joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d0ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [0x43a56c]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x150], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x30]
push 0x105
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x15c]
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x158], 3
mov edx, dword [ecx + 4]
push edx
call dword [0x430260]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push eax
push 0x4380f8
push ecx
call fcn.00426db6
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x5c
call fcn.00426a61
inc eax
lea edx, [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004269e9
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 4
call fcn.004275e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x150], 3
call fcn.004274f4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
call fcn.004275e1
push str.catlog_
lea ecx, [esp + 0x10]
call fcn.004276f5
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [0x430264]
mov edx, dword [0x43a56c]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x10]
mov bl, 5
push eax
mov byte [esp + 0x154], bl
call fcn.00426e12
mov ecx, dword [eax]
lea edx, [esp + 0x10]
mov dword [esp + 0x28], ecx
push str._Y_m_d
push edx
lea ecx, [esp + 0x30]
call fcn.00426e25
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x154], 6
call fcn.004275e1
mov byte [esp + 0x150], bl
lea ecx, [esp + 0x10]
call fcn.004274f4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x20]
push str._s_s.log
push edx
call fcn.00426db6
mov eax, dword [0x43a56c]
add esp, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push str._H:_M:_S
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 8
call fcn.00426e25
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x154], 9
call fcn.004275e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x150], 8
call fcn.004274f4
mov ecx, dword [esp + 0x18]
push 0x4380c8
push ecx
call fcn.0041e3d0
mov esi, eax
add esp, 8
test esi, esi
je 0x401643
mov edx, dword [esp + 0x1c]
push edx
push str._s_t___t
push esi
call fcn.0041e287
mov ecx, dword [esp + 0x168]
lea eax, [esp + 0x16c]
push eax
push ecx
push esi
call fcn.0041e24c
push 0x4380fc
push esi
call fcn.0041e287
push esi
call fcn.0041e0e6
push esi
call fcn.0041e069
add esp, 0x28
lea ecx, [esp + 0x1c]
mov byte [esp + 0x150], 7
call fcn.004274f4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x150], bl
call fcn.004274f4
lea ecx, [esp + 0x20]
mov byte [esp + 0x150], 3
call fcn.004274f4
lea ecx, [esp + 0x18]
mov byte [esp + 0x150], 2
call fcn.004274f4
lea ecx, [esp + 0x24]
mov byte [esp + 0x150], 1
call fcn.004274f4
lea ecx, [esp + 0xc]
mov byte [esp + 0x150], 0
call fcn.004274f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x150], 0xffffffff
call fcn.004274f4
mov ecx, dword [esp + 0x148]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x420e53
Capabilities:
Packed with generic packer

Disassembly:
pop edx
dec edx
sahf
inc edi
pop ecx
dec ebp
outsd dx, dword [esi]
xlatb
xlatb
sbb eax, 0x32f1a34a
in al, dx
fidivr word [esi - 0x77]
mov eax, dword [ecx - 4]
aad 0x46
jno 0x420eb9
cwde
invalid
aaa
sub edx, dword [eax]
pop esi
dec ebp
lea edx, [eax - 0x318650a9]
mov bl, 0xf4

Function at 0x420ec6
Capabilities:
Packed with generic packer

Disassembly:
popal
push ecx
dec edi
add eax, 0x9dea636
xchg edi, eax
ljmp 0xc012
jns 0x420f0c
push ds
mov dword [ecx - 0xc3a4ca7], ebp
jne 0x420e9d
in al, dx
scasb al, byte es:[edi]
adc esi, dword [ebx]
mov ch, 0x8a
popfd
cmp ebx, dword [esi]
dec ebp
arpl si, cx
adc al, 0x3d
mov ebp, 0xf6c70c31
mov ah, 0xe6
pop eax
jle 0x420f49
cli
jo 0x420f58
mov dl, 0xe7
movsb byte es:[edi], byte [esi]
cld
push eax
xor ch, byte [ecx - 0x35c5b2d1]
hlt
aas
jmp 0x420fb8
dec edx
and al, 0x15
idiv al
pushal
pop eax
add dword [ebx - 0x52c24749], ecx
mov al, byte [ecx + 0x52132a78]
pop esp
js 0x420f84
adc edx, dword [edx + 0x5c]
add al, 0xdb
jmp 0x420f46
cmp dword [0x9ad67bbd], ecx
mov edi, 0xeb70d5e1
push edx
fdivr dword [edx + 0x4789fa52]
test ebx, ebp
stosd dword es:[edi], eax
invalid
add dword [eax + 0x20da25e], 0xb45eac7b
xor al, byte [0xd29b46af]
xor eax, 0x3ef21616
adc dword [edx], ebp
mov ebp, 0x4d7cc3d4
dec ebp
or al, 0xcf
cmp dl, dh
salc
pop eax
xor dword [ecx - 0x66], esi
cmp edx, dword [edx + 0x166ca198]
loop fcn.00421015
jecxz 0x420fa8
cmc
push ecx
xor edi, dword [ebp - 0x2b]
dec edi
sbb byte [ebx + ebx + 0x471c1f6f], bh
and byte [ecx - 0x3ace6c7], 0x40
sbb eax, 0x6c853e05
int3

Function at 0x427631
Capabilities:
Encode data using xor

Disassembly:
shl byte [ebx], cl
call dword [eax - 0x25]
adc dl, byte [ebx - 8]
in eax, 0x24
and dword [esi], ebx
mov ds, word [edx + 0x66]
leave
push bp
sbb ah, byte [ebx + 0x441cbf60]
add eax, 0x798eccd5
mov edx, edx
out 0xd9, eax
rol dword [ecx], 0x85
je 0x4275d9
invalid
Function at 0x10013510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025a54b
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0xd4], eax
push esi
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0xe4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xf8]
mov edi, dword [esp + 0xf4]
mov esi, dword [esp + 0xfc]
mov dword [esp + 0x14], 0
movss xmm0, dword [eax]
mov eax, dword [0x102ab104]
movss dword [esp + 0x10], xmm0
mov dword [esp + 0x18], 0x102af29c
mov dword [esp + 0x28], 0x102af2a4
mov dword [esp + 0x80], eax
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0xf0], 0
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 2
call dword [0x102ab0cc]
mov eax, dword [esp + 0x18]
mov dword [esp + 0xec], 1
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x18], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x14], eax
lea ecx, [esp + 0x30]
call dword [0x102ab0a8]
mov dword [esp + 0x30], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov eax, esi
mov dword [esp + 0xec], 3
cdq
push edx
push eax
lea eax, [esp + 0xd0]
push eax
call dword [0x102ab0d4]
mov ecx, eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 4]
push dword [ecx + 0xc]
push dword [ecx + 8]
lea eax, [esp + eax + 0x3c]
push eax
mov eax, dword [ecx]
call eax
movss xmm0, dword [esp + 0x28]
lea ecx, [esp + 0x40]
add esp, 0x14
movss dword [esp], xmm0
call dword [0x102ab098]
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.10015590
push eax
push edi
mov byte [esp + 0xf4], 4
call dword [0x102ab8e4]
add esp, 8
cmp dword [esp + 0xdc], 0x10
jb 0x10013685
push dword [esp + 0xc8]
call fcn.1025720c
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xd8], 0
mov byte [esp + 0xc8], 0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x18], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x14], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.10014b30
lea ecx, [esp + 0x30]
call dword [0x102ab0a4]
lea ecx, [esp + 0x38]
call dword [0x102ab0d0]
lea ecx, [esp + 0x80]
call dword [0x102ab09c]
mov eax, edi
mov ecx, dword [esp + 0xe4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.10257318
add esp, 0xe4
ret
Function at 0x10021170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025c130
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_14b6aa2d980877772e640bd832c68486____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [ecx + 0x60]
mov dword [esp + 0x30], 1
test ecx, ecx
jne 0x100211d9
call dword [0x102ab0b0]
mov eax, dword [ecx]
lea edi, [esp + 0xc]
push edi
push esi
push edx
call dword [eax + 8]
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
test ecx, ecx
je 0x10021209
mov esi, dword [ecx]
lea eax, [esp + 0xc]
cmp ecx, eax
setne dl
movzx eax, dl
push eax
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10257318
add esp, 0x28
ret 0xc
Function at 0x10022300
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
lea edi, [edx + ebp*8]
invalid
Function at 0x10023b01
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop eax
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x4752
and edx, 0xfe73
sub edx, 0x9814
add edx, 0x3e5c
pop edx
push edx
push eax
add esp, 4
add edx, 0xdc34
or edx, 0xf6dd
sub edx, 0x4696
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xfc4], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ebx
xor ebx, 0xdc7a
and ebx, 0xefac
pop ebx
push esi
or esi, 0x2c0e
jmp 0x10023af3
pop esi
push eax
call 0x10023b01
add byte [edx + 0x32], al
xor bh, byte [eax]
aas
add esp, 4
xor eax, 0x4f71
pop eax
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10023b28
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x10023b82
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x10023a50
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x10023a50
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10023b6c
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10023b76
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x10023bcb
push ebx
push ecx
add esp, 4
and ebx, 0x157f1
add ebx, 0x5eb5
pop ebx
push ecx
or ecx, 0x160ca
call 0x10023bb3
add byte [ebp + 0x47], cl
push eax
cmp dword [ecx], edi
xor eax, 0x833d4e3b
les eax, [ecx + eax*4]
rcr dword [edx - 0x11], 0
add byte [ecx - 0x75], bl
test dword [ebx + edi*8], esi
invalid
push ebx
jmp 0x10023bd2
or ebx, 0x4ce5
sub ebx, 0x17e27
sub ebx, 0x1577e
pop ebx
push esi
push ebx
add esp, 4
xor esi, 0x2058
and esi, 0xfc45
add esi, 0xc88e
pop esi
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10023c29
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100239f4
mov dword [ebp - 0x2a4], 0
Function at 0x10023bb3
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop eax
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x4752
and edx, 0xfe73
sub edx, 0x9814
add edx, 0x3e5c
pop edx
push edx
push eax
add esp, 4
add edx, 0xdc34
or edx, 0xf6dd
sub edx, 0x4696
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xfc4], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ebx
xor ebx, 0xdc7a
and ebx, 0xefac
pop ebx
push esi
or esi, 0x2c0e
jmp 0x10023af3
pop esi
push eax
call 0x10023b01
add byte [edx + 0x32], al
xor bh, byte [eax]
aas
add esp, 4
xor eax, 0x4f71
pop eax
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10023b28
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x10023b82
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x10023a50
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x10023a50
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10023b6c
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10023b76
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x10023bcb
push ebx
push ecx
add esp, 4
and ebx, 0x157f1
add ebx, 0x5eb5
pop ebx
push ecx
or ecx, 0x160ca
call 0x10023bb3
add byte [ebp + 0x47], cl
push eax
cmp dword [ecx], edi
xor eax, 0x833d4e3b
les eax, [ecx + eax*4]
rcr dword [edx - 0x11], 0
add byte [ecx - 0x75], bl
test dword [ebx + edi*8], esi
invalid
push ebx
jmp 0x10023bd2
or ebx, 0x4ce5
sub ebx, 0x17e27
sub ebx, 0x1577e
pop ebx
push esi
push ebx
add esp, 4
xor esi, 0x2058
and esi, 0xfc45
add esi, 0xc88e
pop esi
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10023c29
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100239f4
mov dword [ebp - 0x2a4], 0
Function at 0x100565e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10263b50
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x28]
push ebx
call dword [0x102aba44]
lea eax, [ebx + 4]
mov dword [esp + 0x20], 0
push eax
lea ecx, [ebp + 4]
call dword [0x102ab728]
movzx eax, byte [ebx + 8]
lea edi, [ebx + 0x20]
mov byte [ebp + 8], al
lea ecx, [ebp + 0x20]
movzx eax, byte [ebx + 9]
mov byte [ebp + 9], al
movzx eax, byte [ebx + 0xa]
mov byte [ebp + 0xa], al
movzx eax, byte [ebx + 0xb]
mov byte [ebp + 0xb], al
movzx eax, byte [ebx + 0xc]
mov byte [ebp + 0xc], al
mov eax, dword [ebx + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0x18], eax
mov eax, dword [ebx + 0x1c]
push edi
mov byte [esp + 0x24], 1
mov dword [ebp + 0x1c], eax
call fcn.10055ce0
mov eax, dword [edi + 0xc]
mov dword [ebp + 0x2c], eax
lea eax, [ebx + 0x30]
mov byte [esp + 0x20], 2
push eax
lea ecx, [ebp + 0x30]
call fcn.10055a60
mov eax, dword [ebx + 0x3c]
mov dword [ebp + 0x3c], eax
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x10068130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102657e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x102aba48]
mov edx, dword [esp + 0x24]
mov eax, 0x14
push dword [esp + 0x28]
cmp edx, eax
mov byte [esp + 0x29], 0
mov dword [esp + 0x20], 0
cmovl edx, eax
mov eax, dword [esp + 0x30]
xor cl, cl
mov byte [esp + 0x28], al
mov ax, word [esp + 0x28]
mov byte [esp + 0x13], cl
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x14]
mov word [esp + 0x11], ax
mov dword [esp + 0xc], edx
call dword [0x102aba20]
mov eax, dword [esi + 0x50]
lea ecx, [esi + 0x50]
mov edx, dword [eax + 0xc]
sub edx, dword [eax + 8]
lea eax, [esp + 8]
push eax
mov dword [esp + 0x28], edx
call fcn.100682c0
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 0x60]
call fcn.10017550
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call dword [0x102aba64]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc
Function at 0x10088350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1026a52d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.GotoDialog.0
mov dword [esi + 8], vtable.GotoDialog.1.0
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x14], 3
call fcn.10191070
mov ecx, dword [esi + 0x34]
push 0xffffffffffffffff
call dword [0x102ab604]
push esi
call fcn.10149670
mov ecx, eax
call fcn.1014a420
push dword [esi + 0x30]
call fcn.1025720c
add esp, 4
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x3c]
call dword [0x102aba64]
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call dword [0x102aba64]
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 0
call dword [0x102aba64]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call dword [0x102ad13c]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x1008bbc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1026ae36
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x20], 0
push eax
call dword [0x102ad238]
mov edi, dword [esp + 0x30]
push 2
push 0x102bc68c
mov dword [ebx + 0x34], edi
call dword [0x102ab9d0]
add esp, 8
mov dword [esp + 0x30], eax
push edi
lea eax, [esp + 0x10]
mov byte [esp + 0x24], 1
push eax
lea ecx, [esp + 0x38]
call dword [0x102ab6e0]
mov ecx, dword [ebx + 0x18]
push eax
mov byte [esp + 0x24], 2
mov ecx, dword [ecx + 0x10]
call dword [0x102ac87c]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call dword [0x102aba64]
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call dword [0x102aba64]
push 2
push 0x102ae2ac
call dword [0x102ab9d0]
add esp, 8
mov dword [esp + 0x30], eax
mov eax, 0x30
mov byte [esp + 0x20], 3
mov word [esp + 0xc], ax
lea ecx, [esp + 0x30]
push dword [esp + 0xc]
lea eax, [edi + edi]
push 0x10
push eax
push dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
call dword [0x102aba1c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 4
push ecx
mov ecx, eax
call dword [0x102aba00]
mov ecx, dword [ebx + 0x18]
push eax
mov byte [esp + 0x24], 5
mov ecx, dword [ecx + 0x2c]
call dword [0x102ad0e8]
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 4
call dword [0x102aba64]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 3
call dword [0x102aba64]
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call dword [0x102aba64]
mov ecx, dword [ebx + 0x18]
mov ecx, dword [ecx + 0x2c]
call dword [0x102ac878]
mov eax, dword [ebx + 0x18]
push 7
mov ecx, dword [eax + 0x2c]
call dword [0x102acd6c]
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call dword [0x102aba64]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x100a5160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026e429
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x102adb08
call dword [0x102ab9d0]
add esp, 8
mov dword [esp + 8], eax
mov dword [esp + 0x30], 0
lea eax, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], vtable.std::_Func_impl_struct_std::_Callable_obj_class__lambda_e053cc7ea0415d3d22b07aa52321c0c3___0___class_std::allocator_class_std::_Func_class_bool__int__struct_Instruction_t_const_____bool__int__struct_Instruction_t_const__.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
push eax
mov ecx, esi
mov byte [esp + 0x34], 2
call fcn.1005b080
push eax
mov ecx, esi
call fcn.1005b0a0
push eax
mov ecx, esi
call fcn.1005e9b0
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x30], 0
test ecx, ecx
je 0x100a520d
mov edx, dword [ecx]
lea eax, [esp + 0xc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push eax
call fcn.100754e0
add esp, 4
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
call dword [0x102aba64]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10257318
add esp, 0x2c
ret

Function at 0x100a56b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026e599
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x102adb08
call dword [0x102ab9d0]
add esp, 8
mov dword [esp + 8], eax
mov dword [esp + 0x30], 0
lea eax, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], vtable.std::_Func_impl_struct_std::_Callable_obj_class__lambda_08fcf43abc2a93a28d919128572affc4___0___class_std::allocator_class_std::_Func_class_bool__int__struct_Instruction_t_const_____bool__int__struct_Instruction_t_const__.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
push eax
mov ecx, esi
mov byte [esp + 0x34], 2
call fcn.1005b080
push eax
mov ecx, esi
call fcn.1005b0a0
push eax
mov ecx, esi
call fcn.1005e9b0
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x30], 0
test ecx, ecx
je 0x100a575d
mov edx, dword [ecx]
lea eax, [esp + 0xc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push eax
call fcn.100754e0
add esp, 4
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
call dword [0x102aba64]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10257318
add esp, 0x2c
ret