joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x111c
call fcn.0045a570
mov eax, dword [0x48f4c8]
xor eax, esp
mov dword [esp + 0x1118], eax
push ebx
push ebp
push esi
push edi
push str.GlobalSave.sav
lea eax, [esp + 0x12c]
push str.Save_s
push eax
call fcn.0045a6e7
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x140]
push ecx
call dword [0x47d1f4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41f06d
mov ecx, 0xb
mov esi, str.1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik_9ol.0p____:__
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x51
lea edx, [esp + 0x5b]
push 0
push edx
movsb byte es:[edi], byte [esi]
call fcn.0045a5c0
lea eax, [esp + 0x34]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41ef30
mov esi, dword [0x47d0c8]
push 0x1e8480
sub eax, edx
push 2
mov dword [esp + 0x28], eax
mov byte [esp + 0x1b], cl
call esi
mov ebp, eax
test ebp, ebp
jne 0x41ef6c
push 0x47f460
call fcn.00408cb0
add esp, 4
xor eax, eax
jmp 0x41f072
push 0x1e8480
push 2
call esi
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x41ef91
push 0x47f438
call fcn.00408cb0
add esp, 4
xor eax, eax
jmp 0x41f072
mov esi, dword [0x47d0c4]
push ebp
call esi
mov edi, eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov esi, dword [0x47d1c4]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x80
lea edx, [esp + 0xb4]
push edx
push ebx
mov dword [esp + 0x38], eax
call esi
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push ebx
call esi
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push edi
push ebx
call esi
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push ebx
call esi
push ebx
call dword [0x47d1f8]
movsx eax, byte [esp + 0x13]
push eax
call fcn.0045a63a
mov eax, dword [esp + 0x1c]
add esp, 4
xor esi, esi
test eax, eax
jle 0x41f032
call fcn.0045a647
cdq
idiv dword [esp + 0x20]
add esi, 1
mov cl, byte [esp + edx + 0x28]
xor byte [esi + edi - 1], cl
mov eax, dword [esp + 0x18]
cmp esi, eax
jl 0x41f015
mov esi, dword [esp + 0x24]
push eax
push edi
push esi
call fcn.00404cc0
push 0x10b034
push esi
push 0xca9848
call fcn.004014b0
mov esi, dword [0x47d0c0]
add esp, 0x18
push ebp
call esi
mov edi, dword [esp + 0x1c]
push edi
call esi
mov esi, dword [0x47d0bc]
push ebp
call esi
push edi
call esi
mov eax, 1
mov ecx, dword [esp + 0x1128]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045a554
add esp, 0x111c
ret
Function at 0x452860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47bbce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48f4c8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
lea ebx, [esi + 0x7c]
push ebx
push ecx
push edx
mov ecx, esi
call fcn.004578a0
mov ebp, dword [esp + 0x34]
xor edi, edi
push ebp
push edi
lea ecx, [esi + 0x54]
mov dword [esp + 0x28], edi
mov dword [esi], vtable.CBaseRenderer.0
mov dword [esi + 0xc], vtable.CBaseRenderer.2.0
mov dword [esi + 0x10], vtable.CBaseRenderer.1.0
mov dword [esi + 0x50], edi
call fcn.004579a0
push ebp
push 1
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 1
call fcn.004579a0
push ebp
lea ecx, [esi + 0x5c]
push 1
mov byte [esp + 0x28], 2
call fcn.004579a0
push ebx
mov ebx, dword [0x47d214]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call ebx
lea eax, [esi + 0x94]
push eax
call ebx
lea ecx, [esi + 0xc4]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], 1
push ecx
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
call ebx
cmp dword [ebp], edi
jl 0x452957
mov edx, dword [esi + 0x5c]
push edx
call dword [0x47d0a0]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x477ec0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x477f60
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x477f12
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x497404]
xor eax, edx
inc esi
cmp esi, edi
jl 0x477ef3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x477f3b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x497404]
xor eax, edx
inc esi
cmp esi, edi
jl 0x477f1e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x1000b2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100132f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10024330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0x163
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0x163
call dword [sym.imp.mfc140.dll_Ordinal_5095]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x10019e84
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b362
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc140.dll_Ordinal_12503]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c7a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10019eb0
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c7e0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10019f10
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c840
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10019f68
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c8a0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10024330]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0
push str.AppEventsSchemesAppsExplorerNavigating.Current
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000ca17
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c9f3
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f7bb
mov esp, ebp
pop ebp
ret
Function at 0x402490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5163b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x559410]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x559410]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push 0
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0xc]
push 0x55ac54
push edx
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x18], vtable.CryptoPP::ArraySink.0
movlpd qword [esp + 0x2c], xmm0
call dword [eax + 0x28]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00453c72
mov esp, ebp
pop ebp
ret 8

Function at 0x405600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x516908
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x559410]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x559410]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.00405440
add esp, 4
mov esi, eax
push 0x53cd80
lea eax, [esp + 0x30]
mov dword [esp + 0x84], 0
push edi
push eax
call fcn.00405a00
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x88], 1
push eax
call fcn.00404c80
add esp, 0xc
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x88], 2
push eax
call fcn.00405fc0
add esp, 0xc
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.00453b1b
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00406350
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x405701
push dword [esp + 0x44]
call fcn.00406890
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x405729
push dword [esp + 0x14]
call fcn.00406890
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x405751
push dword [esp + 0x2c]
call fcn.00406890
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x405779
push dword [esp + 0x5c]
call fcn.00406890
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00453c72
add esp, 0x74
ret 8
Function at 0x406510
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
mov edi, esi
mov dword [esp + 0x10], edx
shr edi, 2
xor ebp, ebp
mov dword [esp + 0x14], ebx
test edi, edi
je 0x4065fb
cmp edi, 4
jb 0x4065c6
mov ecx, dword [esp + 0x28]
lea eax, [ecx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x406559
mov eax, ecx
lea ecx, [ebx - 4]
lea ecx, [ecx + edi*4]
cmp ecx, eax
jae 0x4065ca
mov ecx, eax
lea eax, [edx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x40656d
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp eax, edx
jae 0x4065c6
mov eax, edi
mov dword [esp + 0x18], edi
and eax, 3
mov esi, ebx
sub dword [esp + 0x18], eax
sub esi, edx
sub ecx, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x2c]
mov eax, edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ebx, [ebx]
movdqu xmm1, xmmword [edx + eax]
add ebp, 4
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [ebx + eax - 0x10], xmm1
cmp ebp, ecx
jb 0x4065a0
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp ebp, edi
jae 0x4065fb
mov esi, edx
lea ecx, [eax + ebp*4]
mov edx, dword [esp + 0x10]
sub ebx, eax
sub edi, ebp
mov dword [esp + 0x20], ebx
sub esi, eax
add ebp, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [ebx + ecx - 4], eax
dec edi
jne 0x4065e3
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x14]
lea eax, [ebp*4]
sub esi, eax
mov dword [esp + 0x2c], esi
je 0x4066c0
mov ebp, dword [esp + 0x28]
add ebx, eax
add edx, eax
mov dword [esp + 0x14], ebx
add ebp, eax
mov dword [esp + 0x10], edx
xor edi, edi
test esi, esi
je 0x4066c0
cmp esi, 0x10
jb 0x40669b
lea eax, [ebp - 1]
lea ecx, [ebx - 1]
add eax, esi
add ecx, esi
cmp ebx, eax
ja 0x406641
cmp ecx, ebp
jae 0x40669b
lea eax, [edx - 1]
add eax, esi
cmp ebx, eax
ja 0x40664e
cmp ecx, edx
jae 0x40669b
mov eax, esi
mov ecx, esi
mov esi, ebx
and eax, 0xf
sub esi, edx
sub ecx, eax
mov ebx, ebp
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x2c]
sub ebx, edx
mov dword [esp + 0x1c], ebx
mov eax, edx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
movdqu xmm1, xmmword [eax + edx]
add edi, 0x10
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax + ebx - 0x10], xmm1
cmp edi, ecx
jb 0x406675
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, esi
jae 0x4066c0
sub edx, ebp
lea ecx, [edi + ebp]
sub ebx, ebp
sub esi, edi
jmp 0x4066b0
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec esi
jne 0x4066b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, esi
xor eax, eax
shr edi, 2
mov ebp, ecx
test edi, edi
je 0x406708
mov esi, ebp
mov dword [esp + 0x10], edi
mov ecx, edx
sub esi, edx
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
dec edi
jne 0x4066f2
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x40671c
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add edx, eax
mov ecx, ebx
mov eax, ebx
shr ecx, 0x18
shr eax, 0x10
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or cl, bl
test esi, esi
je 0x40674e
sub ebp, edx
jmp 0x406740
mov al, byte [edx + ebp]
lea edx, [edx + 1]
xor al, byte [edx - 1]
or cl, al
dec esi
jne 0x406740
pop edi
xor eax, eax
test cl, cl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x407860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x516ae3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x559410]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x559410]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x64]
mov dword [esi + 0xc], eax
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], 0
mov dword [esp + 0x5c], 2
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
push 0
mov dword [esi + 0x2c], 0
call fcn.00403a30
mov dword [esi + 0x30], 0
mov dword [esp + 0x60], 3
push 0
mov dword [esi + 0x4c], 0
call fcn.00403a30
add esp, 8
mov dword [esi + 0x50], 0
cmp byte [esp + 0x70], 0
mov byte [esp + 0x5c], 4
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 0x54], edi
jne 0x4079bf
push 0
push 0x55f6b4
push 0x55f688
push 0
push edi
call fcn.00514d1e
add esp, 0x14
test eax, eax
je 0x4079bf
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00405b80
lea ecx, [esp + 0x28]
mov byte [esp + 0x5c], 5
call fcn.00453b1b
push 0xffffffffffffffff
mov byte [esp + 0x60], 6
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], vtable.CryptoPP::Exception.0
mov dword [esp + 0x40], 1
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
call fcn.00406350
push 0x555db4
lea eax, [esp + 0x2c]
mov byte [esp + 0x60], 5
push eax
mov dword [esp + 0x30], vtable.CryptoPP::InvalidArgument.0
call fcn.00453c81
push ecx
lea eax, [esp + 0x70]
mov edx, str.BlockPaddingScheme
push eax
lea ecx, [esp + 0x18]
call fcn.004084d0
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x60], 7
call fcn.00406f60
mov byte [esp + 0x5c], 4
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4079f6
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00453c72
add esp, 0x54
ret 0x10
Function at 0x4084d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x516c3c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x559410]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.004085f0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40855e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x40857c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x4096b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx esi, byte [eax + 0x53db30]
mov edx, esi
mov ecx, esi
shr edx, 7
imul edi, edx, 0x1b000000
shl ecx, 0x19
imul edx, edx, 0x11b
xor edi, ecx
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or edi, ecx
lea ecx, [esi + esi]
xor edx, ecx
xor ecx, ecx
xor edx, esi
or ecx, edi
or edx, edi
mov dword [eax*8 + 0x569990], ecx
mov dword [eax*8 + 0x569994], edx
inc eax
cmp eax, 0x100
jl 0x4096b4
xorps xmm0, xmm0
pop edi
movlpd qword [0x56a198], xmm0
movlpd qword [0x56a190], xmm0
mov byte [0x569985], 1
pop esi
ret
Function at 0x409720
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
lea ecx, [ecx]
movzx edi, byte [edx + 0x53da30]
mov eax, edi
mov dword [esp + 0x10], edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [esp + 0x14], eax
and ebx, 2
shr edi, 7
and edx, 4
imul eax, edi, 0x1b000000
lea ebp, [ecx + ecx]
mov dword [esp + 0x18], edx
xor ebp, dword [esp + 0x10]
mov edx, esi
shl ebp, 0x19
and esi, 1
shl ecx, 2
and edx, 2
xor ebp, eax
xor ecx, dword [esp + 0x10]
imul eax, dword [esp + 0x14], 0x1b000000
shl ecx, 8
xor ebp, eax
imul eax, ebx, 0x1b000000
xor ebp, eax
imul eax, esi, 0x1b000000
xor ebp, eax
imul eax, edx, 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x18], 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x14], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
mov esi, dword [esp + 0x18]
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [esp + 0x10]
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*8]
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b0000
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, esi, 0x11b0000
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*4]
xor ecx, eax
imul eax, edi, 0x11b
add ecx, ecx
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
xor ecx, eax
imul eax, esi, 0x11b
xor ecx, eax
xor eax, eax
xor ecx, edx
or edx, ebp
or ecx, ebp
or eax, edx
mov edx, dword [esp + 0x1c]
mov dword [edx*8 + 0x56a1c0], eax
mov dword [edx*8 + 0x56a1c4], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x409730
pop edi
pop esi
pop ebp
mov byte [0x569984], 1
pop ebx
add esp, 0x10
ret
Function at 0x40d820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x516ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x559410]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x559410]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x37
push str.BufferedTransformation:_this_object_doesnt_allow_input
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00405b80
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00453b1b
mov byte [esp + 0x38], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x14]
mov dword [esi + 0xc], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00406350
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x40d8dc
push dword [esp + 0x10]
call fcn.00406890
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00453c72
mov esp, ebp
pop ebp
ret
Function at 0x419aa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [edi + 0x210], 1
xor esi, esi
mov eax, dword fs:[esi + 0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 4], ecx
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0x30]
mov dword [edi + 0x208], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x20c], eax
mov eax, edi
mov edx, dword [esi + 0x28]
mov dword [esi + 0x30], str.explorer.exe
mov dword [esi + 0x2c], 0x1a0018
movzx ecx, word [edx]
lea edx, [edx + 2]
mov word [eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x419af0
push str.explorer.exe
lea eax, [esi + 0x24]
push edi
push eax
call fcn.00419b50
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret