joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e52a320
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, edx
push 0
mov dword [esp + 0x18], ebx
mov ebp, ecx
call fcn.4e522160
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52a35d
test ecx, ecx
je 0x4e52a34e
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52a34e
and edx, ebp
jmp 0x4e52a354
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x4e52a38c
push 0
call fcn.4e522160
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52a399
test ecx, ecx
je 0x4e52a37d
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52a37d
and edx, ebx
jmp 0x4e52a383
mov eax, ebx
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52a399
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
jmp 0x4e52a4ca
push 0
call fcn.4e522160
mov ecx, dword [esp + 0x28]
mov esi, eax
add esp, 4
cmp esi, 1
je 0x4e52a3d5
test esi, esi
je 0x4e52a3bd
lea edx, [esi - 1]
test esi, edx
jne 0x4e52a3bd
and edx, ecx
jmp 0x4e52a3c3
mov eax, ecx
xor edx, edx
div esi
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52a3d5
mov edx, dword [esp + 0x28]
jmp 0x4e52a4ca
mov edx, dword [esp + 0x28]
push edi
mov edi, edx
xor esi, esi
shr edi, 2
mov dword [esp + 0x10], esi
test edi, edi
je 0x4e52a4bc
cmp edi, 4
jb 0x4e52a47a
lea eax, [ecx - 4]
mov dword [esp + 0x10], esi
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x4e52a40e
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ecx
jae 0x4e52a47a
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x4e52a422
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ebx
jae 0x4e52a47a
mov esi, ebp
sub esi, ebx
mov dword [esp + 0x1c], esi
mov eax, edi
and eax, 3
mov dword [esp + 0x14], edi
sub dword [esp + 0x14], eax
mov esi, ecx
sub esi, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov eax, ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [ecx]
movdqu xmm1, xmmword [edx + eax]
movdqu xmm0, xmmword [eax]
add esi, 4
pxor xmm1, xmm0
movdqu xmmword [ebx + eax], xmm1
lea eax, [eax + 0x10]
cmp esi, dword [esp + 0x14]
jb 0x4e52a450
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
cmp esi, edi
jae 0x4e52a4bc
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
sub ebx, ecx
sub edi, eax
add eax, edi
mov dword [esp + 0x20], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
lea esi, [ecx + esi*4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + esi]
xor eax, dword [esi]
lea esi, [esi + 4]
mov dword [ebx + esi - 4], eax
dec edi
jne 0x4e52a4a1
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
shl esi, 2
pop edi
sub edx, esi
je 0x4e52a4e1
add ebp, esi
add ebx, esi
add ecx, esi
test edx, edx
je 0x4e52a4e1
sub ebx, ecx
sub ebp, ecx
mov al, byte [ecx + ebx]
xor al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebp - 1], al
dec edx
jne 0x4e52a4d2
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4e52a4f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0
mov esi, edx
mov ebp, ecx
xor bl, bl
call fcn.4e522160
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52a52b
test ecx, ecx
je 0x4e52a51c
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52a51c
and edx, ebp
jmp 0x4e52a522
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x4e52a55a
push 0
call fcn.4e522160
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52a560
test ecx, ecx
je 0x4e52a54b
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52a54b
and edx, esi
jmp 0x4e52a551
mov eax, esi
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52a560
mov ecx, dword [esp + 0x18]
jmp 0x4e52a5ca
mov ecx, dword [esp + 0x18]
push edi
mov edi, ecx
xor ebx, ebx
shr edi, 2
xor eax, eax
mov dword [esp + 0x10], ebx
test edi, edi
je 0x4e52a599
mov ecx, ebp
mov edx, esi
sub ecx, esi
mov dword [esp + 0x14], edi
mov eax, dword [ecx + edx]
xor eax, dword [edx]
lea edx, [edx + 4]
or ebx, eax
dec edi
jne 0x4e52a580
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
shl eax, 2
pop edi
sub ecx, eax
jne 0x4e52a5af
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
add ebp, eax
add esi, eax
shr ebx, 0x18
mov eax, edx
shr eax, 0x10
or bl, al
mov eax, edx
shr eax, 8
or bl, al
or bl, dl
test ecx, ecx
je 0x4e52a5dd
sub ebp, esi
mov al, byte [esi + ebp]
xor al, byte [esi]
lea esi, [esi + 1]
or bl, al
dec ecx
jne 0x4e52a5d0
pop esi
xor eax, eax
test bl, bl
pop ebp
sete al
pop ebx
add esp, 8
ret

Function at 0x4e52ce10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5a98c0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x44]
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x20]
call fcn.4e52cc10
lea ecx, [esi + 0xc]
push ecx
mov edx, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0
call fcn.4e52cc50
add esp, 8
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519140
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x4e52ceb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5a98c0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x1c]
push eax
call fcn.4e52cac0
lea edx, [esi + 0xc]
push edx
mov edx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.4e52cc50
add esp, 4
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519140
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4

Function at 0x4e52d670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5a9810
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d6510]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.4e5181b0
mov ecx, dword [ebp + 8]
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], vtable.CryptoPP::BERGeneralDecoder.1.0
mov dword [esp + 0x10], vtable.CryptoPP::BERGeneralDecoder.0
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 0
mov eax, dword [ecx]
lea edx, [esp + 0xb]
push edx
call dword [eax + 0x48]
test eax, eax
je 0x4e52d702
cmp byte [esp + 0xb], 0x30
jne 0x4e52d702
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x25]
push eax
lea edx, [esp + 0x30]
call fcn.4e52aa40
add esp, 4
test al, al
jne 0x4e52d707
call fcn.4e52a890
mov dword [esp + 0xc], vtable.CryptoPP::BERSequenceDecoder.1.0
mov dword [esp + 0x10], vtable.CryptoPP::BERSequenceDecoder.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 1
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
lea ecx, [esp + 0xc]
call fcn.4e52b0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52b020
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e584c47
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e52d780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5a9888
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d6510]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.4e543290
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x3000
mov dword [esp + 8], vtable.CryptoPP::DERSequenceEncoder.1.0
mov dword [esp + 0xc], vtable.CryptoPP::DERSequenceEncoder.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 0
mov eax, dword [ecx]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
lea ecx, [esp + 8]
call fcn.4e52b2a0
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52b220
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e584c47
mov esp, ebp
pop ebp
ret 4

Function at 0x4e52ea00
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5a9478
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4e5d6510]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call fcn.4e52ed10
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4e52ea80
push 0x4e5bb6bc
lea ecx, [esp + 0xc]
call fcn.4e513ee0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x5c], 0
call fcn.4e52e840
push 0x4e5cfbb8
lea eax, [esp + 0x24]
push eax
call fcn.4e58707b
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.4e584c47
mov esp, ebp
pop ebp
ret 8

Function at 0x4e52eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5a99f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x30]
push edi
lea ecx, [esp + 0x14]
call fcn.4e51c180
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.4e51c1f0
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.4e518f80
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
push edi
push esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call fcn.4e52ea00
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
call fcn.4e518fa0
mov esi, dword [ebx]
push edi
lea ecx, [esp + 0x14]
call fcn.4e51c1f0
push eax
mov ecx, ebx
call dword [esi + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.4e51c1c0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x4e52f610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5a9eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.4e53bbb0
push dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.4e53cf10
mov ecx, dword [esp + 0x30]
push eax
call fcn.4e53bbb0
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.4e519140
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 8

Function at 0x4e52f730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4e5a9eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0x10]
push eax
call fcn.4e52f610
lea ecx, [esi + 0xc]
mov dword [esp + 0x28], 1
push ecx
mov ecx, dword [esp + 0x34]
mov edx, eax
call fcn.4e52cc50
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.4e519140
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x4e52f7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5a98c0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x14]
shl edx, 5
lea ecx, [esp + 0x1c]
call fcn.4e53be30
lea ecx, [esi + 0xc]
push ecx
mov edx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.4e52cc50
add esp, 4
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519140
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x4e52fae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e5a9de8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.4e5181b0
push 0
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [esp + 0x48]
lea ecx, [esp + 0x24]
mov dword [esi], vtable.CryptoPP::StringStore.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.1.0
call fcn.4e518390
push 1
push eax
lea eax, [esp + 0x14]
push str.InputBuffer
push eax
mov byte [esp + 0x48], 1
call fcn.4e521530
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x3c], 2
call fcn.4e527c70
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.4e518b60
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.4e518b40
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x4e53c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5aa018
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d6510]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.4e543290
mov eax, dword [ebp + 8]
mov dword [esp + 8], vtable.CryptoPP::DERGeneralEncoder.1.0
mov dword [esp + 0xc], vtable.CryptoPP::DERGeneralEncoder.0
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x200
push 1
sub esp, 8
mov ecx, esi
mov dword [esp + 0x54], 0
call fcn.4e53c3b0
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.4e53c5b0
lea ecx, [esp + 8]
call fcn.4e52b2a0
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52b220
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e584c47
mov esp, ebp
pop ebp
ret 4

Function at 0x4e53ec40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52cbd0
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e53ed40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52cbf0
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e53ee40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52cc10
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x4e53efe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52cc30
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e53f060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5aa508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52cc50
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53bf10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519140
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e5402d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ecx
mov dword [esp + 4], eax
test ebp, ebp
je 0x4e540392
mov ecx, dword [esp + 0x10]
push ebx
movzx ebx, byte [eax + 0x118]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [eax + 0x114]
movzx eax, byte [eax + 0x119]
cmp ecx, esi
jne 0x4e540342
jmp 0x4e540310
movzx edx, byte [ebx + edi]
add eax, edx
and eax, 0xff
inc ebx
movzx ecx, byte [eax + edi]
mov byte [ebx + edi - 1], cl
add ecx, edx
and ecx, 0xff
mov byte [eax + edi], dl
mov cl, byte [ecx + edi]
xor byte [esi], cl
and ebx, 0xff
lea esi, [esi + 1]
dec ebp
jne 0x4e540310
jmp 0x4e54037f
sub esi, ecx
movzx edx, byte [ebx + edi]
add eax, edx
and eax, 0xff
inc ebx
movzx ecx, byte [eax + edi]
mov byte [ebx + edi - 1], cl
add ecx, edx
mov byte [eax + edi], dl
mov edx, dword [esp + 0x1c]
and ecx, 0xff
inc edx
mov cl, byte [ecx + edi]
xor cl, byte [edx - 1]
and ebx, 0xff
mov byte [esi + edx - 1], cl
mov dword [esp + 0x1c], edx
dec ebp
jne 0x4e540344
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov byte [ecx + 0x118], bl
mov byte [ecx + 0x119], al
pop ebx
pop ebp
pop ecx
ret 0xc
Function at 0x4e5438c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5aaae0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4e5d6510]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x2c], ebx
cmp byte [ebp + 0x14], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
je 0x4e543a17
mov edi, dword [edi]
mov ecx, dword [esp + 0x20]
mov ebx, dword [ebx + 0x14]
mov ecx, dword [ecx + 4]
mov eax, edi
or eax, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
je 0x4e543997
lea ebx, [ebx]
test ebx, ebx
je 0x4e543997
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
test ecx, ecx
ja 0x4e543956
jb 0x4e543954
cmp edi, esi
jae 0x4e543956
mov esi, edi
lea ecx, [ebx + 4]
call fcn.4e51c1f0
add eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
push 1
mov edx, dword [ecx]
push 0
push esi
push eax
push dword [esp + 0x28]
call dword [edx + 0x8c]
add dword [ebx + 0x10], esi
mov ecx, dword [esp + 0x14]
mov ebx, dword [ebx]
sub edi, esi
sbb ecx, 0
mov eax, edi
or eax, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
jne 0x4e543940
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
call fcn.4e543610
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
cmp ecx, esi
ja 0x4e5439c3
jb 0x4e5439bd
cmp eax, edi
jae 0x4e5439c3
lea eax, [esp + 0x2c]
jmp 0x4e5439c7
lea eax, [esp + 0x24]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4e543a0a
cmp byte [ebx + 0x24], 0
mov edx, dword [esp + 0x1c]
push 1
mov eax, dword [edx]
push 0
push ecx
push dword [ebx + 0x1c]
mov ecx, edx
push dword [esp + 0x28]
je 0x4e5439f3
call dword [eax + 0x8c]
jmp 0x4e5439f9
call dword [eax + 0x88]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
add dword [ebx + 0x1c], eax
sub dword [ebx + 0x20], eax
sub edi, eax
sbb esi, 0
mov eax, dword [esp + 0x20]
sub dword [eax], edi
sbb dword [eax + 4], esi
xor eax, eax
jmp 0x4e543a89
lea ecx, [esp + 0x34]
call fcn.4e5182c0
mov dword [esp + 0x78], 0
push dword [0x4e5db9cc]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], vtable.CryptoPP::ByteQueue::Walker.1.0
mov dword [esp + 0x3c], vtable.CryptoPP::ByteQueue::Walker.0
mov dword [esp + 0x44], ebx
call dword [0x4e5bb400]
push 0
push dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push edi
push esi
mov dword [esp + 0x88], 1
call fcn.4e543e80
push dword [edi + 4]
mov edx, dword [ebx]
push dword [edi]
mov ecx, ebx
mov esi, eax
call dword [edx + 0x54]
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], 0xffffffff
call fcn.4e518270
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.4e584c47
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e544410
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e5aada9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e5d6510]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.4e53baf0
push 1
push dword [esp + 0x2c]
mov dword [esp + 0x20], 0
push dword [esp + 0x2c]
mov edx, dword [edi]
push esi
mov ecx, edi
mov dword [esp + 0x1c], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc