joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524a00
Capabilities:
Create directory

Disassembly:
sub esp, 0x480
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x47c], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x524a5a
push 0x7c9
mov ecx, 0x6ee218
call fcn.004d69e0
push eax
push 0x1d
push 0x6ee218
call fcn.004d7c10
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.00589034
add esp, 0x480
ret
mov eax, dword [0x71737c]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x5cae90
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x524a42
cmp dword [esi + 0xc], 0
jne 0x524ac1
push str.bdcap32.dll
mov ecx, esi
call fcn.00525100
test eax, eax
jns 0x524aa5
push 0x7ca
jmp 0x524a28
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x524bd1
lea ecx, [esp + 0x18]
call fcn.00525060
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.00524c70
push 0
mov ecx, 0x719e88
call fcn.0056de30
push eax
lea edx, [esp + 0x27c]
push str._sScreenShot
push edx
call fcn.00589549
add esp, 0xc
push 0
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x524b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x524b2a
push 0x7cc
jmp 0x524a28
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x16]
movzx eax, word [esp + 0x14]
movzx ecx, word [esp + 0x12]
push 0x5cb004
push edx
movzx edx, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1c]
push eax
push ecx
push edx
push str.Capture
lea eax, [esp + 0x29c]
push eax
push str._s_s__d__02d__02d__02d__02d__02d__03d._s
lea ecx, [esp + 0x3a8]
push 0x104
push ecx
call fcn.005895e9
add esp, 0x34
lea edx, [esp + 0x37c]
push edx
push 0x7cd
mov ecx, 0x6ee218
call fcn.004d69e0
push eax
push 0x1d
push 0x6ee218
call fcn.004d7c10
mov eax, dword [esp + 0x14]
add esp, 0x10
push eax
push 4
push 0
lea ecx, [esp + 0x388]
push ecx
push esi
call fcn.00525250
test eax, eax
js 0x524a42
mov ecx, dword [esp + 0x480]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00589034
add esp, 0x480
ret
Function at 0x5255c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
jne 0x525613
mov eax, dword [esp + 8]
push 0x5cb098
push eax
call fcn.005894eb
mov esi, eax
add esp, 8
test esi, esi
je 0x525649
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x5255f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5255f0
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005893b5
push esi
call fcn.005891ea
add esp, 0x14
pop edi
xor eax, eax
pop esi
ret 0xc
cmp eax, 1
jne 0x525649
mov ecx, dword [esp + 8]
push 0x5cb094
push ecx
call fcn.005894eb
mov esi, eax
add esp, 8
test esi, esi
je 0x525649
mov edx, dword [esp + 0xc]
push edx
push 0x5cb090
push esi
call fcn.0058a651
push esi
call fcn.005891ea
add esp, 0x10
xor eax, eax
pop esi
ret 0xc
Function at 0x526e00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x526e2e
xor eax, eax
jmp 0x526eea
push 0x5b9978
push edi
call fcn.005894eb
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x526e46
mov eax, dword [esi + 4]
test eax, eax
je 0x526e27
push ebx
push ebp
push 2
push 0
push eax
call fcn.0058c6fc
mov eax, dword [esi + 4]
push eax
call fcn.0058ca44
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.0058c6fc
add esp, 0x1c
mov ecx, esi
call fcn.00526360
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00589969
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.00581850
test eax, eax
jne 0x526f03
push eax
push 0x38
push str.MHFile.cpp
call fcn.0052bd20
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00589549
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.00581830
test eax, eax
je 0x526fa7
lea edi, [ebx - 0xe]
push edi
call fcn.00587f5a
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x526f3b
push eax
push 0x49
push str.MHFile.cpp
call fcn.0052bd20
add esp, 0xc
jmp 0x526ee6
push edi
push 0
push eax
call fcn.00588e70
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.00581af0
test eax, eax
jne 0x526f87
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00589549
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x526edd
mov ecx, dword [esi + 4]
push ecx
call fcn.005891ea
mov eax, 1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 0x2c], eax
jmp 0x526ee8
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00589969
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x526fde
push eax
call fcn.00587f5a
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00589969
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00589969
mov edx, dword [esi + 4]
push edx
call fcn.005891ea
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.005267d0
test eax, eax
je 0x526ee6
call fcn.00526320
test eax, eax
je 0x526ee6
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x526ee8
Function at 0x52a970
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x52a997
movsx eax, byte [esi]
push eax
call fcn.0058ce6a
add esp, 4
test eax, eax
je 0x52aa0f
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x52aa7a
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x52aa0e
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0058ac90
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x5b9d14
push eax
call fcn.00589549
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x52a9d0
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x6fb098
call fcn.0058cdb5
mov eax, dword [0x6fb0d8]
mov esi, dword [esp + 0x130]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x716430]
jne 0x52aa57
cmp dword [0x6fb0b8], 0
je 0x52aa57
cmp dword [0x6fb0d4], 0
jne 0x52aa57
mov ecx, 0x6fb0b8
call fcn.0051d730
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x114
ret 8

Function at 0x52ab00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x52ab37
push 0
push 0xb6
push str.MHNetwork.cpp
call fcn.0052bd20
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], bl
mov dword [esp + 0x1a], 0x61637646
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], 0x40215e59
mov dword [esp + 0x25], 0x5a767324
mov dword [esp + 0x29], 0x26317241
mov dword [esp + 0x2d], 0x2a21405e
mov dword [esp + 0x31], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x52ab94
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
mov al, byte [esp + edx + 0x10]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0x10]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x52abe6
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x2c
ret 8
Function at 0x52bd20
Capabilities:
Get file size

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0x6fcad8], 0
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2ac]
je 0x52bd9b
push eax
mov eax, dword [esp + 0x2ac]
push eax
push ecx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6fc9d8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6fc9d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x52bede
int3
mov edx, dword [esp + 0x2a8]
test eax, eax
je 0x52bdc0
push eax
push edx
push ecx
lea eax, [esp + 0x1a8]
push str._s_line:_d__msg:_s_
push eax
call fcn.00589549
add esp, 0x14
jmp 0x52bdd7
push edx
push ecx
lea eax, [esp + 0x1a4]
push str._s_line:_d_
push eax
call fcn.00589549
add esp, 0x10
push 0xff
lea ecx, [esp + 0xa1]
push 0
push ecx
mov byte [esp + 0xa8], 0
call fcn.00588e70
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0xa8]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.00589549
add esp, 0x14
cmp dword [0x6fcb30], 0
jne 0x52bede
push esi
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52beae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xa4]
push 0x5cb5e4
push eax
call fcn.005894eb
mov esi, eax
add esp, 8
test esi, esi
je 0x52bedc
call fcn.0052c010
push eax
lea ecx, [esp + 0x1a8]
push ecx
push str._stime:_s_n
push esi
call fcn.0058a651
push esi
call fcn.005891ea
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00589034
add esp, 0x2a0
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x52be5a
mov dword [0x6fcb30], 1
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00589034
add esp, 0x2a0
ret
Function at 0x52cf20
Capabilities:
Get file size

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x39c], eax
push esi
mov esi, dword [esp + 0x3b0]
push edi
mov edi, dword [esp + 0x3ac]
push 0x1ff
lea eax, [esp + 0x1a9]
push 0
push eax
mov byte [esp + 0x1b0], 0
call fcn.00588e70
add esp, 0xc
test esi, esi
je 0x52cf88
mov ecx, dword [esp + 0x3b0]
push esi
push ecx
push edi
lea edx, [esp + 0x1b0]
push str._s_line:_d__msg:_s_
push edx
call fcn.00589549
add esp, 0x14
jmp 0x52cfa6
mov eax, dword [esp + 0x3b0]
push eax
push edi
lea ecx, [esp + 0x1ac]
push str._s_line:_d_
push ecx
call fcn.00589549
add esp, 0x10
push 0xff
lea edx, [esp + 0xa9]
push 0
push edx
mov byte [esp + 0xb0], 0
call fcn.00588e70
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.00589549
add esp, 0x14
cmp dword [0x6fce78], 0
jne 0x52d0a9
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52d07b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push 0x5cb5e4
push ecx
call fcn.005894eb
mov esi, eax
add esp, 8
test esi, esi
je 0x52d0a9
call fcn.0052c010
push eax
lea edx, [esp + 0x1a8]
push edx
push str._stime:_s_n
push esi
call fcn.0058a651
push esi
call fcn.005891ea
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.00589034
add esp, 0x3a0
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x52d027
mov dword [0x6fce78], 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x3a0
ret
Function at 0x54d820
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x54d84d
mov ecx, esi
call fcn.0054d7e0
push 0x5cde38
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x553840
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x55384f
xor eax, eax
ret 8
jmp 0x558a80
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x5c1f28]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x558b84
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x558b82
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x558b84
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x558b86
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x5c0b08]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.005584a0
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8

Function at 0x554d40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x554def
mov edi, dword [esp + 0x14]
test edi, edi
je 0x554def
push 0
push 1
push 0x7191a0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x554def
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x71918c], ecx
mov edx, dword [eax + 4]
mov dword [0x719190], edx
mov eax, dword [eax + 8]
mov dword [0x719194], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x719180], ecx
mov edx, dword [eax + 4]
mov dword [0x719184], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x719188], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x554cb0
push 0
push 0
mov dword [0x71919c], ecx
mov dword [0x719198], edi
mov dword [0x6dab84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x554df6
push eax
push 0x7191a0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x55a4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xa0]
mov ecx, edi
call fcn.0040a8c0
mov ebp, 1
cmp dword [ebx + 0x88], ebp
jbe 0x55a643
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x5bc3e8]
fstp qword [esp + 0x14]
jmp 0x55a500
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x55a517
mov ecx, dword [ecx]
test ecx, ecx
je 0x55a517
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x55a52a
mov eax, dword [eax]
test eax, eax
je 0x55a52a
mov eax, dword [eax]
test eax, eax
jne 0x55a52e
xor edx, edx
jmp 0x55a530
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55a541
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55a563
fadd dword [0x5b9928]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x55a586
mov eax, dword [eax]
test eax, eax
je 0x55a586
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x55a598
mov edx, dword [edx]
test edx, edx
je 0x55a598
mov edx, dword [edx]
test edx, edx
jne 0x55a59c
xor edx, edx
jmp 0x55a59e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55a5af
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55a5d1
fadd dword [0x5b9928]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x55a5ef
push 1
mov ecx, edi
call fcn.0040a770
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x55a5fe
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x55a61b
push 0xc
call fcn.00588f26
add esp, 4
test eax, eax
je 0x55a65b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.0040aa30
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x55a500
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0055e350
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00589c70
push 0x5e6a28
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00589b8b
int3
Function at 0x55a690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.0040a8c0
xor ebp, ebp
cmp dword [ebx + 0x88], ebp
jbe 0x55a813
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x5bc3e8]
fstp qword [esp + 0x14]
jmp 0x55a6d0
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x55a6e7
mov ecx, dword [ecx]
test ecx, ecx
je 0x55a6e7
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x55a6fa
mov eax, dword [eax]
test eax, eax
je 0x55a6fa
mov eax, dword [eax]
test eax, eax
jne 0x55a6fe
xor edx, edx
jmp 0x55a700
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55a711
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55a733
fadd dword [0x5b9928]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x55a756
mov eax, dword [eax]
test eax, eax
je 0x55a756
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x55a768
mov edx, dword [edx]
test edx, edx
je 0x55a768
mov edx, dword [edx]
test edx, edx
jne 0x55a76c
xor edx, edx
jmp 0x55a76e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55a77f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55a7a1
fadd dword [0x5b9928]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x55a7bf
push 1
mov ecx, edi
call fcn.0040a770
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x55a7ce
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x55a7eb
push 0xc
call fcn.00588f26
add esp, 4
test eax, eax
je 0x55a82b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.0040aa30
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x55a6d0
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0055e350
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00589c70
push 0x5e6a28
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00589b8b
int3
Function at 0x56ddf0
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x56de0e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0052bd20
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x56de26
cmp esi, 0x11
je 0x56de26
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4