joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1bc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a7750
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x35
xor ebx, ebx
push str.HashVerificationFilter:_message_hash_or_MAC_not_valid
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 3
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
jb 0x4e1c65
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::HashVerificationFilter::HashVerificationFailed.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret

Function at 0x4e1d20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a7790
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x2b
xor ebx, ebx
push str.VerifierFilter:_digital_signature_not_valid
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 3
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
jb 0x4e1dc5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::SignatureVerificationFilter::SignatureVerificationFailed.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret
Function at 0x4e37d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a7cf9
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x18], esi
call fcn.00489a30
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.0
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [esp + 0x30], 3
mov byte [ecx], bl
call fcn.00403a2b
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push ebp
mov byte [esp + 0x30], 4
mov byte [ecx], bl
call fcn.00403a2b
mov eax, dword [esp + 0x38]
mov byte [esp + 0x24], 5
cmp eax, ebx
jge 0x4e3894
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x4e38af
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xc], ecx
jmp 0x4e38b6
mov edx, dword [esp + 0x30]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00531be5
add esp, 0x14
ret 0x18
Function at 0x4e5300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a8168
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x60]
mov dword [esp + 0x18], 0
call fcn.004e0150
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
mov edi, edx
xor al, al
push edx
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edi, edx
xor al, al
push edx
mov dword [esp + 0x20], 2
rep stosb byte es:[edi], al
call fcn.00493190
mov ecx, dword [esi + 0xc]
add esp, 8
mov dword [esp + 0x18], 0xffffffff
test ecx, ecx
je 0x4e5387
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4e57e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a828b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], 0
lea esi, [ebp + 0xa8]
mov dword [esp + 0x14], esi
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x24], 2
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x28], 3
rep stosb byte es:[edi], al
call fcn.00493190
mov ecx, dword [esi + 0xc]
add esp, 8
mov byte [esp + 0x20], 1
test ecx, ecx
je 0x4e5863
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea esi, [ebp + 0x48]
mov dword [esp + 0x14], esi
mov edx, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x24], 4
rep stosb byte es:[edi], al
call fcn.00493190
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edi, edx
xor al, al
push edx
mov byte [esp + 0x28], 5
rep stosb byte es:[edi], al
call fcn.00493190
mov ecx, dword [esi + 0xc]
add esp, 8
mov byte [esp + 0x20], 0
test ecx, ecx
je 0x4e58af
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edx, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x2c]
mov edi, edx
xor al, al
push edx
mov dword [esp + 0x24], 6
rep stosb byte es:[edi], al
call fcn.00493190
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test ecx, ecx
je 0x4e58e3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x4f5c90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5a8840
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x19
xor ebx, ebx
push str.Integer:_division_by_zero
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
jb 0x4f5d35
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret

Function at 0x4f8c50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a8f68
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
xor ebx, ebx
push ebx
mov esi, ecx
call fcn.00489a30
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x10], bl
mov dword [esi], vtable.CryptoPP::StringStore.1.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov byte [esp + 0x10], bl
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push str.InputBuffer
push edx
mov dword [esp + 0x50], 3
call fcn.00403a58
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x44], 4
call fcn.004e6140
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x40], 3
cmp ecx, ebx
je 0x4f8d01
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edi, edx
xor al, al
push edx
mov dword [esp + 0x44], 0xffffffff
rep stosb byte es:[edi], al
call fcn.00493190
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00531be5
add esp, 0x34
ret 8
Function at 0x4fbd70
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a97c1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push ecx
xor ebx, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.004f7f10
mov ecx, dword [esp + 0x3c]
push ecx
mov edi, 1
mov ecx, eax
mov dword [esp + 0x34], edi
call fcn.004fb380
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.004f7f10
mov ecx, dword [esp + 0x1c]
mov edx, ecx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x20]
add edx, edx
mov byte [esp + 0x30], bl
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x4fbdf0
call fcn.00493180
jmp 0x4fbdf5
call fcn.00493190
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4fcc70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a9989
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], edi
mov ebx, ecx
mov dword [esp + 0x14], esi
cmp dword [0xc1be44], edi
jne 0x4fcccc
call fcn.004f1fc0
mov dword [0xc1be44], 0x4f7d90
mov dword [esi], vtable.CryptoPP::Integer.0
push 8
mov dword [esi + 8], 2
call fcn.004932e0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], edi
mov dword [eax + 4], edi
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esp + 0x38]
push eax
push ebx
lea ecx, [esp + 0x24]
push esi
push ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x24], 1
call fcn.004fcaa0
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00531be5
add esp, 0x1c
ret 8
Function at 0x500f10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5aa180
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x20
xor ebx, ebx
push str.PolynomialMod2:_division_by_zero
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
jb 0x500fb5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::PolynomialMod2::DivideByZero.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret
Function at 0x51c440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5ae1b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x28], ebx
je 0x51c47f
mov dword [esi + 8], 0x5d272c
mov eax, dword [esi + 8]
mov dword [esi + 4], vtable.CryptoPP::X509PublicKey.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 8], vtable.CryptoPP::X509PublicKey.0
mov edx, dword [esi + 8]
mov dword [esi + 4], vtable.CryptoPP::DL_KeyImpl_class_CryptoPP::X509PublicKey__class_CryptoPP::DL_GroupParameters_GFP__class_CryptoPP::OID_.1.0
mov eax, dword [edx + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::DL_KeyImpl_class_CryptoPP::X509PublicKey__class_CryptoPP::DL_GroupParameters_GFP__class_CryptoPP::OID_.0
push ebx
lea ecx, [esi + 0xc]
mov dword [esi + 0x14], 0x5ceba4
call fcn.004ba130
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], vtable.CryptoPP::DL_GroupParameters_GFP.2.0
mov dword [esi + 0x10], vtable.CryptoPP::DL_GroupParameters_GFP.1.0
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x14], vtable.CryptoPP::DL_GroupParameters_GFP.0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x10], ebx
mov edx, dword [esi + 8]
mov dword [esi], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_GFP_.2.0
mov dword [esi + 4], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_GFP_.1.0
mov eax, dword [edx + 4]
lea edi, [esi + 0x80]
mov dword [eax + esi + 8], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_GFP_.0
lea ecx, [edi + 4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], edi
mov dword [edi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.004f7e70
lea ecx, [edi + 0x1c]
mov byte [esp + 0x20], 1
mov dword [edi + 0x18], ebx
call fcn.004f7e70
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x521600
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5aee06
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [esp + 0x18], esi
call fcn.00489a30
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
lea edi, [esi + 0x18]
push 1
mov ecx, edi
mov dword [esp + 0x2c], 2
mov dword [esi], vtable.CryptoPP::HMAC_class_CryptoPP::SHA1_.1.0
mov dword [esi + 4], vtable.CryptoPP::HMAC_class_CryptoPP::SHA1_.0
mov dword [esp + 0x1c], edi
call fcn.00489a30
lea eax, [edi + 0x10]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, 0x10
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
lea eax, [edi + 0x60]
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
mov eax, dword [edi + 0xac]
push eax
mov byte [esp + 0x2c], 4
call fcn.0048dc40
add esp, 4
mov dword [edi], vtable.CryptoPP::SHA1.0
mov eax, dword [0xc1ae18]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push ebp
mov ecx, esi
mov byte [esp + 0x34], 5
call fcn.0048d270
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00531be5
add esp, 0x18
ret 8
Function at 0x526be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5af6a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x23
xor ebx, ebx
push str.Inflator:_error_in_compressed_block
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404791
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 4
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [esp + 0x44], 1
mov byte [ecx], bl
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::Inflator::Err.0
jb 0x526c8b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Inflator::BadBlockErr.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret

Function at 0x527120
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5af760
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x628d00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
push eax
lea eax, [esp + 0x14]
mov esi, ecx
push str.HuffmanDecoder:
push eax
mov dword [esp + 0x18], esi
call fcn.004042a0
add esp, 0xc
mov edi, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00530c30
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [esp + 0x44], 1
mov byte [ecx], 0
call fcn.00403a2b
cmp dword [esp + 0x24], 0x10
jb 0x5271c2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00530f9e
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::HuffmanDecoder::Err.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00531be5
add esp, 0x30
ret 4
Function at 0x531be5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x628d00]
jne 0x531bef
repz ret
jmp fcn.0053c1ec

Function at 0x55726d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0053bbde
and dword [ebp - 0x14], 0
cmp dword [0xc1d9c0], 0
mov dword [ebp - 0x18], eax
jne 0x557320
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5573c8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5573c8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xc1d9c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xc1d9c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xc1d9c8], eax
call edi
push eax
call esi
mov dword [0xc1d9d0], eax
test eax, eax
je 0x557320
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xc1d9cc], eax
mov eax, dword [0xc1d9cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x557379
cmp dword [0xc1d9d0], ecx
je 0x557379
push eax
call esi
push dword [0xc1d9d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x557379
test ebx, ebx
je 0x557379
call edi
test eax, eax
je 0x557370
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x557370
test byte [ebp - 8], 1
jne 0x557379
or dword [ebp + 0x10], 0x200000
jmp 0x5573ac
mov eax, dword [0xc1d9c4]
cmp eax, dword [ebp - 0x18]
je 0x5573ac
push eax
call esi
test eax, eax
je 0x5573ac
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5573ac
mov eax, dword [0xc1d9c8]
cmp eax, dword [ebp - 0x18]
je 0x5573ac
push eax
call esi
test eax, eax
je 0x5573ac
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xc1d9c0]
call esi
test eax, eax
je 0x5573c8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5573ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00531be5
leave
ret
Function at 0x7fe058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007fe1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7fe07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7fe06a
add dl, dl
jne 0x7fe089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7fe0dc
xor eax, eax
add dl, dl
jne 0x7fe096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7fe17d
add dl, dl
jne 0x7fe0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7fe0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7fe0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7fe0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7fe0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7fe075
mov eax, 1
add dl, dl
jne 0x7fe0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7fe0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7fe0e1
sub eax, ebx
mov ebx, 1
jne 0x7fe128
mov ecx, 1
add dl, dl
jne 0x7fe10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7fe119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7fe105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7fe075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7fe13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7fe14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7fe136
cmp eax, 0x7d00
jae 0x7fe16d
cmp eax, 0x500
jb 0x7fe168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7fe075
cmp eax, 0x7f
ja 0x7fe170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7fe075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7fe19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7fe075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10