joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d08d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ff9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [str.UserDict.pyc]
xor edi, edi
cmp byte [eax], 0xa
je 0x4d09df
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, 0x63acf0
push 4
push str.lib_
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0045a6b0
mov dword [esp + 0x38], 0
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x4d095a
xor eax, eax
jmp 0x4d0969
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0960
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0045b740
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
push 0
cmovae eax, dword [esp + 0x14]
push eax
call fcn.005c767a
add esp, 8
test eax, eax
jne 0x4d09ff
cmp dword [esp + 0x24], 0x10
lea esi, [esp + 0x10]
lea ecx, [esp + 0x10]
cmovae esi, dword [esp + 0x10]
cmovae ecx, dword [esp + 0x10]
push esi
push ecx
call ebx
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x4d09c7
push dword [esp + 0x10]
call fcn.004d6210
add esp, 4
inc edi
mov eax, dword [edi*4 + 0x63acf0]
lea esi, [edi*4 + 0x63acf0]
cmp byte [eax], 0xa
jne 0x4d0922
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005c46a4
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x24], 0x10
jb 0x4d0a12
push dword [esp + 0x10]
call fcn.004d6210
add esp, 4
xor al, al
jmp 0x4d09e1
Function at 0x4d0a30
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x69a450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x104]
mov dword [ebp - 0x408], ecx
push eax
push 0x100
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x104]
cmp byte [eax + ecx - 1], 0x5c
je 0x4d0a93
mov edi, ecx
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4d0a80
mov ax, word [0x655d6c]
mov word [edi], ax
lea ecx, [ebp - 0x104]
dec ecx
lea ebx, [ebx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4d0aa0
mov eax, dword [str.metin2client.dat]
mov dword [ecx], eax
mov eax, dword [0x655d4c]
mov dword [ecx + 4], eax
mov eax, dword [0x655d50]
mov dword [ecx + 8], eax
mov eax, dword [0x655d54]
mov dword [ecx + 0xc], eax
mov al, byte [0x655d58]
push ebx
mov byte [ecx + 0x10], al
call fcn.00469380
mov ebx, eax
lea edi, [ebp - 0x404]
mov edx, ebx
sub edi, ebx
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x4d0ae3
push 7
lea eax, [ebp - 0x404]
push str.locale_
push eax
call fcn.005c648d
add esp, 0xc
test eax, eax
jne 0x4d0b22
lea ecx, [ebx + 7]
lea edx, [ebp - 0x404]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4d0b15
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x104]
push eax
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push 0
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp byte [ebp - 0x304], 0
pop ebx
jne 0x4d0bb3
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x408]
push dword [0x6eff54]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp byte [ebp - 0x304], 0
jne 0x4d0bb3
lea eax, [ebp - 0x104]
push eax
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push 0
push esi
push 0x655d98
call edi
cmp byte [ebp - 0x304], 0
jne 0x4d0bb3
lea ecx, [ebp - 0x304]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4d0ba6
lea eax, [ebp - 0x408]
mov ecx, 0x6eff58
push eax
call fcn.0048b370
cmp byte [ebp - 0x304], 0
mov esi, eax
jne 0x4d0bd3
xor ecx, ecx
jmp 0x4d0be9
lea ecx, [ebp - 0x304]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d0be0
sub ecx, edx
push ecx
lea eax, [ebp - 0x304]
mov ecx, esi
push eax
call fcn.0045a6b0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.005c46a4
mov esp, ebp
pop ebp
ret
Function at 0x4d1740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ffb17
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push 0
call fcn.005c6e30
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add eax, esi
push eax
call fcn.00526ff0
add esp, 4
call fcn.00526f90
push eax
call fcn.005c6b69
add esp, 4
push 1
call fcn.00525ae0
add esp, 4
push 0
push str.perf_game_update.txt
call fcn.005c767a
add esp, 8
test eax, eax
jne 0x4d17ce
push str.perf_game_update.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.newpatch.exe
call fcn.005c767a
add esp, 8
test eax, eax
jne 0x4d17f5
push str.patchupdater.exe
call fcn.005c7f06
add esp, 4
xor al, al
jmp 0x4d1984
call dword [sym.imp.DevIL.dll_ilInit]
call fcn.004d1d50
test eax, eax
je 0x4d17ee
push 0
call fcn.00525a90
mov eax, dword [0x6f2bec]
add esp, 4
test al, 1
jne 0x4d184b
or eax, 1
mov dword [0x6f2bec], eax
mov ecx, 0x6f2bf0
mov dword [esp + 0x58], 0
call fcn.00527000
push 0x60d0a0
call fcn.005c501f
mov dword [esp + 0x5c], 0xffffffff
add esp, 4
mov eax, dword [0x6f2bec]
test al, 2
jne 0x4d187e
or eax, 2
mov dword [0x6f2bec], eax
mov ecx, 0x6f2bf8
mov dword [esp + 0x58], 1
call fcn.00556790
push 0x60d090
call fcn.005c501f
add esp, 4
mov dword [esp + 0x58], 0xffffffff
call fcn.004d0cb0
test al, al
jne 0x4d189f
push 0
push 0
push str.Pack_Initialization_failed._Check_log.txt_file..
call fcn.00525930
add esp, 0xc
xor al, al
jmp 0x4d1984
call fcn.0045e590
test al, al
je 0x4d18b6
call fcn.00469360
push eax
call fcn.0054cd20
add esp, 4
push 0x27820
call fcn.005c46b3
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x58], 2
test eax, eax
je 0x4d18de
mov ecx, eax
call fcn.0046dc80
mov esi, eax
jmp 0x4d18e0
xor esi, esi
push ebx
mov ecx, esi
mov dword [esp + 0x5c], 0xffffffff
call fcn.0053c740
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.005bb680
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], 3
call fcn.00488da0
lea eax, [esp + 0x24]
mov byte [esp + 0x58], 4
push eax
call fcn.005bbdd0
add esp, 4
lea ecx, [esp + 0x14]
push str.eter.python
call fcn.005bb730
test al, al
je 0x4d193d
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.004d1160
mov bl, al
mov ecx, esi
call fcn.004702c0
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea ecx, [esp + 0x14]
call sub.python27.dll_Py_Finalize
lea ecx, [esp + 0x24]
call fcn.00488e50
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], 0xffffffff
call fcn.005bb6a0
mov ecx, esi
call fcn.004702d0
test esi, esi
je 0x4d1982
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005c46a4
mov esp, ebp
pop ebp
ret
Function at 0x4d2f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ffe30
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push 0
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0xc]
push 0x69e6ec
push edx
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x18], vtable.CryptoPP::ArraySink.1.0
movlpd qword [esp + 0x2c], xmm0
call dword [eax + 0x28]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005c46a4
mov esp, ebp
pop ebp
ret 8

Function at 0x4d59e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600388
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.004d5850
add esp, 4
mov esi, eax
push 0x656394
lea eax, [esp + 0x30]
mov dword [esp + 0x84], 0
push edi
push eax
call fcn.00499a90
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x88], 1
push eax
call fcn.004d5720
add esp, 0xc
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x88], 2
push eax
call fcn.00466f90
add esp, 0xc
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.005ceb31
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.0045abf0
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x4d5ae1
push dword [esp + 0x44]
call fcn.004d6210
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x4d5b09
push dword [esp + 0x14]
call fcn.004d6210
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x4d5b31
push dword [esp + 0x2c]
call fcn.004d6210
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x4d5b59
push dword [esp + 0x5c]
call fcn.004d6210
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.005c46a4
add esp, 0x74
ret 8
Function at 0x4d6040
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, esi
shr edi, 2
test edi, edi
je 0x4d6086
mov esi, ebp
mov dword [esp + 0x10], edi
mov edx, ecx
sub esi, ecx
jmp 0x4d6070
mov eax, dword [esi + edx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
dec edi
jne 0x4d6070
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x4d609a
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add ecx, eax
mov edx, ebx
mov eax, ebx
shr edx, 0x18
shr eax, 0x10
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
test esi, esi
je 0x4d60ce
sub ebp, ecx
lea esp, [esp]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
dec esi
jne 0x4d60c0
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret

Function at 0x4d7230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6004fb
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x64]
mov dword [esi + 0xc], eax
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], 0
mov dword [esp + 0x5c], 2
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
push 0
mov dword [esi + 0x2c], 0
call fcn.004d4570
mov dword [esi + 0x30], 0
mov dword [esp + 0x60], 3
push 0
mov dword [esi + 0x4c], 0
call fcn.004d4570
add esp, 8
mov dword [esi + 0x50], 0
cmp byte [esp + 0x70], 0
mov byte [esp + 0x5c], 4
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 0x54], edi
jne 0x4d7329
push 0
push 0x6add40
push 0x6add14
push 0
push edi
call fcn.005cf06a
add esp, 0x14
test eax, eax
je 0x4d7329
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x14]
call fcn.0045b870
lea eax, [esp + 0x10]
mov byte [esp + 0x5c], 5
push eax
lea ecx, [esp + 0x2c]
call fcn.004d56a0
push 0x67ddc0
lea eax, [esp + 0x2c]
push eax
call fcn.005c8210
push ecx
lea eax, [esp + 0x70]
mov edx, str.BlockPaddingScheme
push eax
lea ecx, [esp + 0x18]
call fcn.004d8160
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x60], 6
call fcn.004d6990
mov byte [esp + 0x5c], 4
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4d7360
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005c46a4
add esp, 0x54
ret 0x10
Function at 0x4d7b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600609
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov dword [ebx + 0xc], 0
mov dword [esp + 0x14], ebx
mov dword [ebx + 0x14], 0
mov dword [esp + 0x20], 2
push 0
mov dword [ebx + 0x1c], 0
call fcn.004d4570
add esp, 4
mov dword [ebx + 0x20], 0
mov eax, dword [esp + 0x28]
lea ecx, [ebx + 0x34]
mov byte [esp + 0x20], 3
mov dword [ebx + 0x24], eax
mov al, byte [esp + 0x30]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::HashFilter.1.0
mov dword [ebx + 4], vtable.CryptoPP::HashFilter.0
mov byte [ebx + 0x28], al
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.0045abf0
push 0xffffffffffffffff
lea ecx, [ebx + 0x4c]
mov byte [esp + 0x24], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.0045abf0
mov eax, dword [esp + 0x34]
mov byte [esp + 0x20], 5
test eax, eax
jns 0x4d7c58
mov ecx, dword [ebx + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4d7c71
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 0xc], ecx
jmp 0x4d7c78
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x18

Function at 0x4d8160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6006ac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.004d8220
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4d81ee
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x4d820c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4d8a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600780
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.0045a6b0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.005ceb31
mov byte [esp + 0x30], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x10]
mov dword [esi + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0045abf0
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x4d8b46
push dword [esp + 0xc]
call fcn.004d6210
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005c46a4
add esp, 0x2c
ret

Function at 0x4d98b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x600928
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.005049c0
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x30], 0
call fcn.005010e0
mov edx, dword [esp + 0x18]
mov ebx, eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
mov ecx, edx
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push esi
cmp ecx, 0x10
jb 0x4d9921
call fcn.005fa578
jmp 0x4d9926
call fcn.005c663b
mov eax, ebx
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x4d9a80
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6007e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x3c]
shl eax, 5
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
call fcn.004d8dc0
lea ecx, [esi + 0xc]
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x38]
push ecx
push eax
push esi
call fcn.004d9130
mov edx, dword [esp + 0x28]
xor eax, eax
mov ebx, dword [esp + 0x2c]
mov ecx, edx
mov edi, ebx
add esp, 0xc
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x4d9b03
call fcn.005fa578
jmp 0x4d9b08
call fcn.005c663b
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x4d9e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600998
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x40]
push 0
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x10], 0
mov dword [esi], vtable.CryptoPP::StringStore.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.1.0
mov dword [esp + 0x20], 0
call fcn.004d4570
add esp, 4
mov dword [esp + 0x20], 0
test edi, edi
je 0x4d9ea1
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d9e96
sub ecx, edx
jmp 0x4d9ea3
xor ecx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
mov byte [esp + 0xc], 0
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x3c], 3
push eax
lea eax, [esp + 0x2c]
push str.InputBuffer
push eax
call fcn.004d4670
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x3c], 4
call fcn.004d7ef0
mov byte [esp + 0x38], 3
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4d9ef1
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [esp + 0x20]
xor al, al
mov ecx, dword [esp + 0x1c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.005c663b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x4da0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6009d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x69a450]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x69a450]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x1f
push str.CryptoPP:_invalid_group_element
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0045a6b0
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.005ceb31
mov byte [esp + 0x38], 1
lea ecx, [esi + 0x10]
push 0xffffffffffffffff
mov dword [esi], vtable.CryptoPP::Exception.0
lea eax, [esp + 0x14]
mov dword [esi + 0xc], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0045abf0
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidDataFormat.0
jb 0x4da15c
push dword [esp + 0x10]
call fcn.004d6210
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::DL_BadElement.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005c46a4
mov esp, ebp
pop ebp
ret