joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c8d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0043f530
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00410adf
mov dword [ebp - 0x1018], eax
xor eax, eax
mov esi, 0x7fe
push esi
mov word [ebp - 0x1008], ax
xor edi, edi
lea eax, [ebp - 0x1006]
push edi
push eax
call fcn.0042ef80
xor eax, eax
push esi
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push edi
push eax
mov dword [ebp - 0x100c], edi
mov dword [ebp - 0x1010], edi
mov dword [ebp - 0x1014], edi
call fcn.0042ef80
add esp, 0x18
mov eax, 0x400
push eax
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x1014]
push ecx
lea ecx, [ebp - 0x1010]
push ecx
lea ecx, [ebp - 0x100c]
push ecx
push eax
lea eax, [ebp - 0x1008]
push eax
push 0x49181c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 0x1018]
mov ecx, dword [ebp - 0x100c]
mov edx, ebx
call fcn.00410be6
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.0042cc90
leave
ret

Function at 0x410d53
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0043f530
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x1028], eax
call fcn.00410adf
mov dword [ebp - 0x101c], eax
xor eax, eax
mov esi, 0x7fe
push esi
mov word [ebp - 0x814], ax
xor ebx, ebx
lea eax, [ebp - 0x812]
push ebx
push eax
call fcn.0042ef80
xor eax, eax
push esi
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0x1020], ebx
call fcn.0042ef80
add esp, 0x18
mov eax, 0x400
push eax
lea ecx, [ebp - 0x1014]
push ecx
lea ecx, [ebp - 0x1020]
push ecx
lea ecx, [ebp - 0x1024]
push ecx
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x814]
push eax
push 0x49181c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1018]
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x101c]
lea edx, [ebp - 0x14]
call fcn.00410be6
push dword [ebp - 0x1028]
lea eax, [ebp - 0x14]
push eax
call fcn.0040fac5
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0042cc90
leave
ret
Function at 0x410efe
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push 0x20
mov eax, 0x47c71f
call fcn.004332cf
push dword [ebp + 8]
xor esi, esi
push esi
push 0x43a
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x410f3c
mov dword [ebp - 0x1c], esi
push 0x4993fc
lea eax, [ebp - 0x1c]
push eax
call fcn.0043276d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 4
push 0x1000
lea edi, [eax + eax + 2]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, esi
jne 0x410f71
mov dword [ebp - 0x20], esi
push 0x4993fc
lea eax, [ebp - 0x20]
jmp 0x410f36
push esi
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x410f91
mov dword [ebp - 0x24], esi
push 0x4993fc
lea eax, [ebp - 0x24]
jmp 0x410f36
push 0x491828
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x410fbc
mov dword [ebp - 0x28], esi
push 0x4993fc
lea eax, [ebp - 0x28]
jmp 0x410f36
push esi
push esi
push ebx
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, esi
jne 0x41100e
mov dword [ebp - 0x2c], esi
push 0x4993fc
lea eax, [ebp - 0x2c]
jmp 0x410f36
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.00433374
ret 8

Function at 0x4110d6
Capabilities:
Enumerate gui resources

Disassembly:
push 0x2c
mov eax, 0x47f001
call fcn.00433305
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x38], eax
cmp edi, ecx
je 0x41110d
mov ebx, ecx
sub ebx, ecx
sar ebx, 2
shl ebx, 2
push ebx
push ecx
push edi
call fcn.0042cf30
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x38]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
and dword [ebp - 4], eax
push str.XLMAIN
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], esi
call fcn.00402011
lea eax, [ebp - 0x34]
push eax
push 0x411029
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [esi + 4]
sub ebx, dword [esi]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
sar ebx, 2
call fcn.00402144
mov eax, ebx
call fcn.00433388
ret

Function at 0x4111c9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x4111ff
cmp word [esi], bx
je 0x4111ff
push ebx
push esi
call fcn.0042e775
pop ecx
pop ecx
test eax, eax
jne 0x4111ff
cmp word [esi], bx
je 0x411202
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x411202
test al, 0x10
je 0x411202
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x411208
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
push ebx
push esi
push edi
push 9
xor eax, eax
mov ebx, ecx
pop ecx
push dword [ebp + 8]
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x491870
push eax
mov esi, edx
call fcn.0042d8fd
add esp, 0xc
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x4112c0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4112c0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x4112c0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x4112c0
mov ecx, dword [esi + 0x10]
inc eax
cmp eax, ecx
ja 0x411296
or ecx, 0xffffffff
call fcn.0040961d
jmp 0x4112a2
push ebx
mov ebx, eax
sub ebx, ecx
mov edi, esi
call fcn.0040fc10
or ecx, 0xffffffff
xor eax, eax
call fcn.0040961d
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, esi
call fcn.0040986c
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cc90
leave
ret

Function at 0x4112d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov esi, ecx
call fcn.0042ef80
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x411324
sub eax, ecx
sar eax, 1
lea ecx, [ebp - 0x210]
call fcn.00401f96
cmp dword [esi + 0x14], 8
jb 0x411348
mov eax, dword [esi]
jmp 0x41134a
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042cc90
leave
ret
Function at 0x411357
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x808], edi
call fcn.00401ca8
lea eax, [ebp - 0x808]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push edi
push eax
call fcn.0042ef80
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
cmp dword [ebp - 0x808], edi
je 0x411471
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push str.TEMP
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411465
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411405
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp - 0x804]
call fcn.00401f96
push 0xc
mov edi, str._SystemRoot_
push edi
xor eax, eax
mov ecx, esi
call fcn.0040a5c9
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411464
push 0x400
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x411464
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.00430afd
pop ecx
push eax
push ebx
push esi
call fcn.0040e12a
pop ebx
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042cc90
leave
ret
Function at 0x4114e7
Capabilities:
Get common file path

Disassembly:
push 0x87c
mov eax, 0x47ef8b
call fcn.00433305
mov eax, dword [ebp + 8]
mov dword [ebp - 0x884], eax
xor eax, eax
xor ebx, ebx
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0x888], ebx
call fcn.0042ef80
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea esi, [ebp - 0x848]
call fcn.00402ed2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x834], 8
mov eax, dword [ebp - 0x848]
jae 0x41155d
mov eax, esi
mov ecx, dword [ebp - 0x838]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x411580
xor edi, edi
push 0x4911a8
inc edi
lea eax, [ebp - 0x848]
call fcn.004028aa
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], ebx
mov word [ebp - 0x864], cx
mov dword [ebp - 0x818], eax
xor eax, eax
mov dword [ebp - 0x81c], ebx
mov word [ebp - 0x82c], ax
push 8
lea eax, [ebp - 0x864]
mov byte [ebp - 4], 2
call fcn.0040da89
lea ecx, [ebp - 0x848]
push ecx
lea ecx, [ebp - 0x880]
push ecx
mov ebx, eax
call fcn.0041169e
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x82c]
mov byte [ebp - 4], 3
call fcn.0040299c
push 1
xor edi, edi
lea esi, [ebp - 0x880]
mov byte [ebp - 4], 2
call fcn.00402144
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x41160f
lea eax, [ebp - 0x82c]
push 0
push eax
call fcn.0042e775
pop ecx
pop ecx
test eax, eax
jne 0x411640
push 1
xor edi, edi
lea esi, [ebp - 0x82c]
call fcn.00402144
push 1
lea esi, [ebp - 0x864]
call fcn.00402144
xor ebx, ebx
jmp 0x411580
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x411655
lea eax, [ebp - 0x82c]
push eax
call fcn.0042e33d
mov esi, dword [ebp - 0x884]
pop ecx
lea ebx, [ebp - 0x82c]
call fcn.004029ef
push 1
xor edi, edi
mov esi, ebx
call fcn.00402144
push 1
lea esi, [ebp - 0x864]
call fcn.00402144
push 1
lea esi, [ebp - 0x848]
call fcn.00402144
mov eax, dword [ebp - 0x884]
call fcn.00433388
ret
Function at 0x413a60
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480a50
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 0xf
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.00410d53
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x2c]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.00402a81
lea esi, [ebp - 0x48]
call fcn.00410e43
add esp, 0x1c
mov esi, eax
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x413b27
cmp dword [ebp - 0x18], 0x10
jb 0x413ae9
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042cc85
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [esi + 0x14], 0x10
jae 0x413b0c
mov edx, dword [esi + 0x10]
inc edx
push edx
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0042cf30
add esp, 0xc
jmp 0x413b13
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov dword [esi], ebx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp dword [ebp - 0x34], 0x10
jb 0x413b39
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0042cc85
add esp, 4
mov edx, dword [ebp - 0x1c]
inc edx
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 0x2c]
mov edi, 0x10
cmp dword [ebp - 0x18], edi
jae 0x413b5f
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
inc edx
push edx
push ecx
push eax
call fcn.0042f000
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 0x18], edi
jb 0x413b9b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0042cc85
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cc90
mov esp, ebp
pop ebp
ret
Function at 0x414d20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x20a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x20c], ax
call fcn.0042ef80
mov edx, dword [edi + 0x18]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
mov eax, dword [edi + 0x1c]
lea edx, [ebp - 0x218]
push edx
push ebx
mov dword [ebp - 0x214], eax
mov eax, dword [edi]
push 0x44b
lea ecx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x210], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea edx, [ebp - 0x254]
lea ecx, [ebp - 0x20c]
push edx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], 5
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [esi + 0xb4]
pop ebx
cmp ecx, dword [esi + 0xb8]
je 0x414e31
mov eax, dword [ecx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0042cc90
mov esp, ebp
pop ebp
ret
Function at 0x415430
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47fdfa
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4a0234]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x4a0234]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
mov word [esp + 0x20], ax
mov eax, ecx
mov ebx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x415483
sub eax, esi
sar eax, 1
lea esi, [esp + 0x20]
call fcn.00401f96
mov ecx, dword [ebp + 8]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x50], edi
mov eax, dword [ebx + 0xc8]
mov edx, esi
cmp edx, eax
jae 0x415578
mov ecx, dword [ebx + 0xc4]
cmp ecx, edx
ja 0x415578
mov edi, esi
sub edi, ecx
cmp eax, dword [ebx + 0xcc]
jne 0x4154db
lea ecx, [ebx + 0xc4]
call fcn.004025b6
mov esi, dword [ebx + 0xc8]
and edi, 0xffffffe0
add edi, dword [ebx + 0xc4]
test esi, esi
je 0x415622
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp esi, edi
je 0x415570
cmp dword [esi + 0x14], 8
jb 0x41551a
mov ecx, dword [esi]
push ecx
call fcn.0042cc85
add esp, 4
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], dx
cmp dword [edi + 0x14], 8
jae 0x415547
mov eax, dword [edi + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push edi
push esi
call fcn.0042cf30
add esp, 0xc
jmp 0x415551
mov edx, dword [edi]
mov dword [esi], edx
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], dx
mov eax, dword [edi + 0x1c]
jmp 0x41561f
cmp eax, dword [ebx + 0xcc]
jne 0x41558b
lea ecx, [ebx + 0xc4]
call fcn.004025b6
mov esi, dword [ebx + 0xc8]
cmp esi, edi
je 0x415622
xor ecx, ecx
lea edx, [esp + 0x20]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], cx
cmp esi, edx
je 0x41561b
cmp dword [esi + 0x14], 8
jb 0x4155c1
mov eax, dword [esi]
push eax
call fcn.0042cc85
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], cx
cmp dword [esp + 0x34], 8
jae 0x4155f0
mov edx, dword [esp + 0x30]
lea eax, [edx + edx + 2]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.0042cf30
add esp, 0xc
jmp 0x4155fa
mov edx, dword [esp + 0x20]
mov dword [esi], edx
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x14], ecx
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], dx
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x1c], eax
add dword [ebx + 0xc8], 0x20
cmp dword [esp + 0x34], 8
jb 0x41563d
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0042cc85
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0042cc90
mov esp, ebp
pop ebp
ret 4
Function at 0x41e550
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47eca2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a0234]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], esi
call fcn.0044d850
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], 2
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.0045ed70
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xc
call fcn.0045ed70
mov byte [esi + 0x5c], 1
lea edi, [esi + 0x60]
mov dword [ebp - 4], 0xd
push 1
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.0044d850
lea eax, [edi + 0x10]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, 0x10
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
lea eax, [edi + 0x60]
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
mov byte [ebp - 4], 0xf
mov eax, dword [edi + 0xac]
push eax
call fcn.004690e0
mov dword [edi], vtable.CryptoPP::SHA1.0
add esp, 4
mov dword [esi], vtable.CryptoPP::PK_MessageAccumulatorImpl_class_CryptoPP::SHA1_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042cc90
mov esp, ebp
pop ebp
ret
Function at 0x41ea60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d186
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a0234]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], ebx
je 0x41ea9e
mov dword [esi + 8], 0x491fd4
mov eax, dword [esi + 8]
mov dword [esi + 4], vtable.CryptoPP::X509PublicKey.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 8], vtable.CryptoPP::X509PublicKey.0
mov edx, dword [esi + 8]
mov dword [esi + 4], vtable.CryptoPP::DL_KeyImpl_class_CryptoPP::X509PublicKey__class_CryptoPP::DL_GroupParameters_DSA__class_CryptoPP::OID_.1.0
mov eax, dword [edx + 4]
mov dword [eax + esi + 8], vtable.CryptoPP::DL_KeyImpl_class_CryptoPP::X509PublicKey__class_CryptoPP::DL_GroupParameters_DSA__class_CryptoPP::OID_.0
push ebx
lea ecx, [esi + 0xc]
mov dword [esi + 0x14], 0x491fcc
call fcn.0041ec40
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], vtable.CryptoPP::DL_GroupParameters_DSA.2.0
mov dword [esi + 0x10], vtable.CryptoPP::DL_GroupParameters_DSA.1.0
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x14], vtable.CryptoPP::DL_GroupParameters_DSA.0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov edx, dword [esi + 8]
mov dword [esi], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_DSA_.2.0
mov dword [esi + 4], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_DSA_.1.0
mov eax, dword [edx + 4]
lea edi, [esi + 0x80]
mov dword [eax + esi + 8], vtable.CryptoPP::DL_PublicKeyImpl_class_CryptoPP::DL_GroupParameters_DSA_.0
lea ecx, [edi + 4]
mov dword [ebp + 8], edi
mov dword [edi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.0045ed70
mov byte [ebp - 4], 1
lea ecx, [edi + 0x1c]
mov dword [edi + 0x18], ebx
call fcn.0045ed70
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4