.1003f7f0

Function at 0x1005c610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6a1e
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x100f3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x814], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x818], edi
mov dword [edi], vtable.vgui::Image.0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov eax, dword [edi]
push 0xffffffffffffffff
mov dword [edi + 0x14], 0xffffffff
call dword [eax + 0x48]
mov dword [ebp - 4], 0
mov dword [edi], vtable.vgui::TextImage.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], eax
mov byte [ebp - 4], 1
xor eax, eax
mov dword [edi + 0x20], eax
mov ebx, 0x100ccda3
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x1c], eax
mov al, byte [edi + 0x34]
and al, 0xfd
mov dword [edi + 0x18], 0
and al, 0xfb
mov dword [edi + 0x2c], 0xffffffff
and al, 0xf7
mov dword [edi + 0x44], 0
test esi, esi
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], al
cmovne ebx, esi
cmp byte [ebx], 0x23
jne 0x1005c72d
mov ecx, dword [0x100f7a50]
lea eax, [ebx + 1]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov dword [edi + 0x2c], eax
cmp eax, 0xffffffff
je 0x1005c72d
mov ecx, dword [0x100f7a50]
push eax
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov edx, dword [edi]
mov ecx, edi
push 0
push eax
call dword [edx + 0x68]
jmp 0x1005c755
mov ecx, dword [0x100f7a50]
lea edx, [ebp - 0x810]
push 0x800
push edx
push ebx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi]
lea ecx, [ebp - 0x810]
push 0
push ecx
mov ecx, edi
call dword [eax + 0x68]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10078fd6
mov esp, ebp
pop ebp
ret 4