joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447460
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4474aa
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x4474d9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x44751b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x45d477
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45d4af
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045b52e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045b506
jmp 0x45d4bb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45eb69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45ebab
call fcn.00464626
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45ebab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45eba2
xor eax, eax
jmp 0x45ebb3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045ebb9
pop edi
pop esi
pop ebx
ret 4

Function at 0x464b56
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x464b84
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x464ba2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00464abc
jmp 0x464ba2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x464ba2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00464abc
test edi, edi
mov eax, edi
jne 0x464b8c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58335824
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x15143801
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x43b651
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
and edi, esi
call fcn.0043b68b
or esi, edi
sub edi, 0x4045736
push 0xc7983fea
pop esi
xor dword [edx], ebx
sub esi, edi
or edi, esi
push esi
pop edi
inc edx
sub edi, esi
cmp edx, eax
jne fcn.0043b651
inc edi
and edi, edi
ret
Function at 0x5e51fe50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e62ca23
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5e682c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.5e533a00
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CryptoPP::BaseN_Decoder.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], vtable.CryptoPP::BaseN_Decoder.1.0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.5e522860
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.5e533ac0
push 1
lea eax, [ebp + 8]
push eax
push str.DecodingLookupArray
lea ecx, [ebp - 0x24]
push ecx
call fcn.5e527260
add esp, 0x10
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 8]
push ecx
lea edx, [ebp + 0xc]
push edx
push str.Log2Base
mov ecx, dword [ebp - 0x14]
call fcn.5e5286c0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.5e53a1f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.5e51d9c0
mov byte [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5e51ff30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e62ce50
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e682c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.5e5228c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.5e51d9c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
and eax, 1
je 0x5e51ff9c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.5e5fd9d6
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5e51ffb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e62ce50
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e682c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.5e5228c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.5e51d9c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5e520470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5e682c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.5e5221f0
mov ecx, dword [ebp - 0x14]
call fcn.5e521120
mov ecx, dword [ebp - 0x14]
call fcn.5e5211e0
movzx edx, al
test edx, edx
jne 0x5e5204b1
mov ecx, dword [ebp - 0x14]
call fcn.5e521440
mov ecx, dword [ebp - 0x14]
call fcn.5e521290
movzx eax, al
test eax, eax
jne 0x5e5204c8
mov ecx, dword [ebp - 0x14]
call fcn.5e521440
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x4e]
cmp edx, 1
jne 0x5e5204ec
mov ecx, dword [ebp - 0x14]
call fcn.5e5214c0
mov ecx, dword [ebp - 0x14]
call fcn.5e5217e0
mov ecx, dword [ebp - 0x14]
call fcn.5e521910
mov byte [ebp - 0x10], 0x5b
mov byte [ebp - 0xf], 0x2a
mov byte [ebp - 0xe], 0x5d
mov byte [ebp - 0xd], 0x20
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.5e520630
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.5e5fd9c7
mov esp, ebp
pop ebp
ret 4
Function at 0x5e538370
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, edx
push 0
mov dword [esp + 0x18], ebx
mov esi, ecx
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e5383ae
test ecx, ecx
je 0x5e53839f
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e53839f
and edx, esi
jmp 0x5e5383a5
mov eax, esi
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x5e5383dd
push 0
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e5383e6
test ecx, ecx
je 0x5e5383ce
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e5383ce
and edx, ebx
jmp 0x5e5383d4
mov eax, ebx
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x5e5383e6
mov edi, dword [esp + 0x1c]
jmp 0x5e53847a
mov edi, dword [esp + 0x1c]
mov edx, edi
shr edx, 2
xor ebp, ebp
test edx, edx
je 0x5e53846f
cmp edx, 4
jb 0x5e53844f
lea eax, [ebx - 4]
lea ecx, [esi - 4]
lea eax, [eax + edx*4]
lea ecx, [ecx + edx*4]
cmp esi, eax
ja 0x5e53840e
cmp ecx, ebx
jae 0x5e53844f
mov eax, edx
and eax, 3
mov ecx, edx
mov edi, ebx
sub ecx, eax
sub edi, esi
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov eax, esi
lea esp, [esp]
movdqu xmm1, xmmword [ebx + eax]
movdqu xmm0, xmmword [eax]
add ebp, 4
pxor xmm1, xmm0
movdqu xmmword [eax], xmm1
lea eax, [eax + 0x10]
cmp ebp, ecx
jb 0x5e538430
mov ebx, dword [esp + 0x14]
cmp ebp, edx
jae 0x5e53846f
mov edi, ebx
sub edx, ebp
lea ecx, [esi + ebp*4]
sub edi, esi
add ebp, edx
mov edi, edi
mov eax, dword [ecx + edi]
xor dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x5e538460
mov edi, dword [esp + 0x1c]
shl ebp, 2
sub edi, ebp
je 0x5e53848b
add esi, ebp
add ebx, ebp
test edi, edi
je 0x5e53848b
sub ebx, esi
mov al, byte [esi + ebx]
xor byte [esi], al
lea esi, [esi + 1]
dec edi
jne 0x5e538480
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x5e5384a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, edx
push 0
mov dword [esp + 0x18], ebx
mov ebp, ecx
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e5384dd
test ecx, ecx
je 0x5e5384ce
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e5384ce
and edx, ebp
jmp 0x5e5384d4
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x5e53850c
push 0
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e538519
test ecx, ecx
je 0x5e5384fd
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e5384fd
and edx, ebx
jmp 0x5e538503
mov eax, ebx
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x5e538519
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
jmp 0x5e53864a
push 0
call fcn.5e527be0
mov ecx, dword [esp + 0x28]
mov esi, eax
add esp, 4
cmp esi, 1
je 0x5e538555
test esi, esi
je 0x5e53853d
lea edx, [esi - 1]
test esi, edx
jne 0x5e53853d
and edx, ecx
jmp 0x5e538543
mov eax, ecx
xor edx, edx
div esi
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x5e538555
mov edx, dword [esp + 0x28]
jmp 0x5e53864a
mov edx, dword [esp + 0x28]
push edi
mov edi, edx
xor esi, esi
shr edi, 2
mov dword [esp + 0x10], esi
test edi, edi
je 0x5e53863c
cmp edi, 4
jb 0x5e5385fa
lea eax, [ecx - 4]
mov dword [esp + 0x10], esi
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x5e53858e
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ecx
jae 0x5e5385fa
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x5e5385a2
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ebx
jae 0x5e5385fa
mov esi, ebp
sub esi, ebx
mov dword [esp + 0x1c], esi
mov eax, edi
and eax, 3
mov dword [esp + 0x14], edi
sub dword [esp + 0x14], eax
mov esi, ecx
sub esi, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov eax, ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [ecx]
movdqu xmm1, xmmword [edx + eax]
movdqu xmm0, xmmword [eax]
add esi, 4
pxor xmm1, xmm0
movdqu xmmword [ebx + eax], xmm1
lea eax, [eax + 0x10]
cmp esi, dword [esp + 0x14]
jb 0x5e5385d0
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
cmp esi, edi
jae 0x5e53863c
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
sub ebx, ecx
sub edi, eax
add eax, edi
mov dword [esp + 0x20], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
lea esi, [ecx + esi*4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + esi]
xor eax, dword [esi]
lea esi, [esi + 4]
mov dword [ebx + esi - 4], eax
dec edi
jne 0x5e538621
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
shl esi, 2
pop edi
sub edx, esi
je 0x5e538661
add ebp, esi
add ebx, esi
add ecx, esi
test edx, edx
je 0x5e538661
sub ebx, ecx
sub ebp, ecx
mov al, byte [ecx + ebx]
xor al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebp - 1], al
dec edx
jne 0x5e538652
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5e538670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0
mov esi, edx
mov ebp, ecx
xor bl, bl
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e5386ab
test ecx, ecx
je 0x5e53869c
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e53869c
and edx, ebp
jmp 0x5e5386a2
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x5e5386da
push 0
call fcn.5e527be0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x5e5386e0
test ecx, ecx
je 0x5e5386cb
lea edx, [ecx - 1]
test ecx, edx
jne 0x5e5386cb
and edx, esi
jmp 0x5e5386d1
mov eax, esi
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x5e5386e0
mov ecx, dword [esp + 0x18]
jmp 0x5e53874a
mov ecx, dword [esp + 0x18]
push edi
mov edi, ecx
xor ebx, ebx
shr edi, 2
xor eax, eax
mov dword [esp + 0x10], ebx
test edi, edi
je 0x5e538719
mov ecx, ebp
mov edx, esi
sub ecx, esi
mov dword [esp + 0x14], edi
mov eax, dword [ecx + edx]
xor eax, dword [edx]
lea edx, [edx + 4]
or ebx, eax
dec edi
jne 0x5e538700
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
shl eax, 2
pop edi
sub ecx, eax
jne 0x5e53872f
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
add ebp, eax
add esi, eax
shr ebx, 0x18
mov eax, edx
shr eax, 0x10
or bl, al
mov eax, edx
shr eax, 8
or bl, al
or bl, dl
test ecx, ecx
je 0x5e53875d
sub ebp, esi
mov al, byte [esi + ebp]
xor al, byte [esi]
lea esi, [esi + 1]
or bl, al
dec ecx
jne 0x5e538750
pop esi
xor eax, eax
test bl, bl
pop ebp
sete al
pop ebx
add esp, 8
ret

Function at 0x5e53b800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e62f510
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5e682c80]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.5e51ed10
mov ecx, dword [ebp + 8]
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], vtable.CryptoPP::BERGeneralDecoder.0
mov dword [esp + 0x10], vtable.CryptoPP::BERGeneralDecoder.1.0
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 0
mov eax, dword [ecx]
lea edx, [esp + 0xb]
push edx
call dword [eax + 0x48]
test eax, eax
je 0x5e53b892
cmp byte [esp + 0xb], 0x30
jne 0x5e53b892
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x25]
push eax
lea edx, [esp + 0x30]
call fcn.5e538be0
add esp, 4
test al, al
jne 0x5e53b897
call fcn.5e538a30
mov dword [esp + 0xc], vtable.CryptoPP::BERSequenceDecoder.0
mov dword [esp + 0x10], vtable.CryptoPP::BERSequenceDecoder.1.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 1
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
lea ecx, [esp + 0xc]
call fcn.5e539240
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.5e5391c0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.5e5fd9c7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e53b910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e62f588
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5e682c80]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.5e558be0
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x3000
mov dword [esp + 8], vtable.CryptoPP::DERSequenceEncoder.0
mov dword [esp + 0xc], vtable.CryptoPP::DERSequenceEncoder.1.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 0
mov eax, dword [ecx]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
lea ecx, [esp + 8]
call fcn.5e539440
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.5e5393c0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.5e5fd9c7
mov esp, ebp
pop ebp
ret 4

Function at 0x5e53cad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e62f750
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x30]
push edi
lea ecx, [esp + 0x14]
call fcn.5e522860
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.5e522910
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.5e51fa20
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
push edi
push esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call fcn.5e53ca30
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
call fcn.5e51de30
mov esi, dword [ebx]
push edi
lea ecx, [esp + 0x14]
call fcn.5e522910
push eax
mov ecx, ebx
call dword [esi + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.5e5228c0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x5e53dd40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e62fdd1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.5e54a2e0
push dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.5e54b640
mov ecx, dword [esp + 0x30]
push eax
call fcn.5e54a2e0
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.5e51fb50
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 8

Function at 0x5e53de60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5e62fdd1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0x10]
push eax
call fcn.5e53dd40
lea ecx, [esi + 0xc]
mov dword [esp + 0x28], 1
push ecx
mov ecx, dword [esp + 0x34]
mov edx, eax
call fcn.5e53ade0
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.5e51fb50
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x5e53e210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e62fbf8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.5e51ed10
push 0
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [esp + 0x48]
lea ecx, [esp + 0x24]
mov dword [esi], vtable.CryptoPP::StringStore.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.1.0
call fcn.5e51ee80
push 1
push eax
lea eax, [esp + 0x14]
push str.InputBuffer
push eax
mov byte [esp + 0x48], 1
call fcn.5e527120
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x3c], 2
call fcn.5e535600
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.5e51f710
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.5e51f6f0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x5e54adf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e62fdf8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5e682c80]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.5e558be0
mov eax, dword [ebp + 8]
mov dword [esp + 8], vtable.CryptoPP::DERGeneralEncoder.0
mov dword [esp + 0xc], vtable.CryptoPP::DERGeneralEncoder.1.0
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x200
push 1
sub esp, 8
mov ecx, esi
mov dword [esp + 0x54], 0
call fcn.5e54aae0
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.5e54ace0
lea ecx, [esp + 8]
call fcn.5e539440
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.5e5393c0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.5e5fd9c7
mov esp, ebp
pop ebp
ret 4

Function at 0x5e54deb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e630399
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5e682c80]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.5e51fa20
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.CryptoPP::RandomPool.0
mov byte [esi + 0x29], 0
mov dword [esi + 0x30], 0x20
cmp byte [esi + 0x29], 0
jne 0x5e54df0d
lea ecx, [esi + 8]
mov byte [esi + 0x29], 1
call fcn.5e525bc0
jmp 0x5e54df19
push 0
push 0x20
lea ecx, [esi + 0x28]
call fcn.5e51f410
mov dword [esi + 0x34], eax
mov byte [esp + 0x1c], 1
mov byte [esi + 0x49], 0
mov dword [esi + 0x50], 0x10
cmp byte [esi + 0x49], 0
jne 0x5e54df40
lea ecx, [esi + 0x38]
mov byte [esi + 0x49], 1
call fcn.5e525bc0
jmp 0x5e54df4c
push 0
push 0x10
lea ecx, [esi + 0x48]
call fcn.5e51f410
mov dword [esi + 0x54], eax
push 0x120
mov byte [esp + 0x20], 2
call fcn.5e5fd9db
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 3
test eax, eax
je 0x5e54df77
mov ecx, eax
call fcn.5e531cc0
jmp 0x5e54df79
xor eax, eax
mov dword [esi + 0x58], eax
push dword [esi + 0x30]
mov byte [esi + 0x5c], 0
push 0
push dword [esi + 0x34]
call fcn.5e601f40
push dword [esi + 0x50]
push 0
push dword [esi + 0x54]
call fcn.5e601f40
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret