joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54dbba
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x60e0a4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x60e0a0]
test edx, edx
jne 0x54dc06
test eax, eax
je 0x54dc19
mov edx, eax
mov dword [0x60e0a4], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x54dc19
cmp ecx, ebx
jb 0x54dc19
cmp ecx, edi
jbe 0x54dd02
mov edx, eax
test eax, eax
jmp 0x54dc3b
test edx, edx
je 0x54dc36
mov eax, dword [edx + 8]
test eax, eax
je 0x54dc36
cmp eax, ebx
jb 0x54dc36
cmp eax, edi
jbe 0x54dd02
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x60e0a4], edx
jne 0x54dc1f
movzx eax, si
sub esi, eax
cmp esi, 0x40000000
jbe 0x54dc80
lea eax, [esi - 0x40000000]
push esi
push eax
call fcn.0054db03
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x54dcca
lea eax, [esi - 0x40000000]
push eax
push ebx
call fcn.0054da6c
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x54dcca
cmp esi, 0x40000000
jae 0x54dcac
lea eax, [esi + 0x40000000]
push eax
push esi
call fcn.0054da6c
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x54dcca
lea eax, [esi + 0x40000000]
push edi
push eax
call fcn.0054db03
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x54dcca
push esi
push ebx
call fcn.0054da6c
mov edx, eax
pop ecx
pop ecx
test edx, edx
jne 0x54dcca
push edi
push esi
call fcn.0054db03
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x54dd27
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x60e0a0]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x60e0a4], edx
mov dword [0x60e0a0], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
dec esi
jne 0x54dcf4
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x54dd27
cmp esi, edi
ja 0x54dd27
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x54dd29
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x54de40
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x600430
call fcn.0054d810
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x54dea9
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x54dea9
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x54dea9
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x54dea9
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x54deb2
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.0054d856
ret
Function at 0x54deb8
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x54deca
xor eax, eax
pop ebp
ret
push esi
lea esi, [eax + 0x10000]
xor ecx, ecx
lea edx, [eax + 0x88]
cmp dword [edx], 0
je 0x54dee6
cmp dword [edx], eax
jb 0x54def8
cmp dword [edx], esi
jae 0x54def8
inc ecx
add edx, 0x48
cmp ecx, 0x38d
jb 0x54ded9
xor eax, eax
inc eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x54def5

Function at 0x54df97
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x60e0a0]
jmp 0x54dfb9
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x54dfa4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54e297
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x60e0b0], eax
je 0x54e2b3
mov eax, 0x10dd
jmp 0x54e3a3
mov eax, dword [0x60e0b4]
test eax, eax
jne 0x54e3a3
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x54e2d0
push 6
pop eax
jmp 0x54e3a2
cmp dword [edi], 0
jne 0x54e2e8
push 6
pop eax
mov dword [0x60e0b4], eax
mov dword [0x60e0b8], edi
jmp 0x54e3a2
push ebx
push esi
push 0x18
call fcn.0054bee4
mov esi, eax
pop ecx
test esi, esi
jne 0x54e300
push 8
pop ebx
jmp 0x54e387
push 0
push dword [edi]
call fcn.0054e283
push 0
push dword [ebp + 0xc]
mov ebx, eax
call fcn.0054e283
movzx ecx, byte [ebx + 0x36]
mov edx, eax
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp + 8], eax
test ecx, ecx
je 0x54e37b
cmp ecx, 0x1e
ja 0x54e37b
cmp dword [ebx + 0x44], edx
jne 0x54e37b
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x54e351
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x54e387
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x60e0c0]
mov dword [esi], eax
xor eax, eax
mov dword [0x60e0c0], esi
jmp 0x54e3a0
cmp dword [0x60e0a8], 0
push 9
pop ebx
jne 0x54e38d
mov dword [0x60e0b4], ebx
test esi, esi
je 0x54e398
push esi
call fcn.0054cbcb
pop ecx
mov dword [0x60e0b8], edi
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x54e3d3
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x60e0b0], eax
je 0x54e3ef
mov eax, 0x10dd
jmp 0x54e479
push ebx
push esi
push edi
mov edi, dword [0x60e0c0]
xor ebx, ebx
test edi, edi
je 0x54e43b
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x54e42c
cmp dword [edi + 0x10], ebx
je 0x54e42c
push dword [edi + 0x10]
call fcn.0054dd85
pop ecx
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.0054cbcb
mov edi, esi
pop ecx
test esi, esi
jne 0x54e3fe
mov dword [0x60e0c0], ebx
call fcn.0054defc
mov edi, dword [0x60e0bc]
test edi, edi
je 0x54e468
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.0054cbcb
mov edi, esi
pop ecx
test esi, esi
jne 0x54e450
pop edi
pop esi
mov dword [0x60e0bc], ebx
xor eax, eax
mov dword [0x60e0b0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54e734
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x60e0b4]
test eax, eax
jne 0x54e7a5
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, dword [ebp + 8]
cmp ebx, eax
jne 0x54e752
xor eax, eax
jmp 0x54e7a4
push esi
push edi
push 8
pop esi
push esi
call fcn.0054bee4
mov edi, eax
pop ecx
test edi, edi
je 0x54e77f
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x54e790
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.0054cbcb
pop ecx
and dword [0x60e0b8], 0
mov eax, esi
mov dword [0x60e0b4], esi
jmp 0x54e7a2
mov eax, dword [0x60e0bc]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ebx
mov dword [0x60e0bc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x550f40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x592540
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x550fa5
mov eax, dword [esi + 0x10]
pop esi
test eax, eax
je 0x550f95
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x550fd5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.cannot_create_thread
lea ecx, [ebp - 0x24]
call fcn.004075e0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.00525a00
push 0x60262c
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x3c]
call fcn.004075e0
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
call fcn.00525a00
push 0x60262c
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x5526a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x592888
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x5526e1
push 0
push 0x128
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00552340
add esp, 8
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea eax, [edi + 0x1c]
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x55271d
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x552779
mov edx, dword [ebp - 0x10]
pop edi
pop esi
cmp edx, 8
jb 0x552769
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x55275f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x55275f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0054bf14
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00552bf0
int3
Function at 0x552a00
Capabilities:
Check if file exists
Get disk size
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x552a1f
push 0
push 0x5e
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x552a2a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x552a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x552a4b.4
movzx eax, byte [eax + 0x552a6c]
jmp dword [eax*4 + 0x552a64]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00552bf0
nop
push edx
sub dl, byte [ebp]
pop edx
sub dl, byte [ebp]
add byte [eax], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
jmp 5581456
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x552ab5
push 0
push 0x1a0
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x552ac0
mov eax, dword [eax]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x552ae1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
pop esi
add esp, 8
ret
lea eax, [esi + 4]
push eax
call fcn.00552bf0
int3
Function at 0x552bf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5928e8
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x552dc8
je case.0x552c3e.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x552c3e.4
movzx eax, byte [eax + 0x552e64]
jmp dword [eax*4 + 0x552e28]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00524340
push 0x5fcc64
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005240d0
push 0x5fcd3c
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00524270
push 0x5fcc1c
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00523a60
push 0x5fcd84
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00523cd0
push 0x5fcea4
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00525ee0
push 0x5fce14
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005255f0
push 0x5fce5c
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.004075e0
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.00524140
push 0x5fcbd8
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.004075e0
mov dword [ebp - 4], 1
jmp 0x552d0f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.004075e0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.00525590
push 0x5fce5c
jmp 0x552d24
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.004075e0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.00525e80
push 0x5fce14
jmp 0x552d24
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.004075e0
mov dword [ebp - 4], 4
jmp 0x552d0f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.005251e0
push 0x5fcb0c
jmp 0x552d24
cmp esi, 0x781
je case.0x552c3e.3
cmp esi, 0x1779
je 0x552df7
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.005241a0
push 0x5fcbd8
lea eax, [ebp - 0x90]
jmp 0x552d27
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00524410
push 0x5fccf4
jmp 0x552d24
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00525110
push 0x5fccac
jmp 0x552d24
Function at 0x553270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x553292
push 0
push 0x9f
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x55329d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5532b0
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00552bf0
int3

Function at 0x553350
Capabilities:
Check if file exists

Disassembly:
jmp 0x553360
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x553382
push 0
push 0xaa
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x55338d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5533a8
and eax, 0x410
cmp eax, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.00552bf0
int3

Function at 0x553360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x553360
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x553382
push 0
push 0xaa
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x55338d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5533a8
and eax, 0x410
cmp eax, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.00552bf0
int3
Function at 0x553a00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x592988
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x553a41
push 0
push 0x133
push str.e:xhsundcode_remote_trunk_rhinopcinfrastructure_thirdpartypoco_src_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.005291f0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00552340
add esp, 8
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea eax, [edi + 0x1c]
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x553a7d
mov eax, dword [eax]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x553ad9
mov edx, dword [ebp - 0x10]
pop edi
pop esi
cmp edx, 8
jb 0x553ac9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x553abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x553abf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0054bf14
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00552bf0
int3

Function at 0x5547b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592a19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0054cb4f
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x554860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592a39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0054cb4f
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x4c], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x554910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592a59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.0054cb4f
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x50], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x555640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592da9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.0054cb4f
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.0054cb4f
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [esi + 0xc]
mov dword [esi + 0x48], 3
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::FileStreamBuf.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x555d21
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x555d81
mov ecx, dword [esi + 0x48]
test cl, 1
je 0x555d81
test cl, 2
je 0x555d43
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x555d71
lea eax, [esi + 0x50]
push eax
call fcn.00552be0
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc