joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d08e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x758d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x6d08f7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x758d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x6d22f7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75901b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x6d4990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7592ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x6d49a7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7592ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x6db370
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x759988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [esp + 4]
call fcn.006db1b0
mov eax, dword [0x9a49ec]
test eax, eax
mov dword [esp + 0x34], 0
je 0x6db3d3
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [esp + 4]
mov dword [0x9a49ec], 0
mov dword [esp + 0x34], 0xffffffff
call fcn.006db240
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [0x9a49e8]
test eax, eax
je 0x6db3ec
lea ecx, [eax + 0x14]
mov eax, dword [ecx]
push 0x7cb30c
call dword [eax + 0x1c]
mov dword [esp], eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0x10
call esi
push 0x11
mov edi, eax
call esi
mov ecx, dword [0x894310]
push 0
push 0x6db300
push 0
push 0x67
push ecx
mov esi, eax
call fcn.0041cb40
mov ecx, eax
add esp, 0x14
push 1
lea eax, [esi - 0x193]
cdq
sub eax, edx
push 0x193
sar eax, 1
push 0x201
push eax
lea eax, [edi - 0x201]
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
mov dword [0x9a49ec], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [0x9a49ec]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x9a49ec]
push 0x200
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [0x9a49ec]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.006db240
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x6dbf20
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x759a40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
lea eax, [esp + 8]
push str.SAVE
push eax
call fcn.00402210
add esp, 8
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x44], 0
je 0x6dbf67
cmp word [eax], 0
jne 0x6dbf9c
mov ecx, dword [0x894320]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00401b50
add esp, 8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 1
call fcn.004133c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.00412de0
mov eax, dword [esp + 8]
test eax, eax
je 0x6dbfa6
cmp word [eax], 0
jne 0x6dbff7
mov eax, dword [0x8943a0]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x28]
call fcn.004138e0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x4c], 2
call fcn.00401b50
add esp, 8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 3
call fcn.004133c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 2
call fcn.00412de0
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 0
call fcn.00412de0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.004136b0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
jne 0x6dc03d
call fcn.00412de0
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov esi, eax
call fcn.00412de0
mov ecx, dword [esp + 0x3c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6dd460
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x759b33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov cx, word [esp + 0x20]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], eax
or eax, 0xffffffff
mov word [esi + 8], cx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esp + 8], esi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, 0x320
mov dword [esi], vtable.CSoundEmitter.0
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
push 0x30
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], 0xffffd8f0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x1c2
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x6dd509
push 1
push ebx
push ebx
push 0x64
push 1
push esi
mov ecx, eax
call fcn.00419400
jmp 0x6dd50b
xor eax, eax
mov edx, dword [0x9a49f4]
mov ecx, dword [edx + 0x40]
mov edx, dword [ecx]
push 0x64
push eax
mov byte [esp + 0x1c], bl
call dword [edx + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6e1c00
Capabilities:
Decompress data using quicklz

Disassembly:
push 0xffffffffffffffff
push 0x759efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x14
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x6e1c43
mov ecx, eax
call fcn.0043bc10
mov esi, eax
mov dword [esp + 0x10], esi
jmp 0x6e1c49
mov dword [esp + 0x10], ebx
mov esi, ebx
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp + 8]
push 3
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00439b30
cmp dword [ebp + 8], ebx
mov edi, dword [esi + 0xc]
mov esi, dword [ebp + 0xc]
jbe 0x6e1cc9
lea ecx, [ecx]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esi]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ecx
call fcn.00434d10
mov eax, dword [esp + 0x1c]
mov cl, ah
shr cl, 2
shr al, 3
movzx dx, cl
mov cl, byte [esp + 0x1e]
movzx ax, al
shr cl, 3
add ebx, 1
shl edx, 5
add esp, 8
add esi, 4
add edi, 2
or edx, eax
movzx ax, cl
and edx, 0x7ff
shl eax, 0xb
or edx, eax
mov word [edi - 2], dx
cmp ebx, dword [ebp + 8]
jb 0x6e1c70
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x6e1ce0
Capabilities:
Decompress data using quicklz

Disassembly:
push 0xffffffffffffffff
push 0x759efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x14
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x10], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x6e1d23
mov ecx, eax
call fcn.0043bc10
mov esi, eax
mov dword [esp + 0x10], esi
jmp 0x6e1d29
mov dword [esp + 0x10], ebx
mov esi, ebx
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp + 8]
push 3
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00439b30
cmp dword [ebp + 8], ebx
mov edi, dword [esi + 0xc]
mov esi, dword [ebp + 0xc]
jbe 0x6e1da9
lea ecx, [ecx]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esi]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ecx
call fcn.00434fd0
mov eax, dword [esp + 0x1c]
mov cl, ah
shr cl, 2
shr al, 3
movzx dx, cl
mov cl, byte [esp + 0x1e]
movzx ax, al
shr cl, 3
add ebx, 1
shl edx, 5
add esp, 8
add esi, 4
add edi, 2
or edx, eax
movzx ax, cl
and edx, 0x7ff
shl eax, 0xb
or edx, eax
mov word [edi - 2], dx
cmp ebx, dword [ebp + 8]
jb 0x6e1d50
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x6e8fc0
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
mov al, bl
add al, al
add al, al
mov dx, bx
shr dx, 0xb
mov ecx, ebx
shr ecx, 5
add dl, dl
add al, al
add cl, cl
add al, 4
add dl, dl
add cl, cl
mov byte [esp + 8], al
add cl, 2
add dl, dl
mov byte [esp + 9], cl
add dl, 4
lea eax, [esp + 5]
push eax
mov byte [esp + 0xe], dl
lea ecx, [esp + 0xa]
push ecx
lea edx, [esp + 0xf]
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x10]
push edx
push eax
call fcn.0043e500
mov al, byte [esp + 0x15]
movzx dx, byte [esp + 0x16]
shr al, 1
movzx cx, al
mov byte [esp + 0x15], al
movzx ax, byte [esp + 0x17]
push ecx
push edx
push eax
call fcn.0043e650
mov ecx, eax
mov dword [esp + 0x24], eax
shr ecx, 8
movzx eax, al
shr cl, 2
shr al, 3
movzx dx, cl
movzx cx, al
mov eax, dword [esp + 0x24]
shr eax, 0x10
movzx eax, al
shl edx, 5
or edx, ecx
shr al, 3
movzx cx, al
mov eax, dword [0x9a70f4]
and edx, 0x7ff
add ebx, 1
add esp, 0x1c
shl ecx, 0xb
or edx, ecx
cmp ebx, 0x10000
mov word [eax + ebx*2 - 2], dx
jl 0x6e8fc6
pop ebx
add esp, 8
ret
Function at 0x6e90a0
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x10
fld dword [0x786ef4]
push ebx
fdiv dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
fstp dword [esp + 0x14]
lea esp, [esp]
mov al, bl
add al, al
add al, al
mov dx, bx
shr dx, 0xb
mov ecx, ebx
shr ecx, 5
add dl, dl
add al, al
add cl, cl
add al, 4
add dl, dl
add cl, cl
mov byte [esp + 0xc], al
add cl, 2
add dl, dl
mov byte [esp + 0xd], cl
add dl, 4
lea eax, [esp + 0xa]
push eax
mov byte [esp + 0x12], dl
lea ecx, [esp + 0xd]
push ecx
lea edx, [esp + 0x13]
mov byte [esp + 0x17], 0
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.0043e500
movzx ecx, byte [esp + 0x19]
mov dword [esp + 0x20], ecx
add esp, 0x10
fild dword [esp + 0x10]
fmul dword [0x8007e8]
fmul dword [esp + 0x14]
fst dword [esp + 0xc]
fcomp dword [0x786ef4]
fnstsw ax
test ah, 0x41
jne 0x6e9143
mov dword [esp + 0xc], 0x3f800000
fld dword [esp + 0xc]
fcomp dword [esp + 0x1c]
fnstsw ax
test ah, 5
jp 0x6e9185
fld dword [esp + 0x1c]
fsub dword [esp + 0xc]
fdiv dword [esp + 0x1c]
fstp dword [esp + 0x10]
fld dword [esp + 0xc]
fld dword [esp + 0x28]
call fcn.00720360
fmul dword [esp + 0x10]
fld dword [0x786ef4]
fsub dword [esp + 0x10]
fmul dword [esp + 0xc]
faddp st(1)
jmp 0x6e91d7
fld dword [esp + 0xc]
fcomp dword [esp + 0x20]
fnstsw ax
test ah, 0x41
jne 0x6e91d3
fld dword [0x786ef4]
fsub dword [esp + 0xc]
fld dword [0x786ef4]
fsub dword [esp + 0x20]
fdivp st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0xc]
fld dword [esp + 0x2c]
call fcn.00720360
fld dword [0x786ef4]
fsub dword [esp + 0x10]
fmulp st(1)
fld dword [esp + 0x10]
fmul dword [esp + 0xc]
faddp st(1)
jmp 0x6e91d7
fld dword [esp + 0xc]
fmul dword [0x800804]
fadd dword [0x786674]
call fcn.007202a4
mov cl, al
movzx eax, byte [esp + 0xa]
lea edx, [eax + eax*2]
mov eax, 0x2aaaaaab
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx dx, al
mov byte [esp + 0xa], al
movzx ax, cl
mov byte [esp + 9], cl
movzx cx, byte [esp + 0xb]
push edx
push eax
push ecx
call fcn.0043e650
mov dword [esp + 0x18], eax
movzx ecx, byte [esp + 0x18]
mov edx, eax
shr edx, 8
shr dl, 2
shr cl, 3
movzx ax, dl
movzx dx, cl
mov ecx, dword [esp + 0x18]
shr ecx, 0x10
movzx ecx, cl
shl eax, 5
or eax, edx
shr cl, 3
movzx dx, cl
and eax, 0x7ff
add ebx, 1
add esp, 0xc
shl edx, 0xb
or eax, edx
cmp ebx, 0x10000
mov word [esi + ebx*2 - 2], ax
jl 0x6e90c0
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x6ec970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x75a020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
xor eax, eax
push esi
mov dword [esp + 0x1c], ebx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
call fcn.006ebeb0
mov edi, dword [esi]
add ebx, 0x74
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x48]
push eax
push str.images
mov ecx, esi
call dword [edi + 0x8c]
mov edx, dword [ebx]
mov ecx, ebx
mov dword [esp + 0xc], 0
call dword [edx + 0x2c]
test eax, eax
mov dword [esp + 0x10], eax
je 0x6ecadb
mov eax, dword [ebx]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0x24]
mov edi, eax
call fcn.00413ef0
add dword [esp + 0xc], 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push str.image
push ecx
mov dword [esp + 0x48], 0
call fcn.00413c20
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 1
call fcn.004133c0
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 0
call fcn.00412de0
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
test eax, eax
je 0x6ecaca
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
push esi
call dword [edx + 8]
mov ecx, dword [edi + 8]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [edi + 0xc]
mov dword [esp + 0x24], esp
mov dword [eax + 4], edx
mov eax, dword [esi]
push str.offset
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x6eca8f
mov edx, dword [esi]
push eax
push str.boundto
mov ecx, esi
call dword [edx + 0x74]
mov di, word [edi + 0x16]
test di, di
je 0x6ecaa5
mov eax, dword [esi]
push edi
push str.order
mov ecx, esi
call dword [eax + 0x78]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00412de0
cmp dword [esp + 0x10], 0
jne 0x6ec9e1
jmp 0x6ecadb
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00412de0
mov edi, dword [esp + 0x18]
cmp dword [edi + 0x98], 0
je 0x6ecaf6
mov eax, dword [esi]
push 1
push str.pinned
mov ecx, esi
call dword [eax + 0x74]
cmp dword [edi + 0xa0], 0
je 0x6ecb0d
mov edx, dword [esi]
push 1
push str.scramble
mov ecx, esi
call dword [edx + 0x74]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6f1ae0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x75a1ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [esp + 0x1c], ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
je 0x6f1b26
mov dword [esi + 4], 0x800f68
mov dword [esi + 0x78], vtable.CBRTTIObject.0
mov dword [esp + 0x18], ebx
mov dword [esp + 8], 1
push ebx
mov ecx, esi
call fcn.005df7e0
mov eax, dword [esi + 4]
mov dword [esi], vtable.CDrawSourceDef.0
mov dword [esi + 8], vtable.CDrawSourceDef.2.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CDrawSourceDef.1.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x74]
mov dword [eax + esi], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x44], vtable.CBArray_class_CBStr_.0
mov dword [esi + 0x50], 1
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x60], vtable.CBArray_class_CBDrawSource__.0
mov dword [esi + 0x6c], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x39], bl
mov word [esi + 0x24], bx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], ebx
mov word [esi + 0x40], bx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x3a], bl
mov byte [esi + 0x38], 0x64
mov word [esi + 0x58], 0xfffe
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x6f3705
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x48]
cmp eax, 1
jbe 0x6f38c1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x2c]
test eax, eax
mov dword [esp + 0x10], eax
je 0x6f38c1
lea ebx, [ebx]
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x34]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x2c], edx
mov dx, word [eax + 0x14]
mov dword [esp + 0x30], ecx
mov cx, word [eax + 0x16]
mov word [esp + 0x34], dx
mov dl, byte [eax + 0x18]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x20], vtable.CCompImageDef::TImageInfo.0
mov word [esp + 0x36], cx
mov byte [esp + 0x38], dl
je 0x6f38c1
mov dword [esp + 0x14], eax
lea ecx, [ecx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x34]
movzx ebx, word [eax + 0x14]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
mov edi, dword [eax + 0xc]
mov ebp, dword [eax + 0x10]
mov word [esp + 0x50], bx
mov bx, word [eax + 0x16]
mov al, byte [eax + 0x18]
mov byte [esp + 0x54], al
mov eax, dword [esp + 0x7c]
push eax
mov dword [esp + 0x44], ecx
sub esp, 0x1c
mov eax, esp
mov dword [eax + 4], ecx
movzx ecx, word [esp + 0x70]
mov dword [eax], vtable.CCompImageDef::TImageInfo.0
mov dword [eax + 8], edx
mov dword [eax + 0xc], edi
mov word [eax + 0x14], cx
mov ecx, dword [esp + 0x44]
mov dword [eax + 0x10], ebp
mov word [eax + 0x16], bx
mov dword [esp + 0x64], edx
mov dl, byte [esp + 0x74]
mov byte [eax + 0x18], dl
mov edx, dword [esp + 0x48]
sub esp, 0x1c
mov eax, esp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax], vtable.CCompImageDef::TImageInfo.0
mov dword [eax + 0xc], ecx
movzx ecx, word [esp + 0x70]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x10], edx
mov dx, word [esp + 0x72]
mov word [eax + 0x14], cx
mov cl, byte [esp + 0x74]
mov dword [esp + 0x78], vtable.CCompImageDef::TImageInfo.0
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], ebp
mov word [esp + 0x8e], bx
mov word [eax + 0x16], dx
mov byte [eax + 0x18], cl
call dword [esp + 0xb4]
add esp, 0x3c
cmp eax, 1
jl 0x6f38a9
lea ecx, [esp + 0x58]
call fcn.006f0180
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x5c]
call fcn.006f10a0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x24]
call fcn.006f10a0
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x40]
call fcn.006f10a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x5c]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x6f3790
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x6f3730
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8