joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50eba0
Capabilities:
Create directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x50ebfa
push 0x7c9
mov ecx, 0x6b2fd8
call fcn.004c6410
push eax
push 0x1d
push 0x6b2fd8
call fcn.004c7640
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00565c32
add esp, 0x210
ret
mov eax, dword [0x6dbb54]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x592e98
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x50ebe2
cmp dword [esi + 0xc], 0
jne 0x50ec61
push str.bdcap32.dll
mov ecx, esi
call fcn.0050eff0
test eax, eax
jns 0x50ec45
push 0x7ca
jmp 0x50ebc8
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x50ed24
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.0050eab0
push 0
mov ecx, 0x6de658
call fcn.0054d260
push eax
lea edx, [esp + 0xc]
push str._sScreenShot
push edx
call fcn.00565b90
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x50ecbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50ecbb
push 0x7cc
jmp 0x50ebc8
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0x592f90
push str.Capture
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0050e840
lea eax, [esp + 0x10c]
push eax
push 0x7cd
mov ecx, 0x6b2fd8
call fcn.004c6410
push eax
push 0x1d
push 0x6b2fd8
call fcn.004c7640
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 4
push 0
lea edx, [esp + 0x118]
push edx
push esi
call fcn.0050e8d0
test eax, eax
js 0x50ebe2
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00565c32
add esp, 0x210
ret

Function at 0x50f3b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
jne 0x50f403
mov eax, dword [esp + 8]
push 0x593004
push eax
call fcn.00565b32
mov esi, eax
add esp, 8
test esi, esi
je 0x50f439
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x50f3e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50f3e0
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005659fc
push esi
call fcn.00565831
add esp, 0x14
pop edi
xor eax, eax
pop esi
ret 0xc
cmp eax, 1
jne 0x50f439
mov ecx, dword [esp + 8]
push 0x593000
push ecx
call fcn.00565b32
mov esi, eax
add esp, 8
test esi, esi
je 0x50f439
mov edx, dword [esp + 0xc]
push edx
push 0x592ffc
push esi
call fcn.00566ac1
push esi
call fcn.00565831
add esp, 0x10
xor eax, eax
pop esi
ret 0xc
Function at 0x510bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x510bde
xor eax, eax
jmp 0x510c9a
push 0x583690
push edi
call fcn.00565b32
lea edx, [esi + 0x2e]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x510bf6
mov eax, dword [esi + 4]
test eax, eax
je 0x510bd7
push ebx
push ebp
push 2
push 0
push eax
call fcn.00568bc4
mov eax, dword [esi + 4]
push eax
call fcn.00568f0c
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.00568bc4
add esp, 0x1c
mov ecx, esi
call fcn.00510110
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00566115
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x144]
push eax
call fcn.0055f2c0
test eax, eax
jne 0x510cb3
push eax
push 0x38
push str.MHFile.cpp
call fcn.00516310
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00565b90
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.00565c32
add esp, 0x208
ret 4
lea ecx, [esi + 0x144]
call fcn.0055f2a0
test eax, eax
je 0x510d57
lea edi, [ebx - 0xe]
push edi
call fcn.00564fc8
add esp, 4
mov dword [esi + 0x26], eax
test eax, eax
jne 0x510ceb
push eax
push 0x49
push str.MHFile.cpp
call fcn.00516310
add esp, 0xc
jmp 0x510c96
push edi
push 0
push eax
call fcn.00565680
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x26]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x144]
call fcn.0055f560
test eax, eax
jne 0x510d37
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00565b90
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x510c8d
mov ecx, dword [esi + 4]
push ecx
call fcn.00565831
mov eax, 1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 0x2a], eax
jmp 0x510c98
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00566115
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x510d8e
push eax
call fcn.00564fc8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x26], eax
call fcn.00566115
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00566115
mov edx, dword [esi + 4]
push edx
call fcn.00565831
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.00510580
test eax, eax
je 0x510c96
call fcn.005100d0
test eax, eax
je 0x510c96
mov eax, 1
mov dword [esi + 0x2a], eax
jmp 0x510c98
Function at 0x514540
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x514567
movsx eax, byte [esi]
push eax
call fcn.005692aa
add esp, 4
test eax, eax
je 0x5145df
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x51464a
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x5145de
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00567630
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x58397c
push eax
call fcn.00565b90
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x5145a0
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x6bfe48
call fcn.005691f5
mov eax, dword [0x6bfe88]
mov esi, dword [esp + 0x130]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x6dac04]
jne 0x514627
cmp dword [0x6bfe68], 0
je 0x514627
cmp dword [0x6bfe84], 0
jne 0x514627
mov ecx, 0x6bfe68
call fcn.00507720
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.00565c32
add esp, 0x114
ret 8

Function at 0x5146d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x514707
push 0
push 0xb6
push str.MHNetwork.cpp
call fcn.00516310
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], bl
mov dword [esp + 0x1a], 0x61637646
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], 0x40215e59
mov dword [esp + 0x25], 0x5a767324
mov dword [esp + 0x29], 0x26317241
mov dword [esp + 0x2d], 0x2a21405e
mov dword [esp + 0x31], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x514764
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
mov al, byte [esp + edx + 0x10]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0x10]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x5147b6
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00565c32
add esp, 0x2c
ret 8
Function at 0x515d90
Capabilities:
Get file size

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x39c], eax
push esi
mov esi, dword [esp + 0x3b0]
push edi
mov edi, dword [esp + 0x3ac]
push 0x1ff
lea eax, [esp + 0x1a9]
push 0
push eax
mov byte [esp + 0x1b0], 0
call fcn.00565680
add esp, 0xc
test esi, esi
je 0x515df8
mov ecx, dword [esp + 0x3b0]
push esi
push ecx
push edi
lea edx, [esp + 0x1b0]
push str._s_line:_d__msg:_s_
push edx
call fcn.00565b90
add esp, 0x14
jmp 0x515e16
mov eax, dword [esp + 0x3b0]
push eax
push edi
lea ecx, [esp + 0x1ac]
push str._s_line:_d_
push ecx
call fcn.00565b90
add esp, 0x10
push 0xff
lea edx, [esp + 0xa9]
push 0
push edx
mov byte [esp + 0xb0], 0
call fcn.00565680
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.00565b90
add esp, 0x14
cmp dword [0x6c1ab0], 0
jne 0x515f19
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x515eeb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push 0x59353c
push ecx
call fcn.00565b32
mov esi, eax
add esp, 8
test esi, esi
je 0x515f19
call fcn.005155d0
push eax
lea edx, [esp + 0x1a8]
push edx
push str._stime:_s_n
push esi
call fcn.00566ac1
push esi
call fcn.00565831
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.00565c32
add esp, 0x3a0
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x515e97
mov dword [0x6c1ab0], 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
xor ecx, esp
call fcn.00565c32
add esp, 0x3a0
ret
Function at 0x516310
Capabilities:
Get file size

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0x6c1878], 0
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2ac]
je 0x51638b
push eax
mov eax, dword [esp + 0x2ac]
push eax
push ecx
push 0x5934d8
push 0x6c1778
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6c1778
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x5164ce
int3
mov edx, dword [esp + 0x2a8]
test eax, eax
je 0x5163b0
push eax
push edx
push ecx
lea eax, [esp + 0x1a8]
push str._s_line:_d__msg:_s_
push eax
call fcn.00565b90
add esp, 0x14
jmp 0x5163c7
push edx
push ecx
lea eax, [esp + 0x1a4]
push str._s_line:_d_
push eax
call fcn.00565b90
add esp, 0x10
push 0xff
lea ecx, [esp + 0xa1]
push 0
push ecx
mov byte [esp + 0xa8], 0
call fcn.00565680
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0xa8]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.00565b90
add esp, 0x14
cmp dword [0x6c1ad8], 0
jne 0x5164ce
push esi
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x51649e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xa4]
push 0x59353c
push eax
call fcn.00565b32
mov esi, eax
add esp, 8
test esi, esi
je 0x5164cc
call fcn.005155d0
push eax
lea ecx, [esp + 0x1a8]
push ecx
push str._stime:_s_n
push esi
call fcn.00566ac1
push esi
call fcn.00565831
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00565c32
add esp, 0x2a0
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x51644a
mov dword [0x6c1ad8], 1
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00565c32
add esp, 0x2a0
ret
Function at 0x533290
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x5332bd
mov ecx, esi
call fcn.00533250
push 0x595da0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x537e90
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f2]
test ecx, ecx
jne 0x537e9f
xor eax, eax
ret 8
jmp 0x53bb80
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x589ee0]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x53bc84
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x53bc82
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x53bc84
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x53bc86
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x588a90]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.0053b530
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8

Function at 0x539390
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f2], 0
push edi
je 0x53943f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x53943f
push 0
push 1
push 0x6dd978
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x53943f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x6dd964], ecx
mov edx, dword [eax + 4]
mov dword [0x6dd968], edx
mov eax, dword [eax + 8]
mov dword [0x6dd96c], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x6dd958], ecx
mov edx, dword [eax + 4]
mov dword [0x6dd95c], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x6dd960], eax
mov ecx, dword [esi + 0x1f2]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x539300
push 0
push 0
mov dword [0x6dd974], ecx
mov dword [0x6dd970], edi
mov dword [0x69fb84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x539446
push eax
push 0x6dd978
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x53d630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xa0]
mov ecx, edi
call fcn.0053e730
mov ebp, 1
cmp dword [ebx + 0x88], ebp
jbe 0x53d7b3
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x584370]
fstp qword [esp + 0x14]
jmp 0x53d670
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x53d687
mov ecx, dword [ecx]
test ecx, ecx
je 0x53d687
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x53d69a
mov eax, dword [eax]
test eax, eax
je 0x53d69a
mov eax, dword [eax]
test eax, eax
jne 0x53d69e
xor edx, edx
jmp 0x53d6a0
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d6b1
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d6d3
fadd dword [0x583660]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x53d6f6
mov eax, dword [eax]
test eax, eax
je 0x53d6f6
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x53d708
mov edx, dword [edx]
test edx, edx
je 0x53d708
mov edx, dword [edx]
test edx, edx
jne 0x53d70c
xor edx, edx
jmp 0x53d70e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d71f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d741
fadd dword [0x583660]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x53d75f
push 1
mov ecx, edi
call fcn.0040a6f0
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x53d76e
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x53d78b
push 0xc
call fcn.00565d11
add esp, 4
test eax, eax
je 0x53d7cb
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.00539490
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x53d670
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053f260
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00566242
push 0x5ac4c8
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00566330
int3
Function at 0x53d800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.0053e730
xor ebp, ebp
cmp dword [ebx + 0x88], ebp
jbe 0x53d983
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x584370]
fstp qword [esp + 0x14]
jmp 0x53d840
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x53d857
mov ecx, dword [ecx]
test ecx, ecx
je 0x53d857
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x53d86a
mov eax, dword [eax]
test eax, eax
je 0x53d86a
mov eax, dword [eax]
test eax, eax
jne 0x53d86e
xor edx, edx
jmp 0x53d870
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d881
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d8a3
fadd dword [0x583660]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x53d8c6
mov eax, dword [eax]
test eax, eax
je 0x53d8c6
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x53d8d8
mov edx, dword [edx]
test edx, edx
je 0x53d8d8
mov edx, dword [edx]
test edx, edx
jne 0x53d8dc
xor edx, edx
jmp 0x53d8de
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d8ef
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d911
fadd dword [0x583660]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x53d92f
push 1
mov ecx, edi
call fcn.0040a6f0
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x53d93e
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x53d95b
push 0xc
call fcn.00565d11
add esp, 4
test eax, eax
je 0x53d99b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.00539490
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x53d840
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053f260
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00566242
push 0x5ac4c8
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00566330
int3
Function at 0x54d220
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x54d23e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.00516310
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x54d256
cmp esi, 0x11
je 0x54d256
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4