joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66b498
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x61], 1
mov dword [esp + 0x68], eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push ecx
mov edx, eax
xor edi, edi
mov dword [esp + 0x80], edi
push 0x3c
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call fcn.006111dc
mov eax, 0x3c
sub eax, esi
push eax
lea ecx, [esp + esi + 0x38]
push edi
push ecx
call fcn.0060fff0
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x38]
call fcn.0041bd40
mov eax, dword [esp + 0x88]
add esp, 0x20
shr esi, 2
mov dword [eax + esi*4], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov edi, 8
xor ecx, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0xf
xor edx, edx
lea eax, [edi + 5]
mov ebx, 0xf
div ebx
mov eax, edi
mov edi, 0xf
mov esi, dword [esp + 0x68]
mov ebx, edx
xor edx, edx
div edi
mov eax, dword [esi + ebx*4]
mov edi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x14], edi
xor eax, dword [esi + edx*4]
mov edx, dword [esp + 0x10]
add edx, ecx
rol eax, 3
xor eax, edx
xor dword [ecx + esi], eax
add ecx, 4
sub dword [esp + 0x18], 1
jne 0x427ce8
mov edi, 4
xor ecx, ecx
xor edx, edx
lea eax, [ecx + 0xe]
mov ebx, 0xf
div ebx
mov esi, dword [esp + 0x68]
inc ecx
mov eax, dword [esi + edx*4]
and eax, 0x1ff
mov edx, dword [eax*4 + 0x6a84a0]
add edx, dword [esi + ecx*4 - 4]
rol edx, 9
mov dword [esi + ecx*4 - 4], edx
cmp ecx, ebx
jb 0x427d33
sub edi, 1
jne 0x427d31
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov eax, ecx
mov edi, 0xf
div edi
mov edi, dword [esp + 0x68]
mov eax, dword [ebx + 0xbc]
add ecx, 4
add esi, 4
mov edx, dword [edi + edx*4]
mov dword [esi + eax - 4], edx
cmp ecx, 0x28
jb 0x427d71
inc dword [esp + 0x10]
mov dword [esp + 0x1c], esi
cmp esi, 0xa0
jb 0x427cd5
mov edi, 0x14
mov eax, dword [ebx + 0xbc]
mov ecx, dword [eax + edi]
add eax, edi
mov dword [esp + 0x1c], eax
mov edx, ecx
or edx, 3
mov esi, edx
not esi
mov eax, edx
shr eax, 1
xor eax, esi
lea ebx, [edx + edx]
xor ebx, esi
and eax, ebx
and eax, 0x7ffffffe
mov esi, eax
shr esi, 1
and eax, esi
mov esi, eax
shr esi, 2
and eax, esi
mov ebx, dword [esp + 0x20]
mov esi, eax
shr esi, 4
and eax, esi
lea esi, [eax + eax]
or eax, esi
and ecx, 3
lea esi, [eax*4]
or eax, esi
mov esi, dword [ecx*4 + 0x6a88c4]
mov ecx, dword [esp + 0x1c]
mov cl, byte [ecx - 4]
rol esi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and esi, ecx
and esi, 0x7ffffffc
xor esi, edx
mov edx, dword [ebx + 0xbc]
mov dword [edi + edx], esi
add edi, 8
cmp edi, 0x94
jb 0x427db1
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x24]
cmp edi, eax
jne 0x427e51
mov ecx, dword [esp + 0x64]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4283a0
Capabilities:
Encrypt data using twofish

Disassembly:
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or eax, ecx
mov ecx, dword [esp + 4]
sub ecx, 2
je 0x42845c
sub ecx, 1
je 0x428414
sub ecx, 1
jne 0x4284e7
mov edx, eax
shr edx, 0x18
movzx ecx, byte [edx + 0x6a73a0]
mov edx, eax
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x6a72a0]
shl ecx, 8
xor ecx, edx
mov edx, eax
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x6a72a0]
shl ecx, 8
movzx eax, al
xor ecx, edx
movzx edx, byte [eax + 0x6a73a0]
shl ecx, 8
xor ecx, edx
xor ecx, dword [esi + 0x18]
mov eax, ecx
mov ecx, eax
shr ecx, 0x18
movzx edx, byte [ecx + 0x6a72a0]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
movzx ecx, byte [ecx + 0x6a72a0]
shl edx, 8
xor edx, ecx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
movzx ecx, byte [ecx + 0x6a73a0]
shl edx, 8
movzx eax, al
xor edx, ecx
movzx ecx, byte [eax + 0x6a73a0]
shl edx, 8
xor edx, ecx
xor edx, dword [esi + 0x10]
mov eax, edx
mov edx, eax
shr edx, 0x18
movzx ecx, byte [edx + 0x6a73a0]
mov edx, eax
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x6a72a0]
shl ecx, 8
xor ecx, edx
mov edx, eax
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x6a73a0]
movzx eax, al
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 0x6a72a0]
shl ecx, 8
xor ecx, edx
xor ecx, dword [esi + 8]
mov edx, ecx
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x6a73a0]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + 0x6a73a0]
shl eax, 8
xor eax, edx
mov edx, ecx
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x6a72a0]
shl eax, 8
xor eax, edx
movzx ecx, cl
movzx edx, byte [ecx + 0x6a72a0]
shl eax, 8
xor eax, edx
xor eax, dword [esi]
ret
Function at 0x42d050
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x66b978
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x42d082
lea ebp, [edi + 4]
jmp 0x42d084
xor ebp, ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0x708900
push str.Rounds
mov dword [esp + 0x20], 0x14
call eax
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov ebx, esi
call fcn.0042d340
lea ecx, [edi + 0x14]
lea esi, [ebx + ebx + 4]
push ecx
mov dword [edi + 0x10], ebx
call fcn.0042b630
mov ebx, dword [esp + 0x3c]
lea eax, [ebx + 3]
shr eax, 2
mov dword [esp + 0x3c], eax
cmp eax, 1
mov dword [esp + 0x40], 1
lea eax, [esp + 0x40]
jb 0x42d0e6
lea eax, [esp + 0x3c]
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
call fcn.00414250
add esp, 4
test ebp, ebp
jne 0x42d105
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x42d119
lea edx, [ebp*4]
push edx
call fcn.004198a0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x38]
push ebx
push ecx
lea esi, [ebp*4]
push esi
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 4
call fcn.006111dc
mov edx, dword [esp + 0x50]
sub esi, ebx
push esi
xor esi, esi
add edx, ebx
push esi
push edx
call fcn.0060fff0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.0041bd40
mov ecx, dword [edi + 0x1c]
mov eax, 1
add esp, 0x20
mov dword [ecx], 0xb7e15163
cmp dword [edi + 0x18], eax
jbe 0x42d197
jmp 0x42d180
mov edx, dword [edi + 0x1c]
lea ecx, [edx + eax*4]
mov edx, dword [ecx - 4]
sub edx, 0x61c88647
inc eax
mov dword [ecx], edx
cmp eax, dword [edi + 0x18]
jb 0x42d180
mov eax, dword [edi + 0x18]
xor ebx, ebx
mov dword [esp + 0x38], eax
cmp eax, ebp
mov dword [esp + 0x3c], esi
lea eax, [esp + 0x14]
jb 0x42d1b0
lea eax, [esp + 0x38]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov dword [esp + 0x38], eax
test eax, eax
jbe 0x42d20a
lea ecx, [ecx]
xor edx, edx
mov eax, esi
div dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, dword [esp + 0x3c]
xor edx, edx
add eax, ebx
rol eax, 3
mov dword [ecx], eax
mov ebx, eax
mov eax, esi
div ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
inc esi
lea ebp, [ecx + edx*4]
mov cl, bl
add cl, al
add eax, ebx
add eax, dword [ebp]
rol eax, cl
mov dword [ebp], eax
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
cmp esi, dword [esp + 0x38]
jb 0x42d1c0
mov edx, dword [esp + 0x40]
mov edi, edx
xor eax, eax
mov ecx, ebp
push edx
rep stosd dword es:[edi], eax
call fcn.0061588e
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x42d240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov edx, ecx
mov ecx, dword [eax]
push esi
mov esi, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
add eax, 4
mov ebx, dword [eax + 4]
push edi
mov edi, dword [esi]
mov ebp, eax
add edi, dword [ebp]
mov ebp, dword [eax + 8]
add ebp, dword [esi + 4]
add eax, 4
add esi, 8
mov dword [esp + 0x1c], ebx
test edx, edx
jbe 0x42d2c7
mov dword [esp + 0x10], edx
lea ebx, [ebx]
lea edx, [edi + edi + 1]
imul edx, edi
lea eax, [ebp + ebp + 1]
imul eax, ebp
rol edx, 5
rol eax, 5
mov ebx, edx
xor ebx, ecx
mov cl, al
xor eax, dword [esp + 0x1c]
rol ebx, cl
mov cl, dl
rol eax, cl
mov dword [esp + 0x1c], ebp
mov ebp, dword [esi]
mov dword [esp + 0x14], edi
add eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
add ebp, ebx
add esi, 8
sub dword [esp + 0x10], 1
mov edi, eax
jne 0x42d280
mov ebx, dword [esp + 0x1c]
add ebx, dword [esi + 4]
mov esi, dword [esi]
mov eax, dword [esp + 0x20]
add esi, ecx
test eax, eax
je 0x42d2da
mov ecx, dword [eax]
jmp 0x42d2dc
xor ecx, ecx
mov edx, dword [esp + 0x24]
xor ecx, esi
mov dword [edx], ecx
lea ecx, [edx + 4]
test eax, eax
je 0x42d2f4
add eax, 4
je 0x42d2f4
mov edx, dword [eax]
jmp 0x42d2f6
xor edx, edx
xor edx, edi
mov dword [ecx], edx
add ecx, 4
test eax, eax
je 0x42d30a
add eax, 4
je 0x42d30a
mov edx, dword [eax]
jmp 0x42d30c
xor edx, edx
xor edx, ebx
mov dword [ecx], edx
add ecx, 4
test eax, eax
je 0x42d32c
add eax, 4
je 0x42d32c
mov eax, dword [eax]
pop edi
pop esi
xor eax, ebp
pop ebp
mov dword [ecx], eax
pop ebx
add esp, 8
ret 0xc
pop edi
xor eax, eax
pop esi
xor eax, ebp
pop ebp
mov dword [ecx], eax
pop ebx
add esp, 8
ret 0xc
Function at 0x42d3b0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x66b978
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x42d3e2
lea ebp, [edi + 4]
jmp 0x42d3e4
xor ebp, ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0x708900
push str.Rounds
mov dword [esp + 0x20], 0x10
call eax
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov ebx, esi
call fcn.0042d340
lea ecx, [edi + 0x14]
lea esi, [ebx + ebx + 2]
push ecx
mov dword [edi + 0x10], ebx
call fcn.0042b630
mov ebx, dword [esp + 0x3c]
lea eax, [ebx + 3]
shr eax, 2
mov dword [esp + 0x3c], eax
cmp eax, 1
mov dword [esp + 0x40], 1
lea eax, [esp + 0x40]
jb 0x42d446
lea eax, [esp + 0x3c]
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
call fcn.00414250
add esp, 4
test ebp, ebp
jne 0x42d465
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x42d479
lea edx, [ebp*4]
push edx
call fcn.004198a0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x38]
push ebx
push ecx
lea esi, [ebp*4]
push esi
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 4
call fcn.006111dc
mov edx, dword [esp + 0x50]
sub esi, ebx
push esi
xor esi, esi
add edx, ebx
push esi
push edx
call fcn.0060fff0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.0041bd40
mov ecx, dword [edi + 0x1c]
mov eax, 1
add esp, 0x20
mov dword [ecx], 0xb7e15163
cmp dword [edi + 0x18], eax
jbe 0x42d4f7
jmp 0x42d4e0
mov edx, dword [edi + 0x1c]
lea ecx, [edx + eax*4]
mov edx, dword [ecx - 4]
sub edx, 0x61c88647
inc eax
mov dword [ecx], edx
cmp eax, dword [edi + 0x18]
jb 0x42d4e0
mov eax, dword [edi + 0x18]
xor ebx, ebx
mov dword [esp + 0x38], eax
cmp eax, ebp
mov dword [esp + 0x3c], esi
lea eax, [esp + 0x14]
jb 0x42d510
lea eax, [esp + 0x38]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov dword [esp + 0x38], eax
test eax, eax
jbe 0x42d56a
lea ecx, [ecx]
xor edx, edx
mov eax, esi
div dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, dword [esp + 0x3c]
xor edx, edx
add eax, ebx
rol eax, 3
mov dword [ecx], eax
mov ebx, eax
mov eax, esi
div ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
inc esi
lea ebp, [ecx + edx*4]
mov cl, bl
add cl, al
add eax, ebx
add eax, dword [ebp]
rol eax, cl
mov dword [ebp], eax
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
cmp esi, dword [esp + 0x38]
jb 0x42d520
mov edx, dword [esp + 0x40]
mov edi, edx
xor eax, eax
mov ecx, ebp
push edx
rep stosd dword es:[edi], eax
call fcn.0061588e
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x42d5a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [ecx + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [ecx + 0x18]
mov eax, dword [edi]
mov edx, dword [edi + 4]
add eax, dword [esi]
add edx, dword [esi + 4]
add edi, 8
xor esi, esi
test ebx, ebx
jbe 0x42d5df
push ebp
mov ebp, edx
xor ebp, eax
mov cl, dl
rol ebp, cl
inc esi
add ebp, dword [edi + esi*8 - 8]
mov eax, ebp
xor edx, eax
mov cl, al
rol edx, cl
add edx, dword [edi + esi*8 - 4]
cmp esi, ebx
jb 0x42d5c1
pop ebp
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42d5eb
mov ecx, dword [esi]
jmp 0x42d5ed
xor ecx, ecx
mov edi, dword [esp + 0x18]
xor ecx, eax
mov dword [edi], ecx
test esi, esi
je 0x42d60d
lea eax, [esi + 4]
test eax, eax
je 0x42d60d
mov eax, dword [eax]
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
ret 0xc
xor eax, eax
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x42e7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c49b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x78]
xor ebx, ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x6c], 4
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 6
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 0x54], eax
cmp byte [esp + 0x80], bl
jne 0x42e895
push ebx
push 0x70a088
push 0x709868
push ebx
push eax
call fcn.00616733
add esp, 0x14
test eax, eax
je 0x42e895
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00416f50
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x74], 7
call fcn.004175b0
push 0x6d564c
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], vtable.CryptoPP::InvalidArgument.0
call fcn.00610ded
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.BlockPaddingScheme
call fcn.0042f670
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x70], 8
call fcn.0042df90
mov byte [esp + 0x6c], 6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x42e8ce
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x64
ret 0x10
Function at 0x42f110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66bce9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], 2
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x18], 4
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00417450
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 5
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00417450
mov eax, dword [esp + 0x2c]
cmp eax, ebx
mov byte [esp + 0x18], 6
jge 0x42f1c5
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x42f1e0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
jmp 0x42f1e7
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x42f670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66b8c1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.0042f710
push eax
mov ecx, esi
call fcn.0042d780
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x42f6f2
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x42fa10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66ae88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
push str.:_Nonblocking_input_is_not_implemented_by_this_object.
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00416e00
add esp, 0xc
push eax
push 0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004175b0
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x42fa76
mov edx, dword [esp + 8]
push edx
call fcn.00610458
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BufferedTransformation::BlockingInputOnly.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 4
Function at 0x4377d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66c440
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x7086f0
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.006108ae
mov esp, ebp
pop ebp
ret 8

Function at 0x4378b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66c410
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x7086f0
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006108ae
mov esp, ebp
pop ebp
ret 8
Function at 0x43ed20
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x43ed30
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x751860], edx
mov dword [esi*8 + 0x751864], eax
inc esi
cmp esi, 0x100
jl 0x43ed30
mov dword [0x752068], edi
mov dword [0x75206c], edi
mov dword [0x752060], edi
mov dword [0x752064], edi
pop edi
pop esi
mov byte [0x752080], 1
pop ebx
ret

Function at 0x43edb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x6a5160]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x751058], edx
mov dword [eax*8 + 0x75105c], ebp
inc eax
cmp eax, 0x100
mov dword [esp + 0x18], eax
jl 0x43edc0
pop edi
pop esi
pop ebp
mov byte [0x752081], 1
pop ebx
add esp, 0x10
ret