joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563df9
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004bc070
mov byte [ebp - 4], 2
mov edx, eax
push 0x58d734
lea ecx, [ebp - 0x58]
call fcn.00419d80
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.004c11e0
add esp, 4
mov byte [ebp - 4], 5
cmp dword [ebp - 0x44], 8
jb 0x4bc3c4
push dword [ebp - 0x58]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2c], 8
jb 0x4bc3ed
push dword [ebp - 0x40]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, esi
cmp eax, 0xffffffff
je 0x4bc438
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00404450
jmp 0x4bc442
push 0x58d0e4
call fcn.00403ff0
mov dword [ebp - 0x5c], 1
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
jb 0x4bc45e
push dword [ebp - 0x28]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
cmp dword [ebp + 0x1c], 8
jb 0x4bc482
push dword [ebp + 8]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], eax
mov word [ebp + 8], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret

Function at 0x4bc5b0
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x563ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0xc]
call fcn.004bc4b0
add esp, 4
mov dword [esp + 0x30], 0
cmp dword [esp + 0x18], 0
jbe 0x4bc61f
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bc61f
mov bl, 1
jmp 0x4bc621
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x4bc63c
push dword [esp + 8]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
mov al, bl
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
Function at 0x4c8170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565c72
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0
call fcn.0051fe20
push eax
push 4
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.00522afa
add esp, 0x10
test eax, eax
jne 0x4c81ed
push eax
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], eax
push 0x584694
mov byte [edi], al
call fcn.004027f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
jmp 0x4c832e
movzx ebx, byte [ebp - 0x2d]
movzx eax, byte [ebp - 0x2e]
shl ebx, 8
add ebx, eax
mov eax, dword [ebp - 0x30]
shl ebx, 8
movzx ecx, ah
add ebx, ecx
movzx eax, al
shl ebx, 8
add ebx, eax
cmp ebx, 0x40000000
jbe 0x4c8247
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x584694
mov byte [edi], 0
call fcn.004027f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
jmp 0x4c832e
push ebx
call fcn.0051a596
mov esi, eax
call fcn.0051fe20
push eax
push ebx
push 1
push esi
call fcn.00522afa
add esp, 0x14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
push ebx
push esi
mov byte [ebp - 0x28], 0
call fcn.004027f0
mov dword [ebp - 4], 1
push esi
call fcn.0051f88d
mov dword [edi + 0x14], 0xf
add esp, 4
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x14], 0x10
jae 0x4c82c8
mov eax, dword [ebp - 0x18]
inc eax
je 0x4c82e2
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0051ed00
add esp, 0xc
jmp 0x4c82e2
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
mov dword [edi], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x14], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
jb 0x4c831c
push dword [ebp - 0x28]
call fcn.00443e80
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
Function at 0x4c8350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565ca8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x5bf500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x648158], 0
je 0x4c83d3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00402660
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004c80c0
push eax
call dword [0x648158]
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esi + 0x10]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, ebx
shr eax, 0x18
push 0x648140
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xd], al
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0051fe20
add eax, 0x20
push eax
push 4
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.005209cf
add esp, 0x10
cmp dword [esi + 0x14], 0x10
jb 0x4c841d
mov esi, dword [esi]
call fcn.0051fe20
add eax, 0x20
push eax
push ebx
push 1
push esi
call fcn.005209cf
call fcn.0051fe20
add eax, 0x20
push eax
call fcn.0052028b
add esp, 0x14
push 0x648140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x566260
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
movss xmm0, dword [ebp + 8]
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0x10]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [ebp + 0x14]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
movss dword [esp + 0x18], xmm0
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x4ca1d3
jmp dword [eax*4 + 0x4ca2e0]
xor ebx, ebx
cmp byte [esp + 0x14], bl
setne bl
jmp 0x4ca28f
mov ebx, dword [esp + 0x14]
jmp 0x4ca28f
cvttsd2si ebx, qword [esp + 0x14]
jmp 0x4ca28f
push dword [esp + 0x18]
mov dword [esp + 0x4c], 0
lea ecx, [esp + 0x3c]
push dword [esp + 0x18]
mov dword [esp + 0x54], 0
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
call fcn.004027f0
mov byte [esp + 0x60], 1
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x24]
call fcn.00406f40
mov byte [esp + 0x60], 0
cmp dword [esp + 0x4c], 0x10
jb 0x4ca25d
push dword [esp + 0x38]
call fcn.00443e80
add esp, 4
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x4c], 0xf
cmovae eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.005203c8
add esp, 4
mov ebx, eax
jmp 0x4ca28f
xor ebx, ebx
mov dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4ca2aa
push dword [esp + 0x20]
call fcn.00443e80
add esp, 4
mov dword [esp + 0x34], 0xf
mov eax, ebx
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
Function at 0x4cc890
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566812
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x214], 0
mov edi, dword [ecx]
mov dword [ebp - 0x21c], esi
test edi, edi
je 0x4cc911
push 0x100
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00525d00
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0xff
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00403ff0
jmp 0x4cc969
mov edx, dword [ecx + 4]
test edx, edx
je 0x4cc95d
mov ecx, dword [edx]
mov eax, 3
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x218]
push eax
sub esp, 0x10
mov dword [ebp - 0x224], 0
movdqu xmm0, xmmword [ebp - 0x22c]
mov eax, esp
push edx
movdqu xmmword [eax], xmm0
call dword [ecx + 0x2c]
test eax, eax
js 0x4cc95d
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4cc95d
push eax
jmp 0x4cc962
push 0x58d0e4
mov ecx, esi
call fcn.00403ff0
mov dword [ebp - 4], 0
mov dword [ebp - 0x214], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret 4
Function at 0x4e1200
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [str.DEFAULT_ASO_MUTEX]
push edi
mov edi, ecx
lea ecx, [ebp - 0xc]
mov dword [edi], vtable.Mutex.0
call fcn.004e7480
xor ecx, ecx
lea edx, [ebp - 0xc]
test al, al
push esi
cmove edx, ecx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
test eax, eax
jne 0x4e1256
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Mutex:CreateMutex_failed_error67_lasterror_d
call fcn.004d8e40
add esp, 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
je 0x4e127d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Mutex:WaitForSingleObject_failed_error68_rc_d_lasterror_d
call fcn.004d8e40
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e25b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [str.DEFAULT_ASO_SHARED_DATA]
push esi
push edi
push str.kernel32.dll
mov dword [ebp - 0x80c], ebx
or esi, 0xffffffff
mov dword [0x6489b0], 0
mov dword [0x6489ac], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4e2664
push str.WTSGetActiveConsoleSessionId
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e2617
call eax
mov esi, eax
or eax, 0xffffffff
cmp esi, 0xffffffff
cmove esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0xffffffff
je 0x4e2664
push esi
push ebx
push str.Global_s__d
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0051f5fe
add esp, 0x14
lea eax, [ebp - 0x804]
push eax
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor bl, bl
mov dword [0x6489ac], eax
test eax, eax
jne 0x4e26f1
mov ebx, dword [ebp - 0x80c]
push ebx
push str.Local_s
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0051f5fe
add esp, 0x10
lea ecx, [ebp - 0x818]
call fcn.004e7480
test al, al
je 0x4e2780
lea ecx, [ebp - 0x805]
mov byte [ebp - 0x805], 0
call fcn.004e7080
lea eax, [ebp - 0x804]
push eax
push 0x25280
push 0
push 4
lea eax, [ebp - 0x818]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x6489ac], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne bl
call fcn.004e7380
mov esi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call esi
cmp dword [0x6489ac], 0
je 0x4e2780
jmp 0x4e26f7
mov esi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea ecx, [ebp - 0x805]
mov byte [ebp - 0x805], 0
call fcn.004e7080
push 0
push 0
push 0
push 6
push dword [0x6489ac]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6489b0], eax
call fcn.004e7380
call esi
mov eax, dword [0x6489b0]
test eax, eax
jne 0x4e275b
push dword [0x6489ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov dword [0x6489ac], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret 4
test bl, bl
je 0x4e2780
push 0x25280
push 0
push eax
call fcn.00525d00
add esp, 0xc
call fcn.004e7440
mov ecx, dword [0x6489b0]
mov dword [ecx + 0x25074], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051ece9
mov esp, ebp
pop ebp
ret 4
Function at 0x4e3910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569770
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
mov eax, dword [ebp + 8]
jne 0x4e3a02
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4e3959
call dword [sym.imp.KERNEL32.dll_DebugBreak]
sub esp, 0x18
xor edx, edx
mov ecx, esp
mov dword [ebp - 0x5c], esp
mov eax, 0x16
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
cmp byte [str.Object_not_Initialized], dl
cmove eax, edx
push eax
push str.Object_not_Initialized
call fcn.004027f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.004e37c0
mov esi, eax
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.0051fa77
mov byte [ebp - 4], 2
lea eax, [esi + 0xc]
push 0xffffffffffffffff
push 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x34], vtable.encryptionerror.0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00402660
push 0x5bc210
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 1
push eax
call fcn.00524e20
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x4e3a23
mov edi, dword [ebp + 0xc]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x4e3a11
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret 8
Function at 0x4e65c0
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push 0xd0
push 0
lea edi, [esi + 0x120]
mov dword [esi], 3
push edi
mov byte [esi + 0x1c], 0
call fcn.00525d00
mov eax, dword [esi]
add esp, 0xc
dec eax
cmp eax, 4
ja case.default.0x4e65f6
jmp dword [eax*4 + 0x4e6694]
movdqu xmm0, xmmword [0x58c414]
movdqu xmmword [edi], xmm0
mov eax, dword [0x58c424]
mov dword [edi + 0x10], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x20
push 0x58c6f0
push edi
call fcn.005256b0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x20
push 0x58c850
push edi
call fcn.005256b0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x40
push 0x58c428
push edi
call fcn.005256b0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x40
push 0x58c810
push edi
call fcn.005256b0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Invalid_SHA_TYPE_type_
lea ecx, [ebp - 0xc]
call fcn.00407df0
push 0x5bbe38
lea eax, [ebp - 0xc]
push eax
call fcn.00524e20
std
dec esi
add byte [ecx], bl
dec si
add byte [ecx], dh
dec si
add byte [ecx + 0x66], cl
dec esi
add byte [ecx + 0x66], ah
dec esi
add ah, cl
int3
Function at 0x4e7380
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00535d00
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0x1008], 0x7ff
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4e73df
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
mov ecx, str.SYSTEM
lea eax, [ebp - 0x1004]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e7427
test dx, dx
je 0x4e7412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e7427
add eax, 4
add ecx, 4
test dx, dx
jne 0x4e73f0
xor eax, eax
test eax, eax
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
sbb eax, eax
or eax, 1
test eax, eax
sete al
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret

Function at 0x4e7620
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4e768f
cmp dword [ebp - 0x108], 2
jne 0x4e768f
cmp dword [ebp - 0x114], 5
jne 0x4e768f
cmp dword [ebp - 0x110], 1
jne 0x4e768f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
Function at 0x4e7dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569c89
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
push 0
mov dword [esp + 0x14], ebx
call fcn.004eaa60
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov eax, dword [esp + 0x24]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x24], eax
mov al, byte [esp + 0x2c]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::HashFilter.0
mov dword [ebx + 4], vtable.CryptoPP::HashFilter.1.0
mov byte [ebx + 0x28], al
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [esp + 0x28], 3
mov byte [ecx], 0
call fcn.00402660
push 0xffffffffffffffff
lea ecx, [ebx + 0x4c]
mov byte [esp + 0x20], 4
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.00402660
mov eax, dword [esp + 0x30]
mov byte [esp + 0x1c], 5
test eax, eax
jns 0x4e7e93
mov ecx, dword [ebx + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4e7eac
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x28]
mov dword [ebx + 0xc], ecx
jmp 0x4e7eb3
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xc], eax
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x4e7fe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x569cce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 1
push dword [esp + 0x30]
call fcn.004e7c70
mov eax, dword [esp + 0x20]
mov dword [edi], vtable.CryptoPP::ProxyFilter.0
mov dword [edi + 4], vtable.CryptoPP::ProxyFilter.1.0
mov dword [esp + 0x18], 0
mov dword [edi + 0x44], eax
mov byte [esp + 0x18], 1
test eax, eax
je 0x4e808c
push 0x14
call fcn.0051f5ad
mov esi, eax
add esp, 4
mov dword [esp + 0x2c], esi
mov byte [esp + 0x18], 2
test esi, esi
je 0x4e8079
push 0
mov ecx, esi
call fcn.004eaa60
mov dword [esi], vtable.CryptoPP::OutputProxy.0
mov dword [esi + 4], vtable.CryptoPP::OutputProxy.1.0
mov dword [esi + 0xc], edi
mov byte [esi + 0x10], 0
jmp 0x4e807b
xor esi, esi
mov ecx, dword [edi + 0x44]
push esi
mov byte [esp + 0x1c], 1
mov eax, dword [ecx]
call dword [eax + 0xac]
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x4e80b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569d23
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x64]
push 0
mov dword [esp + 0x10], esi
call fcn.004eaa60
mov eax, dword [esp + 0x68]
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esp + 0x5c], 3
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
cmp byte [esp + 0x70], 0
mov byte [esp + 0x5c], 6
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 0x54], edi
jne 0x4e81d2
push 0
push 0x5c1a08
push 0x5c5fcc
push 0
push edi
call fcn.005255cc
add esp, 0x14
test eax, eax
je 0x4e81d2
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x3c]
call fcn.004025d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 7
call fcn.0051fa9a
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x40]
mov byte [esp + 0x64], 8
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], vtable.CryptoPP::Exception.0
mov dword [esp + 0x28], 1
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call fcn.00402660
push 0x5bc084
lea eax, [esp + 0x14]
mov byte [esp + 0x60], 7
push eax
mov dword [esp + 0x18], vtable.CryptoPP::InvalidArgument.0
call fcn.00524e20
push 1
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x40]
push str.BlockPaddingScheme
push eax
call fcn.004e7960
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x60], 9
call fcn.004e9220
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x5c], 6
test ecx, ecx
je 0x4e820b
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0051ece9
add esp, 0x54
ret 0x10

Function at 0x4e8350
Capabilities:
Access peb ldr_data

Disassembly:
sub ecx, 4
jmp method.CryptoPP::FilterWithBufferedInput.virtual_0
push 0xffffffffffffffff
push 0x569d88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
mov dword [esp + 0x1c], 0
call fcn.00443e80
mov ecx, dword [esi + 0xc]
add esp, 4
mov dword [esp + 0x18], 0xffffffff
test ecx, ecx
je 0x4e83ab
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [esp + 0x20], 1
je 0x4e83bb
push esi
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4