joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e526da0
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e5d94e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x4e526eac
mov edx, dword [ebp - 0x1c]
movzx eax, byte [edx + 0x23c]
test eax, eax
je 0x4e526e04
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
call fcn.4e524ca0
add esp, 8
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov byte [edx + 0x23c], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x230
call fcn.4e524fb0
movzx eax, al
test eax, eax
jne 0x4e526e80
mov dword [ebp - 0x20], 0
jmp 0x4e526e2b
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x230
call fcn.4e526fa0
cmp dword [ebp - 0x20], eax
jae 0x4e526e72
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x230
call fcn.4e526fc0
cmp dword [eax], 0
je 0x4e526e70
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x230
call fcn.4e526fc0
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4e526e22
mov ecx, dword [ebp - 0x1c]
add ecx, 0x230
call fcn.4e525700
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x4e526ea7
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 8], 0
jmp 0x4e526f34
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 0x218]
test ecx, ecx
je 0x4e526f34
mov edx, dword [ebp - 0x1c]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e526f34
mov byte [ebp - 0x18], 0x5b
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x5d
mov byte [ebp - 0x15], 0x20
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x68
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x20
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov eax, dword [ebp - 0x1c]
add eax, 0x10
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.4e511f20
push eax
call fcn.4e51a330
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret
Function at 0x4e52a1f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5ac960
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4e5d94e0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
mov eax, dword [ecx]
jne 0x4e52a257
push dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
push dword [ebp + 0xc]
call eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret 0xc
lea edx, [esp + 0x48]
push edx
call dword [eax + 8]
push 0x4e5bdf6c
mov edx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x74], 0
call fcn.4e529440
add esp, 4
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x74], 1
call fcn.4e5179f0
lea ecx, [esp + 8]
mov byte [esp + 0x70], 0
call fcn.4e514380
push 0x4e5d3278
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], vtable.CryptoPP::BufferedTransformation::NoChannelSupport.0
call fcn.4e58a47b
int3
Function at 0x4e52b4e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, edx
push 0
mov dword [esp + 0x18], ebx
mov ebp, ecx
call fcn.4e5227f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52b51d
test ecx, ecx
je 0x4e52b50e
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52b50e
and edx, ebp
jmp 0x4e52b514
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x4e52b54c
push 0
call fcn.4e5227f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52b559
test ecx, ecx
je 0x4e52b53d
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52b53d
and edx, ebx
jmp 0x4e52b543
mov eax, ebx
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52b559
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
jmp 0x4e52b68a
push 0
call fcn.4e5227f0
mov ecx, dword [esp + 0x28]
mov esi, eax
add esp, 4
cmp esi, 1
je 0x4e52b595
test esi, esi
je 0x4e52b57d
lea edx, [esi - 1]
test esi, edx
jne 0x4e52b57d
and edx, ecx
jmp 0x4e52b583
mov eax, ecx
xor edx, edx
div esi
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52b595
mov edx, dword [esp + 0x28]
jmp 0x4e52b68a
mov edx, dword [esp + 0x28]
push edi
mov edi, edx
xor esi, esi
shr edi, 2
mov dword [esp + 0x10], esi
test edi, edi
je 0x4e52b67c
cmp edi, 4
jb 0x4e52b63a
lea eax, [ecx - 4]
mov dword [esp + 0x10], esi
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x4e52b5ce
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ecx
jae 0x4e52b63a
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp ebp, eax
ja 0x4e52b5e2
lea eax, [ebp - 4]
lea eax, [eax + edi*4]
cmp eax, ebx
jae 0x4e52b63a
mov esi, ebp
sub esi, ebx
mov dword [esp + 0x1c], esi
mov eax, edi
and eax, 3
mov dword [esp + 0x14], edi
sub dword [esp + 0x14], eax
mov esi, ecx
sub esi, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov eax, ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [ecx]
movdqu xmm1, xmmword [edx + eax]
movdqu xmm0, xmmword [eax]
add esi, 4
pxor xmm1, xmm0
movdqu xmmword [ebx + eax], xmm1
lea eax, [eax + 0x10]
cmp esi, dword [esp + 0x14]
jb 0x4e52b610
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
cmp esi, edi
jae 0x4e52b67c
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
sub ebx, ecx
sub edi, eax
add eax, edi
mov dword [esp + 0x20], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
lea esi, [ecx + esi*4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + esi]
xor eax, dword [esi]
lea esi, [esi + 4]
mov dword [ebx + esi - 4], eax
dec edi
jne 0x4e52b661
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
shl esi, 2
pop edi
sub edx, esi
je 0x4e52b6a1
add ebp, esi
add ebx, esi
add ecx, esi
test edx, edx
je 0x4e52b6a1
sub ebx, ecx
sub ebp, ecx
mov al, byte [ecx + ebx]
xor al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + ebp - 1], al
dec edx
jne 0x4e52b692
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4e52b6b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0
mov esi, edx
mov ebp, ecx
xor bl, bl
call fcn.4e5227f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52b6eb
test ecx, ecx
je 0x4e52b6dc
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52b6dc
and edx, ebp
jmp 0x4e52b6e2
mov eax, ebp
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
je 0x4e52b71a
push 0
call fcn.4e5227f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x4e52b720
test ecx, ecx
je 0x4e52b70b
lea edx, [ecx - 1]
test ecx, edx
jne 0x4e52b70b
and edx, esi
jmp 0x4e52b711
mov eax, esi
xor edx, edx
div ecx
neg edx
sbb edx, edx
inc edx
test edx, edx
jne 0x4e52b720
mov ecx, dword [esp + 0x18]
jmp 0x4e52b78a
mov ecx, dword [esp + 0x18]
push edi
mov edi, ecx
xor ebx, ebx
shr edi, 2
xor eax, eax
mov dword [esp + 0x10], ebx
test edi, edi
je 0x4e52b759
mov ecx, ebp
mov edx, esi
sub ecx, esi
mov dword [esp + 0x14], edi
mov eax, dword [ecx + edx]
xor eax, dword [edx]
lea edx, [edx + 4]
or ebx, eax
dec edi
jne 0x4e52b740
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
shl eax, 2
pop edi
sub ecx, eax
jne 0x4e52b76f
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
add ebp, eax
add esi, eax
shr ebx, 0x18
mov eax, edx
shr eax, 0x10
or bl, al
mov eax, edx
shr eax, 8
or bl, al
or bl, dl
test ecx, ecx
je 0x4e52b79d
sub ebp, esi
mov al, byte [esi + ebp]
xor al, byte [esi]
lea esi, [esi + 1]
or bl, al
dec ecx
jne 0x4e52b790
pop esi
xor eax, eax
test bl, bl
pop ebp
sete al
pop ebx
add esp, 8
ret

Function at 0x4e52dfd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad0a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x44]
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x20]
call fcn.4e52ddd0
lea ecx, [esi + 0xc]
push ecx
mov edx, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0
call fcn.4e52de10
add esp, 8
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519730
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x4e52e070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad0a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x1c]
push eax
call fcn.4e52dc80
lea edx, [esi + 0xc]
push edx
mov edx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.4e52de10
add esp, 4
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519730
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 4

Function at 0x4e52e830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5acff0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d94e0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.4e5187a0
mov ecx, dword [ebp + 8]
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], vtable.CryptoPP::BERGeneralDecoder.1.0
mov dword [esp + 0x10], vtable.CryptoPP::BERGeneralDecoder.0
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 0
mov eax, dword [ecx]
lea edx, [esp + 0xb]
push edx
call dword [eax + 0x48]
test eax, eax
je 0x4e52e8c2
cmp byte [esp + 0xb], 0x30
jne 0x4e52e8c2
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x25]
push eax
lea edx, [esp + 0x30]
call fcn.4e52bc00
add esp, 4
test al, al
jne 0x4e52e8c7
call fcn.4e52ba50
mov dword [esp + 0xc], vtable.CryptoPP::BERSequenceDecoder.1.0
mov dword [esp + 0x10], vtable.CryptoPP::BERSequenceDecoder.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 1
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
call dword [eax + 4]
lea ecx, [esp + 0xc]
call fcn.4e52c260
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52c1e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e52e940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5ad068
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d94e0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.4e544450
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x3000
mov dword [esp + 8], vtable.CryptoPP::DERSequenceEncoder.1.0
mov dword [esp + 0xc], vtable.CryptoPP::DERSequenceEncoder.0
lea ecx, [esi + 8]
mov dword [esp + 0x48], 0
mov eax, dword [ecx]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
lea ecx, [esp + 8]
call fcn.4e52c460
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52c3e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x4e52fbc0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5acc18
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4e5d94e0]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call fcn.4e52fed0
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4e52fc40
push 0x4e5be84c
lea ecx, [esp + 0xc]
call fcn.4e514340
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x5c], 0
call fcn.4e52fa00
push 0x4e5d3388
lea eax, [esp + 0x24]
push eax
call fcn.4e58a47b
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret 8

Function at 0x4e52fc60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad200
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x30]
push edi
lea ecx, [esp + 0x14]
call fcn.4e51c820
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.4e51c890
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.4e519570
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
push edi
push esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call fcn.4e52fbc0
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
call fcn.4e519590
mov esi, dword [ebx]
push edi
lea ecx, [esp + 0x14]
call fcn.4e51c890
push eax
mov ecx, ebx
call dword [esi + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.4e51c860
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x4e5307d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad611
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.4e53cd70
push dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.4e53e0d0
mov ecx, dword [esp + 0x30]
push eax
call fcn.4e53cd70
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.4e519730
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 8

Function at 0x4e5308f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad611
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0x10]
push eax
call fcn.4e5307d0
lea ecx, [esi + 0xc]
mov dword [esp + 0x28], 1
push ecx
mov ecx, dword [esp + 0x34]
mov edx, eax
call fcn.4e52de10
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.4e519730
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x4e530980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad0a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x14]
shl edx, 5
lea ecx, [esp + 0x1c]
call fcn.4e53cff0
lea ecx, [esi + 0xc]
push ecx
mov edx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.4e52de10
add esp, 4
push eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x3c], 1
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x38], 0
call fcn.4e519730
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x4e530ca0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e5ad5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.4e5187a0
push 0
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [esp + 0x48]
lea ecx, [esp + 0x24]
mov dword [esi], vtable.CryptoPP::StringStore.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.1.0
call fcn.4e518980
push 1
push eax
lea eax, [esp + 0x14]
push str.InputBuffer
push eax
mov byte [esp + 0x48], 1
call fcn.4e521bd0
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x3c], 2
call fcn.4e528e20
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.4e519150
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.4e519130
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x4e53d880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e5ad7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e5d94e0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
call fcn.4e544450
mov eax, dword [ebp + 8]
mov dword [esp + 8], vtable.CryptoPP::DERGeneralEncoder.1.0
mov dword [esp + 0xc], vtable.CryptoPP::DERGeneralEncoder.0
mov dword [esp + 0x30], eax
mov word [esp + 0x34], 0x200
push 1
sub esp, 8
mov ecx, esi
mov dword [esp + 0x54], 0
call fcn.4e53d570
add esp, 4
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.4e53d770
lea ecx, [esp + 8]
call fcn.4e52c460
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0xffffffff
call fcn.4e52c3e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.4e587fd7
mov esp, ebp
pop ebp
ret 4

Function at 0x4e53fe00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5adcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52dd90
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e53ff00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5adcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52ddb0
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e540000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5adcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52ddd0
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x4e5401a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5adcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52ddf0
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e540220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5adcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e5d94e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x30]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.4e52de10
add esp, 4
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x28], 0
call fcn.4e53d0d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.4e519730
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x4e541490
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ecx
mov dword [esp + 4], eax
test ebp, ebp
je 0x4e541552
mov ecx, dword [esp + 0x10]
push ebx
movzx ebx, byte [eax + 0x118]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [eax + 0x114]
movzx eax, byte [eax + 0x119]
cmp ecx, esi
jne 0x4e541502
jmp 0x4e5414d0
movzx edx, byte [ebx + edi]
add eax, edx
and eax, 0xff
inc ebx
movzx ecx, byte [eax + edi]
mov byte [ebx + edi - 1], cl
add ecx, edx
and ecx, 0xff
mov byte [eax + edi], dl
mov cl, byte [ecx + edi]
xor byte [esi], cl
and ebx, 0xff
lea esi, [esi + 1]
dec ebp
jne 0x4e5414d0
jmp 0x4e54153f
sub esi, ecx
movzx edx, byte [ebx + edi]
add eax, edx
and eax, 0xff
inc ebx
movzx ecx, byte [eax + edi]
mov byte [ebx + edi - 1], cl
add ecx, edx
mov byte [eax + edi], dl
mov edx, dword [esp + 0x1c]
and ecx, 0xff
inc edx
mov cl, byte [ecx + edi]
xor cl, byte [edx - 1]
and ebx, 0xff
mov byte [esi + edx - 1], cl
mov dword [esp + 0x1c], edx
dec ebp
jne 0x4e541504
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov byte [ecx + 0x118], bl
mov byte [ecx + 0x119], al
pop ebx
pop ebp
pop ecx
ret 0xc