joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fdfc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5231a90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 4]
test edi, edi
je 0x50fe084
mov edx, dword [esp + 0x40]
mov eax, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50fe010
push 0
sub eax, esi
lea ecx, [esp + 0x18]
push ecx
inc eax
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x50fe08c
push str._ERROR:
push 0xff
push 0x63
push str..ProxyNamedPipeClient.cpp
lea ecx, [esp + 0x2c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x56bc0f0]
push eax
push str.NamedPipeClient::Request
push str._s:_WriteFile_to_pipe_failed._GLE_d
push edx
push esi
call fcn.051ae2d0
add esp, 0x14
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.051ae2c0
or eax, 0xffffffff
jmp 0x50fe1ae
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x40000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x40], eax
test eax, eax
jne 0x50fe0c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x50fe084
test edi, edi
je 0x50fe10a
test esi, esi
jle 0x50fe10a
mov edx, dword [ebx]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50fe0d1
sub eax, ebp
inc eax
push esi
cmp esi, eax
jae 0x50fe0ff
push 0x52c722a
push edi
call dword [sym.imp.MSVCR90.dll_strncpy]
mov ecx, dword [ebx]
lea eax, [esi - 1]
push eax
push ecx
push edi
call dword [sym.imp.MSVCR90.dll_strncat]
add esp, 0x18
jmp 0x50fe10a
push edx
push edi
call dword [sym.imp.MSVCR90.dll_strncpy]
add esp, 0xc
cmp dword [esp + 0x40], 0
je 0x50fe094
mov esi, dword [esp + 0x44]
test esi, esi
je 0x50fe1ac
mov eax, dword [ebx]
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x50fe141
test dl, dl
je 0x50fe13d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x50fe141
add eax, 2
add ecx, 2
test dl, dl
jne 0x50fe121
xor eax, eax
jmp 0x50fe146
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x50fe1ac
cmp dword [esp + 0x48], 0
je 0x50fe1ac
push str._ERROR:
push 0xff
push 0x8f
push str..ProxyNamedPipeClient.cpp
lea ecx, [esp + 0x2c]
call fcn.051ae270
mov dword [esp + 0x38], 1
mov edx, dword [ebx]
mov ecx, dword [0x56bc0f0]
push edx
push esi
push str.NamedPipeClient::Request
push str._s:_Response_is_not_expected__expecting___s__got___s_
push ecx
push eax
call fcn.051ae2d0
add esp, 0x18
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.051ae2c0
mov eax, 0xfffffffd
jmp 0x50fe1ae
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x14
Function at 0x512c7d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5229fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov ebp, dword [esp + 0x64]
movzx esi, word [esp + 0x60]
push ebp
lea ecx, [eax + 0xa800]
mov eax, dword [ecx]
mov eax, dword [eax]
push 0
push esi
lea edx, [esp + 0x40]
push edx
call eax
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
test ecx, ecx
jne 0x512c868
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
movzx ebx, word [esp + 0x6c]
lea ecx, [esp + 0x14]
push ecx
push esi
call sym.META_DLL.dll_META_GetPrimitiveTypeName
mov edx, dword [esp + 0x6c]
push eax
push str.value
push ebx
push edx
push edi
call fcn.05019ed0
add esp, 0x18
lea eax, [esp + 0x18]
push eax
push esi
call sym.META_DLL.dll_META_GetPrimitiveTypeName
mov ecx, dword [esp + 0x6c]
push eax
push str.status
push ebx
push ecx
push edi
call fcn.05019e10
mov edx, dword [esp + 0x44]
add esp, 0x18
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
call dword [esp + 0x30]
push 0x52c722a
push 1
push 0xbc
push str..FunctionPlatformBaseBand.cpp
lea ecx, [esp + 0x2c]
call fcn.051ae270
mov ebx, eax
mov dword [esp + 0x54], 0
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov edx, dword [str.NO_TYPE]
mov ecx, dword [eax + 8]
push 0
push edx
push esi
push esi
mov dword [esp + 0x70], ecx
call sym.META_DLL.dll_META_GetPrimitiveTypeName
mov ecx, dword [esp + 0x6c]
push eax
movsx eax, bp
push eax
push edi
push str.__d__ProcessADCMeaData_cnf_token_d_:__s__d____s__d_:_callback_OK.
push ecx
push ebx
call fcn.051ae2d0
add esp, 0x24
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.051ae2c0
mov eax, 6
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x5132a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52230c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov esi, dword [eax + 8]
push esi
call fcn.051aea20
add esp, 4
push 0x52c722a
push 0xff
push 0x4f1
push str..FunctionPlatformInit.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov dword [esp + 0x28], 0
push str.META_DebugClear__:_purge_debug_log.
push esi
push eax
call fcn.051ae2d0
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
push 0
push 0
push 0
push 0
push edi
call fcn.05131ff0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x5171be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52230c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
cmp dword [eax + 4], 0
jne 0x5171c82
push str._ERROR:
push 0xff
push 0x772
push str..FunctionAudioMETA_audio_test_ex.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x28], 0
mov edi, dword [esp + 0x30]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push edi
push str.__d___s__:_Empty_buffer_.
push eax
push esi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov eax, 0xa
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
mov ecx, dword [esp + 0x30]
push 6
push 0x529fd20
push eax
mov eax, dword [esp + 0x40]
push 0
push eax
push ecx
call fcn.0516fb20
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc

Function at 0x5172370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x522f790
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
test edi, edi
je 0x517241b
mov esi, dword [esp + 0x30]
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
push 0x52c722a
push 1
push 0x40e
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
mov dword [eax + 0xad0c], edi
call fcn.051ae270
mov edi, eax
mov dword [esp + 0x28], 0
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push esi
push str.__d_:META_BT_RegisterAutoCallback:_OK.
push eax
push edi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
push 0x52c722a
push 1
push 0x413
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x28], 1
mov edi, dword [esp + 0x30]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push edi
push str.__d_:META_BT_RegisterAutoCallback:_ERROR.
push eax
push esi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x5172590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x522f790
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
test edi, edi
je 0x517263b
mov esi, dword [esp + 0x30]
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
push 0x52c722a
push 1
push 0x435
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
mov dword [eax + 0xad08], edi
call fcn.051ae270
mov edi, eax
mov dword [esp + 0x28], 0
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push esi
push str.__d_:META_BT_ReceiveHCIData:_OK.
push eax
push edi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
push 0x52c722a
push 1
push 0x43a
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x28], 1
mov edi, dword [esp + 0x30]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push edi
push str.__d_:META_BT_ReceiveHCIData:_ERROR.
push eax
push esi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8

Function at 0x5175750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x522f790
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
test edi, edi
je 0x517581d
mov esi, dword [esp + 0x30]
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
push 0x52c722a
push 1
push 0x499
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
mov dword [eax + 0xad14], edi
call fcn.051ae270
mov edi, eax
mov dword [esp + 0x28], 0
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push str.META_BT_RxTestStart_V2_r___install_callback:_OK.
push eax
push edi
call fcn.051ae2d0
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov eax, dword [esp + 0x34]
push 0
push 7
push 0x52a0f2c
push 0
push 0
push 0
push 0
push 0
push eax
xor ecx, ecx
mov edx, esi
call fcn.051742b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
push 0x52c722a
push 1
push 0x49e
push str..FunctionConnectivitymeta_bt.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x28], 1
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push str.META_BT_RxTestStart_V2_r___install_callback:_ERROR.
push eax
push esi
call fcn.051ae2d0
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x517d5f0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5233738
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x52c722a
push 1
push 0x63d
push str..FunctionConnectivityMETA_nfc.cpp
lea ecx, [esp + 0x24]
call fcn.051ae270
mov edi, eax
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x38]
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov eax, dword [eax + 8]
push ebx
push ebp
push esi
push str.__d__META_NFC_SwpDiscovery_r__:_User_Callback_0x_X___User_Callback_argument:__0x_X_
push eax
push edi
call fcn.051ae2d0
add esp, 0x18
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.051ae2c0
push esi
mov ecx, 0x53f4cc8
call fcn.05065960
push esi
mov ecx, 0x53f4cc8
mov dword [eax + 0xc82c], ebp
call fcn.05065960
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push 0xc
push 0x52a475c
push 0
push 0
mov dword [eax + 0xc830], ebx
mov eax, dword [esp + 0x54]
push eax
push ecx
push edx
push esi
call fcn.0517b7b0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x18
Function at 0x5181d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x52303b8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x78]
mov esi, dword [esp + 0x7c]
test ebp, ebp
je 0x5181e45
test esi, esi
je 0x5181e45
lea ecx, [esp + 0x48]
call fcn.0506a6b0
mov dword [esp + 0x68], 1
lea ecx, [esp + 0x30]
call fcn.0506a6b0
mov byte [esp + 0x68], 2
xor edi, edi
test esi, esi
jbe 0x5181dcf
mov eax, dword [ebp + edi*8]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], eax
call fcn.051c2100
inc edi
cmp edi, esi
jb 0x5181db4
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
push 0x3a
push 0x39
push 8
lea edx, [esp + 0x3c]
push edx
push eax
push ecx
mov edx, 0x52a5940
lea ecx, [esp + 0x60]
call fcn.0517f590
mov ebx, eax
test ebx, ebx
jne 0x5181e22
test esi, esi
jbe 0x5181e22
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
lea ecx, [ebp + 4]
mov ebp, edi
sub ebp, edx
sar ebp, 3
cmp eax, ebp
jae 0x5181e22
mov bp, word [edx + eax*8 + 4]
mov word [ecx], bp
inc eax
add ecx, 8
cmp eax, esi
jb 0x5181e07
mov byte [esp + 0x68], 1
lea ecx, [esp + 0x30]
call fcn.0517e230
mov dword [esp + 0x68], 0xffffffff
lea ecx, [esp + 0x48]
call fcn.0517e230
mov eax, ebx
jmp 0x5181ea5
push str._ERROR:
push 0xff
push 0x597
push str..FunctionConnectivityMETA_wifi.cpp
lea ecx, [esp + 0x2c]
call fcn.051ae270
mov edi, eax
mov dword [esp + 0x68], 0
mov edx, dword [esp + 0x70]
push edx
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push esi
push ebp
push str.META_WiFi_EEPROM_Read_r__:_inva1lid_arguments__array_0x_08X___array_cnt__lu_.
push eax
push edi
call fcn.051ae2d0
add esp, 0x14
mov dword [esp + 0x68], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.051ae2c0
mov eax, 0xa
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x10
Function at 0x5194970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52315e9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53f3c3c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x30], 0
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov eax, dword [eax]
push 1
push eax
push 0x52ab1e0
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::rfind_char_const___unsigned_int__unsigned_int_const]
push 1
push 0
push 0x52ab1e0
lea ecx, [esp + 0x14]
mov esi, eax
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int__unsigned_int_const]
cmp esi, eax
je 0x51949ff
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
or eax, 0xffffffff
jmp 0x5194a53
mov eax, 0x52ab1d8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5194a07
sub eax, edx
push eax
push 0
push 0x52ab1d8
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_first_of_char_const___unsigned_int__unsigned_int_const]
test eax, eax
jl 0x5194a3f
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 0xfffffffe
jmp 0x5194a53
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0520b902
add esp, 0x2c
ret
Function at 0x5194b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52230c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
cmp dword [eax], 0x2694
jne 0x5194bcf
push str._ERROR:
push 0xff
push 0x59d
push str..MetaUtilityMETA_misc_utils.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov dword [esp + 0x28], 0
mov edi, dword [esp + 0x30]
push edi
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
push edi
push str.__d__:_User_decide_to_stop_current_procedure.
push eax
push esi
call fcn.051ae2d0
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x5194ec0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x52316e7
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x53f3c3c]
xor eax, esp
mov dword [esp + 0x170], eax
push esi
push edi
mov eax, dword [0x53f3c3c]
xor eax, esp
push eax
lea eax, [esp + 0x180]
mov dword fs:[0], eax
mov eax, dword [esp + 0x194]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x188], 0
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov eax, dword [eax]
push 1
push eax
push 0x529230c
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::rfind_char_const___unsigned_int__unsigned_int_const]
mov ecx, dword [esp + 0x34]
dec ecx
cmp eax, ecx
lea ecx, [esp + 0x20]
jne 0x5194f43
push 0x539873c
jmp 0x5194f48
push 0x529726c
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp dword [esp + 0x38], 0x10
mov eax, dword [esp + 0x24]
jae 0x5194f5d
lea eax, [esp + 0x24]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5194f77
or esi, eax
jmp 0x5195033
lea eax, [esp + 0x68]
push eax
call fcn.05194e80
add esp, 4
test al, al
jne 0x5194f92
mov esi, 0xfffffffe
jmp 0x519502c
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x3c]
push ecx
push edi
call esi
test eax, eax
je 0x519501a
lea edx, [esp + 0x68]
push edx
call fcn.05194e80
add esp, 4
test al, al
jne 0x5194f98
push 0x52c722a
push 1
push 0x9c8
push str..MetaUtilityMETA_misc_utils.cpp
lea ecx, [esp + 0x1c]
call fcn.051ae270
mov esi, eax
mov byte [esp + 0x188], 1
mov eax, dword [esp + 0x190]
push eax
mov ecx, 0x53f4cc8
call fcn.05065960
mov eax, dword [eax + 8]
lea ecx, [esp + 0x68]
push ecx
push str._find_existing_file__s
push eax
push esi
call fcn.051ae2d0
add esp, 0x10
mov byte [esp + 0x188], 0
lea ecx, [esp + 0xc]
call fcn.051ae2c0
mov esi, 0xfffffffd
jmp 0x519502c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0x12
neg esi
sbb esi, esi
and esi, 0xfffffffc
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x188], 0xffffffff
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x180]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0520b902
add esp, 0x180
ret