joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531805f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532029ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x24]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x10], esi
call sym.libOCAHelperw_2_13.dll_public:_void___thiscall_Ocalibhelper213::CWireObject::constructor_class_Ocalibhelper213::CWireObject_const___enum_Ocalibhelper213::TypeHolder::UrlVersion_
lea edi, [esi + 0x20]
mov dword [esi], vtable.Ocalibhelper213::CPropWireObject.0
mov ecx, edi
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], vtable.CXLib206::SIMap_long_int__class_CXLib206::CSmartRefCountPtr_class_Ocalibhelper213::CPropWireObject__.0
call fcn.53179530
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x2c], edx
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 2
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::STimeZone::constructor_class_CXLib206::STimeZone_const__]
mov ecx, dword [sym.imp.cxlibw_2_6.dll_class_CXLib206::SString_t_unsigned_short_int__1_::_EmptyBuffer_CXLib206::SString_t_unsigned_short_int__1_::EmptyBuffer]
mov dword [esi + 0x54], ecx
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x70], 0
mov ecx, dword [esi + 0x2c]
test ecx, ecx
mov byte [esp + 0x14], 6
je 0x531806a1
mov edx, dword [ecx]
call dword [edx]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], 0x20
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x53184210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53203741
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov dword [esp + 0xc], vtable.CXLib206::SIArray_class_CXLib206::SWCharString_.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x2c], 1
call fcn.53183c30
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.CXLib206::SIArray_class_CXLib206::SWCharString_.0
call fcn.53183790
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], bl
call fcn.531349d0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x53186b00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53203a79
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push edi
mov esi, ecx
call sym.libOCAHelperw_2_13.dll_protected:_static_void___cdecl_Ocalibhelper213::TypeHolder::EncodePropertyId_V2_class_CXLib206::SAsciiString___long_int_
mov ecx, dword [esi + 0xc]
push 0xf
mov edx, ecx
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.cxlibw_2_6.dll_public:_static_class_CXLib206::SWCharString___cdecl_CXLib206::NeutralString::FromNumber_float__int_]
add esp, 0x14
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0
add ebx, 0xc
call dword [sym.imp.cxlibw_2_6.dll_public:_unsigned_int___thiscall_CXLib206::SString_t_unsigned_short_int__1_::getNChars_void_const]
push eax
push ebx
mov ecx, edi
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SAsciiString::concatFromAsciiCharacters_unsigned_short_int_const___unsigned_int_]
push edi
mov ecx, esi
call sym.libOCAHelperw_2_13.dll_protected:_void___thiscall_Ocalibhelper213::TypeHolder::FlagsToBase64_class_CXLib206::SAsciiString__const
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::releaseBuffer_void_]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x5318df10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53204748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov edx, dword [edi]
mov esi, ecx
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::setBuffer_struct_CXLib206::SString_t_unsigned_short_int__1_::SStringBuffer__]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x2c], ebx
call fcn.5318c410
mov esi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::releaseBuffer_void_]
test bl, bl
jne 0x5318df89
push edi
lea ecx, [esi + 0x10]
call dword [0x532152ec]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x5318dfa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53204768
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
push edi
push ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::setBuffer_struct_CXLib206::SString_t_unsigned_short_int__1_::SStringBuffer__]
mov edi, dword [esp + 0x30]
mov edx, dword [edi]
mov dword [esp + 0x10], edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x2c], ebx
call fcn.5318c4d0
mov esi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::releaseBuffer_void_]
test bl, bl
jne 0x5318e014
mov edx, dword [edi]
mov dword [esi + 0x10], edx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x53194580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532051b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x34]
push esi
push ebp
lea ecx, [esp + 0xc]
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::constructor_unsigned_short_int_const__]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharStringCI::constructor_class_CXLib206::SWCharStringCI_const__]
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [ebx + 0x18]
mov byte [esp + 0x38], 1
call fcn.5318c4d0
mov esi, dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::releaseBuffer_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call esi
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call esi
push ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::constructor_unsigned_short_int_const__]
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 2
mov dword [esp + 0x14], 0
call dword [sym.imp.cxlibw_2_6.dll_protected:_void___thiscall_CXLib206::SString_t_unsigned_short_int__1_::setBuffer_struct_CXLib206::SString_t_unsigned_short_int__1_::SStringBuffer__]
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [ebx + 0x30]
mov byte [esp + 0x38], 3
call fcn.531943a0
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call esi
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x531a4f20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x53206198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
push edi
lea ecx, [esp + 0x14]
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x2c], 0
call fcn.531a3bb0
mov esi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
test bl, bl
jne 0x531a4f95
push edi
lea ecx, [esi + 0x10]
call dword [sym.imp.cxlibw_2_6.dll_public:_class_CXLib206::SWCharString____thiscall_CXLib206::SWCharString::operator_class_CXLib206::SWCharString_const__]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x531a51f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x532061e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov edi, dword [esp + 0x30]
mov ecx, dword [edi]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x2c], 0
call fcn.531a44f0
mov esi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
test bl, bl
jne 0x531a5260
mov ecx, dword [edi]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x531ac1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532070e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push esi
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push eax
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
lea ecx, [esp + 0x18]
call fcn.531a9d20
mov edx, dword [esp + 0x34]
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
lea ecx, [esp + 0xc]
call fcn.531a9d20
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.531a9f20
mov esi, eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 3
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret
Function at 0x531ac8d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x53207207
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_void_]
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x34], 1
call fcn.531adad0
mov edi, eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0xc]
mov byte [esp + 0x34], 2
call fcn.531adaa0
mov ebp, eax
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x34], 3
call fcn.531ada70
mov ebx, eax
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x34], 4
call sym.libOCAHelperw_2_13.dll_public:_class_CXLib206::SWCharString___thiscall_Ocalibhelper213::ServerSpec::getName_void_
mov edx, dword [esi + 0x24]
push 0x5322b06c
push edi
push 0x53216978
push ebp
push 0x53216978
push ebx
push 0x53216978
push eax
push 0x53216978
lea ecx, [esi + 0x10]
mov esi, dword [sym.imp.cxlibw_2_6.dll_class_CXLib206::SWCharString____cdecl_CXLib206::operator___class_CXLib206::SWCharString___unsigned_short_int_const__]
push ecx
push 0x5322b068
push edx
lea eax, [esp + 0x40]
push str.ManagedService__
push eax
mov byte [esp + 0x68], 5
call esi
add esp, 8
push eax
call dword [sym.imp.cxlibw_2_6.dll_class_CXLib206::SWCharString____cdecl_CXLib206::operator___class_CXLib206::SWCharString___int_]
add esp, 8
push eax
call esi
mov edi, dword [sym.imp.cxlibw_2_6.dll_class_CXLib206::SWCharString____cdecl_CXLib206::operator___class_CXLib206::SWCharString___class_CXLib206::SWCharString_const__]
add esp, 8
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
push eax
call edi
add esp, 8
push eax
call esi
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 1
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x531b0e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53207b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov esi, ecx
push 0x53215f38
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_unsigned_short_int_const__]
push 0x53215f38
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 1
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_unsigned_short_int_const__]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
push eax
push ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x54]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 2
call fcn.531ce8b0
lea ecx, [esp + 8]
mov byte [esp + 0x38], 5
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 4
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
mov dword [esp + 0x54], 0
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x40], 6
call fcn.531b0490
mov esi, dword [esp + 0x54]
test esi, esi
mov edi, dword [esp + 0x40]
mov dword [edi], esi
je 0x531b0f1c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
test esi, esi
mov dword [esp + 0x10], 1
mov byte [esp + 0x38], 4
je 0x531b0f34
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.5319eca0
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x18
Function at 0x531b5150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532088e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.Ocalibhelper213::ManagedSession.0
mov dword [esi + 0x28], vtable.CXLib206::SIMap_class_Ocalibhelper213::ServiceKey__class_CXLib206::CSmartRefCountPtr_class_Ocalibhelper213::ManagedService__.0
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
lea edi, [esi + 0x2c]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x28], 4
call fcn.531b11f0
mov eax, dword [edi + 4]
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 0x24]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [esp + 0x1c], 3
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 2
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 1
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::destructor_void_]
mov ebp, dword [esi + 0xc]
test ebp, ebp
lea edi, [esi + 8]
mov byte [esp + 0x1c], 0
mov dword [edi], vtable.CXLib206::SISimplePtr_class_Ocalibhelper213::MRWLock_.0
je 0x531b5205
mov ecx, ebp
call fcn.531a9a20
push ebp
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [edi]
mov ecx, edi
call dword [edx]
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.cxlibw_2_6.dll_protected_virtual:_void___thiscall_CXLib206::CRefCount::destructor_void_]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x531b7450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53209030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
push str.y:libsocaframeworkMRWLockHelper.h
mov dword [esp + 0xc], esi
call dword [sym.imp.cxlibw_2_6.dll_bool___cdecl_CXLib206::ShouldAssert_char_const__]
add esp, 4
test al, al
je 0x531b74a0
test esi, esi
jne 0x531b74a0
push str.The_pointer_shouldnt_be_null
push 0x5322afe8
push 0x11
push str.y:libsocaframeworkMRWLockHelper.h
call dword [sym.imp.cxlibw_2_6.dll_void___cdecl_CXLib206::SAssert_char_const___int__char_const___char_const__]
add esp, 0x10
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, esi
mov dword [esp + 0x30], 0
call sym.libOCAHelperw_2_13.dll_public:_void___thiscall_Ocalibhelper213::ManagedSessions::lockModify_void_
mov edi, dword [esp + 0x38]
push edi
lea ecx, [esp + 0x10]
call fcn.531cec80
push edi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0xc]
mov byte [esp + 0x38], 1
call fcn.531b64f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.5319eca0
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call sym.libOCAHelperw_2_13.dll_public:_void___thiscall_Ocalibhelper213::ManagedSessions::releaseLock_void_
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x531b9c90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53209307
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esp + 0x10], esi
mov dword [esi], eax
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_unsigned_short_int_const__]
xor eax, eax
mov dword [esi + 0xc], vtable.CXLib206::SIArray_class_CXLib206::SWCharString_.0
mov dword [esp + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ecx, eax
push eax
push ecx
lea eax, [esp + 0x30]
lea edi, [esi + 0x10]
push eax
mov ecx, edi
mov byte [esp + 0x24], 1
call fcn.53134650
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0xc]
mov ebx, dword [esp + 0x28]
mov eax, dword [eax + 8]
mov edx, dword [esi + 0x18]
push ebx
push ecx
push eax
push edx
mov ecx, edi
call fcn.531b9980
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x531bc4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x532095c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.531a7490
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.531a50a0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sym.libOCAHelperw_2_13.dll_public:_void___thiscall_Ocalibhelper213::QBSet::set_class_CXLib206::SISet_class_CXLib206::CSmartRefCountPtr_class_Ocalibhelper213::CPropWireObject_____long_int__long_int_
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.531a7590
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x531bd2c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x532097a8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
push edi
lea eax, [esp + 0x38]
push eax
lea ecx, [esi + 0x18]
call fcn.531baf20
mov eax, dword [eax]
cmp eax, dword [esi + 0x1c]
je 0x531bd30a
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
push ebx
lea ecx, [esp + 0xc]
call fcn.531a7490
lea ecx, [esp + 0xc]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x38], 0
call sym.libOCAHelperw_2_13.dll_public:_bool___thiscall_Ocalibhelper213::QBSet::find_class_CXLib206::CSmartRefCountPtr_class_Ocalibhelper213::CPropWireObject__const___class_CXLib206::SISet_class_CXLib206::CSmartRefCountPtr_class_Ocalibhelper213::CPropWireObject____
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.531a7590
mov ecx, dword [esp + 0x28]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x531c8bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5320af08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.531c7050
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x2c], 0
call fcn.531c8730
mov esi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.531c6fb0
test bl, bl
jne 0x531c8c69
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x531c8c5c
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [edi]
test ecx, ecx
mov dword [esi + 0x10], ecx
je 0x531c8c69
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8