joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425247
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x130
mov eax, 0x5dc028
call fcn.00518baf
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov esi, ecx
push eax
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x78], esi
call fcn.005aa517
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x6c], ebx
jne 0x42528b
mov byte [ebp - 0x6d], bl
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00410446
mov al, byte [ebp - 0x6d]
call fcn.00518c32
ret 4
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00411468
mov eax, esi
add esi, 0xffffffdc
neg eax
sbb eax, eax
and eax, esi
mov byte [ebp - 4], 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42543f
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0040fb18
mov byte [ebp - 4], 2
call dword [sym.imp.USER32.dll_EmptyClipboard]
call int.004b2f99
cmp eax, 6
setg byte [ebp - 0x6d]
cmp byte [ebp - 0x6d], bl
je 0x4252f9
cmp dword [ebp - 0x34], 8
mov esi, dword [ebp - 0x38]
lea esi, [esi + esi + 2]
jb 0x4252f4
mov eax, dword [ebp - 0x48]
jmp 0x42534b
lea eax, [ebp - 0x48]
jmp 0x42534b
sub esp, 0x1c
lea eax, [ebp - 0x4c]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.00411468
lea eax, [ebp - 0x94]
push eax
call fcn.004a041b
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040f4da
push ebx
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.00410560
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
inc esi
cmp dword [ebp - 0x18], 0x10
jae 0x42534b
lea eax, [ebp - 0x2c]
push esi
push 2
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x42542e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x425427
push esi
push dword [ebp - 0x74]
push eax
call fcn.005167a0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp - 0x6d], bl
push edi
je 0x4253a8
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0x78]
push 0xffffffffffffffff
mov esi, eax
push ebx
lea eax, [ebp - 0x4c]
push eax
add ecx, 0x14
call fcn.004103b3
jmp 0x4253f7
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
sub esp, 0x1c
mov esi, eax
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.0041079f
lea eax, [ebp - 0x94]
push eax
call fcn.004a04d1
add esp, 0x20
mov ecx, dword [ebp - 0x78]
push 0xffffffffffffffff
push ebx
push eax
add ecx, 0x14
mov byte [ebp - 4], 4
call fcn.004103b3
push ebx
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.00410446
cmp esi, ebx
jne 0x42542e
push str.SetClipboardData_failed___.Clipboard.cpp__113_
lea ecx, [ebp - 0x13c]
call fcn.00403dd0
push eax
mov byte [ebp - 4], 5
call fcn.004b0b95
pop ecx
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 2
call fcn.00401451
jmp 0x42542e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00410560
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00410446
mov byte [ebp - 0x6d], 1
jmp 0x425275
Function at 0x42b246
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5dd0fa
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x60]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x44], ebx
call fcn.00509b00
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 1
call fcn.0042b480
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.0042a3a4
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
call fcn.0050d560
lea ecx, [esp + 0x20]
call fcn.0042a3a4
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42dee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d7c75
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6dd9a4]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0042dff1
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00419178
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.00410560
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005112a7
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x432cd5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x432cec
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x432d21
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x432d1d
cmp edi, eax
jae 0x432d21
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x432d0f
cmp edi, eax
jb 0x432d25
xor eax, eax
jmp 0x432d2f
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x436242
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5d7b77
call fcn.00518baf
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x436354
cmp byte [esi + 0x42], bl
je 0x436354
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x43627e
xor al, al
jmp 0x436356
push ebx
push 8
lea ecx, [ebp - 0x30]
call fcn.00401ea3
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041bdf0
mov ecx, eax
call fcn.00415897
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041bdf0
mov ecx, eax
call fcn.00415897
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4362ee
dec eax
je 0x4362f2
dec eax
dec eax
je 0x436350
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00410560
mov al, bl
jmp 0x436356
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041bdf0
mov ecx, eax
call fcn.00415897
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x436332
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041bdf0
mov ecx, eax
call fcn.00415897
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00513a1b
add esp, 0x10
cmp edi, eax
jne 0x4362dc
cmp byte [esi + 0x42], 0
je 0x436350
test edi, edi
jne 0x43628c
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00410632
jmp 0x43628c
mov bl, 1
jmp 0x4362de
mov al, 1
call fcn.00518c32
ret

Function at 0x438aff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [eax - 0x30]
and esi, ecx
cmp byte [eax + 0x1c], 0
je 0x438b42
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 8], 2
jne 0x438b33
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x438b48
cmp dword [ebp + 8], 0
jne 0x438b42
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 1
je 0x438b60
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
add esi, 0x30
push esi
call fcn.00438b88
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4479b9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [eax - 0x34]
and esi, ecx
cmp byte [eax + 0x1c], 0
je 0x4479fc
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 8], 2
jne 0x4479ed
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x447a02
cmp dword [ebp + 8], 0
jne 0x4479fc
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 1
je 0x447a1a
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
add esi, 0x34
push esi
call fcn.00447aa1
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x44878a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x731adc], 0
jne 0x4487ec
push esi
push edi
mov byte [ebp - 4], 0
mov esi, bind
xor eax, eax
mov cl, 0x80
mov dl, byte [ebp - 4]
test dl, cl
je 0x4487af
xor eax, esi
test esi, eax
je 0x4487bc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4487be
add eax, eax
shr cl, 1
jne 0x4487a6
push eax
call fcn.004487ee
push dword [ebp - 4]
mov edi, eax
call fcn.00448812
inc byte [ebp - 4]
movzx eax, al
pop ecx
pop ecx
mov dword [eax*4 + 0x731ae0], edi
jne 0x4487a2
pop edi
mov byte [0x731adc], 1
pop esi
leave
ret
Function at 0x464310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5db75f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x38], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
lea edi, [esi + 0x54]
mov byte [esp + 0x38], 2
mov ecx, edi
mov byte [esi + 0x50], 0xff
call fcn.0041aac2
mov dword [edi], vtable.boost::io::basic_altstringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x3c], ebx
mov byte [edi + 0x40], bl
mov dword [edi + 0x44], 3
mov byte [esi + 0xa0], bl
cmp ebp, ebx
mov byte [esp + 0x38], 4
je 0x4643fb
mov eax, ebp
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4643c0
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.0041072d
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x3c], 5
call fcn.00464e80
cmp dword [esp + 0x2c], 0x10
jb 0x4643fb
mov ecx, dword [esp + 0x18]
push ecx
call fcn.005112a2
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x4659f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5da5c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
mov esi, ecx
mov dword [esp + 0x28], 0
mov edi, dword [esi + 4]
test edi, edi
jne 0x465a30
xor eax, eax
jmp 0x465a46
mov ecx, dword [esi + 8]
sub ecx, edi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jae 0x465a9a
mov ebp, dword [esi + 8]
cmp edi, ebp
jbe 0x465a56
call fcn.00512070
mov eax, dword [esi + 4]
test eax, eax
jne 0x465a72
push ebp
push esi
lea ecx, [esp + 0x3c]
push ecx
sub ebx, eax
push ebx
push esi
call fcn.00465bd0
jmp 0x465af7
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
lea ecx, [esp + 0x3c]
push ecx
sub ebx, eax
push ebx
push esi
call fcn.00465bd0
jmp 0x465af7
test edi, edi
je 0x465af7
mov ebp, dword [esi + 8]
mov ecx, ebp
sub ecx, edi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x465af7
cmp edi, ebp
jbe 0x465ac3
call fcn.00512070
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x465ad0
call fcn.00512070
imul ebx, ebx, 0x64
mov dword [esp + 0x1c], edi
add edi, ebx
cmp edi, dword [esi + 8]
ja 0x465ae3
cmp edi, dword [esi + 4]
jae 0x465ae8
call fcn.00512070
push ebp
push esi
push edi
push esi
lea edx, [esp + 0x28]
push edx
push esi
call fcn.00465b70
lea esi, [esp + 0x34]
call fcn.00465940
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x68
Function at 0x46b8c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x46b94a
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005167a0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46b90d
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46b92f
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x46b9a5
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.0046b62b
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x46b991
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x46b9a5
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x46b8ce
pop esi
pop ebx
leave
ret
Function at 0x46e9c0
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x5da570
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov esi, 0x10
mov dword [ecx + 0x48], esi
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x48], esi
mov byte [ecx + 0x41], dl
mov dword [ecx + 0x4c], ecx
mov edi, dword [eax + 0xac]
mov ecx, 8
mov esi, 0x68fbfc
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x472190
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp esi, 4
push edi
jb 0x4721fd
mov edi, esi
shr edi, 2
xor eax, dword [edx]
sub esi, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x6653c8]
add edx, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x6653c8]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x6653c8]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x6653c8]
sub edi, 1
jne 0x4721a8
test esi, esi
je 0x472222
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x6653c8]
sub esi, 1
add edx, 1
test esi, esi
jne 0x472201
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
ret 8

Function at 0x472660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d8f78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.0041072d
lea eax, [esp + 4]
push eax
push 1
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0046f080
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x4726d8
mov ecx, dword [esp + 8]
push ecx
call fcn.005112a2
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x4727e0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5de8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.004885e0
mov ecx, dword [esp + 0x38]
push eax
mov dword [esp + 0x30], 0
call fcn.0048a590
push eax
mov ecx, edi
call fcn.004885e0
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add esi, esi
add esi, esi
push esi
push 0
push eax
mov ebx, eax
call fcn.00516720
add esp, 0xc
cmp esi, 0x10
push ebx
jb 0x47285c
call fcn.00519006
jmp 0x472861
call fcn.005118c1
mov eax, edi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x473320
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5deba8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
mov eax, dword [esp + 0x40]
push eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
call fcn.004727e0
mov ecx, eax
lea eax, [esi + 0xc]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], 0
call fcn.00472af0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add edi, edi
add edi, edi
push edi
push 0
push eax
mov ebx, eax
call fcn.00516720
add esp, 0xc
cmp edi, 0x10
push ebx
jb 0x4733a2
call fcn.00519006
jmp 0x4733a7
call fcn.005118c1
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x4750e0
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x5dcc40
mov eax, dword fs:[0]
push eax
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x48], 0x10
mov byte [ecx + 0x41], dl
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x478660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dddd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0x6e6bbc
push edx
call eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.004885e0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add esi, esi
add esi, esi
push esi
push 0
push eax
mov ebx, eax
call fcn.00516720
add esp, 0xc
cmp esi, 0x10
push ebx
jb 0x4786dc
call fcn.00519006
jmp 0x4786e1
call fcn.005118c1
mov eax, edi
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x479730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d8f78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x2b
push str.VerifierFilter:_digital_signature_not_valid
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.0041072d
lea eax, [esp + 4]
push eax
push 3
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0046f080
cmp dword [esp + 0x1c], 0x10
jb 0x4797a2
mov ecx, dword [esp + 8]
push ecx
call fcn.005112a2
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::SignatureVerificationFilter::SignatureVerificationFailed.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x47b660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
xor ebx, ebx
shr ecx, 2
je 0x47b692
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
lea esp, [esp]
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
sub ecx, 1
jne 0x47b680
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x47b6bd
add edx, eax
add esi, eax
test edi, edi
jbe 0x47b6bd
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x47b6b0
pop edi
pop esi
pop ebx
ret

Function at 0x47b6d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
xor eax, eax
shr edx, 2
je 0x47b714
mov edi, ebx
sub esi, ecx
mov eax, ecx
sub edi, ecx
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
sub edx, 1
mov dword [edi + eax - 4], ebp
jne 0x47b6f6
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x47b741
add ebx, eax
add esi, eax
add ecx, eax
test edi, edi
jbe 0x47b741
mov edx, esi
mov esi, ebx
sub edx, ecx
mov eax, ecx
sub esi, ecx
mov cl, byte [eax + edx]
xor cl, byte [eax]
add eax, 1
sub edi, 1
mov byte [eax + esi - 1], cl
jne 0x47b730
pop edi
pop esi
pop ebx
pop ecx
ret