joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x10b7e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0x10d577c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0x10d577c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0x10d4568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10b7e0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1ab0f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x726000]
push edi
or ebp, 0xffffffff
jmp 0x1ab0f82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1ab0f89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1ab0f78
mov eax, 1
add ebx, ebx
jne 0x1ab0f9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1ab0fac
jne 0x1ab0fcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1ab0fcb
dec eax
add ebx, ebx
jne 0x1ab0fb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1ab0f90
add ebx, ebx
jne 0x1ab0fc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1ab101d
xor ecx, ecx
sub eax, 3
jb 0x1ab0fe3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1ab1052
sar eax, 1
mov ebp, eax
jmp 0x1ab0fee
add ebx, ebx
jne 0x1ab0fee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1ab0fbc
inc ecx
add ebx, ebx
jne 0x1ab0ffc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1ab0fbc
add ebx, ebx
jne 0x1ab1009
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1ab0ffe
jne 0x1ab101a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1ab0ffe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1ab103c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1ab102e
jmp 0x1ab0f7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1ab103c
add edi, ecx
jmp 0x1ab0f7e
pop esi
mov edi, esi
mov ecx, 0x4977e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1ab105a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1ab105f
lea edi, [esi + 0xbac000]
mov eax, dword [edi]
or eax, eax
je 0x1ab10c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc2e124]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc2e250]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1ab1085
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc2e254]
or eax, eax
je 0x1ab10c1
mov dword [ebx], eax
add ebx, 4
jmp 0x1ab10a2
call dword [esi + 0xc2e264]
mov ebp, dword [esi + 0xc2e258]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1ab10fb
sub esp, 0xffffff80
jmp 0x14f006c
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x19477134
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x75243b5b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40b50d
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x48c23e
call fcn.0045a8ee
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x28], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x1d]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x1d], dl
call fcn.0041424a
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.004103c8
push ecx
mov ecx, esp
push eax
call fcn.00409d95
call fcn.0042b745
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x24], eax
je 0x40b5e2
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00409359
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004099ec
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.0040a125
call fcn.00426bfe
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor edi, edi
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
je 0x40b615
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + section..data]
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x1d]
push eax
call fcn.0041424a
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x40b5ec
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push eax
mov ecx, ebx
call fcn.0041424a
lea ecx, [ebp - 0x34]
call fcn.00455078
lea ecx, [ebp - 0x1c]
call fcn.00455078
lea ecx, [ebp + 0xc]
call fcn.00455078
mov eax, ebx
call fcn.0045a89d
ret
Function at 0x40b644
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x48c23e
call fcn.0045a8ee
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov edi, ebx
mov dword [ebp - 0x20], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x21]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x21], dl
call fcn.0041424a
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.004103c8
push ecx
mov ecx, esp
push eax
call fcn.00409d95
call fcn.0042b745
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x28], eax
je 0x40b719
push dword [ebp - 0x38]
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00409359
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004099ec
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.0040a125
call fcn.00426bfe
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
xor edi, edi
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
je 0x40b751
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + section..data]
cbw
movzx eax, ax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00414391
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x40b723
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.00414391
lea ecx, [ebp - 0x34]
call fcn.00455078
lea ecx, [ebp - 0x1c]
call fcn.00455078
lea ecx, [ebp + 0xc]
call fcn.00455078
mov eax, ebx
call fcn.0045a89d
ret
Function at 0x40d430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x58
mov eax, 0x48c432
call fcn.0045a8bb
mov ebx, ecx
cmp dword [ebp + 0x10], 1
jne 0x40d46a
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.0040a02a
mov ecx, dword [ebx + 0x50]
xor edi, edi
push 1
push eax
mov dword [ebp - 4], edi
call fcn.00416597
lea ecx, [ebp - 0x24]
jmp 0x40d52f
xor edi, edi
cmp dword [ebx + 0x64], edi
je 0x40d50b
push edi
sub esp, 0xc
mov dword [ebp - 0x64], 0x70516a51
mov ecx, esp
mov dword [ebp - 0x60], 0x67517866
lea eax, [ebp + 0x13]
mov dword [ebp - 0x5c], 0x566f6850
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x58], 0x7a5a6864
push eax
push edx
lea esi, [ebp - 0x64]
mov dword [ebp - 0x54], 0x42555242
push esi
mov dword [ebp - 0x50], 0x2f395464
mov dword [ebp - 0x4c], 0x67517a4c
mov dword [ebp - 0x48], 0x58306866
mov dword [ebp - 0x44], 0x41347847
mov dword [ebp - 0x40], 0x5a414141
call fcn.0040a169
lea eax, [ebp - 0x18]
push eax
call fcn.0040b50d
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.004103c8
mov esi, eax
push esi
call fcn.004137d0
pop ecx
push eax
push esi
lea ecx, [ebx + 0x54]
call fcn.0040d6bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00455078
push dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
push dword [ebp + 8]
call fcn.0040a02a
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebx + 0x54]
mov dword [ebp - 4], 2
call fcn.0040d5b5
lea ecx, [ebp - 0x3c]
push edi
push 1
call fcn.0040d2aa
call fcn.0045a889
ret 0xc
Function at 0x4129f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xfc
mov eax, 0x48c83e
call fcn.0045a8ee
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x412a1b
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x412a12
sub esi, ecx
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0045a578
mov edi, eax
pop ecx
test edi, edi
jne 0x412c5e
push eax
sub esp, 0xc
mov dword [ebp - 0xe8], 0x68306944
mov ecx, esp
mov dword [ebp - 0xe4], 0x6d515449
lea eax, [ebp - 0xe9]
mov dword [ebp - 0xe0], 0x72597a63
lea edx, [ebp - 0x14]
mov dword [ebp - 0xdc], 0x6d306959
push eax
push edx
lea esi, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0x6c34794c
push esi
mov dword [ebp - 0xd4], 0x6f45534a
mov dword [ebp - 0xd0], 0x7a637a5a
mov dword [ebp - 0xcc], 0x346b7a4f
mov dword [ebp - 0xc8], 0x6c4d584d
mov dword [ebp - 0xc4], 0x6b55694b
mov dword [ebp - 0xc0], 0x7177574c
mov dword [ebp - 0xbc], 0x6b63444f
mov dword [ebp - 0xb8], 0x75416a4e
mov dword [ebp - 0xb4], 0x39396e47
mov dword [ebp - 0xb0], 0x634d544a
mov dword [ebp - 0xac], 0x33516a64
mov dword [ebp - 0xa8], 0x2b414146
mov dword [ebp - 0xa4], 0x6b554145
mov dword [ebp - 0xa0], 0x6942784c
mov dword [ebp - 0x9c], 0x6359694b
mov dword [ebp - 0x98], 0x456b5242
mov dword [ebp - 0x94], 0x51636748
mov dword [ebp - 0x90], 0x4d776750
mov dword [ebp - 0x8c], 0x5151794c
mov dword [ebp - 0x88], 0x54516a62
mov dword [ebp - 0x84], 0x636f774a
mov dword [ebp - 0x80], 0x674d424b
mov dword [ebp - 0x7c], 0x39736848
mov dword [ebp - 0x78], 0x39733262
mov dword [ebp - 0x74], 0x5351794f
mov dword [ebp - 0x70], 0x4b345342
mov dword [ebp - 0x6c], 0x464d544a
mov dword [ebp - 0x68], 0x54514445
mov dword [ebp - 0x64], 0x4e6b6943
mov dword [ebp - 0x60], 0x7a38674f
mov dword [ebp - 0x5c], 0x4d77474e
mov dword [ebp - 0x58], 0x2b6f6943
mov dword [ebp - 0x54], 0x35384449
mov dword [ebp - 0x50], 0x44347a59
mov dword [ebp - 0x4c], 0x3045414c
mov dword [ebp - 0x48], 0x6967414a
mov dword [ebp - 0x44], 0x6f675347
mov dword [ebp - 0x40], 0x6e6f6866
mov dword [ebp - 0x3c], 0x2f74424d
mov dword [ebp - 0x38], 0x304a6846
mov dword [ebp - 0x34], 0x315a6a42
mov dword [ebp - 0x30], 0x7a344147
mov dword [ebp - 0x2c], 0x6e493266
mov dword [ebp - 0x28], 0x6759544d
mov dword [ebp - 0x24], 0x3138774d
mov dword [ebp - 0x20], 0x3645794c
mov dword [ebp - 0x1c], 0x41556a42
mov dword [ebp - 0x18], 0x31424141
call fcn.0040a169
lea eax, [ebp - 0x108]
push eax
call fcn.0040b50d
add esp, 0x10
and dword [ebp - 4], edi
mov ecx, eax
call fcn.004103c8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xfc]
lea eax, [ebp - 0x14]
push eax
call fcn.0045a6b3
push 0x4a0afc
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], vtable.std::runtime_error.0
push eax
call fcn.0045a826
push esi
push ebx
push edi
call fcn.0045cad0
add esp, 0xc
mov byte [esi + edi], 0
mov eax, edi
call fcn.0045a89d
ret
Function at 0x4162e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x118
mov eax, 0x48cb9b
call fcn.0045a8ee
mov edi, ecx
cmp dword [edi], 0
mov esi, dword [ebp + 8]
je 0x416306
push dword [edi]
call fcn.0045a540
pop ecx
mov al, byte [esi]
test al, al
je 0x416583
cmp al, 0x2f
je 0x416583
push 0
sub esp, 0xc
mov dword [ebp - 0x104], 0x6c4d7943
mov ecx, esp
mov dword [ebp - 0x100], 0x73514449
lea eax, [ebp - 0x105]
mov dword [ebp - 0xfc], 0x6b467a4a
lea edx, [ebp - 0x16]
mov dword [ebp - 0xf8], 0x356b7a4c
push eax
push edx
lea esi, [ebp - 0x104]
mov dword [ebp - 0xf4], 0x3145324e
push esi
mov dword [ebp - 0xf0], 0x2f51444d
mov dword [ebp - 0xec], 0x7751324d
mov dword [ebp - 0xe8], 0x2b514349
mov dword [ebp - 0xe4], 0x68776e64
mov dword [ebp - 0xe0], 0x39735345
mov dword [ebp - 0xdc], 0x37466765
mov dword [ebp - 0xd8], 0x32426842
mov dword [ebp - 0xd4], 0x6a453348
mov dword [ebp - 0xd0], 0x4151444a
mov dword [ebp - 0xcc], 0x544d6962
mov dword [ebp - 0xc8], 0x48384145
mov dword [ebp - 0xc4], 0x64385341
mov dword [ebp - 0xc0], 0x6d5a4241
mov dword [ebp - 0xbc], 0x6734484c
mov dword [ebp - 0xb8], 0x68777945
mov dword [ebp - 0xb4], 0x6b594341
mov dword [ebp - 0xb0], 0x724d4742
mov dword [ebp - 0xac], 0x4c596741
mov dword [ebp - 0xa8], 0x37306763
mov dword [ebp - 0xa4], 0x53416a65
mov dword [ebp - 0xa0], 0x476f6843
mov dword [ebp - 0x9c], 0x4959794d
mov dword [ebp - 0x98], 0x6a594345
mov dword [ebp - 0x94], 0x43636844
mov dword [ebp - 0x90], 0x4f733347
mov dword [ebp - 0x8c], 0x38516e65
mov dword [ebp - 0x88], 0x4c675349
mov dword [ebp - 0x84], 0x62556a4f
mov dword [ebp - 0x80], 0x75307865
mov dword [ebp - 0x7c], 0x74304148
mov dword [ebp - 0x78], 0x59385464
mov dword [ebp - 0x74], 0x6a596963
mov dword [ebp - 0x70], 0x44457941
mov dword [ebp - 0x6c], 0x3351694a
mov dword [ebp - 0x68], 0x6a396843
mov dword [ebp - 0x64], 0x76557843
mov dword [ebp - 0x60], 0x3170424b
mov dword [ebp - 0x5c], 0x556b5359
mov dword [ebp - 0x58], 0x3652424e
mov dword [ebp - 0x54], 0x6e4d544a
mov dword [ebp - 0x50], 0x6f497863
mov dword [ebp - 0x4c], 0x774e6943
mov dword [ebp - 0x48], 0x6d597947
mov dword [ebp - 0x44], 0x38633242
mov dword [ebp - 0x40], 0x67556963
mov dword [ebp - 0x3c], 0x48736a65
mov dword [ebp - 0x38], 0x70596a4f
mov dword [ebp - 0x34], 0x7955784a
mov dword [ebp - 0x30], 0x456b4344
mov dword [ebp - 0x2c], 0x43776762
mov dword [ebp - 0x28], 0x684d6945
mov dword [ebp - 0x24], 0x33357964
mov dword [ebp - 0x20], 0x6d384444
mov dword [ebp - 0x1c], 0x41414141
mov word [ebp - 0x18], 0x416c
call fcn.0040a169
lea eax, [ebp - 0x124]
push eax
call fcn.0040b50d
add esp, 0x10
and dword [ebp - 4], 0
mov ecx, eax
call fcn.004103c8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x118]
call fcn.0045a6b3
push 0x4a0afc
lea eax, [ebp - 0x118]
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
push eax
call fcn.0045a826
push 0xffffffffffffffff
push esi
call fcn.004129f3
pop ecx
pop ecx
mov dword [edi], eax
call fcn.0045a89d
ret 4
Function at 0x41830c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x74
mov eax, 0x48cd1f
call fcn.0045a8ee
movsd xmm0, qword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push ecx
push ecx
movsd qword [ebp - 0x78], xmm0
mov dword [ebp - 0x80], ebx
movsd qword [esp], xmm0
call fcn.00413262
pop ecx
pop ecx
test al, al
jne 0x41834f
cvttsd2si ecx, qword [ebp - 0x78]
push ecx
push esi
call fcn.004182ec
pop ecx
pop ecx
jmp 0x41845e
movsd xmm0, qword [ebp - 0x78]
lea eax, [ebp - 0x6d]
push ecx
push ecx
movsd qword [esp], xmm0
lea edx, [ebp - 0x30]
push ebx
sub esp, 0xc
mov dword [ebp - 0x6c], 0x6d395762
mov ecx, esp
mov dword [ebp - 0x68], 0x32595464
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x64], 0x78415449
mov dword [ebp - 0x60], 0x4577584c
push eax
push edx
push edi
mov dword [ebp - 0x5c], 0x66515445
mov dword [ebp - 0x58], 0x45635143
mov dword [ebp - 0x54], 0x50597a4c
mov dword [ebp - 0x50], 0x446b7a42
mov dword [ebp - 0x4c], 0x6b705447
mov dword [ebp - 0x48], 0x49594165
mov dword [ebp - 0x44], 0x39426745
mov dword [ebp - 0x40], 0x64597766
mov dword [ebp - 0x3c], 0x496f5850
mov dword [ebp - 0x38], 0x41386a65
mov dword [ebp - 0x34], 0x6b414141
call fcn.0040a169
lea eax, [ebp - 0x7c]
push eax
call fcn.0040b50d
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004103c8
push eax
lea eax, [ebp - 0x30]
push 0x20
push eax
call fcn.00459b21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
add esp, 0x14
call fcn.00455078
lea ecx, [ebp - 0x30]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418412
sub ecx, edx
lea eax, [ebp + ecx - 0x31]
cmp byte [eax], 0x30
jne 0x418453
jmp 0x41842c
cmp byte [eax], 0x30
jne 0x418433
dec eax
lea ecx, [ebp - 0x30]
cmp eax, ecx
ja 0x418426
mov edx, eax
jmp 0x418447
mov cl, byte [eax]
cmp cl, 0x2e
je 0x418450
sub cl, 0x30
cmp cl, 9
ja 0x418453
dec eax
lea ecx, [ebp - 0x30]
cmp eax, ecx
jae 0x418437
jmp 0x418453
mov byte [edx + 1], bl
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.0040a059
mov eax, esi
call fcn.0045a89d
ret