joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov al, byte [ebp + 8]
push ebx
push esi
push edi
and al, 0xf
mov dword [ebp - 8], edx
mov edi, ecx
mov byte [ebp - 1], al
mov ebx, edx
mov esi, 0x10
sub ebx, edi
nop
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec esi
jne 0x4026c0
mov eax, dword [ebp + 0xc]
mov dword [0x63995c], edi
test eax, eax
je 0x4026e6
mov dword [0x639a10], eax
call fcn.004020a0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
test eax, eax
mov esi, dword [0x639a14]
cmovne esi, eax
mov eax, dword [ebp + 8]
mov dword [0x639a14], esi
test eax, eax
je 0x402765
dec eax
shr eax, 4
inc eax
mov dword [ebp + 8], eax
lea esp, [esp]
mov ebx, edx
mov ecx, edi
sub ebx, edi
mov edx, 0x10
jmp 0x402720
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edx
jne 0x402720
mov dword [0x63995c], edi
call fcn.00402500
mov eax, edi
sub esi, edi
mov edx, 0x10
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x402740
mov edx, dword [ebp - 8]
add edi, 0x10
mov esi, edx
add edx, 0x10
dec dword [ebp + 8]
mov dword [ebp - 8], edx
jne 0x402710
mov dword [0x639a14], esi
mov bl, byte [ebp - 1]
test bl, bl
je 0x4027a4
mov ecx, edi
sub edx, edi
mov esi, 0x10
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec esi
jne 0x402775
movzx ecx, bl
mov eax, 0x10
sub eax, ecx
push eax
push esi
lea eax, [ecx + edi]
push eax
call fcn.00582c30
add esp, 0xc
mov dword [0x63995c], edi
call fcn.00402500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4034f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a8b00
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6281c0]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
push 0x24
push str.AlgorithmParametersBase:_parameter__
mov dword [esp + 0x14], edi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00406080
push esi
lea edx, [esp + 0x14]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x44]
call fcn.00406750
push str.__not_used
mov edx, eax
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x30]
call fcn.00406750
add esp, 8
mov esi, eax
mov ecx, edi
mov byte [esp + 0x68], 2
call fcn.0057f195
mov byte [esp + 0x68], 3
lea ecx, [edi + 0x10]
push 0xffffffffffffffff
mov dword [edi], vtable.CryptoPP::Exception.0
mov dword [edi + 0xc], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00405dd0
cmp dword [esp + 0x3c], 0x10
jb 0x4035d3
push dword [esp + 0x28]
call fcn.00455d1e
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x4035fb
push dword [esp + 0x40]
call fcn.00455d1e
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x403623
push dword [esp + 0x10]
call fcn.00455d1e
add esp, 4
mov eax, edi
mov dword [edi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0057f07f
mov esp, ebp
pop ebp
ret 4

Function at 0x403e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8c1e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6281c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::Grouper.1.0
mov dword [esi + 4], vtable.CryptoPP::Grouper.0
mov dword [esi + 0x1c], 0
call fcn.00406300
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [esi + 0x28], 0
call fcn.00406300
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x403ef1
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41e0f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab366
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6281c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x220]
call fcn.00407380
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push dword [ebp - 0x220]
or edi, 0xffffffff
push 0x80000001
call dword [0x5c0028]
cmp dword [ebp + 8], 0
je 0x41e22b
test eax, eax
jne 0x41e1b1
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x5c047c]
lea eax, [ebp - 0x218]
push eax
call dword [0x5c0404]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.TiCode
push dword [ebp - 0x21c]
call dword [0x5c0024]
jmp 0x41e240
call fcn.00456a6e
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x41e1cd
push 0x80004005
call fcn.00407730
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x224], esi
push 0x6d
mov byte [ebp - 4], 1
call fcn.00456c38
test eax, eax
je 0x41e200
push 0x6d
push eax
lea ecx, [ebp - 0x224]
call fcn.004070f0
mov esi, dword [ebp - 0x224]
push 0
push 0
push esi
mov ecx, ebx
call fcn.00459ccd
add esi, 0xfffffff0
mov byte [ebp - 4], 0
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41e24c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41e24c
test eax, eax
jne 0x41e24c
push str.TiCode
push dword [ebp - 0x21c]
call dword [0x5c0018]
push dword [ebp - 0x21c]
call dword [0x5c0020]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x41e270
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057f07f
mov esp, ebp
pop ebp
ret 4
Function at 0x435db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad5ee
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [edi], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.004360c0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
push eax
push 0
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004360c0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x435ed8
test dl, 0x10
jne 0x435ed8
mov eax, 1
jmp 0x435eda
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.00435f70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x437660
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x437a14

Function at 0x439060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x439091
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x439080
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x43d7f0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ada98
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6281c0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00405dd0
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.0043d710
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x43d86d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0057f132
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x43d896
push dword [esp + 0x10]
call fcn.00455d1e
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0057f07f
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4433c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae4cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6281c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.Json::BuiltStyledStreamWriter.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
push 0xffffffffffffffff
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], 0x4a
push 0
push dword [ebp + 8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00405dd0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x4c]
push 0xffffffffffffffff
mov byte [ebp - 4], 3
mov dword [esi + 0x48], eax
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00405dd0
push 0xffffffffffffffff
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
push 0
push dword [ebp + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00405dd0
push 0xffffffffffffffff
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
push 0
push dword [ebp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00405dd0
mov ecx, dword [ebp + 0x1c]
mov al, byte [esi + 0x94]
and cl, 1
and al, 0xf8
shl cl, 2
or cl, al
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x98], eax
mov eax, esi
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x444810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ae6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x5fd6f8
lea ecx, [esp + 0x10]
call fcn.0043e5c0
push 0x5fd6a4
push str.commentStyle
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
push 0x5f97c4
lea ecx, [esp + 0x10]
call fcn.0043e5c0
push 0x5fd697
push str.indentation
mov ecx, esi
mov dword [esp + 0x38], 1
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
mov byte [esp + 0x14], 5
and dword [esp + 0x14], 0xfffffeff
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0xc], 0
push 0x5fd6bf
push str.enableYAMLCompatibility
mov ecx, esi
mov dword [esp + 0x38], 2
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
mov byte [esp + 0x14], 5
and dword [esp + 0x14], 0xfffffeff
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0xc], 0
push 0x5fd6d4
push str.dropNullPlaceholders
mov ecx, esi
mov dword [esp + 0x38], 3
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
mov byte [esp + 0x14], 5
and dword [esp + 0x14], 0xfffffeff
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0xc], 0
push 0x5fd6e8
mov dword [esp + 0x34], 4
mov ecx, esi
push str.useSpecialFloats
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
mov byte [esp + 0x14], 1
and dword [esp + 0x14], 0xfffffeff
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0x11
mov dword [esp + 0x10], 0
push 0x5fd6f5
push str.precision
mov ecx, esi
mov dword [esp + 0x38], 5
call fcn.0043f770
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, eax
call fcn.0043e960
lea ecx, [esp + 0xc]
call fcn.0043e870
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5af0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6281c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.0044b270
add esp, 4
mov esi, eax
push 0x5fcf9c
mov edx, edi
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x30]
call fcn.0044b630
add esp, 4
push esi
mov edx, eax
mov byte [esp + 0x84], 1
lea ecx, [esp + 0x18]
call fcn.0044b100
add esp, 4
push str._is_not_a_valid_key_length
mov edx, eax
mov byte [esp + 0x84], 2
lea ecx, [esp + 0x48]
call fcn.00406750
add esp, 4
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.0057f195
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00405dd0
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x44b501
push dword [esp + 0x44]
call fcn.00455d1e
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x44b529
push dword [esp + 0x14]
call fcn.00455d1e
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x44b551
push dword [esp + 0x2c]
call fcn.00455d1e
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x44b579
push dword [esp + 0x5c]
call fcn.00455d1e
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0057f07f
add esp, 0x74
ret 8

Function at 0x44bfd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5af158
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xc], eax
mov dword [esp + 8], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esp + 0x14], 2
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xffffffff
mov byte [esi + 0x24], 0
mov dword [esi + 0x2c], 0
call fcn.00406300
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x44c0b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5af1a3
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6281c0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0xc], 0
mov dword [esp + 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esp + 0x60], 2
xor ecx, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x2c], 0
call fcn.00406300
mov dword [esi + 0x30], 0
mov byte [esp + 0x60], 3
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x44c183
cmp dword [esi + 0x1c], 1
jb 0x44c183
cmp dword [esi + 0x20], 0xffffffff
je 0x44c183
push eax
push 1
lea ecx, [esi + 0x28]
call fcn.0044bda0
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0057f07f
add esp, 0x58
ret 0x10
push 0x2c
push str.FilterWithBufferedInput:_invalid_buffer_size
lea ecx, [esp + 0x44]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
call fcn.00406080
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], 4
call fcn.0057f195
push 0xffffffffffffffff
mov byte [esp + 0x64], 5
lea eax, [esp + 0x40]
push 0
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], vtable.CryptoPP::Exception.0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00405dd0
push 0x623068
lea eax, [esp + 0x18]
mov byte [esp + 0x64], 4
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::InvalidArgument.0
call fcn.005825ff
int3

Function at 0x44d6e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5af46c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0044d7a0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44d76e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x44d78c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x44ef00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5af46c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6281c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 1
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
push edx
call fcn.0044efc0
mov dword [esi], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esi + 4], 0
mov byte [esp + 0x28], 2
mov cl, byte [eax + 8]
mov byte [esi + 8], cl
mov edi, dword [eax + 4]
mov dword [eax + 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x44ef8e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov byte [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x44efac
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x44f980
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx esi, byte [eax + str.cw]
mov edx, esi
mov ecx, esi
shr edx, 7
imul edi, edx, 0x1b000000
shl ecx, 0x19
imul edx, edx, 0x11b
xor edi, ecx
mov ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or edi, ecx
lea ecx, [esi + esi]
xor edx, ecx
xor ecx, ecx
xor edx, esi
or ecx, edi
or edx, edi
mov dword [eax*8 + 0x636fb0], ecx
mov dword [eax*8 + 0x636fb4], edx
inc eax
cmp eax, 0x100
jl 0x44f984
xorps xmm0, xmm0
pop edi
movlpd qword [0x6377b8], xmm0
movlpd qword [0x6377b0], xmm0
mov byte [0x636fa0], 1
pop esi
ret

Function at 0x44f9f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
lea ecx, [ecx]
movzx edi, byte [edx + 0x5f7000]
mov eax, edi
mov dword [esp + 0x10], edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [esp + 0x14], eax
and ebx, 2
shr edi, 7
and edx, 4
imul eax, edi, 0x1b000000
lea ebp, [ecx + ecx]
mov dword [esp + 0x18], edx
xor ebp, dword [esp + 0x10]
mov edx, esi
shl ebp, 0x19
and esi, 1
shl ecx, 2
and edx, 2
xor ebp, eax
xor ecx, dword [esp + 0x10]
imul eax, dword [esp + 0x14], 0x1b000000
shl ecx, 8
xor ebp, eax
imul eax, ebx, 0x1b000000
xor ebp, eax
imul eax, esi, 0x1b000000
xor ebp, eax
imul eax, edx, 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x18], 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x14], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
mov esi, dword [esp + 0x18]
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [esp + 0x10]
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*8]
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b0000
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, esi, 0x11b0000
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*4]
xor ecx, eax
imul eax, edi, 0x11b
add ecx, ecx
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
xor ecx, eax
imul eax, esi, 0x11b
xor ecx, eax
xor eax, eax
xor ecx, edx
or edx, ebp
or ecx, ebp
or eax, edx
mov edx, dword [esp + 0x1c]
mov dword [edx*8 + 0x639a30], eax
mov dword [edx*8 + 0x639a34], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x44fa00
pop edi
pop esi
pop ebp
mov byte [0x636fa1], 1
pop ebx
add esp, 0x10
ret