joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4280e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x510dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5723f8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x5723f8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
or al, 0xff
mov byte [esp + 0x2d], 0xd9
xorps xmm0, xmm0
mov byte [esp + 0x2c], al
movq qword [esp + 0x2e], xmm0
jne 0x428133
xor ecx, ecx
jmp 0x428149
lea ecx, [esp + 0x2c]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428140
sub ecx, edx
push ecx
push 0
lea eax, [esp + 0x34]
mov ecx, edi
push eax
call fcn.00408830
mov esi, eax
cmp esi, 0xffffffff
je 0x42825d
lea edx, [esp + 0x2c]
lea ecx, [edx + 1]
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x428170
mov eax, dword [edi + 0x10]
sub edx, ecx
sub eax, edx
mov ecx, edi
sub eax, esi
push eax
lea eax, [edx + esi]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00406480
mov dword [esp + 0x48], 0
xor edi, edi
mov esi, dword [esp + 0x24]
nop
shl esi, 2
push esi
mov dword [esp + 0x14], esi
call fcn.004510d6
add esp, 4
mov ebx, eax
push esi
push 0
push ebx
call fcn.0045abe0
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
cmovae edx, dword [esp + 0x14]
push ebx
push eax
call fcn.00444630
add esp, 8
cmp eax, 1
je 0x428209
push ebx
test eax, eax
jne 0x4281ff
mov eax, dword [esp + 0x14]
lea esi, [eax + eax]
call fcn.0044ef7f
inc edi
add esp, 4
cmp edi, 4
jb 0x4281a0
jmp 0x42824a
call fcn.0044ef7f
add esp, 4
jmp 0x42824a
test ebx, ebx
je 0x42824a
cmp dword [esp + 0x10], 0x50
jbe 0x42824a
sub esp, 0xc
mov ecx, ebx
call fcn.00435510
mov edi, eax
add esp, 0xc
test edi, edi
je 0x42824a
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x559e90
call esi
mov ecx, edi
call fcn.00435680
mov edi, eax
test edi, edi
je 0x42824a
push 0x559ea8
call esi
call edi
cmp dword [esp + 0x28], 0x10
jb 0x42825d
push dword [esp + 0x14]
call fcn.0044ef7f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
Function at 0x429580
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
mov edx, edi
mov cx, word [eax]
cmp cx, word [edx]
jne 0x4295b9
test cx, cx
je 0x4295b5
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x4295b9
add eax, 4
add edx, 4
test cx, cx
jne 0x429593
xor eax, eax
jmp 0x4295be
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4295cd
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.004296f0
mov ecx, ebx
sub edi, ebx
jmp 0x4295e0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x4295e0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x429644
push 0x63
push str.Error_opening_file
lea eax, [esi + 0x218]
push eax
call fcn.00502f95
push 0x31
lea eax, [esi + 0x2e0]
push 0x535d6c
push eax
call fcn.00502f95
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x429663
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x63
push str.File_is_empty
jmp 0x429617
cmp ebx, 0x400000
jbe 0x42967b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x63
push str.File_too_large
jmp 0x429617
push ebx
mov dword [ebp + 8], 0
call fcn.004510d6
add esp, 4
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
push 0
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 4]
cmp dword [ebp + 8], ebx
je 0x4296c8
push edi
call fcn.004510df
add esp, 4
mov ecx, esi
call fcn.004296f0
push 0x63
push str.Could_not_read_file
jmp 0x429617
push dword [ebp + 0xc]
mov ecx, esi
push ebx
push edi
call fcn.00429400
push edi
mov bl, al
call fcn.004510df
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c1f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5112f0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5723f8]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov eax, dword [0x5723f8]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
push 0x24
push str.AlgorithmParametersBase:_parameter__
mov dword [esp + 0x14], edi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004071b0
push esi
lea edx, [esp + 0x14]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x44]
call fcn.0040d3c0
push str.__not_used
mov edx, eax
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x30]
call fcn.0040d3c0
add esp, 8
mov esi, eax
mov ecx, edi
mov byte [esp + 0x68], 2
call fcn.00452d41
mov byte [esp + 0x68], 3
lea ecx, [edi + 0x10]
push 0xffffffffffffffff
mov dword [edi], vtable.CryptoPP::Exception.0
mov dword [edi + 0xc], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00406dc0
cmp dword [esp + 0x3c], 0x10
jb 0x42c2d3
push dword [esp + 0x28]
call fcn.0044ef7f
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x42c2fb
push dword [esp + 0x40]
call fcn.0044ef7f
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x42c323
push dword [esp + 0x10]
call fcn.0044ef7f
add esp, 4
mov eax, edi
mov dword [edi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret 4
Function at 0x42eac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [0x573d40], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.Private__u_
push 0x20
push 0x573d44
call fcn.00452199
add esp, 0x10
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42eb30
push str.CShareObject_get_system_version_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push str.CShareObject_init_osver_d__d
push 0x573d88
call fcn.0042f130
add esp, 0xc
call fcn.0042eb70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431e10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x431e1b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x431ee5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
dec edi
jne 0x431e30
pop edi
test esi, esi
je 0x431f0a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5382e0]
dec esi
jne 0x431ef0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x432620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x432663
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432655
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x432674
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0045a590
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4326a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4326db
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4326d6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x432708
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4326ec
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.0045a590
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x43271c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x432713
cmp byte [esi + 8], 0
je 0x432713
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4327e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x432814
cmp byte [edi + 1], 0
je 0x43280d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x43281a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
je 0x432839
cmp byte [edi + 1], 0
je 0x432835
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x43283c
xor eax, eax
jmp 0x43283c
mov eax, dword [edi + 0x18]
push ebx
mov ebx, 0xffff
mov dword [ebp - 4], eax
cmp eax, ebx
push esi
cmovb ebx, eax
push 0x404
mov dword [ebp - 0x1c], ebx
call fcn.00451025
mov esi, eax
add esp, 4
test esi, esi
jne 0x432868
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0xc], 0
cmp ebx, eax
jbe 0x43296a
lea esp, [esp]
mov ecx, dword [ebp - 4]
add eax, 0x400
cmp eax, ebx
mov edx, eax
mov eax, 0x404
cmova edx, ebx
mov ebx, dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
sub ebx, ecx
mov dword [ebp - 0x14], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x4328ce
cmp byte [edi + 1], 0
je 0x43296a
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4328d1
mov dword [edi + 0x18], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x4328f9
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4328f4
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x10]
jmp 0x432922
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x43290c
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.0045a590
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x43296a
lea eax, [ebx - 3]
test eax, eax
jle 0x43295c
dec eax
cmp byte [eax + esi], 0x50
jne 0x43294e
cmp byte [eax + esi + 1], 0x4b
jne 0x43294e
cmp byte [eax + esi + 2], 5
jne 0x43294e
cmp byte [eax + esi + 3], 6
je 0x432954
test eax, eax
jg 0x432932
jmp 0x43295c
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jne 0x43296a
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp eax, ebx
jb 0x432880
push esi
call fcn.0044f7e4
mov eax, dword [ebp - 0xc]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x433640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x4336b8
cmp dword [esi + 4], 0xffffffff
jne 0x4336b8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
jmp 0x433670
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x433670
mov eax, dword [0x53643c]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00432580
add esp, 8
test eax, eax
jne 0x4336a2
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00432980
mov dword [esi], eax
mov eax, dword [0x57d4d0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433d90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x433e7a
movzx eax, word [ebx]
test ax, ax
je 0x433e7a
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x433dce
cmp ax, 0x5c
jne 0x433dd0
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x433dc2
cmp edi, ebx
je 0x433e1a
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.00502f95
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x433e8a
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, esi
mov word [ebp + edi - 0x20c], ax
call fcn.00433d90
lea ecx, [ebp - 0x414]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x433e22
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x433e34
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x433e50
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ed21
mov esp, ebp
pop ebp
ret
call fcn.0044fdb1
int3
Function at 0x4357c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x14], 0x10
push ebx
push edi
mov ebx, edx
jb 0x4357cf
mov ecx, dword [ecx]
push 0x55b0c8
push ecx
call fcn.00502c4b
mov edi, eax
add esp, 8
test edi, edi
je 0x43580e
push edi
push dword [ebp + 8]
push 1
push ebx
call fcn.004575ca
add esp, 0x10
push edi
cmp eax, dword [ebp + 8]
jne 0x435806
call fcn.00457dbc
add esp, 4
mov al, 1
pop edi
pop ebx
pop ebp
ret
call fcn.00457dbc
add esp, 4
pop edi
xor al, al
pop ebx
pop ebp
ret

Function at 0x435820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 8], edx
jb 0x435831
mov ecx, dword [ecx]
push edi
push 0x55b0cc
push ecx
call fcn.00502c4b
mov edi, eax
add esp, 8
test edi, edi
je 0x4358ba
push ebx
push esi
push 2
push 0
push edi
call fcn.00502cef
push edi
call fcn.005042fc
push 0
push 0
push edi
mov ebx, eax
call fcn.00502cef
lea esi, [ebx + 1]
push esi
call fcn.004510d6
push esi
push 0
push eax
mov dword [ebp - 4], eax
call fcn.0045abe0
mov esi, dword [ebp - 4]
push edi
push ebx
push 1
push esi
call fcn.00503ec0
add esp, 0x3c
push edi
cmp eax, ebx
jne 0x4358a9
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
mov dword [eax], esi
call fcn.00457dbc
add esp, 4
mov al, 1
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00457dbc
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x437a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x511cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5723f8]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x5723f8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.004378e0
add esp, 4
mov esi, eax
push 0x537148
mov edx, edi
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x30]
call fcn.00406500
add esp, 4
push esi
mov edx, eax
mov byte [esp + 0x84], 1
lea ecx, [esp + 0x18]
call fcn.00437830
add esp, 4
push str._is_not_a_valid_key_length
mov edx, eax
mov byte [esp + 0x84], 2
lea ecx, [esp + 0x48]
call fcn.0040d3c0
add esp, 4
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.00452d41
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00406dc0
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x437b71
push dword [esp + 0x44]
call fcn.0044ef7f
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x437b99
push dword [esp + 0x14]
call fcn.0044ef7f
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x437bc1
push dword [esp + 0x2c]
call fcn.0044ef7f
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x437be9
push dword [esp + 0x5c]
call fcn.0044ef7f
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0044ed21
add esp, 0x74
ret 8
Function at 0x438bc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x511e63
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5723f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [edi + 0xc], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 2
mov dword [edi + 0x14], 0
mov dword [esp + 0x28], 2
xor ecx, ecx
mov dword [edi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [edi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [edi + 0x2c], 0
call fcn.0042df70
mov dword [edi + 0x30], 0
mov dword [esp + 0x28], 3
xor ecx, ecx
mov dword [edi + 0x4c], 0
call fcn.0042df70
mov dword [edi + 0x50], 0
push ecx
mov byte [esp + 0x2c], 4
lea eax, [esp + 0x10]
push eax
mov edx, str.BlockPaddingScheme
mov dword [edi], vtable.CryptoPP::StreamTransformationFilter.1.0
lea ecx, [esp + 0x1c]
mov dword [edi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [edi + 0x54], esi
call fcn.00439750
add esp, 8
push eax
mov ecx, edi
mov byte [esp + 0x2c], 7
call fcn.004382c0
mov byte [esp + 0x28], 4
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x438c98
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10

Function at 0x439750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x511fac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5723f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.00439810
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4397de
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x4397fc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x439d10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
mov edi, esi
mov dword [esp + 0x10], edx
shr edi, 2
xor ebp, ebp
mov dword [esp + 0x14], ebx
test edi, edi
je 0x439dfb
cmp edi, 4
jb 0x439dc6
mov ecx, dword [esp + 0x28]
lea eax, [ecx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x439d59
mov eax, ecx
lea ecx, [ebx - 4]
lea ecx, [ecx + edi*4]
cmp ecx, eax
jae 0x439dca
mov ecx, eax
lea eax, [edx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x439d6d
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp eax, edx
jae 0x439dc6
mov eax, edi
mov dword [esp + 0x18], edi
and eax, 3
mov esi, ebx
sub dword [esp + 0x18], eax
sub esi, edx
sub ecx, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x2c]
mov eax, edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ebx, [ebx]
movdqu xmm1, xmmword [edx + eax]
add ebp, 4
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [ebx + eax - 0x10], xmm1
cmp ebp, ecx
jb 0x439da0
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp ebp, edi
jae 0x439dfb
mov esi, edx
lea ecx, [eax + ebp*4]
mov edx, dword [esp + 0x10]
sub ebx, eax
sub edi, ebp
mov dword [esp + 0x20], ebx
sub esi, eax
add ebp, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [ebx + ecx - 4], eax
dec edi
jne 0x439de3
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x14]
lea eax, [ebp*4]
sub esi, eax
mov dword [esp + 0x2c], esi
je 0x439ec0
mov ebp, dword [esp + 0x28]
add ebx, eax
add edx, eax
mov dword [esp + 0x14], ebx
add ebp, eax
mov dword [esp + 0x10], edx
xor edi, edi
test esi, esi
je 0x439ec0
cmp esi, 0x10
jb 0x439e9b
lea eax, [ebp - 1]
lea ecx, [ebx - 1]
add eax, esi
add ecx, esi
cmp ebx, eax
ja 0x439e41
cmp ecx, ebp
jae 0x439e9b
lea eax, [edx - 1]
add eax, esi
cmp ebx, eax
ja 0x439e4e
cmp ecx, edx
jae 0x439e9b
mov eax, esi
mov ecx, esi
mov esi, ebx
and eax, 0xf
sub esi, edx
sub ecx, eax
mov ebx, ebp
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x2c]
sub ebx, edx
mov dword [esp + 0x1c], ebx
mov eax, edx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
movdqu xmm1, xmmword [eax + edx]
add edi, 0x10
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax + ebx - 0x10], xmm1
cmp edi, ecx
jb 0x439e75
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, esi
jae 0x439ec0
sub edx, ebp
lea ecx, [edi + ebp]
sub ebx, ebp
sub esi, edi
jmp 0x439eb0
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec esi
jne 0x439eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret