joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b960
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push 1
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0041bea0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b9ef
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x41ba0d
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x41bb60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push 1
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0041c020
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41bbef
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x41bc0d
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x41bc30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0041c1a0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41bcbe
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x41bcdc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x41c8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49de50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.HashVerificationFilter:_message_hash_or_MAC_not_valid
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.0040aff0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00467706
lea eax, [esp + 0xc]
mov byte [esp + 0x30], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 3
call fcn.00409a60
lea ecx, [esp + 0xc]
call fcn.0040b150
mov dword [esi], vtable.CryptoPP::HashVerificationFilter::HashVerificationFailed.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004654b1
add esp, 0x2c
ret
Function at 0x41d010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49ded3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x70]
mov dword [esi + 0xc], eax
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], 0
mov eax, dword [esp + 0x64]
xor ecx, ecx
mov dword [esp + 0x5c], 3
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x2c], 0
call fcn.0041b700
mov dword [esi + 0x30], 0
mov byte [esp + 0x5c], 4
cmp dword [esi + 0x1c], 1
jb 0x41d0d0
push dword [esi + 0x18]
lea ecx, [esi + 0x28]
push 1
call fcn.0041cdc0
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004654b1
add esp, 0x54
ret 0x10
push str.FilterWithBufferedInput:_invalid_buffer_size
lea ecx, [esp + 0x3c]
call fcn.0040aff0
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 5
call fcn.00467706
lea eax, [esp + 0x38]
mov byte [esp + 0x5c], 6
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], vtable.CryptoPP::Exception.0
mov dword [esp + 0x20], 1
call fcn.00409a60
push 0x4c9cec
lea eax, [esp + 0x14]
mov byte [esp + 0x60], 5
push eax
mov dword [esp + 0x18], vtable.CryptoPP::InvalidArgument.0
call fcn.004654c0
int3
Function at 0x41db70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49e093
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x68]
mov dword [edi + 0xc], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 4
mov dword [edi + 0x14], 0
mov dword [esp + 0x60], 3
xor ecx, ecx
mov dword [edi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [edi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [edi + 0x2c], 0
call fcn.0041b700
mov dword [edi + 0x30], 0
mov dword [esp + 0x60], 4
xor ecx, ecx
mov dword [edi + 0x4c], 0
call fcn.0041b700
mov dword [edi + 0x50], 0
push 0
push 0x4cfacc
push 0x4cf5fc
mov byte [esp + 0x6c], 5
push 0
push esi
mov dword [edi], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [edi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [edi + 0x54], esi
call fcn.0049bcca
add esp, 0x14
test eax, eax
je 0x41dc92
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x18]
call fcn.0040aff0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 6
call fcn.00467706
lea eax, [esp + 0x14]
mov byte [esp + 0x60], 7
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], vtable.CryptoPP::Exception.0
mov dword [esp + 0x3c], 1
call fcn.00409a60
push 0x4c9cec
lea eax, [esp + 0x30]
mov byte [esp + 0x64], 6
push eax
mov dword [esp + 0x34], vtable.CryptoPP::InvalidArgument.0
call fcn.004654c0
push ecx
lea eax, [esp + 0x10]
mov edx, str.BlockPaddingScheme
push eax
lea ecx, [esp + 0x1c]
call fcn.0041ecb0
add esp, 8
push eax
mov ecx, edi
mov byte [esp + 0x64], 8
call fcn.0041d130
mov byte [esp + 0x60], 5
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x41dcc9
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004654b1
add esp, 0x58
ret 0x10
Function at 0x41e850
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49e1e3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0xc], 0
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esi + 0x14], 0
mov dword [esp + 0x28], 3
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 0x2c], 0
call fcn.0041b700
mov dword [esi + 0x30], 0
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x28], 4
mov dword [esi], vtable.CryptoPP::HashVerificationFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::HashVerificationFilter.0
mov dword [esi + 0x44], eax
mov dword [esi + 0x58], 0
call fcn.0041b700
mov dword [esi + 0x5c], 0
push ecx
lea eax, [esp + 0x10]
mov byte [esp + 0x2c], 5
push eax
mov edx, str.HashVerificationFilterFlags
lea ecx, [esp + 0x1c]
call fcn.0041edb0
add esp, 8
mov ecx, eax
mov byte [esp + 0x28], 6
movzx eax, byte [ecx + 8]
push eax
lea eax, [esp + 0xc]
push eax
push str.TruncatedDigestSize
call fcn.0041bf60
push eax
mov ecx, esi
call fcn.0041d130
mov byte [esp + 0x28], 5
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x41e945
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0x10

Function at 0x41ecb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0041ef10
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41ed3e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x41ed5c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x41edb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0041efd0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41ee3e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x41ee5c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x4217e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49e6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.00421700
add esp, 4
mov esi, eax
push 0x4b4300
mov edx, edi
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x30]
call fcn.0041f640
add esp, 4
push esi
mov edx, eax
mov byte [esp + 0x84], 1
lea ecx, [esp + 0x18]
call fcn.0041b8d0
add esp, 4
push str._is_not_a_valid_key_length
mov edx, eax
mov byte [esp + 0x84], 2
lea ecx, [esp + 0x48]
call fcn.0041b8a0
add esp, 4
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.00467706
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push esi
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
call fcn.00409a60
lea ecx, [esp + 0x44]
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
call fcn.0040b150
lea ecx, [esp + 0x14]
call fcn.0040b150
lea ecx, [esp + 0x2c]
call fcn.0040b150
lea ecx, [esp + 0x5c]
call fcn.0040b150
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004654b1
add esp, 0x74
ret 8
Function at 0x421b50
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, esi
xor eax, eax
shr edi, 2
mov ebp, ecx
test edi, edi
je 0x421b88
mov esi, ebp
mov dword [esp + 0x10], edi
mov ecx, edx
sub esi, edx
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
dec edi
jne 0x421b72
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x421b9c
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add edx, eax
mov ecx, ebx
mov eax, ebx
shr ecx, 0x18
shr eax, 0x10
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or cl, bl
test esi, esi
je 0x421bce
sub ebp, edx
jmp 0x421bc0
mov al, byte [edx + ebp]
lea edx, [edx + 1]
xor al, byte [edx - 1]
or cl, al
dec esi
jne 0x421bc0
pop edi
xor eax, eax
test cl, cl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret

Function at 0x421e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49de50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.DefaultDecryptor:_cannot_decrypt_message_with_this_passphrase
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.0040aff0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00467706
lea eax, [esp + 0xc]
mov byte [esp + 0x30], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 3
call fcn.00409a60
lea ecx, [esp + 0xc]
mov dword [esi], vtable.CryptoPP::DefaultDecryptor::Err.0
call fcn.0040b150
mov dword [esi], vtable.CryptoPP::DefaultDecryptor::KeyBadErr.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004654b1
add esp, 0x2c
ret

Function at 0x421ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49de50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.DefaultDecryptorWithMAC:_MAC_check_failed
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.0040aff0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00467706
lea eax, [esp + 0xc]
mov byte [esp + 0x30], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 3
call fcn.00409a60
lea ecx, [esp + 0xc]
mov dword [esi], vtable.CryptoPP::DefaultDecryptor::Err.0
call fcn.0040b150
mov dword [esi], vtable.CryptoPP::DefaultDecryptorWithMAC::MACBadErr.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004654b1
add esp, 0x2c
ret
Function at 0x423fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49de50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.FileStore:_error_reading_file
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.0040aff0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00467706
lea eax, [esp + 0xc]
mov byte [esp + 0x30], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 5
call fcn.00409a60
lea ecx, [esp + 0xc]
mov dword [esi], vtable.CryptoPP::FileStore::Err.0
call fcn.0040b150
mov dword [esi], vtable.CryptoPP::FileStore::ReadErr.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004654b1
add esp, 0x2c
ret

Function at 0x424120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49de50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc1c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.FileSink:_error_writing_file
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.0040aff0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00467706
lea eax, [esp + 0xc]
mov byte [esp + 0x30], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 5
call fcn.00409a60
lea ecx, [esp + 0xc]
mov dword [esi], vtable.CryptoPP::FileSink::Err.0
call fcn.0040b150
mov dword [esi], vtable.CryptoPP::FileSink::WriteErr.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004654b1
add esp, 0x2c
ret
Function at 0x425330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49ec98
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a740
and eax, 0xfffffffe
push 0
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a320
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.00406e10
mov dword [esp + 0x38], 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a740
test al, 6
jne 0x4253f5
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00407100
movdqu xmm0, xmmword [esp + 0x40]
push 1
sub esp, 0x18
mov edx, dword [eax]
mov ecx, esp
movdqu xmmword [ecx], xmm0
movq xmm0, qword [esp + 0x6c]
movq qword [ecx + 0x10], xmm0
lea ecx, [esp + 0x30]
push ecx
mov ecx, eax
call dword [edx + 0x2c]
lea ecx, [esp + 0x14]
call fcn.00403980
cmp eax, dword [0x4a2bb8]
jne 0x4253f5
cmp edx, dword [0x4a2bbc]
jne 0x4253f5
mov eax, dword [esi]
push 0
push 2
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a360
lea ecx, [esp + 0xc]
call fcn.00406950
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0x18

Function at 0x425420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49ec98
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a740
and eax, 0xfffffffe
push 0
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a320
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.00406e10
mov dword [esp + 0x38], 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a740
test al, 6
jne 0x4254da
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00407100
push 1
push dword [ebp + 0x10]
lea ecx, [esp + 0x1c]
push dword [ebp + 0xc]
mov edx, dword [eax]
push dword [ebp + 8]
push ecx
mov ecx, eax
call dword [edx + 0x28]
lea ecx, [esp + 0x14]
call fcn.00403980
cmp eax, dword [0x4a2bb8]
jne 0x4254da
cmp edx, dword [0x4a2bbc]
jne 0x4254da
mov eax, dword [esi]
push 0
push 2
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0040a360
lea ecx, [esp + 0xc]
call fcn.00406950
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49dd1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4cc1c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.00428510
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4284de
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x4284fc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x429920
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx esi, byte [eax + 0x4b0950]
mov edx, esi
mov ecx, esi
shr edx, 7
imul edi, edx, 0x1b000000
shl ecx, 0x19
imul edx, edx, 0x11b
xor edi, ecx
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or edi, ecx
lea ecx, [esi + esi]
xor edx, ecx
xor ecx, ecx
xor edx, esi
or ecx, edi
or edx, edi
mov dword [eax*8 + 0x4d1dd0], ecx
mov dword [eax*8 + 0x4d1dd4], edx
inc eax
cmp eax, 0x100
jl 0x429924
xorps xmm0, xmm0
pop edi
movlpd qword [0x4d25d8], xmm0
movlpd qword [0x4d25d0], xmm0
mov byte [0x4d1dc5], 1
pop esi
ret