joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dd9ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
xor edi, edi
xor esi, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x18], ebp
test eax, 0xfffffffc
je 0x4b0c32
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
cmp eax, esi
jae 0x4b0bb4
mov ecx, eax
cmp edi, ecx
ja 0x4b0bb4
mov ebx, eax
sub ebx, edi
sar ebx, 2
cmp esi, ebp
jne 0x4b0ba5
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4b0c87
mov ecx, ebp
sub ecx, edi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4b0ba5
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4b0b87
xor ecx, ecx
jmp 0x4b0b89
add ecx, edx
cmp ecx, eax
jae 0x4b0b8f
mov ecx, eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00479200
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x4b0bae
mov edx, dword [edi + ebx*4]
mov dword [esi], edx
mov ebx, dword [esp + 0x1c]
jmp 0x4b0c11
cmp esi, ebp
jne 0x4b0c07
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4b0c87
mov ecx, ebp
sub ecx, edi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4b0c07
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4b0be9
xor ecx, ecx
jmp 0x4b0beb
add ecx, edx
cmp ecx, eax
jae 0x4b0bf1
mov ecx, eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00479200
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x4b0c11
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x18]
inc eax
add esi, 4
sar ecx, 2
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
cmp eax, ecx
jne 0x4b0b28
push 0x1c
call fcn.004597dd
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x38], 1
test ebx, ebx
je 0x4b0c91
sub esi, edi
sar esi, 2
xor ecx, ecx
xor eax, eax
test esi, esi
je 0x4b0c63
mov edx, dword [edi + eax*4]
add ecx, dword [edx + 4]
inc eax
cmp eax, esi
jne 0x4b0c58
mov dword [ebx + 4], ecx
mov dword [ebx + 8], 0
lea eax, [esp + 0x20]
push eax
lea ecx, [ebx + 0xc]
mov byte [esp + 0x3c], 2
mov dword [ebx], vtable.Botan::Parallel.0
call fcn.004b0820
jmp 0x4b0c93
push str.vector_T__too_long
call fcn.0044720f
xor ebx, ebx
test edi, edi
je 0x4b0ca0
push edi
call fcn.00458691
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4b8ef0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
call fcn.004a53b0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4b8f12
mov ecx, dword [esi + 0x48]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.00458cc0
add esp, 0xc
mov edx, dword [esi + 0x38]
mov dword [edx], 0x67452301
mov eax, dword [esi + 0x38]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [esi + 0x38]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [esi + 0x38]
mov dword [edx + 0xc], 0x10325476
mov eax, dword [esi + 0x38]
mov dword [eax + 0x10], 0xc3d2e1f0
pop esi
ret

Function at 0x4b8f50
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x4ddc4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
push 8
push 1
push 1
push 0x40
push 0x14
call fcn.004a5540
xor ebp, ebp
lea ecx, [edi + 0x38]
mov dword [esp + 0x24], ebp
mov dword [edi], vtable.Botan::SHA_160.0
call fcn.004835e0
lea esi, [edi + 0x48]
mov dword [esp + 0x18], esi
mov dword [esi], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
push 1
mov byte [esp + 0x28], 2
call fcn.00479b90
mov ecx, dword [esi + 8]
add esp, 4
mov dword [esi + 0xc], eax
cmp ecx, 0x50
jb 0x4b8fed
cmp ecx, ebp
je 0x4b8fe4
lea eax, [ecx*4]
mov ecx, dword [esi]
push eax
push ebp
push ecx
call fcn.00458cc0
add esp, 0xc
mov dword [esi + 4], 0x50
jmp 0x4b9019
mov edx, dword [eax]
mov edx, dword [edx + 4]
add ecx, ecx
add ecx, ecx
push ecx
mov ecx, dword [esi]
push ecx
mov ecx, eax
call edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
push 0x140
call edx
mov dword [esi], eax
mov eax, 0x50
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
call fcn.004a53b0
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x4b9038
mov ecx, dword [esi]
add eax, eax
add eax, eax
push eax
push ebp
push ecx
call fcn.00458cc0
add esp, 0xc
mov edx, dword [edi + 0x38]
mov dword [edx], 0x67452301
mov eax, dword [edi + 0x38]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [edi + 0x38]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [edi + 0x38]
mov dword [edx + 0xc], 0x10325476
mov eax, dword [edi + 0x38]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4ba740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ddd19
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x53132c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov eax, 0x20
mov dword [esp + 0xc], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor ebx, ebx
push 0xf
push str.R3411_CryptoPro
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], ebx
mov dword [esi], vtable.Botan::GOST_34_11.0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404270
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 1
call fcn.004a17e0
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x5c], 2
call fcn.004a1490
cmp dword [esp + 0x44], 0x10
jb 0x4ba7e2
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00458691
add esp, 4
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp dword [esp + 0x24], 0x10
mov byte [esp + 0x58], 5
jb 0x4ba80b
mov edx, dword [esp + 0x10]
push edx
call fcn.00458691
add esp, 4
lea ecx, [esi + 0x40]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
call fcn.004804c0
lea ecx, [esi + 0x50]
mov byte [esp + 0x58], 6
call fcn.004804c0
lea ecx, [esi + 0x60]
mov byte [esp + 0x58], 7
call fcn.004804c0
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004587b6
add esp, 0x50
ret
Function at 0x4ba870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ddd8c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x60]
mov edi, dword [ecx]
push eax
mov eax, dword [edi + 4]
push edx
mov dword [esp + 0x28], 3
call eax
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x5c]
mov edi, dword [ecx]
push eax
push edx
mov edx, dword [edi + 4]
mov byte [esp + 0x28], 2
call edx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x40]
mov edi, dword [ecx]
push eax
mov eax, dword [edi + 4]
push edx
mov byte [esp + 0x28], 1
call eax
lea edi, [esi + 0xc]
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x30]
mov ebx, dword [ecx]
add eax, eax
add eax, eax
push eax
push edx
mov edx, dword [ebx + 4]
mov byte [esp + 0x28], 5
call edx
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, edx
add edx, edx
push edx
mov edx, dword [edi + 0x14]
push edx
mov byte [esp + 0x28], 4
call eax
mov dword [edi], vtable.Botan::SymmetricAlgorithm.0
mov dword [esi], vtable.Botan::BufferedComputation.0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4bd000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4de1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x53132c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x78], 0x20
jbe 0x4bd089
push 0x2d
xor esi, esi
push str.BigInt::get_substring:_Substring_size_too_big
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
call fcn.00404270
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x70], esi
call fcn.00473ba0
push 0x5213bc
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], vtable.Botan::Invalid_Argument.0
call fcn.0045869c
mov ebx, dword [esp + 0x74]
mov edx, dword [ecx + 4]
xor eax, eax
xor ebp, ebp
xor edi, edi
shr ebx, 3
mov dword [esp + 0x18], edx
mov ecx, ebx
sub ecx, edi
add ecx, 7
mov esi, ecx
shr esi, 2
cmp esi, dword [esp + 0x18]
jb 0x4bd0b3
xor cl, cl
jmp 0x4bd0d5
or edx, 0xffffffff
sub edx, ecx
and edx, 3
mov ecx, 3
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx + esi*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr edx, cl
mov cl, dl
shld ebp, eax, 8
shl eax, 8
mov esi, eax
movzx eax, cl
cdq
inc edi
or eax, esi
or ebp, edx
cmp edi, 8
jne 0x4bd09d
mov ecx, dword [esp + 0x74]
and ecx, 7
mov edx, ebp
call fcn.0046f380
mov ecx, dword [esp + 0x78]
mov edx, 1
shl edx, cl
dec edx
and eax, edx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004587b6
add esp, 0x5c
ret 8

Function at 0x4bd340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de233
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov edi, dword [ecx]
add eax, eax
add eax, eax
push eax
push edx
mov edx, dword [edi + 4]
mov dword [esp + 0x20], 1
call edx
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x20]
mov edi, dword [ecx]
add eax, eax
add eax, eax
push eax
push edx
mov edx, dword [edi + 4]
mov byte [esp + 0x20], 0
call edx
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, edx
add edx, edx
push edx
mov edx, dword [esi]
push edx
mov dword [esp + 0x20], 0xffffffff
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4bfaa0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x4de829
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00479430
xor edi, edi
mov dword [esi + 0x30], edi
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi], vtable.Botan::BlockCipherMode.0
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x34], eax
imul eax, dword [esp + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x40]
mov dword [esi + 0x3c], eax
push edi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov dword [esp + 0x2c], edi
mov byte [ecx], 0
call fcn.00403b00
push edi
lea ecx, [esi + 0x60]
mov byte [esp + 0x24], 1
call fcn.00474690
push edi
lea ecx, [esi + 0x70]
mov byte [esp + 0x24], 2
call fcn.00474690
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x30], ebx
mov ebx, dword [esi + 0x38]
mov eax, dword [esi + 0x68]
mov byte [esp + 0x20], 3
cmp ebx, eax
ja 0x4bfb5a
test eax, eax
je 0x4bfb79
push eax
mov eax, dword [esi + 0x60]
push edi
push eax
call fcn.00458cc0
add esp, 0xc
jmp 0x4bfb79
mov ecx, dword [esi + 0x6c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esi + 0x60]
push eax
call edx
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax]
push ebx
call edx
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov eax, dword [esi + 0x78]
mov ebx, dword [esp + 0x30]
cmp ebx, eax
ja 0x4bfb9c
test eax, eax
je 0x4bfbbb
push eax
mov eax, dword [esi + 0x70]
push 0
push eax
call fcn.00458cc0
add esp, 0xc
jmp 0x4bfbbb
mov ecx, dword [esi + 0x7c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esi + 0x70]
push eax
call edx
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
mov edx, dword [eax]
push ebx
call edx
mov dword [esi + 0x70], eax
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov eax, esi
mov dword [esi + 0x80], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x4c0060
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4dfdf8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov ecx, dword [esi + 0x38]
push eax
mov eax, dword [esi + 0x40]
push eax
push ecx
lea edx, [esp + 0x20]
push 0
push edx
call fcn.004bfff0
add esp, 0x18
lea edi, [esi + 0x44]
mov dword [esp + 0x28], 0
cmp edi, eax
je 0x4c00c1
push eax
mov ecx, edi
call fcn.004bbad0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esp + 0x14]
push edx
mov dword [esp + 0x30], 0xffffffff
call eax
lea ebx, [esi + 0x64]
cmp ebx, edi
je 0x4c00ed
push edi
mov ecx, ebx
call fcn.004bbad0
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
mov eax, dword [ebx]
push eax
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x4c03f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4de9b1
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x53132c]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xcc]
mov esi, ecx
mov dword [esp + 0x18], esi
call fcn.00479430
xor ebp, ebp
mov dword [esi + 0x30], ebp
mov edi, dword [esp + 0xc8]
mov dword [esp + 0xc0], ebp
mov dword [esi], vtable.Botan::EAX_Base.0
cmp ebx, ebp
je 0x4c0461
mov eax, ebx
shr eax, 3
jmp 0x4c0464
mov eax, dword [edi + 0x10]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x10]
push ebp
lea ecx, [esi + 0x44]
mov dword [esi + 0x38], eax
call fcn.00474690
push ebp
lea ecx, [esi + 0x54]
mov byte [esp + 0xc4], 1
call fcn.00474690
push 0
lea ecx, [esi + 0x64]
mov byte [esp + 0xc4], 2
call fcn.00474690
lea ecx, [esi + 0x74]
push 0
mov byte [esp + 0xc4], 3
call fcn.00474690
push 0x64
mov byte [esp + 0xc4], 4
mov dword [esi + 0x3c], edi
call fcn.004597dd
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0xc0], 5
test edi, edi
je 0x4c04e6
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, edi
call fcn.004bbf70
jmp 0x4c04e8
xor eax, eax
mov byte [esp + 0xc0], 4
mov dword [esi + 0x40], eax
test bl, 7
jne 0x4c0552
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4c0552
cmp ecx, dword [eax + 4]
ja 0x4c0552
mov ecx, dword [esi + 0x38]
push ecx
lea ecx, [esi + 0x64]
call fcn.004745a0
mov edx, dword [esi + 0x38]
push edx
lea ecx, [esi + 0x74]
call fcn.004745a0
mov dword [esi + 0x84], 0
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.004587b6
add esp, 0xb0
ret 8
push 0
push 0
lea eax, [esp + 0xa0]
push ebx
push eax
call fcn.00477a30
add esp, 0x10
mov edi, eax
lea ecx, [esp + 0x44]
push ecx
mov ecx, esi
mov byte [esp + 0xc4], 6
call fcn.004c0350
push str.:_Bad_tag_size
push eax
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0xcc], 7
call fcn.00405a00
push edi
push eax
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0xd8], 8
call fcn.0044ed70
add esp, 0x18
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xc4], 9
call fcn.00473ba0
push 0x5213bc
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], vtable.Botan::Invalid_Argument.0
call fcn.0045869c
int3
Function at 0x4c1380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4deb0e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00479430
xor ebp, ebp
mov dword [esi + 0x30], ebp
push ebp
lea ecx, [esi + 0x3c]
mov dword [esp + 0x24], ebp
mov dword [esi], vtable.Botan::XTS_Decryption.0
call fcn.00474690
push ebp
lea ecx, [esi + 0x4c]
mov byte [esp + 0x24], 1
call fcn.00474690
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x34], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov byte [esp + 0x20], 2
call edx
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x34]
mov ebp, dword [eax + 0x10]
mov eax, dword [esi + 0x44]
cmp ebp, eax
ja 0x4c140e
test eax, eax
je 0x4c142d
mov ecx, dword [esi + 0x3c]
push eax
push 0
push ecx
call fcn.00458cc0
add esp, 0xc
jmp 0x4c142d
mov ecx, dword [esi + 0x48]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esi + 0x3c]
push eax
call edx
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
mov edx, dword [eax]
push ebp
call edx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], ebp
mov dword [esi + 0x40], ebp
mov eax, dword [esi + 0x34]
mov ebx, dword [eax + 0x10]
mov eax, dword [esi + 0x54]
add ebx, ebx
cmp ebx, eax
ja 0x4c1454
test eax, eax
je 0x4c1473
mov ecx, dword [esi + 0x4c]
push eax
push 0
push ecx
call fcn.00458cc0
add esp, 0xc
jmp 0x4c1473
mov ecx, dword [esi + 0x58]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [esi + 0x4c]
push eax
call edx
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
mov edx, dword [eax]
push ebx
call edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov eax, esi
mov dword [esi + 0x5c], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4c5380
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4df6d6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x28]
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.Botan::Default_DSA_Op.0
call fcn.004bcd30
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.004bcd30
mov dl, byte [edi + 0x2c]
lea ebx, [esi + 0x2c]
lea eax, [edi + 0x30]
push eax
lea ecx, [ebx + 4]
mov byte [esp + 0x24], 2
mov dword [esp + 0x2c], ebx
mov byte [ebx], dl
call fcn.004bcd30
lea ecx, [edi + 0x44]
push ecx
lea ecx, [ebx + 0x18]
mov byte [esp + 0x24], 3
call fcn.004bcd30
lea edx, [edi + 0x58]
push edx
lea ecx, [ebx + 0x2c]
mov byte [esp + 0x24], 4
call fcn.004bcd30
lea eax, [edi + 0x6c]
lea ecx, [esi + 0x6c]
push eax
mov byte [esp + 0x24], 5
call fcn.004c3920
lea edx, [edi + 0x74]
lea ecx, [esi + 0x74]
push edx
mov byte [esp + 0x24], 6
call fcn.004c3920
lea ebp, [esi + 0x7c]
lea ebx, [edi + 0x7c]
push ebx
mov ecx, ebp
mov byte [esp + 0x24], 7
mov dword [esp + 0x2c], ebp
call fcn.004bcd30
lea eax, [ebx + 0x14]
push eax
lea ecx, [ebp + 0x14]
mov byte [esp + 0x24], 8
call fcn.004bcd30
lea ecx, [ebx + 0x28]
push ecx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x24], 9
call fcn.004bcd30
mov edx, dword [ebx + 0x3c]
mov dword [ebp + 0x3c], edx
mov eax, dword [ebx + 0x40]
mov dword [ebp + 0x40], eax
mov ecx, dword [ebx + 0x44]
mov dword [ebp + 0x44], ecx
lea ebx, [esi + 0xc4]
add edi, 0xc4
mov byte [esp + 0x20], 0xa
mov dword [esp + 0x28], ebx
push edi
mov ecx, ebx
call fcn.004bcd30
lea edx, [edi + 0x14]
push edx
lea ecx, [ebx + 0x14]
mov byte [esp + 0x24], 0xb
call fcn.004bcd30
lea eax, [edi + 0x28]
push eax
lea ecx, [ebx + 0x28]
mov byte [esp + 0x24], 0xc
call fcn.004bcd30
mov ecx, dword [edi + 0x3c]
mov dword [ebx + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [ebx + 0x40], edx
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4c5d70
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4df9a6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x28]
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.Botan::Default_NR_Op.0
call fcn.004bcd30
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.004bcd30
mov dl, byte [edi + 0x2c]
lea ebx, [esi + 0x2c]
lea eax, [edi + 0x30]
push eax
lea ecx, [ebx + 4]
mov byte [esp + 0x24], 2
mov dword [esp + 0x2c], ebx
mov byte [ebx], dl
call fcn.004bcd30
lea ecx, [edi + 0x44]
push ecx
lea ecx, [ebx + 0x18]
mov byte [esp + 0x24], 3
call fcn.004bcd30
lea edx, [edi + 0x58]
push edx
lea ecx, [ebx + 0x2c]
mov byte [esp + 0x24], 4
call fcn.004bcd30
lea eax, [edi + 0x6c]
lea ecx, [esi + 0x6c]
push eax
mov byte [esp + 0x24], 5
call fcn.004c3920
lea edx, [edi + 0x74]
lea ecx, [esi + 0x74]
push edx
mov byte [esp + 0x24], 6
call fcn.004c3920
lea ebp, [esi + 0x7c]
lea ebx, [edi + 0x7c]
push ebx
mov ecx, ebp
mov byte [esp + 0x24], 7
mov dword [esp + 0x2c], ebp
call fcn.004bcd30
lea eax, [ebx + 0x14]
push eax
lea ecx, [ebp + 0x14]
mov byte [esp + 0x24], 8
call fcn.004bcd30
lea ecx, [ebx + 0x28]
push ecx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x24], 9
call fcn.004bcd30
mov edx, dword [ebx + 0x3c]
mov dword [ebp + 0x3c], edx
mov eax, dword [ebx + 0x40]
mov dword [ebp + 0x40], eax
mov ecx, dword [ebx + 0x44]
mov dword [ebp + 0x44], ecx
lea ebx, [esi + 0xc4]
add edi, 0xc4
mov byte [esp + 0x20], 0xa
mov dword [esp + 0x28], ebx
push edi
mov ecx, ebx
call fcn.004bcd30
lea edx, [edi + 0x14]
push edx
lea ecx, [ebx + 0x14]
mov byte [esp + 0x24], 0xb
call fcn.004bcd30
lea eax, [edi + 0x28]
push eax
lea ecx, [ebx + 0x28]
mov byte [esp + 0x24], 0xc
call fcn.004bcd30
mov ecx, dword [edi + 0x3c]
mov dword [ebx + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [ebx + 0x40], edx
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4