joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x457a3f
pop dword [ebp - 0x18]
mov eax, 0x457a3f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x643595ef
sub dword [ebp - 0x28], 0x15e350a4
mov dword [ebp - 0x24], 0xd2ccee72
sub dword [ebp - 0x24], 0xa099a22d
mov dword [ebp - 0x20], 0x86613ff9
sub dword [ebp - 0x20], 0x3a14fbcb
mov dword [ebp - 0x1c], 0xd1493531
add dword [ebp - 0x1c], 0x2eb6cacf
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe3a4410f
sub dword [ebp - 0x28], 0x6f31d7b9
mov dword [ebp - 0x24], 0xe6721124
add dword [ebp - 0x24], 0x5afa5051
mov dword [ebp - 0x20], 0xf07eff6e
add dword [ebp - 0x20], 0x72f06cfe
mov dword [ebp - 0x1c], 0x8774db1d
sub dword [ebp - 0x1c], 0x8774db1d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x486e9
push 0
call eax
mov ecx, 0xcdf3cbf9
sub ecx, 0xcdf38071
mov ebx, eax
mov edi, 0xcea5dc82
add edi, 0x31a2fb7e
add edi, dword [ebp - 0x18]
mov edx, 0xcc60f5c6
sub edx, 0xff223222
sub dword [ebp - 8], edi
mov esi, dword [edi]
sub dword [ebp - 0x10], 0x5ad69d0c
add esi, edx
xor dword [ebp - 8], esi
mov dword [ebx], esi
add ebx, 4
add edi, 0x95fe955
sub edi, 0x95fe951
loop 0x457b52
add eax, 0x120f3
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000d77d
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000d77d
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10

Function at 0x1000d77d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000d78c
pop dword [ebp - 0x10]
mov eax, 0x1000d78c
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push SetFileAttributesW
push 0
mov eax, 0x45274a8f
add eax, 0xcadba6cd
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x42a5
xor edx, edx
add edx, eax
mov ebx, 0x4d9e9e51
sub ebx, 0x3d99f251
add ebx, dword [ebp - 0x10]
mov esi, 0xff56b24
add esi, 0xe8278091
xor dword [ebp - 0xc], ebx
mov edi, dword [ebx]
sub dword [ebp - 4], 0xdd107
xor edi, esi
add dword [ebp - 4], esi
mov dword [edx], edi
mov dword [ebp - 0xc], 0x9427d738
add edx, 0xda626caa
sub edx, 0xda626ca6
add ebx, 4
loop 0x1000d7e2
add eax, 0x43777d4
sub eax, 0x4367a6d
mov ebx, eax
add eax, 5
mov ecx, 0xccf15dad
add ecx, 0x430ea253
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1005a57f
Capabilities:
Authenticate hmac

Disassembly:
inc esi
jmp 0x1005cb20
add edi, eax
pushal
mov edi, dword [edi + ecx*4]
cmp ah, bh
cmc
test edi, edi
pushfd
lea esp, [esp + 0x28]
jo 0x100597b0
push esi
lea esp, [esp + 4]
je 0x10085b01
cmc
jns 0x1007e91c
add eax, edi
clc
test sp, bp
bt bx, 0xd
clc
cmp eax, edx
call fcn.1007ec93
push 0xbf8db1e6
pushfd
pushfd
lea esp, [esp + 0xc]
jb 0x10085b0e
test dh, 0x55
call fcn.1008162a
call fcn.10080125
cmc
add eax, edi
cmp bh, al
cmp eax, edx
call fcn.10083d5d
je 0x100850a6
clc
cmp di, si
pushfd
mov byte [esp], 2
cmp al, ah
mov word [esp], 0x25a8
pushfd
pushal
lea esp, [esp + 0x28]
jne 0x10085af1
jmp 0x10058fb9
push edi
pushal
cmp dl, ah
or ah, ah
jmp 0x1008570e
call fcn.10085acc
push 0xf3624983
mov byte [esp], dh
push ecx
push dword [esp + 8]
ret 0xc
Function at 0x1005cc31
Capabilities:
Encrypt data using speck

Disassembly:
cmp ax, 0xac7d
bt esp, 0x18
cmp dl, bh
sub ecx, 1
call fcn.10059af3
cmp ecx, 7
mov byte [esp], 0xc4
pushfd
lea esp, [esp + 8]
jb 0x10058f58
setg dh
sets al
aaa
mov eax, dword [ebp - 0x20]
add dh, dh
xadd dh, cl
jmp 0x10083c22
pushal
lea esp, [esp + 0x24]
jl 0x10081ebb
push edi
lea eax, [ebx + eax*4 + 0x3c0]
call fcn.1005115a
bts di, 0xb
shld di, di, 7
mov edi, ebx
sub esp, 0xfffffffc
jb 0x10088a65
neg al
sar al, cl
neg al
mov al, 0x2e
jb 0x1005d375
repne scasb al, byte es:[edi]
call fcn.10083df2
jne 0x1005cc0b
ror dh, 1
or dword [edi], esp
dec eax
in al, 0x56
scasd eax, dword es:[edi]
mov cl, 0x63
xchg byte [esi], bl
jge 0x1005ccda
sbb dword [ecx], 0x66079b7f
ja 0x1005ccd7
sbb dword [edi - 0x65], edi
pop es
ja 0x1005ccd7
and al, 0xeb
xor esi, edx
test eax, 0x19c52abd
inc esi
push esp
loopne 0x1005ccde
fstp qword [ecx - 0x2e51edd0]
sub cl, al
mov byte [esi], dh
outsd dx, dword [esi]
scasb al, byte es:[edi]
shr dword [edx], 1
enter 0x3688, 0x6f
mov eax, dword [0xb840ae50]
or esi, dword [ebp + 1]
test dword [ecx], 0x5e2ddaf
jge fcn.1005ccd2
pop ecx
stc
jbe 0x1005cc6c
cmpsb byte [esi], byte es:[edi]
pop esp
jnp 0x1005cceb
mov ecx, 0x554db514
fcmovu st(0), st(7)
jecxz 0x1005cc84
adc byte [esi], ch
mov edx, 0x9fca0611
invalid
lea esp, [esp + 0x28]
je 0x100829d9
sub byte [edi], cl
test al, bh
pop esp
add al, byte [eax]
clc
test cx, 0x30c0
pushal
push dword [esp + 4]
or ecx, ecx
add al, 9
leave
call fcn.1005dc57
pushal
push dword [esp]
call fcn.10088731
adc edx, dword [ebp + 0x3d]
jb 0x1005cc9c
sbb dl, bl
cld
push ebx
xchg byte [ebp + 0x51], dl
scasb al, byte es:[edi]
invalid
pushal
lea eax, [ebx + edx*4 + 0x400]
mov word [esp + 4], bp
pushal
jmp 0x10083bde
push 0x6708d542
pushal
pushal
repne scasb al, byte es:[edi]
push dword [esp]
mov word [esp + 8], sp
call fcn.1007cdd6
push 0xe427b3ed
call fcn.10059225
pushal
pushfd
lea eax, [ebx + eax*4 + 0x3c0]
pushfd
call fcn.100818f2
push 0xb109f518
lea esp, [esp + 0x44]
call fcn.1005a923
pushfd
call fcn.10085332
inc cl
not eax
shl dh, 4
clc
mov cl, byte [eax + edi]
btc ax, 2
not ax
xor ax, 0x7b79
add cl, cl
movsx ax, al
mov ax, 0x62df
setb dh
jmp 0x1005ce80
bt cx, bx
ror al, 1
mov al, cl
cmp dl, dl
mov al, 0x2e
cmp cl, 0x56
pushfd
stc
repne scasb al, byte es:[edi]
push dword [esp]
lea esp, [esp + 8]
jl 0x1007fde0
push 0xdb3c958b
lea esp, [esp + 4]
jne 0x1005d474
call fcn.10086209
rol al, 1
mov byte [esp + 0xc], 0xd3
add al, 0x40
stc
mov word [esp], ax
neg al
stc
bt edx, 0x17
rol al, 3
cmc
bt bp, 9
shl edi, 8
cmc
bt cx, si
test bh, dh
add edi, eax
jmp 0x10059ecf

Function at 0x1005d38b
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x2c]
jne 0x10085b01
shrd esi, edi, 0xe
mov ecx, edi
cmc
not esi
cmp cl, cl
sub ecx, ebx
or si, 0xb245
jmp 0x10082d58
mov esi, esp
pushal
pushal
cmp ax, 0x376d
sub edi, 4
clc
push dword [edi]
pop dword [esp + 0x3c]
clc
jmp 0x10082c8c

Function at 0x10084a0f
Capabilities:
Authenticate hmac

Disassembly:
pushfd
sub al, 0x30
cmp bh, dh
pushfd
stc
cmp al, 9
call fcn.1005d42f
jmp 0x10085355
lea esp, [esp + 0xc]
je 0x10089796
jmp 0x1007ea51
Function at 0xa8f98a
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a8f906
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0xa8fb02
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0xa8fb02
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0xa8fab1
jg 0xa8f9e3
test eax, eax
je 0xa8faa7
push 1
push 0x1000
call fcn.00a7967f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0xa8fa09
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0xa8fa9e
push 0x8000
push ebx
call fcn.00a77d3e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0xa8fa35
jg 0xa8fa30
cmp ecx, 0x1000
jb 0xa8fa35
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00a8f206
add esp, 0x10
cmp eax, 0xffffffff
je 0xa8fa7a
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0xa8fa30
jl 0xa8fa61
test ecx, ecx
jne 0xa8fa22
push dword [ebp - 0xc]
push ebx
call fcn.00a77d3e
push esi
call fcn.00a7a3a6
add esp, 0xc
xor edi, edi
jmp 0xa8fb13
cmp byte [edi + 0x24], 0
je 0xa8fa91
cmp dword [edi + 0x20], 5
jne 0xa8fa91
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0xa8fa9c
mov edi, dword [edi + 0x18]
jmp 0xa8fa9e
xor edi, edi
push esi
call fcn.00a7a3a6
pop ecx
jmp 0xa8fb13
test ecx, ecx
jg 0xa8fa73
jl 0xa8fab1
test eax, eax
jae 0xa8fa73
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a84457
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0xa8fad4
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa8fa73
jmp 0xa8fb0b
push ebx
call fcn.00a88cb2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xa8fa73
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0xa8fb13
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa8fb10
mov edi, dword [edi + 0x18]
jmp 0xa8fb13
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00a84457
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0xa95890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1000928f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b348]
jne 0x10009299
repz ret
jmp fcn.1000966a
Function at 0x40d38b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004086b1
mov dword [ebp - 0x14], eax
cmp dword [0x455ffc], esi
jne 0x40d47e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d40b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d55e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d55e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d55e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x455ffc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x456000], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x456004], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45600c], eax
test eax, eax
je 0x40d47b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456008], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d4a3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d496
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d4b8
push 4
pop eax
jmp 0x40d560
cmp dword [ebp - 0x14], esi
je 0x40d4b8
push dword [0x455ffc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d49d
mov eax, dword [0x456008]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d516
cmp dword [0x45600c], edi
je 0x40d516
push eax
call ebx
push dword [0x45600c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d516
test eax, eax
je 0x40d516
call ecx
test eax, eax
je 0x40d50b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d50b
test byte [ebp - 8], 1
jne 0x40d516
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d546
mov eax, dword [0x456000]
cmp eax, edi
je 0x40d543
push eax
call ebx
test eax, eax
je 0x40d543
call eax
mov esi, eax
test esi, esi
je 0x40d543
mov eax, dword [0x456004]
cmp eax, edi
je 0x40d543
push eax
call ebx
test eax, eax
je 0x40d543
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x455ffc]
call ebx
test eax, eax
je 0x40d55e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d560
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040437c
mov esp, ebp
pop ebp
ret
Function at 0x4066e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476ffb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x493f58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004336e9
push 4
mov dword [ebp - 4], 0
call fcn.0044c124
mov edi, eax
add esp, 4
test edi, edi
je 0x406760
call fcn.004318b1
mov dword [edi], eax
call fcn.00431670
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004315a5
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406756
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004315cd
jmp 0x406762
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476ffb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x493f58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004336e9
push 4
mov dword [ebp - 4], 0
call fcn.0044c124
mov edi, eax
add esp, 4
test edi, edi
je 0x410eb0
call fcn.004318b1
mov dword [edi], eax
call fcn.00431670
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004315a5
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x410ea6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004315cd
jmp 0x410eb2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477fa9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x493f58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0044bc33
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::program_options::error_with_option_name.0
mov eax, dword [edi + 0xc]
lea edx, [edi + 0x10]
lea ecx, [esi + 0x10]
push edx
mov dword [esi + 0xc], eax
call fcn.0041a410
lea eax, [edi + 0x20]
lea ecx, [esi + 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.0041a4e0
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
push 0
lea edx, [edi + 0x30]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.00404e20
push 0xffffffffffffffff
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 3
push 0
add edi, 0x4c
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.00404e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jge 0x422e72
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x1c], 0
je 0x422e7f
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422ed2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.00424750
mov edx, dword [esi + 4]
mov ebx, eax
push ebx
push edx
push edi
push str.Error__d_reading_file:__s___s_
call fcn.00424710
push ebx
call fcn.0044bac5
add esp, 0x14
pop edi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
jne 0x422edd
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], eax
movzx eax, byte [esi + 0x1c]
neg eax
mov dword [esi + 0x14], 0
sbb eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x422f50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 0x14]
cmp edi, ebx
jle 0x422f64
mov edi, ebx
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x10]
push edi
push eax
push ecx
call fcn.0044df10
add dword [esi + 0x14], edi
mov eax, dword [esi + 0x14]
add esp, 0xc
sub ebx, edi
je 0x422fe2
test eax, eax
jle 0x422fa6
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x422fab
mov dword [esi + 0x14], 0
add dword [ebp + 8], edi
jmp 0x422f58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.00424750
mov edx, dword [esi + 4]
mov ebx, eax
push ebx
push edx
push edi
push str.Error__d_writing_to_file:__s___s_
call fcn.00424710
push ebx
call fcn.0044bac5
add esp, 0x14
pop edi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x14]
test eax, eax
jle 0x423052
mov edx, dword [esi + 0x10]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42304b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.00424750
mov ecx, dword [esi + 4]
mov ebx, eax
push ebx
push ecx
push edi
push str.Error__d_writing_to_file:__s___s_
call fcn.00424710
push ebx
call fcn.0044bac5
add esp, 0x14
pop edi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x14], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x423f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 8]
push eax
push 1
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x423f94
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, esi
call fcn.00424750
mov edi, eax
mov eax, dword [ebp + 8]
push edi
push eax
push esi
push str.Error__d_reading_file:__s___s_
call fcn.00424710
push edi
call fcn.0044bac5
add esp, 0x14
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0
je 0x423fa2
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x423fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
cmp byte [ebx], 0
push esi
push edi
je 0x424027
mov edx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push 1
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42400b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, esi
call fcn.00424750
mov edi, eax
mov eax, dword [ebp + 8]
push edi
push eax
push esi
push str.Error__d_reading_file:__s___s_
call fcn.00424710
push edi
call fcn.0044bac5
add esp, 0x14
mov eax, 0xfffffffe
jmp 0x42401a
cmp dword [ebp - 8], 0
je 0x424017
movzx eax, byte [ebp - 1]
jmp 0x42401a
or eax, 0xffffffff
movzx ecx, byte [ebx]
inc ebx
cmp eax, ecx
jne 0x424030
cmp byte [ebx], 0
jne 0x423fc0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret