joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12053a1
Capabilities:
Encode data using xor

Disassembly:
cmp dh, dl
cmc
cmp al, 9
jmp 0x2128a2e
jmp 0x12049ef
cmp al, ah
jno 0x21289b4
loopne 0x2128a20
pop ebx
pop ecx
stosd dword es:[edi], eax
pop eax
jmp 0x212897d
dec ecx
xor dword [ebx], edi
out dx, al
lcall 0xf585, 0x470fe84e
cmc
push edi
push 0x2e
insd dword es:[edi], dx
invalid
mov word [esp], 0x535c
mov word [esp + 8], cx
call fcn.0211d72b
out 0x13, eax
bnd jecxz 0x21289ed
xor ch, byte [ecx - 0x68f42a9c]
imul edi, dword [ecx + 0x6b], 0x4b45b567
aaa
fisttp qword [ebp - 0x43]
cmp eax, 0x65f5078b
jge 0x2128ac8
stosd dword es:[edi], eax
daa
leave
stc
xlatb
imul eax, edx, 0xfd11916
cmp eax, 0x9c0cb4e3
jbe 0x2128a16
test dword [edi - 0x4a], edx
mov ebp, dword [edx - 0x18]
inc ecx
add eax, 0x58870614
jl 0x2128af7
jbe 0x2128aad
cmp bl, ch
sbb esp, dword [edi]
add ebp, ebp
salc
push ecx
sbb esp, dword [ecx + ecx*4]
salc
xor byte [eax + 0x17], bl
outsd dx, dword [esi]
mov esi, 0x6ed1ec0e
mov edi, 0x54aa1e86
pop esp
add dword [ecx + 0x541b3923], edx
inc esi
invalid
cmp ah, 0x45
stc
mov eax, dword [0xb5ed02ab]
add eax, 0x8994b0a3
mov dword [0x5092b21c], eax
mov dword [0xa38994b0], eax
sbb al, 0xb2
xchg edx, eax
push eax
pop ss
lahf
mov byte [esi], dh
pop ebx
or eax, 0x21d7023f
or byte [esi - 0x67], bl
stosd dword es:[edi], eax
insd dword es:[edi], dx
xchg esi, eax
loopne 0x2128a99
jge 0x2128a7b
inc esp
xchg esi, eax
jns 0x2128b1e
mov al, 0x4f
fistp dword [0x834fdfd]
mov edi, 0xc6e2526f
push edx
loop 0x2128aa3
insb byte es:[edi], dx
push esp
fimul dword [0x6d36169]
mov dl, 0x85
stc
xor byte [eax], al
js 0x2128ada
std
or eax, dword [edi - 0x1ea8b996]
inc ebx
cmp byte [esp + ebp - 0xa677d12], al
out dx, al
sbb byte [eax - 0x3f65f00b], 0xf
cdq
ror byte [ebp - 0x2a1603bb], 0x26
cld
aad 0x26
invalid
inc edi
xchg ebp, eax
mov dl, 0xab
xor ch, byte [ecx - 0x2f3fc95f]
xor dh, byte [edi]
mov al, byte [ecx]
leave
jb 0x2128b05
arpl di, bp
cmp eax, 0xf3ed8753
maxps xmm1, xmmword [esi + 0x50]
xor ebx, dword [eax]
mov cl, 0xb5
bnd jg 0x2128b1d
imul edx, dword [0x39efa23d], 0x19
xchg ecx, eax
jno 0x2128b9f
mov ebx, 0x6965f527
pop ecx
and esp, ecx
int1
or esi, edi
fistp qword [ebx]
xor dword [bp + di + 0x67], 0xffffffcd
mov eax, 0xa456c178
daa
mov dh, 0xd8
or al, 0xf9
pop eax
je 0x2128b03
mov ecx, 0x8fa317b2
mov ch, 0x4a
mov ah, 0x64
dec esi
fisub dword [esi - 0x78]
cmp byte [esi - 0x398100e3], bl
ret
push 0x10
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
mov al, byte [0xd35d958f]
pop eax
stosd dword es:[edi], eax
xchg edi, eax
inc esp
insb byte es:[edi], dx
pop edx
lcall 0x727d, 0x4f2337b0
sar dh, cl
add esi, eax
ror byte [esi], 0xbe
leave
and ah, al
iretd

Function at 0xc2b6ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
je 0xc2b711
test ecx, ecx
je 0xc2b711
push ebx
push edi
mov ebx, 0
mov edi, 0xc2b714
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0xc2b700
pop edi
pop ebx
ret
xor eax, eax
ret
Function at 0x4033f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x563850
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5d6b80]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
push 0x24
push str.AlgorithmParametersBase:_parameter__
mov dword [esp + 0x14], edi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004066d0
push esi
lea edx, [esp + 0x14]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x44]
call fcn.00407310
push str.__not_used
mov edx, eax
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x30]
call fcn.00407310
add esp, 8
mov esi, eax
mov ecx, edi
mov byte [esp + 0x68], 2
call fcn.0052b902
mov byte [esp + 0x68], 3
lea ecx, [edi + 0x10]
push 0xffffffffffffffff
mov dword [edi], vtable.CryptoPP::Exception.0
mov dword [edi + 0xc], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00406100
cmp dword [esp + 0x3c], 0x10
jb 0x4034d3
push dword [esp + 0x28]
call fcn.0052586e
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x4034fb
push dword [esp + 0x40]
call fcn.0052586e
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x403523
push dword [esp + 0x10]
call fcn.0052586e
add esp, 4
mov eax, edi
mov dword [edi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00525878
mov esp, ebp
pop ebp
ret 4

Function at 0x403c00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5639be
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::Grouper.1.0
mov dword [esi + 4], vtable.CryptoPP::Grouper.0
mov dword [esi + 0x1c], 0
call fcn.00406a00
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [esi + 0x28], 0
call fcn.00406a00
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x403ca1
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404020
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, ecx
push edi
push str.MozillaLZ4::_file_to_memory__start_
call esi
push 0x59c6d4
push dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.0052b499
mov edi, eax
add esp, 8
test edi, edi
jne 0x404068
push str.MozillaLZ4::_file_to_memory___file_not_opened
call esi
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push str.MozillaLZ4::_file_to_memory___opened
call esi
push 2
push 0
push edi
call fcn.0052da08
add esp, 0xc
test eax, eax
jns 0x404099
push str.MozillaLZ4::_file_to_memory___fseek_f__0__SEEK_END____0
call esi
push edi
call fcn.0052b265
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push edi
call fcn.0052d90d
add esp, 4
mov dword [ebp + 8], eax
push str.MozillaLZ4::_file_to_memory___ftell_ed
call esi
push 0
push 0
push edi
call fcn.0052da08
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x4040d9
push str.MozillaLZ4::_file_to_memory____fsize__0_
call esi
push edi
call fcn.0052b265
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push eax
call fcn.005243ff
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x404101
push str.MozillaLZ4::_file_to_memory_____comp_data__0_
call esi
push edi
call fcn.0052b265
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push str.MozillaLZ4::_file_to_memory___allocated_memory
call esi
push edi
push dword [ebp + 8]
push 1
push dword [ebx]
call fcn.0052d4d1
add esp, 0x10
cmp dword [ebp + 8], eax
je 0x404143
push str.MozillaLZ4::_file_to_memory____fsize___fread__comp_data__1__fsize__f__
call esi
push dword [ebx]
call fcn.00525873
push edi
mov dword [ebx], 0
call fcn.0052b265
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push edi
call fcn.0052b265
add esp, 4
push str.MozillaLZ4::_file_to_memory___in_memory
call esi
cmp dword [ebx], 0
je 0x40415e
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
push str.MozillaLZ4::_file_to_memory__end_
call esi
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
Function at 0x404170
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, ecx
push str.MozillaLZ4::_read_from_file__start_
call edi
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xc], 0
call fcn.00404020
test al, al
jne 0x4041a8
push str.MozillaLZ4::_read_from_file____file_to_memory_failed
call edi
pop edi
xor al, al
pop esi
pop ebp
ret 4
push str.MozillaLZ4::_read_from_file___file_in_memory
call edi
cmp dword [esi + 4], 0xc
jb 0x4042a8
mov ecx, dword [esi]
mov eax, dword [str.mozLz40]
cmp eax, dword [ecx]
jne 0x4042a8
mov eax, dword [0x59d774]
cmp eax, dword [ecx + 4]
jne 0x4042a8
push str.MozillaLZ4::_read_from_file____comp_size___ok
call edi
mov edx, dword [esi]
push str.MozillaLZ4::_read_from_file___magicsize___ok
movzx eax, byte [edx + 8]
add dword [esi + 0xc], eax
movzx eax, byte [edx + 9]
mov ecx, dword [esi + 0xc]
shl eax, 8
add ecx, eax
mov dword [esi + 0xc], ecx
movzx eax, byte [edx + 0xa]
shl eax, 0x10
add ecx, eax
mov dword [esi + 0xc], ecx
movzx eax, byte [edx + 0xb]
shl eax, 0x18
add eax, ecx
mov dword [esi + 0xc], eax
call edi
mov eax, dword [esi + 0xc]
inc eax
push eax
call fcn.005243ff
mov ecx, dword [esi + 0xc]
add esp, 4
mov dword [esi + 8], eax
mov byte [eax + ecx], 0
cmp dword [esi + 8], 0
jne 0x404240
push str.MozillaLZ4::_read_from_file___failed_on__decomp_data_allocation
call edi
pop edi
xor al, al
pop esi
pop ebp
ret 4
push ebx
push str.MozillaLZ4::_read_from_file___decomp_allocated___ok
call edi
mov eax, dword [esi + 4]
push dword [esi + 0xc]
mov ecx, dword [esi]
sub eax, 0xc
mov edx, dword [esi + 8]
add ecx, 0xc
push eax
call fcn.0040acc0
mov ebx, eax
add esp, 8
test ebx, ebx
jns 0x404278
push str.MozillaLZ4::_read_from_file___LZ4_decompress_safe_failed
call edi
pop ebx
pop edi
xor al, al
pop esi
pop ebp
ret 4
push str.MozillaLZ4::_read_from_file___LZ4_decompress_safe___ok
call edi
cmp ebx, dword [esi + 0xc]
je 0x404294
push str.MozillaLZ4::_read_from_file____dsize____decomp_size_
call edi
pop ebx
pop edi
xor al, al
pop esi
pop ebp
ret 4
push dword [esi + 8]
lea ecx, [esi + 0x2c]
call fcn.00404f30
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 4
push str.MozillaLZ4::_read_from_file___failed_on__comp_size
call edi
pop edi
xor al, al
pop esi
pop ebp
ret 4
Function at 0x404a70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x563b00
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5d6b80]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea esi, [edi + 0x14]
push 0x59c550
mov ecx, esi
call fcn.004066d0
cmp byte [edi + 0x10], 0
jne 0x404ac7
xor al, al
jmp 0x404c0f
mov dword [esp + 0x24], 0
push 0x400
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], 0
call fcn.004063a0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea eax, [edi + 0x2c]
mov dword [esp + 0x58], 1
cmp dword [eax + 0x14], 0x10
jb 0x404b0a
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
call fcn.00408cd0
cmp dword [eax + 0x28], 0
je 0x404b38
push str.JSON_not_parsed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
jmp 0x404bf5
push str.metaData
lea ecx, [esp + 0x1c]
call fcn.004062f0
test eax, eax
jne 0x404b5c
push str.__document.HasMember_metaData__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
jmp 0x404bf5
push str.metaData
lea ecx, [esp + 0x1c]
call fcn.00405990
push str.current
mov ecx, eax
call fcn.004062f0
test eax, eax
jne 0x404b89
push str.__document_metaData_.HasMember_current__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
jmp 0x404bf5
push str.current
push str.metaData
lea ecx, [esp + 0x20]
call fcn.00405990
mov ecx, eax
call fcn.00405990
cmp dword [eax + 4], 0
ja 0x404bb8
push str._document_metaData__current_.GetStringLength___0_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
jmp 0x404bf5
push str.current
push str.metaData
lea ecx, [esp + 0x20]
call fcn.00405990
mov ecx, eax
call fcn.00405990
mov ecx, esi
push dword [eax]
call fcn.00404f30
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Current_search
call edi
cmp dword [esi + 0x14], 0x10
jb 0x404bf0
mov esi, dword [esi]
push esi
call edi
mov bl, 1
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x404c0d
mov ecx, esi
call fcn.00406690
push esi
call fcn.0052586e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00525878
mov esp, ebp
pop ebp
ret
Function at 0x404c30
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, ecx
push str.MozillaLZ4::_write_to_file___start
call edi
mov ecx, dword [ebx + 0x3c]
cmp ecx, 0x7e000000
jbe 0x404c55
xor eax, eax
jmp 0x404c6d
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 0x10
add eax, edx
add eax, ecx
add eax, 0xc
push eax
call fcn.005243ff
mov esi, eax
add esp, 4
test esi, esi
je 0x404d03
push str.MozillaLZ4::_write_to_file___allocated
call edi
mov eax, dword [str.mozLz40]
mov dword [esi], eax
mov eax, dword [0x59d774]
mov dword [esi + 4], eax
movzx eax, byte [ebx + 0x3c]
mov byte [esi + 8], al
mov eax, dword [ebx + 0x3c]
shr eax, 8
mov byte [esi + 9], al
movzx eax, byte [ebx + 0x3e]
mov byte [esi + 0xa], al
movzx eax, byte [ebx + 0x3f]
push str.MozillaLZ4::_write_to_file___magic
mov byte [esi + 0xb], al
call edi
cmp dword [ebx + 0x40], 0x10
lea ecx, [ebx + 0x2c]
jb 0x404cc9
mov ecx, dword [ecx]
push dword [ebx + 0x3c]
lea edx, [esi + 0xc]
call fcn.0040ac40
add esp, 4
add eax, 0xc
mov dword [ebp - 4], eax
push str.MozillaLZ4::_write_to_file___compressed
call edi
push 0x59cb70
push dword [ebp + 8]
call fcn.0052b499
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x404d0e
push esi
call fcn.00525873
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.MozillaLZ4::_write_to_file___opened
call edi
push ebx
push dword [ebp - 4]
push 1
push esi
call fcn.0052c0ff
add esp, 0x10
cmp dword [ebp - 4], eax
je 0x404d43
push esi
call fcn.00525873
push ebx
call fcn.0052b265
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.0052b265
add esp, 4
push str.MozillaLZ4::_write_to_file___saved
call edi
push esi
call fcn.00525873
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b960
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564023
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5d6b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x54], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x2c], 0
call fcn.00406a00
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x40ba27
cmp dword [esi + 0x1c], 1
jb 0x40ba27
cmp dword [esi + 0x20], 0xffffffff
je 0x40ba27
push eax
push 1
lea ecx, [esi + 0x28]
call fcn.0040b6e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525878
mov esp, ebp
pop ebp
ret 0x10
push 0x2c
push str.FilterWithBufferedInput:_invalid_buffer_size
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
call fcn.004066d0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.0052b902
push 0xffffffffffffffff
mov byte [ebp - 4], 5
lea eax, [ebp - 0x50]
push 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], vtable.CryptoPP::Exception.0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406100
push 0x5cbddc
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x38], vtable.CryptoPP::InvalidArgument.0
call fcn.00526718
int3

Function at 0x40def0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov eax, 0
xor cl, cl
mov dword [ebp - 4], ebx
test bl, 3
push esi
sete al
test eax, eax
je 0x40df88
test dl, 3
mov eax, 0
sete al
test eax, eax
je 0x40df88
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, esi
xor eax, eax
shr edi, 2
test edi, edi
je 0x40df54
mov esi, dword [ebp - 4]
mov ecx, edx
sub esi, edx
mov dword [ebp - 8], edi
jmp 0x40df40
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
dec edi
jne 0x40df40
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
pop edi
sub esi, eax
jne 0x40df69
xor eax, eax
test ebx, ebx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp - 4], eax
add edx, eax
mov ecx, ebx
mov eax, ebx
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or cl, bl
mov ebx, dword [ebp - 4]
jmp 0x40df8b
mov esi, dword [ebp + 8]
test esi, esi
je 0x40df9f
sub ebx, edx
mov al, byte [edx + ebx]
lea edx, [edx + 1]
xor al, byte [edx - 1]
or cl, al
dec esi
jne 0x40df91
xor eax, eax
test cl, cl
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5644c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x17]
push ecx
push 0x5dc50c
push str.InsertLineBreaks
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 4]
call eax
movzx ecx, byte [esp + 0x17]
test al, al
mov eax, dword [edi]
mov ebx, 1
cmovne ebx, ecx
lea ecx, [esp + 0x18]
push ecx
push 0x5dca2c
mov eax, dword [eax + 4]
mov ecx, edi
push str.MaxLineLength
call eax
mov esi, dword [esi + 0x44]
test al, al
mov ecx, 0x48
mov dword [esp + 0x20], 6
cmovne ecx, dword [esp + 0x18]
mov eax, 0x59c550
test bl, bl
mov dword [esp + 0x18], 0x59d8e8
mov edi, 0x5a2df4
mov dword [esp + 0x64], 0
cmove edi, eax
xor eax, eax
test bl, bl
cmovne eax, ecx
xor ecx, ecx
mov dword [esp + 0x1c], eax
call fcn.00406a00
mov dword [esp + 0x68], 0
test edi, edi
je 0x40f5fb
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f5f0
sub eax, edx
jmp 0x40f5fd
xor eax, eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], eax
mov byte [esp + 0x54], 0
mov dword [esp + 0x78], 1
xor ecx, ecx
mov dword [esp + 0x4c], 0
call fcn.00406a00
mov dword [esp + 0x50], 0
test edi, edi
je 0x40f63d
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f632
sub ecx, edx
jmp 0x40f63f
xor ecx, ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ecx
mov byte [esp + 0x3c], 0
push ecx
lea eax, [esp + 0x1c]
mov byte [esp + 0x7c], 3
push eax
mov edx, str.EncodingLookupArray
lea ecx, [esp + 0x38]
call fcn.0040f750
add esp, 8
mov byte [esp + 0x78], 4
movzx ecx, byte [eax + 8]
push ecx
push ecx
push str.PaddingByte
mov ecx, eax
call fcn.0040f8d0
movzx ecx, byte [eax + 8]
push ecx
lea ecx, [esp + 0x20]
push ecx
push str.GroupSize
mov ecx, eax
call fcn.00408b50
movzx ecx, byte [eax + 8]
push ecx
lea ecx, [esp + 0x40]
push ecx
push str.Separator
mov ecx, eax
call fcn.00408a90
movzx ecx, byte [eax + 8]
push ecx
lea ecx, [esp + 0x58]
push ecx
push str.Terminator
mov ecx, eax
call fcn.00408a90
push 1
lea ecx, [esp + 0x24]
push ecx
push str.Log2Base
mov ecx, eax
call fcn.00408b50
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], vtable.CryptoPP::CombinedNameValuePairs.0
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov eax, dword [esi]
push 0xffffffffffffffff
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov byte [esp + 0x78], 3
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x40f708
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [esp + 0x50]
xor al, al
mov ecx, dword [esp + 0x4c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0052616f
mov edx, dword [esp + 0x6c]
add esp, 4
mov ecx, dword [esp + 0x64]
mov edi, edx
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.0052616f
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413720
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5646e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5d6b80]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x5d6b80]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00406100
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.00413640
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x41379d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0052b89f
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4137c6
push dword [esp + 0x10]
call fcn.0052586e
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00525878
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41ef40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x564828
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5d6b80]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5d6b80]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.00420040
mov eax, dword [ebp + 8]
mov dword [esp + 8], vtable.CryptoPP::DERGeneralEncoder.0
mov dword [esp + 0xc], vtable.CryptoPP::DERGeneralEncoder.1.0
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x200
push 1
sub esp, 8
mov dword [esp + 0x54], 0
mov ecx, esi
call fcn.0041ec60
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0041ede0
lea ecx, [esp + 8]
call fcn.00421ff0
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.00421f60
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00525878
mov esp, ebp
pop ebp
ret 4