joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov edi, eax
push 0x65
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x401141
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401141
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x401141
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test eax, eax
je 0x401138
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 4
mov edi, dword [ebx + eax]
mov eax, dword [esi + 8]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [esi]
call fcn.004044a0
add esp, 8
test eax, eax
je 0x401141
mov dword [esi], eax
xor ecx, ecx
mov eax, dword [esi + 8]
mov edx, 4
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [esi + 4]
call fcn.004044a0
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x401141
mov eax, dword [ebp - 4]
mov edx, dword [esi + 8]
add eax, 4
mov dword [esi + 4], ecx
mov dword [ebp - 8], edx
add eax, ebx
je 0x401117
test edi, edi
je 0x401117
push edi
call fcn.004044c6
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x401141
mov ecx, dword [ebp - 4]
add ecx, 4
push edi
add ecx, ebx
push ecx
push eax
call fcn.00402fe0
mov eax, dword [esi]
add esp, 0xc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 4]
mov dword [eax + edx*4], edi
jmp 0x401127
mov eax, dword [esi]
mov dword [eax + edx*4], 0
mov dword [ecx + edx*4], 0
inc dword [esi + 8]
add ebx, 4
add ebx, edi
cmp ebx, dword [ebp - 0x10]
jb 0x401075
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e59
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e98
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e98
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e98
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e98
cmp dword [ecx + 0x74], 0xe
jbe 0x401e98
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ac5f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40acfc
push ebx
push esi
call fcn.0040ac28
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ab71
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40aca9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40acfb
push edi
push eax
call fcn.00407b7b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40acc9
call fcn.00407b41
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40acfa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ab71
add esp, 0x20
test eax, eax
jne 0x40ace8
push edi
call fcn.00407b41
jmp 0x40acf0
push ebx
call fcn.00407b41
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b9a3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415168
push 0x415160
push str.FlsAlloc
push 0x1e
call fcn.0040b8c1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b9d7
push dword [ebp + 8]
mov ecx, esi
call dword [0x413160]
call esi
jmp 0x40b9dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ba21
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415178
push 0x415170
push str.FlsGetValue
push 0x20
call fcn.0040b8c1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ba58
push dword [ebp + 8]
mov ecx, esi
call dword [0x413160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4125d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4125fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4125fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x395b6eb4
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x1e2f56f3
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10016550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.1007dab0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1004], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1008], ecx
mov edx, dword [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x1008]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea edx, [ebp - 0x1000]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x1004], 0
mov esp, ebp
pop ebp
ret

Function at 0x100504c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x100504f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100504ec
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
add esp, 8
ret

Function at 0x10050550
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0xffffffff
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
cmp dword [sym.stlport_vc645.dll_unsigned_int__STL::_Filebuf_base::_M_page_size], ebx
jne 0x10050585
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0xc]
mov dword [sym.stlport_vc645.dll_unsigned_int__STL::_Filebuf_base::_M_page_size], ecx
mov dword [esi + 4], ebx
mov eax, dword [sym.stlport_vc645.dll_unsigned_int__STL::_Filebuf_base::_M_page_size]
cmp eax, ebx
ja 0x1005059b
mov dword [sym.stlport_vc645.dll_unsigned_int__STL::_Filebuf_base::_M_page_size], 0x1000
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x100507f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
lea eax, [esp]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [ebp]
push 0
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test byte [ebp + 8], 4
mov eax, dword [esp + 8]
jne 0x100508cb
test eax, eax
je 0x100508cb
push ebx
push esi
lea esi, [eax + edi - 1]
mov eax, edi
cmp eax, esi
mov ebx, edi
ja 0x100508c1
mov al, byte [edi]
cmp al, 0x1a
je 0x100508ab
cmp al, 0xd
je 0x10050848
mov byte [ebx], al
jmp 0x10050893
cmp edi, esi
jae 0x10050854
cmp byte [edi + 1], 0xa
je 0x10050894
jmp 0x10050890
mov edx, dword [ebp]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x28]
push 1
push ecx
push edx
mov byte [esp + 0x34], 0x20
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10050889
mov eax, dword [ebp]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esp + 0x20], 0xa
je 0x10050894
mov byte [ebx], 0xd
inc ebx
inc edi
cmp edi, esi
jbe 0x1005083a
mov eax, dword [esp + 0x1c]
pop esi
sub ebx, eax
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 8
ret 8
cmp edi, esi
ja 0x100508c1
mov ecx, dword [ebp]
sub esi, edi
push 1
inc esi
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
pop esi
sub ebx, eax
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 8
ret 8
Function at 0x100508e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1020
call fcn.1007dab0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
test byte [edi + 8], 1
je 0x10050905
push 4
push 0
mov ecx, edi
call sym.stlport_vc645.dll_public:_long_int___thiscall__STL::_Filebuf_base::_M_seek_long_int__int_
test byte [edi + 8], 4
je 0x10050934
mov esi, dword [esp + 0x1038]
mov ecx, dword [esp + 0x1034]
mov edx, dword [edi]
lea eax, [esp + 0x20]
push 0
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [esp + 0x20]
jmp 0x10050a59
mov ebx, dword [esp + 0x1034]
mov eax, dword [esp + 0x1038]
cmp eax, 0x1000
lea ebp, [esp + 0x2c]
lea ecx, [ebx + eax]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x10]
jg 0x10050967
lea eax, [esp + 0x1038]
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x10], esi
jle 0x10050a19
jmp 0x1005097b
mov esi, dword [esp + 0x10]
push esi
push 0xa
push ebx
call dword [sym.imp.MSVCRT.dll_memchr]
add esp, 0xc
test eax, eax
je 0x100509f5
sub eax, ebx
mov esi, ebx
mov ecx, eax
mov edi, ebp
mov edx, ecx
add ebp, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea ebx, [ebx + eax + 1]
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov byte [ebp - 1], 0xd
mov byte [ebp], 0xa
inc ebp
lea eax, [esp + 0x102c]
sub ecx, ebx
sub eax, ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
test eax, eax
lea eax, [esp + 0x10]
jg 0x100509dd
lea eax, [esp + 0x28]
cmp dword [eax], ecx
jl 0x100509e5
lea eax, [esp + 0x1c]
mov eax, dword [eax]
mov edi, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], eax
jg 0x10050977
jmp 0x10050a19
test esi, esi
jle 0x10050a19
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
add ebx, eax
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x2c]
sub ebp, ecx
je 0x10050a49
mov eax, dword [edi]
lea edx, [esp + 0x24]
push 0
push edx
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x10050a49
test eax, eax
je 0x10050a92
add esi, eax
sub ebp, eax
jne 0x10050a25
mov eax, dword [esp + 0x1034]
mov esi, dword [esp + 0x1038]
sub ebx, eax
cmp esi, ebx
je 0x10050a83
test ebx, ebx
jle 0x10050a92
cmp ebx, esi
jge 0x10050a92
mov eax, dword [esp + 0x1034]
sub esi, ebx
add eax, ebx
mov dword [esp + 0x1038], esi
mov dword [esp + 0x1034], eax
jmp 0x100508f4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1020
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1020
ret 8
Function at 0x10050b60
Capabilities:
Read file via mapping

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0
push 0
push 0
mov eax, dword [edi]
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
test ecx, ecx
mov dword [edi + 4], ecx
je 0x10050bb8
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, ebp
push ebx
cdq
push ebp
push edx
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x10050baf
add ebp, ebx
push 1
push ebp
mov ecx, edi
call sym.stlport_vc645.dll_public:_long_int___thiscall__STL::_Filebuf_base::_M_seek_long_int__int_
test eax, eax
jge 0x10050bc1
push ebx
push esi
mov ecx, edi
call sym.stlport_vc645.dll_public:_void___thiscall__STL::_Filebuf_base::_M_unmap_void___long_int_
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10054010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10080246
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ecx - 0x94]
push ebx
push esi
push edi
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov dword [edx + ecx - 0x94], 0x10085538
lea esi, [ecx - 0x8c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], vtable._STL::basic_filebuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__.0
mov dl, byte [esi + 0x30]
mov cl, byte [esi + 0x38]
cmp dl, bl
mov byte [esp + 0x1c], 1
setne al
cmp cl, bl
je 0x10054087
cmp al, bl
je 0x1005407e
push 0xffff
mov ecx, esi
call dword [0x10085570]
mov ecx, esi
call sym.stlport_vc645.dll_private:_bool___thiscall__STL::basic_filebuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::_M_unshift_void_
jmp 0x100540a6
cmp byte [esi + 0x37], bl
je 0x100540a6
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x100540a0
mov ecx, dword [esi + 0x60]
push ecx
push eax
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_void___thiscall__STL::_Filebuf_base::_M_unmap_void___long_int_
mov byte [esi + 0x37], bl
mov dword [esi + 0x5c], ebx
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_bool___thiscall__STL::_Filebuf_base::_M_close_void_
push ebx
push ebx
push ebx
mov ecx, esi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call sym.stlport_vc645.dll_public:_void___thiscall__STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::_M_setg_unsigned_short_int___unsigned_short_int___unsigned_short_int__
push ebx
push ebx
mov ecx, esi
call sym.stlport_vc645.dll_protected:_void___thiscall__STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::setp_unsigned_short_int___unsigned_short_int__
mov al, byte [esi + 0x36]
mov edi, dword [sym.imp.MSVCRT.dll_free]
cmp al, bl
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov byte [esi + 0x3a], bl
mov byte [esi + 0x39], bl
mov byte [esi + 0x38], bl
mov byte [esi + 0x37], bl
je 0x100540fe
mov edx, dword [esi + 0x3c]
push edx
call edi
add esp, 4
mov eax, dword [esi + 0x44]
push eax
call edi
add esp, 4
lea ecx, [esi + 0x1c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esp + 0x1c], bl
mov dword [esi], vtable._STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__.0
call sym.stlport_vc645.dll_public:_void___thiscall__STL::locale::destructor_void_
mov ecx, dword [esi - 8]
pop edi
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x10]
mov dword [edx + esi - 8], 0x100852cc
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10054bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100803e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ecx - 0x90]
push ebx
push esi
push edi
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov dword [edx + ecx - 0x90], 0x10085584
lea esi, [ecx - 0x8c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], vtable._STL::basic_filebuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__.0
mov dl, byte [esi + 0x30]
mov cl, byte [esi + 0x38]
cmp dl, bl
mov byte [esp + 0x1c], 1
setne al
cmp cl, bl
je 0x10054c37
cmp al, bl
je 0x10054c2e
push 0xffff
mov ecx, esi
call dword [0x10085570]
mov ecx, esi
call sym.stlport_vc645.dll_private:_bool___thiscall__STL::basic_filebuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::_M_unshift_void_
jmp 0x10054c56
cmp byte [esi + 0x37], bl
je 0x10054c56
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x10054c50
mov ecx, dword [esi + 0x60]
push ecx
push eax
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_void___thiscall__STL::_Filebuf_base::_M_unmap_void___long_int_
mov byte [esi + 0x37], bl
mov dword [esi + 0x5c], ebx
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_bool___thiscall__STL::_Filebuf_base::_M_close_void_
push ebx
push ebx
push ebx
mov ecx, esi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call sym.stlport_vc645.dll_public:_void___thiscall__STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::_M_setg_unsigned_short_int___unsigned_short_int___unsigned_short_int__
push ebx
push ebx
mov ecx, esi
call sym.stlport_vc645.dll_protected:_void___thiscall__STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__::setp_unsigned_short_int___unsigned_short_int__
mov al, byte [esi + 0x36]
mov edi, dword [sym.imp.MSVCRT.dll_free]
cmp al, bl
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov byte [esi + 0x3a], bl
mov byte [esi + 0x39], bl
mov byte [esi + 0x38], bl
mov byte [esi + 0x37], bl
je 0x10054cae
mov edx, dword [esi + 0x3c]
push edx
call edi
add esp, 4
mov eax, dword [esi + 0x44]
push eax
call edi
add esp, 4
lea ecx, [esi + 0x1c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esp + 0x1c], bl
mov dword [esi], vtable._STL::basic_streambuf_unsigned_short_int__class__STL::char_traits_unsigned_short_int__.0
call sym.stlport_vc645.dll_public:_void___thiscall__STL::locale::destructor_void_
mov ecx, dword [esi - 4]
pop edi
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x10]
mov dword [edx + esi - 4], 0x100852bc
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10058980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x50]
cmp eax, ecx
jbe 0x100589b9
mov dl, byte [esp + 0x13]
mov edi, dword [esi + 0x44]
mov byte [esp + 0x13], dl
lea edx, [esp + 0x13]
push ebx
push edx
push edi
push eax
push ecx
call fcn.1004ffd0
add esp, 0x14
jmp 0x100589bc
mov eax, dword [esi + 0x44]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_int___thiscall__STL::_Filebuf_base::_M_read_char___int_
cmp eax, ebx
jle 0x10058ab2
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x40]
mov edi, dword [esi + 0x3c]
lea ebp, [esp + 0x18]
push ebp
add ecx, eax
push edx
lea edx, [esp + 0x24]
mov dword [esi + 0x50], ecx
mov eax, ecx
mov ecx, dword [esi + 0x58]
push edi
push edx
push eax
mov eax, dword [esi + 0x44]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x70]
push eax
lea eax, [esp + 0x2c]
mov ebx, dword [ecx]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x10058a61
cmp eax, 2
je 0x10058a86
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp ecx, eax
je 0x10058a2c
cmp edx, dword [esi + 0x44]
je 0x10058a86
xor ebx, ebx
cmp byte [esi + 0x34], bl
je 0x10058a46
mov edi, ecx
mov ebp, edx
sub edi, eax
sub ebp, dword [esi + 0x44]
sar edi, 1
imul edi, dword [esi + 0x74]
cmp edi, ebp
jne 0x10058a88
cmp ecx, eax
jne 0x10058a6c
mov ebp, dword [esi + 0x44]
mov edi, edx
sub edi, ebp
mov ebp, dword [esi + 0x78]
cmp edi, ebp
jge 0x10058a88
cmp ecx, eax
jne 0x10058a6c
jmp 0x100589bf
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x4c], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
xor ebx, ebx
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x10058a9c
mov ecx, dword [esi + 0x60]
push ecx
push eax
lea ecx, [esi + 0x24]
call sym.stlport_vc645.dll_public:_void___thiscall__STL::_Filebuf_base::_M_unmap_void___long_int_
mov byte [esi + 0x37], bl
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0x10
ret