joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462210
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, esi
shr edi, 2
test edi, edi
je 0x462256
mov esi, ebp
mov dword [esp + 0x10], edi
mov edx, ecx
sub esi, ecx
jmp 0x462240
mov eax, dword [esi + edx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
dec edi
jne 0x462240
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x46226a
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add ecx, eax
mov edx, ebx
mov eax, ebx
shr edx, 0x18
shr eax, 0x10
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
test esi, esi
je 0x46229e
sub ebp, ecx
lea esp, [esp]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
dec esi
jne 0x462290
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret

Function at 0x462920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a5619
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov dword [ebx + 0xc], 0
mov dword [esp + 0x14], ebx
mov dword [ebx + 0x14], 0
mov dword [esp + 0x20], 2
push 0
mov dword [ebx + 0x1c], 0
call fcn.0045f290
add esp, 4
mov dword [ebx + 0x20], 0
mov eax, dword [esp + 0x28]
lea ecx, [ebx + 0x34]
mov byte [esp + 0x20], 3
mov dword [ebx + 0x24], eax
mov al, byte [esp + 0x30]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::HashFilter.1.0
mov dword [ebx + 4], vtable.CryptoPP::HashFilter.0
mov byte [ebx + 0x28], al
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00461e20
push 0xffffffffffffffff
lea ecx, [ebx + 0x4c]
mov byte [esp + 0x24], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.00461e20
mov eax, dword [esp + 0x34]
mov byte [esp + 0x20], 5
test eax, eax
jns 0x4629f8
mov ecx, dword [ebx + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x462a11
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 0xc], ecx
jmp 0x462a18
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x18
Function at 0x4639e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a56a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x762dc0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004615c0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0065cde3
mov byte [esp + 0x30], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x10]
mov dword [esi + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00461e20
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x463a96
push dword [esp + 0xc]
call fcn.004623e0
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0065b5b4
add esp, 0x2c
ret

Function at 0x464870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6a5818
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00487570
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x30], 0
call fcn.00483980
mov edx, dword [esp + 0x18]
mov ebx, eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
mov ecx, edx
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push esi
cmp ecx, 0x10
jb 0x4648e1
call fcn.006a375e
jmp 0x4648e6
call fcn.0065cb97
mov eax, ebx
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x464a40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6a56d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x3c]
shl eax, 5
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
call fcn.00463d80
lea ecx, [esi + 0xc]
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x38]
push ecx
push eax
push esi
call fcn.004640f0
mov edx, dword [esp + 0x28]
xor eax, eax
mov ebx, dword [esp + 0x2c]
mov ecx, edx
mov edi, ebx
add esp, 0xc
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x464ac3
call fcn.006a375e
jmp 0x464ac8
call fcn.0065cb97
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x464f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6a5880
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x762dc0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x1f
push str.CryptoPP:_invalid_group_element
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004615c0
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0065cde3
mov byte [esp + 0x38], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x14]
mov dword [esi + 0xc], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00461e20
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidDataFormat.0
jb 0x464fcc
push dword [esp + 0x10]
call fcn.004623e0
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::DL_BadElement.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret

Function at 0x4659c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a599b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
cmp dword [0x819c90], 0
jne 0x465a06
call fcn.00481f90
mov dword [0x819c90], 0x47c1b0
mov dword [esi + 4], vtable.CryptoPP::Integer.0
push 2
mov dword [esi + 0xc], 2
call fcn.00467190
push 8
call fcn.00462360
mov dword [esi + 0x10], eax
add esp, 8
mov dword [esi + 0x14], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov dword [esp + 0x14], 0
mov dword [esi + 0x18], 0
cmp dword [0x819c90], 0
jne 0x465a66
call fcn.00481f90
mov dword [0x819c90], 0x47c1b0
mov dword [esi + 0x1c], vtable.CryptoPP::Integer.0
push 2
mov dword [esi + 0x24], 2
call fcn.00467190
push 8
call fcn.00462360
mov dword [esi + 0x28], eax
add esp, 8
mov dword [esi + 0x2c], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0x28]
mov dword [eax], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x466010
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6a56d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0
call dword [eax + 0x28]
mov esi, eax
mov dword [esp + 0x30], 0
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0x20]
push eax
push esi
mov esi, dword [esp + 0x40]
push esi
call fcn.004640c0
mov edx, dword [esp + 0x28]
xor eax, eax
mov ebx, dword [esp + 0x2c]
mov ecx, edx
mov edi, ebx
add esp, 0xc
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x466090
call fcn.006a375e
jmp 0x466095
call fcn.0065cb97
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4

Function at 0x466af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a5b50
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 8], 0
push 0
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], 0
call fcn.0045f290
mov dword [esi + 0x14], 0
mov dword [esp + 0x18], 2
push 0
mov dword [esi + 0x20], 0
call fcn.0045f290
mov dword [esi + 0x24], 0
mov dword [esp + 0x1c], 3
push 0
mov dword [esi + 0x30], 0
call fcn.0045f290
add esp, 0xc
mov dword [esi + 0x34], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x467470
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x6a5c20
mov eax, dword fs:[0]
push eax
mov eax, dword [0x762dc0]
push ecx
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov edx, ecx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x4674bb
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x4674bd
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x4674e6
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x4674e8
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x467530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6a5880
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x762dc0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x37
push str.BufferedTransformation:_this_object_doesnt_allow_input
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004615c0
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0065cde3
mov byte [esp + 0x38], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x14]
mov dword [esi + 0xc], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00461e20
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x4675ec
push dword [esp + 0x10]
call fcn.004623e0
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret

Function at 0x467610
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6a5c59
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push dword [esp + 0x44]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.00483640
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x30], 2
push eax
mov eax, dword [ecx]
mov edi, dword [esi]
mov dword [esp + 0x14], 4
call dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ecx, esi
push eax
push ebx
call dword [edi + 0x18]
mov edx, dword [esp + 0x1c]
xor eax, eax
mov esi, dword [esp + 0x20]
mov ecx, edx
mov edi, esi
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push esi
cmp ecx, 0x10
jb 0x46769a
call fcn.006a375e
jmp 0x46769f
call fcn.0065cb97
mov eax, ebx
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
Function at 0x468380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a59d9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
cmp dword [0x819c90], 0
jne 0x4683cd
call fcn.00481f90
mov dword [0x819c90], 0x47c1b0
mov esi, dword [esp + 0x20]
push 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.00467190
push 8
call fcn.00462360
mov dword [esi + 0xc], eax
add esp, 8
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [esp + 0x2c]
mov dword [esp + 0x20], 0
mov ecx, edi
push dword [esp + 0x2c]
mov edx, dword [edi]
push esi
mov dword [esp + 0x1c], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc

Function at 0x469670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a5d79
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
cmp dword [0x819c90], 0
jne 0x4696bf
call fcn.00481f90
mov dword [0x819c90], 0x47c1b0
mov esi, dword [esp + 0x24]
push 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.00467190
add esp, 4
push 8
call fcn.00462360
mov dword [esi + 0xc], eax
add esp, 4
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [esp + 0x30]
mov dword [esp + 0x24], 0
mov ecx, edi
push dword [esp + 0x30]
mov edx, dword [edi]
push esi
mov dword [esp + 0x20], 1
call dword [edx + 0x54]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x46aa30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6a5ffc
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push 1
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push 0x716ddc
call fcn.0046c560
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x46aac3
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x46aae1
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x471be0
Capabilities:
Encrypt data using twofish

Disassembly:
push esi
mov esi, edx
mov edx, ecx
mov eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or edx, eax
mov eax, dword [esp + 8]
sub eax, 2
je 0x471c99
dec eax
je 0x471c53
dec eax
mov eax, edx
jne 0x471d26
shr eax, 0x18
movzx ecx, byte [eax + 0x711900]
mov eax, edx
shr eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x711800]
xor ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x711800]
xor ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x711900]
xor edx, ecx
xor edx, dword [esi + 0x18]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax + 0x711800]
mov eax, edx
shr eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x711800]
xor ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x711900]
xor ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x711900]
xor edx, ecx
xor edx, dword [esi + 0x10]
push ebx
mov eax, edx
shr eax, 0x18
movzx ebx, byte [eax + 0x711900]
mov eax, edx
shr eax, 0x10
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + 0x711800]
xor ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + 0x711900]
xor ebx, eax
movzx eax, dl
shl ebx, 8
movzx eax, byte [eax + 0x711800]
xor ebx, eax
xor ebx, dword [esi + 8]
mov eax, ebx
mov ecx, ebx
shr eax, 0x18
shr ecx, 8
movzx ecx, cl
movzx edx, byte [eax + 0x711900]
mov eax, ebx
shr eax, 0x10
movzx ecx, byte [ecx + 0x711800]
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x711900]
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, bl
shl eax, 8
pop ebx
movzx ecx, byte [ecx + 0x711800]
xor eax, ecx
xor eax, dword [esi]
pop esi
ret
Function at 0x472a00
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [ecx + 0x2c]
push esi
mov esi, dword [eax]
push edi
xor edi, edi
bswap esi
bswap edx
test ebx, ebx
je 0x472a76
mov eax, dword [ecx + 0x28]
push ebp
mov ecx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
add ecx, dword [esp + 0x1c]
shl eax, 4
add eax, ebp
xor ecx, eax
lea eax, [edi + edx]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edi + esi]
xor ecx, eax
add edx, ecx
cmp edi, ebx
jne 0x472a37
pop ebp
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x472a82
mov ecx, dword [eax]
jmp 0x472a84
xor ecx, ecx
bswap esi
xor esi, ecx
mov ecx, dword [esp + 0x20]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
test eax, eax
je 0x472aab
add eax, 4
test eax, eax
je 0x472aab
mov eax, dword [eax]
bswap edx
xor edx, eax
mov dword [ecx + 4], edx
add esp, 8
ret 0xc
xor eax, eax
bswap edx
xor edx, eax
mov dword [ecx + 4], edx
add esp, 8
ret 0xc
Function at 0x472c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a54f8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x762dc0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.00460e80
add esp, 4
mov esi, eax
push 0x70c9dc
lea eax, [esp + 0x30]
mov dword [esp + 0x84], 0
push edi
push eax
call fcn.00461440
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x88], 1
push eax
call fcn.00460610
add esp, 0xc
push 0x716680
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x88], 2
push eax
call fcn.004619d0
add esp, 0xc
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.0065cde3
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00461e20
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x472d11
push dword [esp + 0x44]
call fcn.004623e0
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x472d39
push dword [esp + 0x14]
call fcn.004623e0
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x472d61
push dword [esp + 0x2c]
call fcn.004623e0
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x472d89
push dword [esp + 0x5c]
call fcn.004623e0
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidRounds.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0065b5b4
add esp, 0x74
ret 8
Function at 0x473260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a6531
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::RandomPool.0
mov byte [esi + 0x29], 0
mov dword [esi + 0x30], 0x20
cmp byte [esi + 0x29], 0
mov dword [esp + 0xc], esi
jne 0x4732aa
mov byte [esi + 0x29], 1
lea ecx, [esi + 8]
jmp 0x4732ac
xor ecx, ecx
mov dword [esi + 0x34], ecx
mov dword [esp + 0x18], 2
mov byte [esi + 0x49], 0
mov dword [esi + 0x50], 0x10
cmp byte [esi + 0x49], 0
jne 0x4732d1
mov byte [esi + 0x49], 1
lea ecx, [esi + 0x38]
jmp 0x4732d3
xor ecx, ecx
mov dword [esi + 0x54], ecx
push 0x120
mov byte [esp + 0x1c], 3
call fcn.0065951d
add esp, 4
mov ecx, eax
test ecx, ecx
je 0x473334
lea edx, [ecx + 0x18]
mov byte [edx + 0xf9], 0
mov dword [edx + 0x100], 0x3c
cmp byte [edx + 0xf9], 0
jne 0x47331d
mov eax, edx
mov byte [edx + 0xf9], 1
neg eax
and eax, 0xf
add eax, edx
jmp 0x47331f
xor eax, eax
mov dword [edx + 0x104], eax
mov dword [ecx], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
mov dword [ecx + 4], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
jmp 0x473336
xor ecx, ecx
mov dword [esi + 0x58], ecx
push dword [esi + 0x30]
mov byte [esi + 0x5c], 0
push 0
push dword [esi + 0x34]
call fcn.006593c0
push dword [esi + 0x50]
push 0
push dword [esi + 0x54]
call fcn.006593c0
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x4739e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6a6680
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x34]
push esi
mov dword [esp + 0x1c], esi
call fcn.0045f290
add esp, 4
test esi, esi
jne 0x473a21
xor ebx, ebx
jmp 0x473a2c
push esi
call fcn.00462360
add esp, 4
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], vtable.CryptoPP::NonblockingRng.0
push esi
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call fcn.00473930
mov byte [esp + 0x28], 0
mov ecx, edi
mov eax, dword [edi]
push esi
push ebx
call dword [eax + 0xc]
xor al, al
mov edi, ebx
mov ecx, esi
rep stosb byte es:[edi], al
push ebx
call fcn.0065cb97
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8