joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x546a14
mov dword [esp + 4], str.__.___
mov dword [esp + 8], 0x54bed8
mov dword [esp + 0xc], 0x55d68c
mov dword [esp + 0x10], 0x5574b4
mov dword [esp + 0x14], 0x55d690
mov dword [esp + 0x18], 0x547390
mov dword [esp + 0x1c], 0x557484
mov dword [esp + 0x20], 0x55d694
mov dword [esp + 0x24], 0x55d698
mov dword [esp + 0x28], 0x55d69c
mov dword [esp + 0x2c], 0x54a908
mov dword [esp + 0x30], 0x55d6a0
mov dword [esp + 0x34], 0x55d6a4
mov dword [esp + 0x38], 0x557480
mov dword [esp + 0x3c], 0x55d6a8
mov dword [esp + 0x40], 0x54f144
mov dword [esp + 0x44], 0x55d6ac
mov dword [esp + 0x48], 0x55d2c8
mov dword [esp + 0x4c], 0x54f370
mov dword [esp + 0x50], 0x557498
mov dword [esp + 0x54], 0x5574a0
mov dword [esp + 0x58], 0x546a14
mov dword [esp + 0x5c], 0x546a14
mov dword [esp + 0x60], 0x55d6b8
mov dword [esp + 0x64], 0x55d6bc
mov dword [esp + 0x68], 0x549620
mov dword [esp + 0x6c], 0x5574a8
mov dword [esp + 0x70], 0x55d2cc
mov dword [esp + 0x74], 0x55d2d0
mov dword [esp + 0x78], 0x55d2d4
mov dword [esp + 0x7c], 0x55d2d8
mov dword [esp + 0x80], 0x55d2dc
mov dword [esp + 0x84], 0x55d2e0
mov dword [esp + 0x88], 0x55d2e4
mov dword [esp + 0x8c], 0x55d2e8
mov dword [esp + 0x90], 0x55d6c0
mov dword [esp + 0x94], 0x549624
mov dword [esp + 0x98], 0x55d2ec
mov dword [esp + 0x9c], 0x546a14
mov dword [esp + 0xa0], 0x546a14
mov dword [esp + 0xa4], 0x546a14
mov dword [esp + 0xa8], 0x546a14
mov dword [esp + 0xac], 0x546a14
mov dword [esp + 0xb0], 0x546a14
mov dword [esp + 0xb4], 0x546a14
mov dword [esp + 0xb8], 0x546a14
mov dword [esp + 0xbc], 0x55d2f0
mov dword [esp + 0xc0], 0x55d2f4
mov dword [esp + 0xc4], 0x55d2f8
mov dword [esp + 0xc8], 0x5473c0
mov dword [esp + 0xcc], 0x55d2fc
mov dword [esp + 0xd0], 0x55d300
mov dword [esp + 0xd4], 0x557458
mov dword [esp + 0xd8], 0x55038c
mov dword [esp + 0xdc], 0x55d304
mov dword [esp + 0xe0], 0x55d308
mov dword [esp + 0xe4], 0x55d6c4
mov dword [esp + 0xe8], 0x55d30c
mov dword [esp + 0xec], 0x55d310
cmp cl, 0x3c
jb 0x502dd6
mov eax, 0x546a14
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.0049f3ce
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.0049f3ce
add esp, 0xf4
ret
Function at 0x502e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x502f6b
add eax, 4
cmp word [eax], cx
jb 0x502f63
sub eax, 2
cmp cx, word [eax]
jb 0x502f90
cmp cx, word [eax + 2]
ja 0x502f90
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0049f3ce
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.0049f3ce
add esp, 0x9c
ret
Function at 0x503dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x540b00
mov eax, dword fs:[0]
push eax
push ebx
push ebp
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea ebx, [ebx]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
cmp ebp, dword [esp + 0x54]
jne 0x503e11
cmp ecx, eax
je 0x503e8c
cmp ebx, dword [esp + 0x94]
jne 0x503e20
cmp dword [esp + 0x78], edx
je 0x503e8c
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push dword [esp + 0x6c]
cmovae eax, dword [esp + 0x60]
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x34]
push 0
call fcn.004322f0
test eax, eax
js 0x503edb
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push dword [esp + 0x2c]
cmovae eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push eax
push dword [esp + 0x74]
push 0
call fcn.004322f0
test eax, eax
js 0x503ed4
lea eax, [esp + 0x1c]
push eax
call fcn.00504080
lea eax, [esp + 0x60]
push eax
call fcn.00504080
add esp, 8
jmp 0x503df0
cmp ebp, dword [esp + 0x54]
jne 0x503ec2
cmp ecx, eax
jne 0x503ec2
cmp ebx, dword [esp + 0x94]
jne 0x503ea9
cmp dword [esp + 0x78], edx
jne 0x503ea9
xor ebx, ebx
jmp 0x503ede
cmp ecx, eax
jne 0x503ec2
xor ebx, ebx
mov eax, 1
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x503ede
xor ebx, ebx
xor eax, eax
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x503ede
mov ebx, 1
jmp 0x503ede
or ebx, 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x503ef1
push dword [esp + 0x1c]
call fcn.0047d4a0
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
cmp dword [esp + 0x50], 8
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
jb 0x503f1b
push dword [esp + 0x3c]
call fcn.0047d4a0
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
cmp dword [esp + 0x70], 8
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x503f45
push dword [esp + 0x5c]
call fcn.0047d4a0
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
cmp dword [esp + 0x90], 8
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x503f72
push dword [esp + 0x7c]
call fcn.0047d4a0
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x508580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541298
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x28
push str.Day_of_month_value_is_out_of_range_1..31
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00431d40
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x30], 0
cmovae eax, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.004a14f7
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::out_of_range.0
jb 0x508615
push dword [esp + 0xc]
call fcn.0047d4a0
add esp, 4
mov eax, esi
mov dword [esi], vtable.cptboost::gregorian::bad_day_of_month.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049f3ce
add esp, 0x2c
ret

Function at 0x508660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541298
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x22
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00431d40
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x30], 0
cmovae eax, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.004a14f7
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::out_of_range.0
jb 0x5086f5
push dword [esp + 0xc]
call fcn.0047d4a0
add esp, 4
mov eax, esi
mov dword [esi], vtable.cptboost::gregorian::bad_month.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049f3ce
add esp, 0x2c
ret

Function at 0x508740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541298
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x27
push str.Year_is_out_of_valid_range:_1400..10000
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00431d40
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x30], 0
cmovae eax, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.004a14f7
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::out_of_range.0
jb 0x5087d5
push dword [esp + 0xc]
call fcn.0047d4a0
add esp, 4
mov eax, esi
mov dword [esi], vtable.cptboost::gregorian::bad_year.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049f3ce
add esp, 0x2c
ret
Function at 0x50b340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541760
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004a1537
mov dword [esi], vtable.cptboost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00431c30
mov dword [esi], vtable.cptboost::lock_error.0
mov dword [esi + 0x2c], vtable.cptboost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x50b3d2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::lock_error_.0
mov dword [esi + 0x2c], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::lock_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x50b410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541218
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.004a1537
mov dword [edi], vtable.cptboost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00431c30
mov dword [edi + 0x2c], vtable.cptboost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::lock_error_.0
mov dword [edi + 0x2c], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::lock_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x50b4d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541760
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004a1537
mov dword [esi], vtable.cptboost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00431c30
mov dword [esi], vtable.cptboost::thread_resource_error.0
mov dword [esi + 0x2c], vtable.cptboost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x50b562
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::thread_resource_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x50b5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541218
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.004a1537
mov dword [edi], vtable.cptboost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00431c30
mov dword [edi + 0x2c], vtable.cptboost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.cptboost::exception_detail::error_info_injector_class_cptboost::thread_resource_error_.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x50c330
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x54188b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0x5467e4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x50c41c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x50c41c
push str.AcquireSRWLockExclusive
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x50c41c
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50c41c
push str.InitializeConditionVariable
push esi
call edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x50c41c
push str.SleepConditionVariableSRW
push esi
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x50c41c
push str.WakeAllConditionVariable
push esi
call edi
mov esi, eax
test esi, esi
je 0x50c41c
push 0x1c
call fcn.0047d464
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x50c48a
push esi
push dword [esp + 0x18]
mov ecx, eax
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ebx
call fcn.0050b7a0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0x2c
call fcn.0047d464
add esp, 4
test eax, eax
je 0x50c48a
mov dword [eax], vtable.once_block_impl_nt5.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x50f710
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x541f6f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
call fcn.0043e380
mov dword [esi], vtable.cptboost::log::v2s_mt_nt5::aux::basic_ostringstreambuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea edx, [esi + 0x44]
mov dword [esi + 0x38], 0
mov ecx, esi
mov dword [esi + 0x3c], 0
sub ecx, edx
mov byte [esi + 0x40], 0
add ecx, 0x64
mov eax, dword [esi + 0x10]
sar ecx, 1
mov dword [eax], edx
mov eax, dword [esi + 0x20]
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
lea edx, [esi + 0x68]
mov dword [esp + 0x1c], 0
mov dword [edx], 0x548e58
mov dword [esp + 0x10], edx
mov dword [edx + 8], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
push 0
push esi
mov byte [esp + 0x24], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x10], 1
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.00442aa0
mov ecx, esi
mov dword [esp + 0x1c], 2
call fcn.00510150
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret

Function at 0x511df0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x542328
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 8]
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.0050cbc0
mov edi, dword [esp + 0x28]
lea ecx, [ebx + 0x18]
mov dword [esp + 0x20], 0
mov eax, dword [edi]
add eax, 4
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00511ab0
mov eax, dword [esp + 0x28]
mov ecx, dword [edi]
push dword [eax]
lea eax, [ecx + 4]
push eax
lea eax, [ebx + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00510fc0
mov dword [esp + 0x20], 0xffffffff
mov eax, SysReAllocString
lock xadd dword [esi], eax
test eax, 0x40000000
jne 0x511e9a
cmp eax, 0x80000000
jle 0x511e9a
lock bts dword [esi], 0x1e
jb 0x511e9a
mov ecx, esi
call fcn.0050c7a0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x511eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x58ab78]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [esp + 0x6c]
lea eax, [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x78]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add ecx, 0x2ac18000
push 0
push 0xa
adc eax, 0xfe624e21
push eax
push ecx
call fcn.004a0650
push 0
push 0xf4240
mov ebp, eax
push edx
push ebp
call fcn.004a0650
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], edx
push eax
call esi
mov edi, eax
add esp, 8
movzx esi, word [edi + 0xc]
lea eax, [esi + 1]
cmp eax, 2
jl 0x511ff7
cmp esi, 0x1f
ja 0x512001
mov ax, word [edi + 0x10]
inc ax
movzx ecx, ax
lea eax, [ecx + 1]
cmp eax, 2
jl 0x51200b
cmp ecx, 0xc
ja 0x512015
mov eax, 0x76c
add ax, word [edi + 0x14]
movzx edx, ax
lea eax, [edx + 1]
cmp eax, 0x579
jl 0x51201f
mov eax, 0x2710
cmp dx, ax
ja 0x51202c
mov eax, dword [edi + 8]
mov word [esp + 0x14], dx
cdq
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x30], edx
cdq
mov dword [esp + 0x34], eax
mov eax, dword [edi]
mov dword [esp + 0x38], edx
movdqu xmm0, xmmword [esp + 0x2c]
cdq
mov dword [esp + 0x3c], eax
imul eax, dword [esp + 0x10], 0xf4240
mov word [esp + 0x16], cx
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x70]
sub ebp, eax
mov dword [esp + 0x40], edx
movdqu xmmword [ebx + 8], xmm0
pop edi
mov dword [esp + 0x40], ebp
mov eax, ebx
mov dword [esp + 0x44], 0
movdqu xmm0, xmmword [esp + 0x38]
mov word [ebx + 4], si
pop esi
pop ebp
movdqu xmmword [ebx + 0x18], xmm0
pop ebx
xor ecx, esp
call fcn.0049f3ce
add esp, 0x64
ret
push 0
push esi
push 1
call fcn.0050a390
push 1
push esi
push 1
call fcn.0050a390
push 0
push ecx
push 1
call fcn.0050a3d0
push 1
push ecx
push 1
call fcn.0050a3d0
push 0
push edx
push 0x578
call fcn.0050a410
push 1
push edx
push 0x578
call fcn.0050a410
int3