joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131ec
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413289
push ebx
push esi
call fcn.004131b5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004130fe
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x413236
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413288
push edi
push eax
call fcn.00410915
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x413256
call fcn.004108db
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413287
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004130fe
add esp, 0x20
test eax, eax
jne 0x413275
push edi
call fcn.004108db
jmp 0x41327d
push ebx
call fcn.004108db
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41432f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41e480
push 0x41e478
push str.FlsAlloc
push 0x1e
call fcn.004141f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414363
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c250]
call esi
jmp 0x414369
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4143ad
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41e490
push 0x41e488
push str.FlsGetValue
push 0x20
call fcn.004141f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4143e4
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c250]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsGetValue]
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x512058], 1
mov dword [0x512054], 1
mov dword [0x512050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x51200c], eax
mov eax, dword [0x512064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x512078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x512060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4c6078], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4016ce
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40171e
mov dword [esp + 4], str._ERRORE__Impossibile_allocare_memoria_n
mov dword [esp], 0x4c7920
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
jmp 0x40182c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4017d0
mov dword [esp + 4], str._ERRORE__Impossibile_creare_il_thread_n
mov dword [esp], 0x4c7920
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
jmp 0x40182c
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp + 4], str._INFO__Payload_eseguito_con_successo._n
mov dword [esp], 0x4c7a60
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
leave
ret
Function at 0x41d1c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x41d220
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x51206c]
test esi, esi
jle 0x41d340
mov eax, dword [0x512070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x41d254
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x41d2d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x41d240
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x41d367
mov eax, dword [0x512070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x512070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x41d347
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x41d2d0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x41d2e0
add dword [0x51206c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x512070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x41d2d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x41d25e
mov eax, dword [0x512070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop
Function at 0x41d890
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x512088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x512080]
sub esp, 4
test ebx, ebx
je 0x41d8e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x41d8de
test eax, eax
jne 0x41d8de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41d8c0
mov dword [esp], 0x512088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41dc20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x41dc45
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x41dc50
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x41dc45
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x41dc98
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x41dc8e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x41dc9a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x41dc80
xor eax, eax
pop ebx
pop esi
ret
Function at 0x42c770
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], str.msvcrt.dll
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x42c7b8
mov dword [esp + 0x20], esi
mov dword [dbg.init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x512ac4], eax
sub esp, 8
mov eax, dbg.mingw_rand_s
jmp 0x42c7a3

Function at 0x42f2f0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
mov edx, 0xffffffff
test eax, eax
jle 0x42f328
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x42f340
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8

Function at 0x42fee0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4c7dc4], 0
jne 0x430006
mov byte [0x4c7dc4], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x42ffd4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x42ffc4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4c81dd
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4bd1cc
jmp 0x4bd1c4
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x42ff8a
mov dword [esp], 2
call dword [0x4c6218]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4bd1bf
mov dword [esp], 2
call dword [0x4c6218]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x43e2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4c765c
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x43e46d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x43e46d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4ce244
mov dword [esp + 4], 0x4cdf48
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x43e46d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.0043ff30
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x43e440
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x43e3f6
test al, al
jne 0x43e418
cmp dl, al
jne 0x43e404
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x43e3f6
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x43e3f6
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x43e3e6
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x43e3e6
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x43e480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4c765c
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x43e60d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x43e60d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4ce244
mov dword [esp + 4], 0x4cdf48
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x43e60d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.0043ff30
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x43e5e0
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x43e596
test al, al
jne 0x43e5b8
cmp dl, al
jne 0x43e5a4
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x43e596
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x43e596
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x43e586
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x43e586
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4639b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov edi, dword [esi + 0xc]
mov eax, edi
and eax, 0xffffffb5
or eax, 8
mov dword [esi + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x28], edx
mov ecx, edx
mov edx, ebx
mov ebx, dword [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0xc], edi
mov dword [eax], ebx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
Function at 0x467e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4c765c
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x467fad
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x467fad
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4ce244
mov dword [esp + 4], 0x4cdf48
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x467fad
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.004695c0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x467f80
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x467f36
test al, al
jne 0x467f58
cmp dl, al
jne 0x467f44
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x467f36
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x467f36
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x467f26
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x467f26
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x467fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4c765c
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x46814d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x46814d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4ce244
mov dword [esp + 4], 0x4cdf48
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x46814d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.004695c0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x468120
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x4680d6
test al, al
jne 0x4680f8
cmp dl, al
jne 0x4680e4
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x4680d6
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x4680d6
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x4680c6
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x4680c6
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x485590
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sym._fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x4855d0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x4855a1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8