joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56051a
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x6260e4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x6260e0]
test edx, edx
jne 0x560566
test eax, eax
je 0x560579
mov edx, eax
mov dword [0x6260e4], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x560579
cmp ecx, ebx
jb 0x560579
cmp ecx, edi
jbe 0x560662
mov edx, eax
test eax, eax
jmp 0x56059b
test edx, edx
je 0x560596
mov eax, dword [edx + 8]
test eax, eax
je 0x560596
cmp eax, ebx
jb 0x560596
cmp eax, edi
jbe 0x560662
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x6260e4], edx
jne 0x56057f
movzx eax, si
sub esi, eax
cmp esi, 0x40000000
jbe 0x5605e0
lea eax, [esi - 0x40000000]
push esi
push eax
call fcn.00560463
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x56062a
lea eax, [esi - 0x40000000]
push eax
push ebx
call fcn.005603cc
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x56062a
cmp esi, 0x40000000
jae 0x56060c
lea eax, [esi + 0x40000000]
push eax
push esi
call fcn.005603cc
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x56062a
lea eax, [esi + 0x40000000]
push edi
push eax
call fcn.00560463
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x56062a
push esi
push ebx
call fcn.005603cc
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x56062a
push edi
push esi
call fcn.00560463
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x560687
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x6260e0]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x6260e4], edx
mov dword [0x6260e0], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
dec esi
jne 0x560654
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x560687
cmp esi, edi
ja 0x560687
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x560689
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5607a0
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x618d58
call fcn.00560170
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x560809
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x560809
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x560809
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x560809
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x560812
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.005601b6
ret
Function at 0x560818
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x56082a
xor eax, eax
pop ebp
ret
push esi
lea esi, [eax + 0x10000]
xor ecx, ecx
lea edx, [eax + 0x88]
cmp dword [edx], 0
je 0x560846
cmp dword [edx], eax
jb 0x560858
cmp dword [edx], esi
jae 0x560858
inc ecx
add edx, 0x48
cmp ecx, 0x38d
jb 0x560839
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x560855

Function at 0x5608f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x6260e0]
jmp 0x560919
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x560904
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x560bf7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x6260f0], eax
je 0x560c13
mov eax, 0x10dd
jmp 0x560d03
mov eax, dword [0x6260f4]
test eax, eax
jne 0x560d03
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x560c30
push 6
pop eax
jmp 0x560d02
cmp dword [edi], 0
jne 0x560c48
push 6
pop eax
mov dword [0x6260f4], eax
mov dword [0x6260f8], edi
jmp 0x560d02
push ebx
push esi
push 0x18
call fcn.0055e844
mov esi, eax
pop ecx
test esi, esi
jne 0x560c60
push 8
pop ebx
jmp 0x560ce7
push 0
push dword [edi]
call fcn.00560be3
push 0
push dword [ebp + 0xc]
mov ebx, eax
call fcn.00560be3
movzx ecx, byte [ebx + 0x36]
mov edx, eax
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp + 8], eax
test ecx, ecx
je 0x560cdb
cmp ecx, 0x1e
ja 0x560cdb
cmp dword [ebx + 0x44], edx
jne 0x560cdb
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x560cb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x560ce7
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x626100]
mov dword [esi], eax
xor eax, eax
mov dword [0x626100], esi
jmp 0x560d00
cmp dword [0x6260e8], 0
push 9
pop ebx
jne 0x560ced
mov dword [0x6260f4], ebx
test esi, esi
je 0x560cf8
push esi
call fcn.0055f52b
pop ecx
mov dword [0x6260f8], edi
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x560d33
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x6260f0], eax
je 0x560d4f
mov eax, 0x10dd
jmp 0x560dd9
push ebx
push esi
push edi
mov edi, dword [0x626100]
xor ebx, ebx
test edi, edi
je 0x560d9b
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x560d8c
cmp dword [edi + 0x10], ebx
je 0x560d8c
push dword [edi + 0x10]
call fcn.005606e5
pop ecx
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.0055f52b
mov edi, esi
pop ecx
test esi, esi
jne 0x560d5e
mov dword [0x626100], ebx
call fcn.0056085c
mov edi, dword [0x6260fc]
test edi, edi
je 0x560dc8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.0055f52b
mov edi, esi
pop ecx
test esi, esi
jne 0x560db0
pop edi
pop esi
mov dword [0x6260fc], ebx
xor eax, eax
mov dword [0x6260f0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x561094
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6260f4]
test eax, eax
jne 0x561105
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, dword [ebp + 8]
cmp ebx, eax
jne 0x5610b2
xor eax, eax
jmp 0x561104
push esi
push edi
push 8
pop esi
push esi
call fcn.0055e844
mov edi, eax
pop ecx
test edi, edi
je 0x5610df
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x5610f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.0055f52b
pop ecx
and dword [0x6260f8], 0
mov eax, esi
mov dword [0x6260f4], esi
jmp 0x561102
mov eax, dword [0x6260fc]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ebx
mov dword [0x6260fc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5638b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5aa3c0
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x563915
mov eax, dword [esi + 0x10]
pop esi
test eax, eax
je 0x563905
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x563945
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.cannot_create_thread
lea ecx, [ebp - 0x24]
call fcn.00407760
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.00538380
push 0x61af54
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x3c]
call fcn.00407760
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
call fcn.00538380
push 0x61af54
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x565010
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5aa708
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x565051
push 0
push 0x128
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00564cb0
add esp, 8
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea eax, [edi + 0x1c]
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x56508d
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x5650e9
mov edx, dword [ebp - 0x10]
pop edi
pop esi
cmp edx, 8
jb 0x5650d9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5650cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x5650cf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0055e874
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00565560
int3
Function at 0x565370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x56538f
push 0
push 0x5e
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x56539a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5653c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x5653bb.4
movzx eax, byte [eax + 0x5653dc]
jmp dword [eax*4 + 0x5653d4]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00565560
nop
ret 0x5653
Function at 0x565560
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5aa768
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x565738
je case.0x5655ae.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x5655ae.4
movzx eax, byte [eax + 0x5657d4]
jmp dword [eax*4 + 0x565798]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00536cc0
push 0x615590
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00536a50
push 0x615668
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00536bf0
push 0x615548
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005363e0
push 0x6156b0
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00536650
push 0x6157d0
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00538860
push 0x615740
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00537f70
push 0x615788
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.00407760
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.00536ac0
push 0x615504
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.00407760
mov dword [ebp - 4], 1
jmp 0x56567f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.00407760
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.00537f10
push 0x615788
jmp 0x565694
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.00407760
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.00538800
push 0x615740
jmp 0x565694
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.00407760
mov dword [ebp - 4], 4
jmp 0x56567f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00537b60
push 0x615438
jmp 0x565694
cmp esi, 0x781
je case.0x5655ae.3
cmp esi, 0x1779
je 0x565767
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.00536b20
push 0x615504
lea eax, [ebp - 0x90]
jmp 0x565697
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00536d90
push 0x615620
jmp 0x565694
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00537a90
push 0x6155d8
jmp 0x565694
Function at 0x5659c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5659e2
push 0
push 0x9f
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x5659ed
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x565a00
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00565560
int3

Function at 0x565aa0
Capabilities:
Check if file exists

Disassembly:
jmp 0x565ab0
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x565ad2
push 0
push 0xaa
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x565add
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x565af8
and eax, 0x410
cmp eax, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.00565560
int3

Function at 0x565ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x565ab0
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x565ad2
push 0
push 0xaa
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x565add
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x565af8
and eax, 0x410
cmp eax, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.00565560
int3
Function at 0x566150
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5aa808
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x566191
push 0
push 0x133
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.0053bb60
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00564cb0
add esp, 8
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea eax, [edi + 0x1c]
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x5661cd
mov eax, dword [eax]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x566229
mov edx, dword [ebp - 0x10]
pop edi
pop esi
cmp edx, 8
jb 0x566219
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x56620f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x56620f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0055e874
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00565560
int3

Function at 0x566f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa899
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0055f4af
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x566fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa8b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0055f4af
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x4c], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x567060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa8d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0055f4af
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x50], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x567d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aac29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.0055f4af
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.0055f4af
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [esi + 0xc]
mov dword [esi + 0x48], 3
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::FileStreamBuf.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x568470
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x5684d1
mov ecx, dword [esi + 0x48]
test cl, 1
je 0x5684d1
test cl, 2
je 0x568493
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5684c1
lea eax, [esi + 0x50]
push eax
call fcn.00565550
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc