joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b5d6
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push 0x154
mov dword [esi], vtable.CInput.0
mov dword [esi + 0x14a0], edi
call fcn.00531bf4
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], edi
cmp eax, edi
je 0x47f5db
mov ecx, eax
call fcn.004048ae
jmp 0x47f5dd
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x14a4], eax
lea edi, [esi + 0x14a8]
mov ebx, 4
push 0x1c
call fcn.00531bf4
add esp, 4
mov dword [ebp - 0x54], eax
xor edx, edx
mov dword [ebp - 4], 1
cmp eax, edx
je 0x47f61a
mov ecx, eax
call fcn.00404403
xor edx, edx
jmp 0x47f61c
xor eax, eax
mov dword [edi], eax
add edi, 4
dec ebx
mov dword [ebp - 4], 0xffffffff
jne 0x47f5f5
mov dword [esi + 0x14fc], edx
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
or eax, 0xffffffff
mov dword [esi + 0x14d8], eax
mov dword [esi + 0x14dc], eax
mov dword [esi + 0x14e0], eax
mov dword [esi + 0x14e4], eax
mov dword [esi + 0x14e8], eax
mov dword [esi + 0x14ec], eax
mov dword [esi + 0x14f0], eax
mov dword [esi + 0x14f4], eax
or eax, eax
mov dword [esi + 0x14b8], eax
mov dword [esi + 0x14bc], eax
mov dword [esi + 0x14c0], eax
mov dword [esi + 0x14c4], eax
mov dword [esi + 0x14c8], eax
mov dword [esi + 0x14cc], eax
mov dword [esi + 0x14d0], eax
mov ecx, esi
mov dword [esi + 0x14d4], eax
call fcn.00403684
xor al, al
xor ecx, ecx
mov edi, edi
mov byte [ebp + ecx - 0x50], al
mov byte [ebp + ecx - 0x30], al
inc al
inc ecx
cmp al, 0x20
jb 0x47f6f0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x50]
push ecx
mov ecx, esi
call fcn.00402847
fldz
fst dword [esi + 0x148c]
mov dword [esi + 0x44], edx
fstp dword [esi + 0x1490]
mov dword [esi + 0x48], edx
fld dword [0x5bd4d8]
mov dword [esi + 0x4c], edx
fst dword [esi + 0x1494]
mov dword [esi + 0x50], edx
fstp dword [esi + 0x1498]
mov dword [esi + 0x5c], edx
fld1
mov dword [esi + 0x60], edx
fstp dword [esi + 0x149c]
mov dword [esi + 0x14f8], 0xd0c8cdcb
mov dword [esi + 0x1500], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
Function at 0x47fd40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x47fd99
cmp byte [eax], 0
je 0x47fd99
lea ecx, [ebp + 0x10]
push ecx
push eax
lea edx, [ebp - 0x220]
push 0x200
push edx
call fcn.00534bd2
mov eax, dword [esi + 4]
add esp, 0x10
test eax, eax
je 0x47fd89
mov dword [eax], 1
push 0x51010
push 0
lea eax, [ebp - 0x220]
push eax
jmp 0x47fdd4
push 0x51010
push 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x74737953
mov dword [ebp - 0x1c], 0x66206d65
mov dword [ebp - 0x18], 0x20656c69
mov dword [ebp - 0x14], 0x6e207369
mov dword [ebp - 0x10], 0x6620746f
mov dword [ebp - 0xc], 0x646e756f
mov word [ebp - 8], 0x2e
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00531be5
mov esp, ebp
pop ebp
ret
Function at 0x48dc90
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, 8
mov esi, 0x5ca0a0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
Function at 0x4933b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
je 0x4933e1
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
dec ecx
jne 0x4933d1
mov esi, dword [esp + 0x18]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x493409
add edx, eax
add esi, eax
test edi, edi
je 0x493409
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea esp, [esp]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x493400
pop edi
pop esi
pop ebx
ret

Function at 0x493410
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x20]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x49345c
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
lea esp, [esp]
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x493440
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x493485
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x493485
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x493478
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x493c80
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x59caa8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [esp + 0x68]
lea ecx, [esp + 0xb]
call fcn.00493bb0
mov ecx, dword [esp + 0x6c]
mov eax, dword [eax]
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x493d14
push 0xe
push str.CryptGenRandom
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], al
call fcn.00404791
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x64], 0
call fcn.004937a0
push 0x5f95b0
lea eax, [esp + 0x2c]
push eax
call fcn.00531c74
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00531be5
add esp, 0x5c
ret 8
Function at 0x493da0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59cb10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x30]
push ebp
mov dword [esp + 0x18], ebp
call fcn.00402031
add esp, 4
test ebp, ebp
jne 0x493de1
xor esi, esi
jmp 0x493dec
push ebp
call fcn.004932e0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], esi
push 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0
call fcn.00489a30
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
push ebp
push esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call fcn.00493c80
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
push esi
mov ecx, edi
mov byte [esp + 0x2c], 0
mov dword [esp + 0x38], vtable.CryptoPP::NonblockingRng.0
call edx
xor al, al
mov edi, esi
mov ecx, ebp
push esi
mov dword [esp + 0x28], 0xffffffff
rep stosb byte es:[edi], al
call fcn.00493190
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8

Function at 0x495c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59ccc0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
push eax
lea eax, [esp + 0x14]
mov esi, ecx
push str.IteratedHashBase:_input_data_exceeds_maximum_allowed_by_hash_function
push eax
mov dword [esp + 0x18], esi
call fcn.004042a0
add esp, 0xc
mov edi, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [esp + 0x44], 1
mov byte [ecx], 0
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidDataFormat.0
jb 0x495d38
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::HashInputTooLong.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret 4

Function at 0x4965d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x4965e0
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0xc1b630], edx
mov dword [esi*8 + 0xc1b634], eax
inc esi
cmp esi, 0x100
jl 0x4965e0
mov dword [0xc1be38], edi
mov dword [0xc1be3c], edi
mov dword [0xc1be30], edi
mov dword [0xc1be34], edi
pop edi
pop esi
mov byte [0xc1be40], 1
pop ebx
ret
Function at 0x496660
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x5d1938]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0xc1ae30], edx
mov dword [eax*8 + 0xc1ae34], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x496670
pop edi
pop esi
pop ebp
mov byte [0xc1be41], 1
pop ebx
add esp, 0x10
ret
Function at 0x4a3890
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59d5b1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
mov edi, 1
sub eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, edi
push eax
lea ecx, [esp + 0x18]
call fcn.004f6720
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
push ecx
push esi
mov dword [esp + 0x3c], edi
call fcn.004a2f20
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov edx, ecx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x20]
add edx, edx
mov byte [esp + 0x30], bl
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x4a3921
call fcn.00493180
jmp 0x4a3926
call fcn.00493190
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4a3b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d65c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], 0
lea ebp, [esi + 0x20]
mov dword [esp + 0x14], ebp
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edi, edx
xor eax, eax
push edx
mov byte [esp + 0x24], 3
rep stosd dword es:[edi], eax
call fcn.00493190
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 0xc]
xor eax, eax
mov edi, ebp
push ebp
mov byte [esp + 0x28], 2
rep stosd dword es:[edi], eax
call fcn.00493190
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov edi, edx
xor eax, eax
push edx
mov byte [esp + 0x2c], 1
rep stosd dword es:[edi], eax
call fcn.00493190
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edi, edx
xor eax, eax
push edx
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
call fcn.00493190
mov ecx, dword [esi + 4]
add esp, 0x10
mov dword [esp + 0x20], 0xffffffff
test ecx, ecx
je 0x4a3c31
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x4b07f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0490
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
xor ebx, ebx
push str.BER_decode_error
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
mov eax, 1
mov dword [esi + 0xc], eax
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov byte [esp + 0x3c], al
mov dword [esi], vtable.CryptoPP::Exception.0
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x4b089b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret

Function at 0x4b87b0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a2241
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push ecx
xor ebx, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.004f7f10
mov ecx, dword [esp + 0x3c]
push ecx
mov edi, 1
mov ecx, eax
mov dword [esp + 0x34], edi
call fcn.004f77c0
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.004f7f10
mov ecx, dword [esp + 0x1c]
mov edx, ecx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x20]
add edx, edx
mov byte [esp + 0x30], bl
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x4b8830
call fcn.00493180
jmp 0x4b8835
call fcn.00493190
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x4b8850
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a2281
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004b87b0
add esi, 0xc
push esi
mov esi, dword [esp + 0x3c]
push eax
mov edi, 1
push esi
mov dword [esp + 0x3c], edi
call fcn.004a2fb0
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x20]
xor eax, eax
mov byte [esp + 0x30], bl
mov edx, ecx
mov ebx, edi
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x4b88da
call fcn.00493180
jmp 0x4b88df
call fcn.00493190
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4ba130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a289e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x28], ebx
je 0x4ba16f
mov dword [esi + 8], 0x5ce7dc
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], ebx
call fcn.004f7e70
mov eax, dword [esi + 8]
mov dword [esi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.2.0
mov dword [esi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 8], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.0
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
mov dword [eax + esi + 4], ebx
mov dword [esi + 0x24], vtable.CryptoPP::ModExpPrecomputation.0
mov dword [esp + 0x20], ebx
mov dword [esi + 0x28], ebx
lea edi, [esi + 0x2c]
lea ecx, [edi + 4]
mov byte [esp + 0x20], 1
mov dword [esp + 0x28], edi
mov dword [edi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.004f7e70
lea ecx, [edi + 0x1c]
mov byte [esp + 0x20], 2
mov dword [edi + 0x18], ebx
call fcn.004f7e70
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x4c5fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a4051
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x2c], ebx
je 0x4c5fe0
mov dword [esi + 4], 0x5cf390
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
mov dword [esi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::EcPrecomputation_class_CryptoPP::ECP___class_CryptoPP::DL_FixedBasePrecomputationImpl_struct_CryptoPP::ECPPoint___class_CryptoPP::DL_GroupParameters_struct_CryptoPP::ECPPoint__.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::EcPrecomputation_class_CryptoPP::ECP___class_CryptoPP::DL_FixedBasePrecomputationImpl_struct_CryptoPP::ECPPoint___class_CryptoPP::DL_GroupParameters_struct_CryptoPP::ECPPoint__.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov dword [esi + eax], ebx
mov dword [esi + 0xc], vtable.CryptoPP::EcPrecomputation_class_CryptoPP::ECP_.0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea edi, [esi + 0x18]
lea ebp, [edi + 4]
mov dword [edi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_struct_CryptoPP::ECPPoint_.0
lea ecx, [ebp + 4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], ebp
mov byte [ebp], 1
call fcn.004f7e70
lea ecx, [ebp + 0x18]
mov byte [esp + 0x24], 1
call fcn.004f7e70
lea ecx, [edi + 0x34]
mov byte [esp + 0x24], 2
mov dword [edi + 0x30], ebx
call fcn.004f7e70
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4d3cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a6407
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edx, dword [esi + 0x50]
mov ebx, dword [esi + 0x54]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
mov dword [esp + 0x1c], 4
push ebx
cmp eax, 0x10
jb 0x4d3d24
call fcn.00493180
jmp 0x4d3d29
call fcn.00493190
mov edx, dword [esi + 0x3c]
mov ebx, dword [esi + 0x40]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
add esp, 4
lea ecx, [edx*4]
mov byte [esp + 0x1c], 3
push ebx
cmp ecx, 0x10
jb 0x4d3d53
call fcn.00493180
jmp 0x4d3d58
call fcn.00493190
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
add esp, 4
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x20], 2
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x24], 1
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x28], 0
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edi, edx
xor al, al
push edx
mov dword [esp + 0x2c], 0xffffffff
rep stosb byte es:[edi], al
call fcn.00493190
add esp, 0x10
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4dcf90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a73b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x1d
xor ebx, ebx
push str.Gunzip:_header_decoding_error
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 4
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::Inflator::Err.0
jb 0x4dd03b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Gunzip::HeaderErr.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret