joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11019681
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
test eax, eax
jle 0x110196d0
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call sym.DuiLib.dll_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x1101972e
mov ecx, edi
inc ebx
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp ebx, eax
jl 0x1101969f
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x11019785
sub eax, 4
je 0x11019732
dec eax
dec eax
jne 0x1101977c
push dword [ebp + 0xc]
mov byte [ebp + 8], al
lea edi, [ebp + 9]
stosb byte es:[edi], al
call fcn.11039180
pop ecx
mov ecx, dword [esi + 0x50]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov byte [ebp + 8], al
mov eax, dword [ecx]
push sym.DuiLib.dll_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x1101977c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x1101977e
cmp dword [esi + 0x54], 0
je 0x1101977c
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x10], al
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.11016dfd
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x1101977c
cmp dword [esi + 0x54], 0
je 0x110197d4
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x110197d4
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x110197d4
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.RichEditUI
push eax
call fcn.110384b9
pop ecx
pop ecx
test eax, eax
je 0x110197d4
mov ecx, dword [esi + 0x54]
call sym.DuiLib.dll_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x1101977c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call sym.DuiLib.dll_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x1101972e
Function at 0x11027084
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1106ee10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x110270f4
cmp dword [esi + 0x10], ebx
je 0x110270f4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
inc edi
mov eax, edi
call fcn.110384f0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x110270f4
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x138
call fcn.1100d0e9
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11036d1b
leave
ret 0x10

Function at 0x1102fa3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x314], ebx
je 0x1102faa3
cmp dword [ebp + 8], 0x100
jne 0x1102fa92
cmp byte [ebp + 0xc], 0xd
jne 0x1102fa92
cmp byte [esi + 0x31a], bl
je 0x1102fa79
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1102fa92
cmp byte [esi + 0x31b], bl
jne 0x1102fa92
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x1102fa8e
push ebx
push ebx
push ebx
push str.return
push esi
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x1102faa6
mov eax, dword [esi + 0x314]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x11036d1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1106ee10]
jne 0x11036d25
repz ret
jmp fcn.1103cc1c
Function at 0x11042301
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1103b8cd
and dword [ebp - 4], 0
cmp dword [0x11070eac], 0
mov ebx, eax
jne 0x110423b2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x11042463
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x11051408
push edi
call esi
test eax, eax
je 0x11042463
push eax
call fcn.1103b85b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x11070eac], eax
call esi
push eax
call fcn.1103b85b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x11070eb0], eax
call esi
push eax
call fcn.1103b85b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x11070eb4], eax
call esi
push eax
call fcn.1103b85b
pop ecx
mov dword [0x11070ebc], eax
test eax, eax
je 0x110423b2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1103b85b
pop ecx
mov dword [0x11070eb8], eax
mov eax, dword [0x11070eb8]
cmp eax, ebx
je 0x1104240a
cmp dword [0x11070ebc], ebx
je 0x1104240a
push eax
call fcn.1103b8d6
push dword [0x11070ebc]
mov esi, eax
call fcn.1103b8d6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1104240a
test edi, edi
je 0x1104240a
call esi
test eax, eax
je 0x11042401
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x11042401
test byte [ebp - 0xc], 1
jne 0x1104240a
or dword [ebp + 0x10], 0x200000
jmp 0x11042443
mov eax, dword [0x11070eb0]
cmp eax, ebx
je 0x11042443
push eax
call fcn.1103b8d6
pop ecx
test eax, eax
je 0x11042443
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x11042443
mov eax, dword [0x11070eb4]
cmp eax, ebx
je 0x11042443
push eax
call fcn.1103b8d6
pop ecx
test eax, eax
je 0x11042443
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x11070eac]
call fcn.1103b8d6
pop ecx
test eax, eax
je 0x11042463
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x11042465
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x46b342cc
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x520f33fd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x404200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce429
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x50b164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00459a70
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x30], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402b80
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 8
call fcn.00460600
lea ecx, [ebp - 0x28]
call fcn.0045e070
call fcn.00403b10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a807d
mov esp, ebp
pop ebp
ret 4

Function at 0x407db0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ced8f
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x50b164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00454e90
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00454e90
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00454e90
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00457900
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00457900
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], edx
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x68], 0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edx, dword [ebp + 0x14]
push edx
call fcn.00457800
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e90
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40c520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf65c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50b164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
call fcn.004846c0
movzx eax, al
test eax, eax
je 0x40c574
push 0x4068
push 0x4df248
push 0x4df2ac
call fcn.004b5ea8
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, 0x58
call fcn.00462eb0
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0040c720
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
call fcn.0048d4d0
cmp eax, 1
jbe 0x40c622
push 1
lea ecx, [ebp - 0xd]
call fcn.0040b790
mov dword [ebp - 4], 0
push 1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
call fcn.004804a0
mov ecx, eax
call fcn.00464060
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
call fcn.00484d50
jmp 0x40c5eb
lea ecx, [ebp - 0x18]
call fcn.00463a70
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.00462710
movzx eax, al
test eax, eax
je 0x40c613
push 2
lea ecx, [ebp - 0x18]
call fcn.00462f70
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0040c7b0
jmp 0x40c5e3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0040b810
mov ecx, dword [ebp - 0x14]
add ecx, 0xcc
call fcn.004800c0
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
push 0xa
call fcn.00449640
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00429670
add esp, 8
push eax
call fcn.00429370
add esp, 8
push 0x17
lea ecx, [ebp - 0xe]
call fcn.0040b790
mov dword [ebp - 4], 1
push 0xa
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00401f50
add esp, 8
push eax
call fcn.00429370
add esp, 8
push 0x447810
push 0xa
call fcn.004496a0
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
push eax
call fcn.00429670
add esp, 8
push eax
call fcn.00429370
add esp, 8
mov ecx, eax
call fcn.00461b30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe]
call fcn.0040b810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x413920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d068e
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x50b164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00411c70
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0xfc
push ecx
call fcn.004126b0
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045f3c0
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
jne 0x4139ae
xor al, al
jmp 0x413a1d
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x48]
push edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xf0
call fcn.0048afb0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x34]
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xac
call fcn.00462fb0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 0x1c]
call edx
mov eax, dword [ebp - 0x34]
add eax, 0x94
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a807d
mov esp, ebp
pop ebp
ret 8
Function at 0x41e870
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.0047df40
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
call fcn.0047e1a0
mov dword [ebp - 0x14], eax
jmp 0x41e8ae
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x14]
je 0x41e8ee
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
movsx eax, byte [ebp - 1]
cdq
xor eax, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
push 0x100
push 0x1b3
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004a8140
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
jmp 0x41e8a5
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x450f30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d688f
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x50b164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004598e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax], vtable.Catch::StreamingReporterBase_struct_Catch::CompactReporter_.0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040af40
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.0040af30
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.00450420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.004503e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
add ecx, 0x58
call fcn.00450400
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
add ecx, 0xcc
call fcn.00457460
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd8
call fcn.00459f50
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd8], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.00429d60
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x4c]
call eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.004867f0
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x44]
call fcn.00481c20
test eax, eax
jne 0x45103b
mov dword [ebp - 0x38], 1
jmp 0x451042
mov dword [ebp - 0x38], 0
mov cl, byte [ebp - 0x38]
mov byte [ebp - 0x2d], cl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5c]
call fcn.0045e400
movzx edx, byte [ebp - 0x2d]
test edx, edx
je 0x4510b7
lea eax, [ebp - 0x28]
push eax
push str.Verbosity_level_not_supported_by_this_reporter
lea ecx, [ebp - 0x68]
call fcn.00402a40
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
call fcn.00428ff0
mov ecx, eax
call fcn.00402b80
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x54]
push eax
call fcn.004078f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.0045e070
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.00402ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a807d
mov esp, ebp
pop ebp
ret 4
Function at 0x4510e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d691f
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x50b164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004598e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax], vtable.Catch::StreamingReporterBase_struct_Catch::ConsoleReporter_.0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040af40
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.0040af30
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.00450420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.004503e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
add ecx, 0x58
call fcn.00450400
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
add ecx, 0xcc
call fcn.00457460
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd8
call fcn.00459f50
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd8], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.00429d60
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x4c]
call eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.00486840
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x44]
call fcn.00481c20
test eax, eax
jne 0x4511eb
mov dword [ebp - 0x38], 1
jmp 0x4511f2
mov dword [ebp - 0x38], 0
mov cl, byte [ebp - 0x38]
mov byte [ebp - 0x2d], cl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5c]
call fcn.0045e400
movzx edx, byte [ebp - 0x2d]
test edx, edx
je 0x451267
lea eax, [ebp - 0x28]
push eax
push str.Verbosity_level_not_supported_by_this_reporter
lea ecx, [ebp - 0x68]
call fcn.00402a40
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
call fcn.00428ff0
mov ecx, eax
call fcn.00402b80
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x54]
push eax
call fcn.004078f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.0045e070
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.00402ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a807d
mov esp, ebp
pop ebp
ret 4
Function at 0x451290
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d69af
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x50b164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004598e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax], vtable.Catch::StreamingReporterBase_struct_Catch::TestEventListenerBase_.0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040af40
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.0040af30
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.00450420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.004503e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
add ecx, 0x58
call fcn.00450400
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
add ecx, 0xcc
call fcn.00457460
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
add ecx, 0xd8
call fcn.00459f50
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd8], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.00429d60
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x4c]
call eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.0040b700
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x44]
call fcn.00481c20
test eax, eax
jne 0x45139b
mov dword [ebp - 0x38], 1
jmp 0x4513a2
mov dword [ebp - 0x38], 0
mov cl, byte [ebp - 0x38]
mov byte [ebp - 0x2d], cl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5c]
call fcn.0045e400
movzx edx, byte [ebp - 0x2d]
test edx, edx
je 0x451417
lea eax, [ebp - 0x28]
push eax
push str.Verbosity_level_not_supported_by_this_reporter
lea ecx, [ebp - 0x68]
call fcn.00402a40
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
call fcn.00428ff0
mov ecx, eax
call fcn.00402b80
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x54]
push eax
call fcn.004078f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.0045e070
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.00402ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a807d
mov esp, ebp
pop ebp
ret 4