joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dccd0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x53f58b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x58c584]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a8]
mov ebx, dword [esp + 0x2a0]
mov esi, dword [esp + 0x2ac]
mov ebp, dword [esp + 0x2b0]
push 0xffffffffffffffff
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a8]
push edi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], edi
mov word [esp + 0x2c], dx
call fcn.0040e453
mov eax, dword [esp + 0x30]
mov dword [esp + 0x294], edi
cmp eax, edi
je 0x4dcde3
lea edi, [eax - 1]
cmp edi, eax
jbe 0x4dcd7e
call fcn.0050a3d1
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
jae 0x4dcd8d
lea ecx, [esp + 0x20]
cmp word [ecx + edi*2], 0x5c
je 0x4dcddc
lea edi, [eax - 1]
cmp edi, eax
jbe 0x4dcda4
call fcn.0050a3d1
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
jae 0x4dcdb3
lea ecx, [esp + 0x20]
cmp word [ecx + edi*2], 0x2f
je 0x4dcddc
lea edi, [eax - 1]
cmp edi, eax
jbe 0x4dcdc6
call fcn.0050a3d1
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4dcdd5
lea eax, [esp + 0x20]
cmp word [eax + edi*2], 0x3a
jne 0x4dcde3
mov edx, 0x55b5e0
jmp 0x4dcde8
mov edx, 0x55b5d8
mov eax, edx
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4dcdf0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.004dadc0
mov eax, dword [esp + 0x20]
mov edi, 8
cmp dword [esp + 0x34], edi
jae 0x4dce1d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4dce7b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], 0
call edi
cmp eax, 2
je 0x4dce50
call edi
cmp eax, 0x12
je 0x4dce50
call edi
mov esi, eax
jmp 0x4dce52
xor esi, esi
call fcn.004f7150
cmp dword [esp + 0x34], 8
mov edi, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
jb 0x4dce74
mov edx, dword [esp + 0x20]
push edx
call fcn.005089a3
add esp, 4
mov eax, edi
jmp 0x4dcf01
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4dce82
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x68]
push eax
call fcn.004550be
mov eax, dword [esp + 0x38]
test eax, 0x400
je 0x4dceba
mov dword [esi], 0
mov dword [ebp], 0
jmp 0x4dceda
test al, 0x10
je 0x4dcecd
mov dword [esi], 3
mov dword [ebp], 3
jmp 0x4dceda
mov dword [esi], 2
mov dword [ebp], 2
mov esi, dword [esp + 0x14]
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
cmp dword [esp + 0x34], edi
jb 0x4dceff
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005089a3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.0050a878
add esp, 0x284
ret
Function at 0x4dd840
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x53f700
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
cmp eax, 1
jne 0x4dd898
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x4dd884
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
cmp eax, 3
je 0x4dd913
cmp eax, 0xb
je 0x4dd913
push str.boost::filesystem::remove
lea ecx, [esp + 0x2c]
call fcn.004026ad
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x58]
push ecx
push eax
push eax
mov dword [esp + 0x5c], 1
call fcn.004dc6f0
add esp, 4
test al, al
sete dl
movzx eax, dl
push eax
call fcn.004dd6b0
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x4dd8f7
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.005089a3
add esp, 4
test bl, bl
je 0x4dd992
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
push 0x19
xor esi, esi
push str.boost::filesystem::remove
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], esi
mov byte [esp + 0x18], 0
call fcn.004041c5
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x54]
cmp dword [esi + 0x18], 8
jb 0x4dd949
mov eax, dword [esi + 4]
jmp 0x4dd94c
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x5c]
test eax, eax
setne al
lea edx, [esp + 0xc]
push edx
test al, al
sete dl
push ecx
movzx eax, dl
push esi
push eax
call fcn.004dd6b0
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x4dd98a
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005089a3
add esp, 4
test bl, bl
jne 0x4dd884
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret

Function at 0x4ddad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x18], 8
push edi
jb 0x4ddae1
mov eax, dword [ebx + 4]
jmp 0x4ddae4
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ddb0a
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.004dd9b0
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4ddb21
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x4ddb54
push ebx
call fcn.004dc720
add esp, 4
test al, al
je 0x4ddb4c
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
ret
pop edi
mov eax, 9
pop ebx
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
ret
Function at 0x4ddb70
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x53d998
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x1c
push str.boost::filesystem::copy_file
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004041c5
mov edx, dword [esp + 0x3c]
mov ecx, 8
mov dword [esp + 0x30], 0
cmp dword [edx + 0x18], ecx
jb 0x4ddbd5
mov esi, dword [edx + 4]
jmp 0x4ddbd8
lea esi, [edx + 4]
mov eax, dword [esp + 0x38]
cmp dword [eax + 0x18], ecx
jb 0x4ddbe6
mov ecx, dword [eax + 4]
jmp 0x4ddbe9
lea ecx, [eax + 4]
lea edi, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
push edi
push edx
push eax
xor eax, eax
cmp dword [esp + 0x50], eax
sete al
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.004dd730
add esp, 0x14
cmp dword [esp + 0x24], 0x10
jb 0x4ddc2c
mov eax, dword [esp + 0x10]
push eax
call fcn.005089a3
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4ddec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x53f7c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4ddef7
mov eax, dword [esi]
jmp 0x4ddef9
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ddf2f
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push eax
push edi
push esi
call fcn.004dd9b0
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
test ebx, 0x400
je 0x4de02e
cmp dword [edi + 0x18], 8
jb 0x4ddf49
mov ecx, dword [esi]
mov dword [esp + 0x40], ecx
jmp 0x4ddf4d
mov dword [esp + 0x40], esi
push 0
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x18]
call fcn.004dbf00
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 0
jae 0x4ddf74
lea eax, [esp + 0x14]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x40], esi
cmp dword [esp + 0x28], 8
mov byte [esp + 0x34], 2
jb 0x4ddfa9
mov eax, dword [esp + 0x14]
push eax
call fcn.005089a3
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp esi, 0xffffffff
jne 0x4ddfed
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push edx
push edi
push esi
call fcn.004dd9b0
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push edi
call fcn.004dc720
add esp, 4
mov dword [esp + 0x34], 0xffffffff
push esi
test al, al
jne 0x4de028
mov edi, dword [esp + 0x40]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4de044
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 3
test bl, 0x10
jne 0x4de05d
mov dword [esp + 0x40], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x3c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4de080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x18], 8
jb 0x4de092
mov eax, dword [edi + 4]
jmp 0x4de095
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4de0bc
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push eax
push edi
push esi
call fcn.004dd9b0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4de0d2
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
test ebx, 0x400
je 0x4de107
push edi
call fcn.004dc720
add esp, 4
test al, al
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
jne 0x4de0fb
mov dword [esp + 0x14], 9
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 3
test bl, 0x10
jne 0x4de120
mov dword [esp + 0x14], 2
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], edx
pop ebx
ret

Function at 0x4de4b0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x53f848
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x9c]
cmp dword [esi + 0x18], 8
jb 0x4de4eb
mov eax, dword [esi + 4]
jmp 0x4de4ee
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4de51b
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4de514
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
mov al, 1
jmp 0x4de5b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.004f7150
cmp ebx, 0xb7
jne 0x4de563
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004ddec0
add esp, 0xc
cmp dword [eax], 3
jne 0x4de563
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4de5b2
mov dword [esi], 0
call fcn.004f7150
mov dword [esi + 4], eax
jmp 0x4de5b2
mov edi, dword [esp + 0xa0]
test edi, edi
jne 0x4de5a8
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x20]
call fcn.004026ad
mov dword [esp + 0x94], edi
call fcn.004f7150
push eax
push ebx
push esi
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x48]
call fcn.004dd450
push 0x57c704
lea eax, [esp + 0x3c]
push eax
call fcn.0050a446
call fcn.004f7150
mov dword [edi], ebx
mov dword [edi + 4], eax
xor al, al
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4ded80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53f988
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x58c584]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.004dc880
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00435f9b
cmp dword [esp + 0x24], 8
jb 0x4dee1c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005089a3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0050a878
add esp, 0x30
ret 0x1c

Function at 0x4dfab0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x4dfadf
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x4dfac0
pop edi
pop esi
ret

Function at 0x4e42a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53fbc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401441
mov dword [esp + 0x18], 0
test edi, edi
je 0x4e42e4
add edi, 0x28
jmp 0x4e42e6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4e42fe
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], 0x55b85c
mov dword [esi + 0x28], 0x55b858
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4e6040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53fe68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401441
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4e608a
add edi, 0x28
jmp 0x4e608c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4e60a4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], 0x55b85c
mov dword [esi + 0x28], 0x55b858
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4ec220
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5403b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004784b0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.004784b0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.004784b0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4f5790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x540c78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004012ad
mov dword [esi], 0x55c51c
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4f57f5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], 0x55c508
mov dword [esi + 0x30], 0x55c504
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4f5890
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x540cb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004f5790
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], 0x55c514
mov dword [eax], 0x55c510
mov dword [esi + 0x44], 0x55c524
cmp edi, ecx
je 0x4f58f2
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00469f70
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4f6d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x561cc7
mov dword [esp], eax
mov dword [esp + 4], 0x54d800
mov dword [esp + 8], 0x557278
mov dword [esp + 0xc], 0x55c988
mov dword [esp + 0x10], 0x55c984
mov dword [esp + 0x14], 0x54bf48
mov dword [esp + 0x18], 0x54bde8
mov dword [esp + 0x1c], 0x55c980
mov dword [esp + 0x20], 0x553a2c
mov dword [esp + 0x24], str.___:
mov dword [esp + 0x28], 0x561cdc
mov dword [esp + 0x2c], 0x54ab80
mov dword [esp + 0x30], 0x54ad64
mov dword [esp + 0x34], 0x55c97c
mov dword [esp + 0x38], 0x54bc20
mov dword [esp + 0x3c], 0x561ce0
mov dword [esp + 0x40], 0x561cec
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x55c680
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x55c96c
mov dword [esp + 0x54], 0x55c968
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x55c964
mov dword [esp + 0x64], 0x55c960
mov dword [esp + 0x68], 0x561cc8
mov dword [esp + 0x6c], 0x561cd8
mov dword [esp + 0x70], 0x55c684
mov dword [esp + 0x74], 0x55c674
mov dword [esp + 0x78], 0x54bf40
mov dword [esp + 0x7c], 0x55c648
mov dword [esp + 0x80], 0x55c640
mov dword [esp + 0x84], 0x55c638
mov dword [esp + 0x88], 0x55c630
mov dword [esp + 0x8c], 0x55c67c
mov dword [esp + 0x90], 0x561ce8
mov dword [esp + 0x94], 0x54b8e0
mov dword [esp + 0x98], 0x561d3c
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x561d38
mov dword [esp + 0xc0], 0x55c708
mov dword [esp + 0xc4], 0x55c6f0
mov dword [esp + 0xc8], 0x55b58c
mov dword [esp + 0xcc], str.ZYXWVUTRQPOLKJIHGFA
mov dword [esp + 0xd0], 0x55c728
mov dword [esp + 0xd4], 0x55c95c
mov dword [esp + 0xd8], 0x55c650
mov dword [esp + 0xdc], 0x55c70c
mov dword [esp + 0xe0], 0x54bf44
mov dword [esp + 0xe4], 0x55c958
mov dword [esp + 0xe8], 0x55c718
mov dword [esp + 0xec], 0x55c704
cmp cl, 0x3c
jae 0x4f6f1d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret

Function at 0x50a878
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x58c584]
jne 0x50a882
repz ret
jmp fcn.00514b6c
Function at 0x525272
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00514310
and dword [ebp - 4], 0
cmp dword [0x593294], 0
mov ebx, eax
jne 0x525323
push 0x5611cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5253d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5611c0
push edi
call esi
test eax, eax
je 0x5253d4
push eax
call fcn.0051429e
mov dword [esp], 0x5611b0
push edi
mov dword [0x593294], eax
call esi
push eax
call fcn.0051429e
mov dword [esp], 0x56119c
push edi
mov dword [0x593298], eax
call esi
push eax
call fcn.0051429e
mov dword [esp], 0x561180
push edi
mov dword [0x59329c], eax
call esi
push eax
call fcn.0051429e
pop ecx
mov dword [0x5932a4], eax
test eax, eax
je 0x525323
push 0x561168
push edi
call esi
push eax
call fcn.0051429e
pop ecx
mov dword [0x5932a0], eax
mov eax, dword [0x5932a0]
cmp eax, ebx
je 0x52537b
cmp dword [0x5932a4], ebx
je 0x52537b
push eax
call fcn.00514319
push dword [0x5932a4]
mov esi, eax
call fcn.00514319
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x52537b
test edi, edi
je 0x52537b
call esi
test eax, eax
je 0x525372
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x525372
test byte [ebp - 0xc], 1
jne 0x52537b
or dword [ebp + 0x10], 0x200000
jmp 0x5253b4
mov eax, dword [0x593298]
cmp eax, ebx
je 0x5253b4
push eax
call fcn.00514319
pop ecx
test eax, eax
je 0x5253b4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5253b4
mov eax, dword [0x59329c]
cmp eax, ebx
je 0x5253b4
push eax
call fcn.00514319
pop ecx
test eax, eax
je 0x5253b4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x593294]
call fcn.00514319
pop ecx
test eax, eax
je 0x5253d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5253d6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret