joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008790
Capabilities:
Get number of processors

Disassembly:
push esi
push eax
add esp, 4
jmp 0x100086d5
jmp 0x100086de
pop esi
push eax
push edi
add esp, 4
and eax, 0x48b7
or eax, 0x149c7
add eax, 0x8629
xor eax, 0x35ad
pop eax
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0x5e0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed4], edx
xor eax, eax
mov word [ebp - 0x27c], ax
push dword [ebx]
leave
mov word [ebp - 0x144], cx
push esi
push edi
add esp, 4
xor esi, 0x7023
pop esi
push ecx
add ecx, 0x6a19
xor ecx, 0x4bb
or ecx, 0x700d
sub ecx, 0x15904
pop ecx
push ebx
push edx
add esp, 4
sub ebx, 0x1a67
pop ebx
mov edx, dword [ebp - 0xed4]
mov ax, word [edx]
mov word [ebp - 0x12d2], ax
mov ecx, dword [ebp - 0xed4]
add ecx, 2
mov dword [ebp - 0xed4], ecx
mov dx, word [ebp - 0x12d2]
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
test ch, bh
invalid
dec dword [ebx - 0xed77b]
jmp dword [esi - 0x75]
mov ecx, dword [eax]
mov word [ebp - 0x12d4], cx
mov edx, dword [ebp - 0xed8]
add edx, 2
ret 0x8902
xchg ebp, eax
sub cl, dh
invalid
jmp dword [esi - 0x75]
test dword [ebp*8 - 0x76990001], ebp
test dword [esi + edi*8 - 0x7eac0001], edi
jmp 0x10008744
add byte [bx + si], al
and ebx, 0x7c95
xor ebx, 0x4bc8
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x96fa
pop ecx
push ebx
push ebx
add esp, 4
xor ebx, 0x1373d
add ebx, 0x6126
pop ebx
movzx ecx, word [ebp - 0x144]
test ecx, ecx
jne 0x1000880b
movzx edx, word [ebp - 0x27c]
movzx eax, word [ebp - 0x144]
sub edx, eax
mov dword [ebp - 0x1950], edx
jmp 0x1000886e
movzx ecx, word [ebp - 0x27c]
movzx edx, word [ebp - 0x144]
cmp ecx, edx
je 0x1000872a
invalid
movzx eax, word [ebp - 0x27c]
xor eax, 0x20
movzx ecx, word [ebp - 0x144]
invalid
invalid
cmp eax, ecx
je 0x1000872a
movzx edx, word [ebp - 0x27c]
movzx eax, word [ebp - 0x144]
cmp edx, eax
jge 0x10008858
mov dword [ebp - 0x194c], 0xffffffff
jmp 0x10008862
mov dword [ebp - 0x194c], 1
mov ecx, dword [ebp - 0x194c]
mov dword [ebp - 0x1950], ecx
cmp dword [ebp - 0x1950], 0
jne 0x100088b7
push edx
push edx
add esp, 4
or edx, 0x37e0
pop edx
push edi
add edi, 0x13574
and edi, 0xb6a5
sub edi, 0x6bea
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x5d5d
or edi, 0x7a0a
pop edi
mov edx, dword [ebp - 0x5e0]
mov dword [ebp - 0x378], edx
jmp 0x1000891f
push eax
push edx
add esp, 4
add eax, 0xd6ca
add eax, 0xe792
jmp 0x100088cf
jmp 0x100088d4
pop eax
push ebx
sub ebx, 0x15d4b
add ebx, 0xdcb8
xor ebx, 0x16006
pop ebx
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [eax]
mov dword [ebp - 0x5e0], ecx
mov edx, dword [ebp - 0x5e0]
cmp edx, dword [ebp - 0xedc]
je 0x10008915
mov eax, dword [ebp - 0x5e0]
cmp dword [eax + 0x30], 0
jne 0x100086cb
mov dword [ebp - 0x378], 0
push ebx
or ebx, 0x178da
and ebx, 0x15dc8
invalid
xor byte [ebx], dl

Function at 0x10008940
Capabilities:
Get number of processors

Disassembly:
adc dword [esi + 1], esi
add byte [ecx + 0x942ccf], al
add byte [ecx + 0x9ae1c7], al
add byte [edi - 0x7d], bl
pop edi
cmp dword [ebp - 0x378], 0
jne 0x1000926b
mov ecx, 0x6b
mov word [ebp - 0x1b54], cx
mov edx, 0x65
mov word [ebp - 0x1b52], dx
Function at 0x10008950
Capabilities:
Get number of processors

Disassembly:
pop edi
cmp dword [ebp - 0x378], 0
jne 0x1000926b
mov ecx, 0x6b
mov word [ebp - 0x1b54], cx
mov edx, 0x65
mov word [ebp - 0x1b52], dx
mov eax, 0x72
mov word [ebp - 0x1b50], ax
mov ecx, 0x6e
mov word [ebp - 0x1b4e], cx
mov edx, 0x65
mov word [ebp - 0x1b4c], dx
mov eax, 0x6c
mov word [ebp - 0x1b4a], ax
mov ecx, 0x33
mov word [ebp - 0x1b48], cx
invalid
invalid
mov edx, 0x32
mov word [ebp - 0x1b46], dx
mov eax, 0x2e
mov word [ebp - 0x1b44], ax
mov ecx, 0x64
mov word [ebp - 0x1b42], cx
mov edx, 0x6c
mov word [ebp - 0x1b40], dx
mov eax, 0x6c
mov word [ebp - 0x1b3e], ax
xor ecx, ecx
mov word [ebp - 0x1b3c], cx
push ecx
push esi
add esp, 4
jmp 0x10008a02
or ecx, 0x136ce
add ecx, 0xd390
pop ecx
push edi

Function at 0x10008a10
Capabilities:
Get number of processors

Disassembly:
push esi
add esp, 4
add edi, 0xbdc0
sub edi, 0x8d92

Function at 0x10008a20
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
jmp 0x10008a28
pop edi
mov byte [ebp - 0xb14], 0x4c

Function at 0x10008a30
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov byte [ebp - 0xb13], 0x6f
mov byte [ebp - 0xb12], 0x61
invalid
invalid

Function at 0x10008e44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0xd6c7
pop edi
push ecx
push ebx

Function at 0x10008e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ecx, 0x26d6
add ecx, 0xa3a5
pop ecx

Function at 0x10008e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x8ac]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x8bc], 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp - 0x19a0], ecx
cmp dword [ebp - 0x19a0], 0
jne 0x10008e9f
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x490], edx
jmp 0x10009190
mov eax, dword [ebp - 0x19a0]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x19a4], ecx
jne 0x10008ec7
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x490], edx
jmp 0x10009190
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x19a4]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x19a8], eax
cmp dword [ebp - 0x19a8], 0
jne 0x10008ef9
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp - 0x490], ecx
jo 0x10008eed
invalid
invalid
jmp 0x10009190
mov edx, dword [ebp - 0x3d0]
add edx, dword [ebp - 0x19a8]
xchg ebp, eax
pop eax
out 0xff, al
dec dword [ecx - 0x8af6b]
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x8b0]
mov edx, dword [ebp - 0x3d0]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x23c8], edx
mov eax, dword [ebp - 0x8b0]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + 0x24]
dec eax
and al, 0x89
lea eax, [eax - 1]
dec dword [ebx - 0x8af6b]
dec dword [ebx - 0x3cf7b]
inc dword [ebx]
inc edx
sbb al, 0x89
test dword [eax - 0x20], eax
invalid
inc edi
test dword [edi + esi*8 - 1], ecx
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
Function at 0x10009635
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10009635
add byte [edx + eax*2 + 0x32], al
inc edx
xor cl, byte [ebx + 0x4e]
dec esp
add esp, 4
jmp 0x1000963d
pop esi
mov dword [ebp - 0x8cc], 0
xor al, 0xf7
invalid
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x3cb73], cl
dec dword [ecx - 0x19bb73]
inc esp
out 0xff, al
inc dword [ebx - 0x19bb43]
inc dword [eax]
jne 0x1000966e
invalid
xchg ebp, eax
invalid

Function at 0x10023b70
Capabilities:
Encode data using xor

Disassembly:
sahf
cmc
lock or byte [eax], cl
xchg edx, eax
sahf
rol dword [0x8a5c0808], 1
in al, dx
mov ebx, 0x8a0909eb
aam 0xed
sbb ecx, dword [edx]
or dword [edx + 0xa3e71f4], ecx
or dword [edx + 0x9906cec], ecx
or dword [ecx + ebx*2 + 0x5f], esp
mov ebp, cs
or eax, 0xa89af98a
or dword [ecx], ecx
mov dh, cl
pop eax
push cs
or cl, byte [ecx]
mov cl, cl
dec ecx
mov eax, 0xf4610909
push cs
cmp dword [esi], eax
or byte [eax], cl
ror byte [esi + 0x808f671], 1
or dword [ecx], ecx
or dword [ecx], ecx
pushal
pop ecx
mov ebp, cs
or eax, 0x7bf7d08a
or cl, byte [ecx]
mov bl, al
aam 0xce
or dword [ecx], ecx
mov dh, al
cmpsb byte [esi], byte es:[edi]
cmp cl, byte [edx]
or dword [edx + 0x94b59f8], ecx
or dword [eax + 0x5a], ebp
mov dl, dl
cld
cmp cl, byte [ecx]
or dword [edx + 0x5b], esp
pop ecx
mov ebp, cs
or eax, 0x7ffcfb8a
or cl, byte [ecx]
arpl word [esi + ecx*4 + 0x80805d1], dx
xor al, 0x8e
sub esp, edi
or byte [eax], cl
xchg esp, eax
xchg esi, eax
and esp, edi
or byte [eax], cl
xor al, 0xd1
xchg edx, eax
xchg esi, eax
jns 0x10023bf8
or byte [eax], cl
xchg esp, eax
sahf
cdq
loope 0x10023c17
invalid

Function at 0x100279d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113478
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 9
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ToolTip.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10027ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101134a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 7
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_CheckButton.0
call fcn.100edd47
mov edx, dword [edi + 0x1168]
mov dword [esi + 0x1168], edx
mov eax, dword [edi + 0x116c]
mov dword [esi + 0x116c], eax
mov ecx, dword [edi + 0x1170]
mov dword [esi + 0x1170], ecx
mov dl, byte [edi + 0x1174]
mov byte [esi + 0x1174], dl
mov al, byte [edi + 0x1175]
mov byte [esi + 0x1175], al
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10027c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101134d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 4
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ProgressBar.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10027d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113508
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 0x18
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_Tab.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10027e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113538
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 4
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_SocketBox.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10027f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113568
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 0xc
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ListBox.0
call fcn.100edd47
mov edx, dword [edi + 0x1cf8]
mov dword [esi + 0x1cf8], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10028030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113598
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ImageBox.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10028100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101135c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ComboBox.0
call fcn.100edd47
mov edx, dword [edi + 0x388]
mov dword [esi + 0x388], edx
mov eax, dword [edi + 0x38c]
mov dword [esi + 0x38c], eax
mov ecx, dword [edi + 0x390]
mov dword [esi + 0x390], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10028320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101135f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_DoubleText.0
call fcn.100edd47
mov edx, dword [edi + 0x388]
mov dword [esi + 0x388], edx
mov eax, dword [edi + 0x38c]
mov dword [esi + 0x38c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10028420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113628
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_ImageBoxEx.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100284f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113658
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 4
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_LVItem.0
call fcn.100edd47
mov edx, dword [edi + 0xa78]
mov dword [esi + 0xa78], edx
mov eax, dword [edi + 0xa7c]
mov dword [esi + 0xa7c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10028610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113688
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 9
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_LVBox.0
call fcn.100edd47
mov edx, dword [edi + 0x1608]
mov dword [esi + 0x1608], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10028710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101136b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_LVCell.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100287e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101136e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
add edi, 0x138
push edi
lea eax, [esi + 0x138]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_LVSep.0
call fcn.100edd47
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x100288b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10113718
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e6198]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call sym.i3FrameworkDx.dll_public:_void___thiscall_i3UITemplate::constructor_class_i3UITemplate_const__
push sym.i3FrameworkDx.dll_public_virtual:_void___thiscall_i3UIShape::destructor_void_
push sym.i3FrameworkDx.dll_public:_void___thiscall_i3UIShape::constructor_class_i3UIShape_const__
push 1
push 0x250
lea eax, [edi + 0x138]
push eax
lea ecx, [esi + 0x138]
push ecx
mov dword [esp + 0x30], 0
mov dword [esi], vtable.i3UITemplate_LVHeader.0
call fcn.100edd47
mov edx, dword [edi + 0x388]
mov dword [esi + 0x388], edx
mov eax, dword [edi + 0x38c]
mov dword [esi + 0x38c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4