joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421070
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x42109d
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.004231e0
mov ecx, dword [ebp + 0xc]
mov eax, ecx
movzx edx, word [eax*8 + 0x43f0f2]
mov dword [esi + 0x6af98], edx
movzx edx, word [eax*8 + 0x43f0f0]
mov dword [esi + 0x6af9c], edx
movzx edx, word [eax*8 + 0x43f0f4]
mov dword [esi + 0x6afa0], edx
movzx eax, word [eax*8 + 0x43f0f6]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ecx, 2
jg 0x421103
mov eax, dword [ebp + 0x10]
or word [eax], 4
jmp 0x42110f
cmp ecx, 8
jl 0x42110f
mov eax, dword [ebp + 0x10]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x421176
cmp eax, 0xffffffff
je 0x421176
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x421151
push esi
call fcn.0041f65c
pop ecx
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0x421159
jmp 0x421186
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x421738
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x421940
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x4217b2
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x4217f5
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x4217f5
mov ecx, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], ecx
jbe 0x4217dc
mov dword [esi + 0x6afa0], ecx
push dword [ebp - 4]
push esi
call fcn.0041f518
mov ebx, eax
mov eax, dword [esi + 0x6af90]
pop ecx
pop ecx
cmp ebx, eax
jbe 0x4217f5
mov ebx, eax
cmp ebx, 3
jb 0x4218ba
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.0041f09d
sub dword [esi + 0x6af90], ebx
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp ebx, dword [esi + 0x6af98]
ja 0x421887
cmp eax, 3
jb 0x421887
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x421835
jmp 0x4218dd
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [esi + 0x6af7c], edx
jmp 0x4218e3
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.0041f09d
add esp, 0xc
dec dword [esi + 0x6af90]
mov dword [ebp + 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x42191f
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x4218fc
lea ecx, [eax + esi + 0x1af70]
jmp 0x4218fe
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.004215b5
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x421932
push esi
call fcn.0041f65c
pop ecx
cmp dword [esi + 0x6af90], 0
jne 0x421762
pop edi
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x421953
lea ecx, [eax + esi + 0x1af70]
jmp 0x421955
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.004215b5
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0x404240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a12d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44e014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.00417790
mov dword [eax], 0x30
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 4], 0
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0xc], 0
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x10], 0
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x14], edi
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov edi, dword [ebp + 0x20]
push 0x7f00
push 0
mov dword [eax + 0x18], edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x1c], esi
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x20], 5
lea eax, [ebp + 8]
push eax
call fcn.00417790
sub esp, 0x18
mov ecx, esp
mov dword [eax + 0x24], 0
lea eax, [ebp + 8]
push eax
call fcn.00417f30
call fcn.00404140
add esp, 0x18
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x28], esi
lea eax, [ebp + 8]
push eax
call fcn.00417790
mov dword [eax + 0x2c], edi
lea eax, [ebp + 8]
push eax
call fcn.00417790
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x404396
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404385
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40437b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40439d
push edx
push ecx
call fcn.0041c8b0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 1
call fcn.0042577e
call fcn.00426c99
int3
Function at 0x406450
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a598
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x44e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0xf4], edi
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00417f30
call fcn.00404140
add esp, 0x18
mov esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
lea ecx, [ebp - 0xf4]
push ecx
push 0x64
lea ecx, [ebp - 0xd8]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe0], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406510
sub ecx, edx
lea eax, [ebp - 0xd8]
push ecx
push eax
lea ecx, [ebp - 0xf0]
call fcn.00419530
mov byte [ebp - 4], 1
lea eax, [ebp - 0xf0]
mov ecx, dword [ebp - 0xf4]
cmp dword [ebp - 0xe0], ecx
mov dword [edi], 0
cmovb ecx, dword [ebp - 0xe0]
cmp dword [ebp - 0xdc], 0x10
push ecx
cmovae eax, dword [ebp - 0xf0]
mov ecx, edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push eax
mov byte [edi], 0
call fcn.00419530
mov edx, dword [ebp - 0xdc]
cmp edx, 0x10
jb 0x4065ad
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4065a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065fa
push edx
push ecx
call fcn.0041c8b0
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4065dd
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4065d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065fa
push edx
push ecx
call fcn.0041c8b0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret
call fcn.00426c99
int3
Function at 0x415140
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movsx eax, al
push eax
call fcn.00425adb
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 4
mov bl, al
push 0x14
call esi
test al, 1
je 0x41517d
push 0x10
call esi
test al, al
js 0x41517d
movsx eax, bl
push eax
call fcn.00425b0b
add esp, 4
mov bl, al
push 0x14
call esi
test al, 1
jne 0x41519b
push 0x10
call esi
test al, al
jns 0x41519b
movsx eax, bl
push eax
call fcn.00425b0b
add esp, 4
mov bl, al
push 0x10
call esi
test al, al
jns 0x41529b
cmp bl, 0x31
jne 0x4151b3
mov bl, 0x21
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x32
jne 0x4151bf
mov bl, 0x40
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x33
jne 0x4151cb
mov bl, 0x23
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x34
jne 0x4151d7
mov bl, 0x24
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x35
jne 0x4151e3
mov bl, 0x25
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x36
jne 0x4151ef
mov bl, 0x5e
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x37
jne 0x4151fb
mov bl, 0x26
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x38
jne 0x415207
mov bl, 0x2a
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x39
jne 0x415213
mov bl, 0x28
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x30
jne 0x41521f
mov bl, 0x29
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x2d
jne 0x41522b
mov bl, 0x5f
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x3d
jne 0x415237
mov bl, 0x2b
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x5b
jne 0x415243
mov bl, 0x7b
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x5d
jne 0x41524f
mov bl, 0x7d
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x3b
jne 0x41525b
mov bl, 0x3a
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x27
jne 0x415267
mov bl, 0x22
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x5c
jne 0x415273
mov bl, 0x7c
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x2c
jne 0x41527f
mov bl, 0x3c
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x2e
jne 0x41528b
mov bl, 0x3e
pop esi
mov al, bl
pop ebx
ret
cmp bl, 0x2f
movzx eax, bl
mov ecx, 0x3f
cmove eax, ecx
mov bl, al
pop esi
mov al, bl
pop ebx
ret
Function at 0x415d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x415e18
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x415e07
jg 0x415d70
test edx, edx
je 0x415e07
nop dword [eax]
call fcn.00419270
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x415dc4
jg 0x415d87
test esi, esi
je 0x415dc4
cmp ebx, eax
jg 0x415d97
jl 0x415d91
cmp edi, esi
jae 0x415d97
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0041f130
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x415deb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x415e01
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x415d70
jl 0x415e01
test edi, edi
jne 0x415d70
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x415e3a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x415e3c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x415eba
jg 0x415e4f
test esi, esi
je 0x415eba
test eax, eax
jl 0x415e9e
jg 0x415e59
test ebx, ebx
je 0x415e9e
cmp edi, eax
jg 0x415e69
jl 0x415e63
cmp esi, ebx
jae 0x415e69
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0041f130
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x415eba
jg 0x415ea1
test esi, esi
je 0x415eba
jmp 0x415ea1
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x415eba
push eax
push esi
push 1
push edx
call fcn.004264ff
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x416450
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41648c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41648c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x416576
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4164b4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4164e7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004257bd
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x416549
sub eax, 1
je 0x416549
sub eax, 2
jne 0x416576
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004257bd
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x416566
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004264ff
add esp, 0x10
cmp edi, eax
jne 0x416576
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x416477
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c670
mov esp, ebp
pop ebp
ret 4
Function at 0x418df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44e014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x418eac
cmp byte [esi + 0x3d], 0
je 0x418eac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x418e9a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x418e62
sub eax, 1
je 0x418e66
sub eax, 2
jne 0x418e9a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x418e83
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004264ff
add esp, 0x10
cmp edi, eax
jne 0x418e9a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c670
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0041c670
mov esp, ebp
pop ebp
ret
Function at 0x419080
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b32f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x44e014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0
mov dword [ebx], 0x449494
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], esi
push esi
call fcn.0041a4f0
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.0041a240
lea eax, [ebx + 0x10]
lea ebx, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x450498]
mov dword [eax], 0
mov eax, dword [0x450494]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x14]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
cmp dword [ebx + 0x4c], 0
jne 0x41922d
push 0x40
push 0x21
push dword [ebp + 8]
call fcn.0041e0b8
add esp, 0xc
test eax, eax
je 0x41922d
push 1
push eax
mov ecx, ebx
call fcn.00418ec0
mov eax, dword [ebx + 0x34]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.0041ac60
add esp, 4
mov ecx, ebx
push eax
call fcn.00418d60
test esi, esi
je 0x419216
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x419216
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004056d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41a240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b3f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44e014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041c880
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0041dcc3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a4f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b48d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44e014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004056d0
push 8
call fcn.0041c880
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.0041dcc3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.0041a720
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x41a60d
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x41a629
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.004056d0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc