joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x19
push 0x64f5c8
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416460
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00416a60
cmp dword [esp + 0x1c], 0x10
jb 0x401072
mov ecx, dword [esp + 8]
push ecx
call fcn.005c5896
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x32
push str.Integer:_no_integer_satisfies_the_given_parameters
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416460
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00416a60
cmp dword [esp + 0x1c], 0x10
jb 0x401102
mov ecx, dword [esp + 8]
push ecx
call fcn.005c5896
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61924b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0xc]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov bl, byte [esp + 0x30]
mov dword [esp + 0x20], 1
cmp bl, al
je 0x401f8a
mov ebp, dword [esp + 0x2c]
push ebp
mov ecx, edi
call fcn.004135f0
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
push ebp
push eax
push ecx
push edx
call fcn.005c53ca
add esp, 0x10
jmp 0x401f98
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov eax, esi
mov byte [esi], bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x40f550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61ab30
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.0
call fcn.0040f5e0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005c5ea5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4118f0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x61b211
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.0040e960
mov ebx, 1
mov dword [esp + 0x30], ebx
mov esi, dword [esp + 0x38]
mov ecx, esi
call fcn.0040e960
mov eax, dword [esp + 0x3c]
push eax
push esi
mov ecx, edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.004115e0
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
add esp, 8
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x41197b
call fcn.005ebc82
jmp 0x411980
call fcn.005c8c7b
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4119a0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x61b1d1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x38]
mov ecx, esi
call fcn.0040e960
mov dword [esp + 0x30], ebx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.0040e960
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov edx, esi
mov dword [esp + 0x38], ebx
call fcn.004115e0
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ecx, edx
add edx, edx
add esp, 8
xor eax, eax
add edx, edx
mov edi, ebx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x411a2e
call fcn.005ebc82
jmp 0x411a33
call fcn.005c8c7b
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4141c0
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x619f60
mov eax, dword fs:[0]
push eax
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x48], 0x10
mov byte [ecx + 0x41], dl
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
Function at 0x4145e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619af1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 1
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.00415020
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.0042cbb0
mov byte [esp + 0x20], 0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], 1
test ecx, ecx
je 0x41466a
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x414ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61a151
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push 1
push eax
push 0x65aa50
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.004151b0
push eax
mov ecx, esi
call fcn.0042cbb0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x414b68
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x414b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61a108
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0x6b0178
push edx
call eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0040ea40
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, ecx
add edx, edx
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x414bf0
call fcn.005ebc82
jmp 0x414bf5
call fcn.005c8c7b
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x18
Function at 0x415fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416460
lea eax, [esp + 4]
push eax
push 1
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00416a60
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x416058
mov ecx, dword [esp + 8]
push ecx
call fcn.005c5896
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x418bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
jbe 0x418be2
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
jmp 0x418bd0
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
sub ecx, 1
jne 0x418bd0
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x418c0b
add edx, eax
add esi, eax
test edi, edi
jbe 0x418c0b
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x418c00
pop edi
pop esi
pop ebx
ret

Function at 0x418c10
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
jbe 0x418c56
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
sub ecx, 1
mov dword [edi + eax - 4], ebp
jne 0x418c38
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x418c81
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
jbe 0x418c81
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
sub edi, 1
mov byte [eax + esi - 1], dl
jne 0x418c72
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4192d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61aed0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x30]
push ebp
mov dword [esp + 0x18], ebp
call fcn.00414250
add esp, 4
test ebp, ebp
jne 0x419311
xor esi, esi
jmp 0x41931c
push ebp
call fcn.00418db0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], vtable.CryptoPP::NonblockingRng.0
push ebp
push esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 3
call fcn.00419230
mov byte [esp + 0x24], 0
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
push esi
mov ecx, edi
call edx
xor al, al
mov edi, esi
mov ecx, ebp
push esi
rep stosb byte es:[edi], al
call fcn.005c8c7b
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8

Function at 0x4199a0
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x619fb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov esi, 0x10
mov dword [ecx + 0x48], esi
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov byte [ecx + 0x49], dl
mov edx, ecx
neg edx
and edx, 0xf
add edx, ecx
mov dword [ecx + 0x50], esi
mov dword [ecx + 0x54], edx
mov edi, dword [eax + 0xb4]
mov ecx, 8
mov esi, 0x65bb48
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41bee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [eax + 0x8c]
push edi
add ecx, 8
mov edi, 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x654330]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654530]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654730]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x654930]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x654430]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654630]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654830]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x654a30]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x654330]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654530]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654730]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x654930]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x654430]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654630]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x654830]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x654a30]
xor esi, ebx
sub edi, 1
jne 0x41bf02
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x41e630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x619f36
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.0040e960
xor eax, eax
mov dword [esp + 0x18], eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
call fcn.0040e960
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.0041f690
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x4270d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6194a8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x61], 1
mov dword [esp + 0x68], eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push ecx
mov edx, eax
xor edi, edi
mov dword [esp + 0x80], edi
push 0x3c
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call fcn.005c53ca
mov eax, 0x3c
sub eax, esi
push eax
lea ecx, [esp + esi + 0x38]
push edi
push ecx
call fcn.005c5560
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x38]
call fcn.0041b230
mov eax, dword [esp + 0x88]
add esp, 0x20
shr esi, 2
mov dword [eax + esi*4], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov edi, 8
xor ecx, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0xf
xor edx, edx
lea eax, [edi + 5]
mov ebx, 0xf
div ebx
mov eax, edi
mov edi, 0xf
mov esi, dword [esp + 0x68]
mov ebx, edx
xor edx, edx
div edi
mov eax, dword [esi + ebx*4]
mov edi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x14], edi
xor eax, dword [esi + edx*4]
mov edx, dword [esp + 0x10]
add edx, ecx
rol eax, 3
xor eax, edx
xor dword [ecx + esi], eax
add ecx, 4
sub dword [esp + 0x18], 1
jne 0x427188
mov edi, 4
xor ecx, ecx
xor edx, edx
lea eax, [ecx + 0xe]
mov ebx, 0xf
div ebx
mov esi, dword [esp + 0x68]
inc ecx
mov eax, dword [esi + edx*4]
and eax, 0x1ff
mov edx, dword [eax*4 + 0x652ac0]
add edx, dword [esi + ecx*4 - 4]
rol edx, 9
mov dword [esi + ecx*4 - 4], edx
cmp ecx, ebx
jb 0x4271d3
sub edi, 1
jne 0x4271d1
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov eax, ecx
mov edi, 0xf
div edi
mov edi, dword [esp + 0x68]
mov eax, dword [ebx + 0xbc]
add ecx, 4
add esi, 4
mov edx, dword [edi + edx*4]
mov dword [esi + eax - 4], edx
cmp ecx, 0x28
jb 0x427211
inc dword [esp + 0x10]
mov dword [esp + 0x1c], esi
cmp esi, 0xa0
jb 0x427175
mov edi, 0x14
mov eax, dword [ebx + 0xbc]
mov ecx, dword [eax + edi]
add eax, edi
mov dword [esp + 0x1c], eax
mov edx, ecx
or edx, 3
mov esi, edx
not esi
mov eax, edx
shr eax, 1
xor eax, esi
lea ebx, [edx + edx]
xor ebx, esi
and eax, ebx
and eax, 0x7ffffffe
mov esi, eax
shr esi, 1
and eax, esi
mov esi, eax
shr esi, 2
and eax, esi
mov ebx, dword [esp + 0x20]
mov esi, eax
shr esi, 4
and eax, esi
lea esi, [eax + eax]
or eax, esi
and ecx, 3
lea esi, [eax*4]
or eax, esi
mov esi, dword [ecx*4 + 0x652ee4]
mov ecx, dword [esp + 0x1c]
mov cl, byte [ecx - 4]
rol esi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and esi, ecx
and esi, 0x7ffffffc
xor esi, edx
mov edx, dword [ebx + 0xbc]
mov dword [edi + edx], esi
add edi, 8
cmp edi, 0x94
jb 0x427251
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x24]
cmp edi, eax
jne 0x4272f1
mov ecx, dword [esp + 0x64]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42dbf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61a49b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x78]
xor ebx, ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x6c], 4
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 6
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 0x54], eax
cmp byte [esp + 0x80], bl
jne 0x42dcc5
push ebx
push 0x6b1b08
push 0x6b12e8
push ebx
push eax
call fcn.005c9aa3
add esp, 0x14
test eax, eax
je 0x42dcc5
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00416460
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x74], 7
call fcn.00416a60
push 0x67cfa4
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], vtable.CryptoPP::InvalidArgument.0
call fcn.005c5906
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.BlockPaddingScheme
call fcn.0042eaa0
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x70], 8
call fcn.0042d3c0
mov byte [esp + 0x6c], 6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x42dcfe
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x64
ret 0x10
Function at 0x42e540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x619c29
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], 2
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x18], 4
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00416950
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 5
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00416950
mov eax, dword [esp + 0x2c]
cmp eax, ebx
mov byte [esp + 0x18], 6
jge 0x42e5f5
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x42e610
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
jmp 0x42e617
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x42eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61a151
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.0042eb40
push eax
mov ecx, esi
call fcn.0042cbb0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x42eb22
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret