joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x60
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov dword [esp + 0x3c], edx
mov ecx, eax
mov edx, ebx
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x488e58
fld xword [esp + 0x50]
mov eax, dword [esp + 0x8c]
fstp xword [eax]
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], eax
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20

Function at 0x488e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x60
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov dword [esp + 0x3c], edx
mov ecx, eax
mov edx, ebx
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x488f18
fld xword [esp + 0x50]
mov eax, dword [esp + 0x8c]
fstp xword [eax]
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], eax
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
Function at 0x48d640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x48d720
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x48d758
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x48d6f8
test al, al
jne 0x48d730
mov ebx, esi
cmp bl, al
jne 0x48d708
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x48d6d3
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x48d6f8
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x48d6f8
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x48d6ea
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x48d6ea
Function at 0x48da60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES4_S4_RiPPKcjRSt8ios_baseRSt
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x48dbb0
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x48dbe8
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x48db90
test al, al
jne 0x48dbc0
cmp dl, al
jne 0x48db9e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x48db6f
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x48db90
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x48db90
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x48db82
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x48db82
Function at 0x48f940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_char__const_std::use_facet_std.ctype_char____std::locale_const_
mov ebp, eax
mov eax, dword [esp + 0x74]
mov dword [eax], 0
cmp byte [ebp + 0x1c], 0
je 0x48fa60
movzx edx, byte [ebp + 0x42]
cmp byte [esp + 0x24], 0
mov byte [esp + 0x3c], dl
jne 0x48fa40
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], al
lea eax, [esp + 0x3c]
mov dword [esp + 4], ebx
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
mov esi, eax
sub esp, 0x20
cmp edx, 0xffffffff
mov ebx, edx
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x48fac0
cmp dword [esp + 0x20], 0xffffffff
sete al
test edi, edi
je 0x48fa24
test al, al
jne 0x48fa98
cmp dl, al
jne 0x48fa2f
mov eax, dword [esp + 0x74]
or dword [eax], 2
add esp, 0x4c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3d], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], al
jmp 0x48f9ba
mov ecx, ebp
call method.std::ctype_char_._M_widen_init___const
mov eax, dword [ebp]
mov edx, 0x25
mov eax, dword [eax + 0x18]
cmp eax, method.std::ctype_char_.do_widen_char__const
je 0x48f99d
mov dword [esp], 0x25
mov ecx, ebp
call eax
sub esp, 4
mov edx, eax
jmp 0x48f99d
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x48fa24
mov eax, dword [edi]
mov byte [esp + 0x20], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x20]
cmp eax, 0xffffffff
sete al
jmp 0x48fa24
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x48fa14
mov eax, dword [esi]
mov byte [esp + 0x24], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x24]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x48fa14
Function at 0x490160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES4_S4_RiPPKwjRSt8ios_baseRSt
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x4902d0
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x4902f8
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x4902b2
test al, al
jne 0x4902e0
cmp bl, cl
jne 0x4902c0
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x49028d
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x490320
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x4902b2
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x490338
movzx eax, word [eax]
xor ebx, ebx
mov ebp, 0
cmp ax, 0xffff
cmove ebx, esi
cmovne ebp, ecx
jmp 0x49029f
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x4902eb
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x490303
Function at 0x4acee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call method.std::time_get_char__std::istreambuf_iterator_char__std::char_traits_char_____._M_extract_num_std::istreambuf_iterator_char__std::char_traits_char_____std::istreambuf_iterator_char__std::char_traits_char_____int__int__int__unsigned_int__std::ios_ba
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x4acfc0
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x4acff8
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x4acf98
test al, al
jne 0x4acfd0
mov ebx, esi
cmp bl, al
jne 0x4acfa8
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x4acf73
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x4acf98
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x4acf98
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x4acf8a
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x4acf8a
Function at 0x4ad300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES3_S3_RiPPKcjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4ad450
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x4ad488
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x4ad430
test al, al
jne 0x4ad460
cmp dl, al
jne 0x4ad43e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x4ad40f
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x4ad430
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x4ad430
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x4ad422
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x4ad422
Function at 0x4af4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x4af620
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x4af648
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x4af602
test al, al
jne 0x4af630
cmp bl, cl
jne 0x4af610
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x4af5dd
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x4af670
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x4af602
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x4af688
movzx eax, word [eax]
xor ebx, ebx
mov ebp, 0
cmp ax, 0xffff
cmove ebx, esi
cmovne ebp, ecx
jmp 0x4af5ef
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x4af63b
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x4af653
Function at 0x4d3680
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x50]
test esi, esi
je 0x4d36c0
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.file_size_too_large
mov dword [esp], eax
call dword [esp + 0x58]
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._lseek64
test edx, edx
js 0x4d37a8
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sym._backtrace_alloc
mov ecx, dword [esp + 0x60]
mov dword [ecx + 4], eax
test eax, eax
je 0x4d380f
mov dword [ecx], eax
mov dword [ecx + 8], ebx
test ebx, ebx
je 0x4d3798
xor edi, edi
xor ebp, ebp
jmp 0x4d3742
je 0x4d37d0
cdq
add edi, eax
adc ebp, edx
cmp edi, ebx
mov eax, ebp
sbb eax, esi
jae 0x4d3798
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov edx, ebx
mov eax, dword [esp + 0x44]
sub edx, edi
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._read
test eax, eax
jns 0x4d3728
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
mov dword [esp + 4], str.read
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call dword [esp + 0x58]
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._free
xor eax, eax
jmp 0x4d36b8
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
mov dword [esp + 4], str.lseek
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call dword [esp + 0x58]
xor eax, eax
jmp 0x4d36b8
mov dword [esp + 0x1c], eax
cmp edi, ebx
mov eax, ebp
sbb eax, esi
jae 0x4d3798
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.file_too_short
mov dword [esp], eax
call dword [esp + 0x58]
mov eax, dword [esp + 0x60]
mov edx, dword [eax + 4]
mov dword [esp], edx
call sym._free
mov eax, dword [esp + 0x1c]
jmp 0x4d36b8
xor eax, eax
jmp 0x4d36b8
Function at 0x4d9770
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4f48ac]
test eax, eax
je 0x4d9780
ret
push esi
push ebx
sub esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 8
mov ebx, eax
test eax, eax
jne 0x4d97b8
mov eax, dword [0x4f48ac]
test eax, eax
je 0x4d97ec
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], eax
call sym._xmalloc
mov dword [esp], ebx
mov dword [0x4f48ac], eax
mov dword [esp + 4], eax
call esi
sub esp, 8
test eax, eax
jne 0x4d97a5
mov eax, dword [0x4f48ac]
mov dword [esp], eax
call sym._free
mov dword [0x4f48ac], 0
mov dword [esp], 0x560e80
call sym._xstrdup
mov dword [0x4f48ac], eax
jmp 0x4d97ae