joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414110
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004073e4
xor ebx, ebx
cmp dword [0x423a9c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4141e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4142c6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4142c6
push eax
call fcn.00407376
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423a9c], eax
call esi
push eax
call fcn.00407376
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423aa0], eax
call esi
push eax
call fcn.00407376
mov dword [0x423aa4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00409a1a
test eax, eax
pop ecx
pop ecx
je 0x4141b4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405f0e
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4141e6
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00407376
cmp eax, ebx
pop ecx
mov dword [0x423aac], eax
je 0x4141e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407376
pop ecx
mov dword [0x423aa8], eax
mov eax, dword [0x423aa8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41426b
cmp dword [0x423aac], ecx
je 0x41426b
push eax
call fcn.004073ed
push dword [0x423aac]
mov esi, eax
call fcn.004073ed
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41426b
cmp edi, ebx
je 0x41426b
call esi
cmp eax, ebx
je 0x414238
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414238
test byte [ebp - 0x18], 1
jne 0x41426b
lea eax, [ebp - 0x10]
push eax
call fcn.00409ac9
test eax, eax
pop ecx
je 0x414253
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405f0e
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x414262
or dword [ebp + 0x10], 0x200000
jmp 0x4142a6
or dword [ebp + 0x10], 0x40000
jmp 0x4142a6
mov eax, dword [0x423aa0]
cmp eax, dword [ebp - 8]
je 0x4142a6
push eax
call fcn.004073ed
cmp eax, ebx
pop ecx
je 0x4142a6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4142a6
mov eax, dword [0x423aa4]
cmp eax, dword [ebp - 8]
je 0x4142a6
push eax
call fcn.004073ed
cmp eax, ebx
pop ecx
je 0x4142a6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423a9c]
call fcn.004073ed
cmp eax, ebx
pop ecx
je 0x4142c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4142c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x168dccc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x168dcd2
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x447862b2
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x420c3934
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x405b9a
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x405ce1
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x405c40
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x405bea
cmp ecx, 0x40010001
je 0x405bea
cmp ecx, 0x40020001
je 0x405bea
cmp ecx, 0x40030001
jne 0x405bf5
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x405c07
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x405c3a
dec ecx
je 0x405c34
dec ecx
je 0x405c2e
dec ecx
je 0x405c28
dec ecx
je 0x405c22
dec ecx
jne 0x405c4d
or dword [ebp - 4], 0xe
jmp 0x405c4d
or dword [ebp - 4], 0xc
jmp 0x405c4d
or dword [ebp - 4], 0xa
jmp 0x405c4d
or dword [ebp - 4], 8
jmp 0x405c4d
or dword [ebp - 4], 6
jmp 0x405c4d
or dword [ebp - 4], 2
jmp 0x405c4d
cmp ecx, 0x40030000
jne 0x405c4d
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x405c5d
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x405c6b
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x405c79
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x405c87
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x405c9c
push 3
jmp 0x405cc7
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x405ccd
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x405cb9
xor edx, edx
inc edx
jmp 0x405cc8
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x405cd9
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x405c8a
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x405cee
mov eax, 0x8876086c
jmp 0x405cf8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x4103f2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41044a
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x41044a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x41044a
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x410473
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4104e1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4104d8
cmp dword [ebp - 0xc], 4
jne 0x4104d8
cmp dword [ebp - 0x10], edi
je 0x4104d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x6f36a4], edi
xor eax, eax
jmp 0x410509
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x6f36a4], edi
jge 0x410504
mov dword [0x6f36a4], edi
call fcn.0041044e
test eax, eax
je 0x410504
emms
mov dword [0x6f36a4], 1
mov eax, dword [0x6f36a4]
pop edi
leave
ret

Function at 0x4105e9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x410620
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x410642
cmp dword [ebp - 0x20], 4
ja 0x41064c
jne 0x41063c
cmp dword [ebp - 0x1c], 0xa
jb 0x41063c
cmp word [ebp - 0x18], 0x55d
jae 0x41064c
mov byte [ebp + 0x73], 1
jmp 0x41064c
cmp dword [ebp - 0x14], 2
jne 0x410662
test bl, bl
je 0x41067d
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x41066d
dec eax
je 0x410666
sub eax, 3
jne 0x410662
cmp byte [ebp + 0x73], 0
je 0x41068e
xor eax, eax
jmp 0x410696
call fcn.0041050c
jmp 0x410696
cmp byte [ebp + 0x73], 0
jne 0x410662
call fcn.00410544
and eax, 4
jmp 0x410696
cmp dword [ebp + 0x7c], 0xa
je 0x41068e
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x410696
call fcn.00410544
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x42db94
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dba2
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dc76
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6864f8]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6864f8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6864f8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6864f8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6864f8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6864f8]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6864f8]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6864f8]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbbf
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dc96
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x6864f8]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dc7c
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x43c510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
push 0x1000
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call fcn.0061b105
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
ja 0x43c5a5
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
je 0x43c56c
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x2a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x78
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
call ecx
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
mov byte [eax], 0xff
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
mov byte [edx + 1], 0xd9
mov dword [ebp - 4], 2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx + 0x24], 0
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x43da90
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x43dac8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x180]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x78], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x180]
movzx eax, byte [edx + 8]
test eax, eax
je 0x43db95
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x78]
cmp eax, dword [edx + 0x60]
jae 0x43db5d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x43db23
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x78]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x60]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x78
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x184]
mov edx, dword [ecx + 4]
call edx
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x43db5b
xor al, al
jmp 0x43dbaf
jmp 0x43dadd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x180]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x180]
mov eax, dword [edx]
call eax
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], 0
jmp 0x43dac8
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x41]
neg eax
sbb eax, eax
neg eax
add eax, 0xcd
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x45ac00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64dd40
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6f77c8]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x6f77c8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push 0
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0xc]
push 0x6fb6a0
push edx
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x18], vtable.CryptoPP::ArraySink.1.0
movlpd qword [esp + 0x2c], xmm0
call dword [eax + 0x28]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0061693e
mov esp, ebp
pop ebp
ret 8
Function at 0x45dfb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6f77c8]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x6f77c8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.0045de20
add esp, 4
mov esi, eax
push 0x6a4460
lea eax, [esp + 0x30]
mov dword [esp + 0x84], 0
push edi
push eax
call fcn.0045e460
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x88], 1
push eax
call fcn.0045d5e0
add esp, 0xc
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x88], 2
push eax
call fcn.0045e9f0
add esp, 0xc
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.0062066b
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.0045ee10
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x45e0b1
push dword [esp + 0x44]
call fcn.0045f3d0
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x45e0d9
push dword [esp + 0x14]
call fcn.0045f3d0
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x45e101
push dword [esp + 0x2c]
call fcn.0045f3d0
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x45e129
push dword [esp + 0x5c]
call fcn.0045f3d0
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0061693e
add esp, 0x74
ret 8
Function at 0x45f040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
mov edi, esi
mov dword [esp + 0x10], edx
shr edi, 2
xor ebp, ebp
mov dword [esp + 0x14], ebx
test edi, edi
je 0x45f12b
cmp edi, 4
jb 0x45f0f6
mov ecx, dword [esp + 0x28]
lea eax, [ecx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x45f089
mov eax, ecx
lea ecx, [ebx - 4]
lea ecx, [ecx + edi*4]
cmp ecx, eax
jae 0x45f0fa
mov ecx, eax
lea eax, [edx - 4]
lea eax, [eax + edi*4]
cmp ebx, eax
ja 0x45f09d
lea eax, [ebx - 4]
lea eax, [eax + edi*4]
cmp eax, edx
jae 0x45f0f6
mov eax, edi
mov dword [esp + 0x18], edi
and eax, 3
mov esi, ebx
sub dword [esp + 0x18], eax
sub esi, edx
sub ecx, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x2c]
mov eax, edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea ebx, [ebx]
movdqu xmm1, xmmword [edx + eax]
add ebp, 4
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [ebx + eax - 0x10], xmm1
cmp ebp, ecx
jb 0x45f0d0
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp ebp, edi
jae 0x45f12b
mov esi, edx
lea ecx, [eax + ebp*4]
mov edx, dword [esp + 0x10]
sub ebx, eax
sub edi, ebp
mov dword [esp + 0x20], ebx
sub esi, eax
add ebp, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [ebx + ecx - 4], eax
dec edi
jne 0x45f113
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x14]
lea eax, [ebp*4]
sub esi, eax
mov dword [esp + 0x2c], esi
je 0x45f1f0
mov ebp, dword [esp + 0x28]
add ebx, eax
add edx, eax
mov dword [esp + 0x14], ebx
add ebp, eax
mov dword [esp + 0x10], edx
xor edi, edi
test esi, esi
je 0x45f1f0
cmp esi, 0x10
jb 0x45f1cb
lea eax, [ebp - 1]
lea ecx, [ebx - 1]
add eax, esi
add ecx, esi
cmp ebx, eax
ja 0x45f171
cmp ecx, ebp
jae 0x45f1cb
lea eax, [edx - 1]
add eax, esi
cmp ebx, eax
ja 0x45f17e
cmp ecx, edx
jae 0x45f1cb
mov eax, esi
mov ecx, esi
mov esi, ebx
and eax, 0xf
sub esi, edx
sub ecx, eax
mov ebx, ebp
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x2c]
sub ebx, edx
mov dword [esp + 0x1c], ebx
mov eax, edx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
movdqu xmm1, xmmword [eax + edx]
add edi, 0x10
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax + ebx - 0x10], xmm1
cmp edi, ecx
jb 0x45f1a5
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, esi
jae 0x45f1f0
sub edx, ebp
lea ecx, [edi + ebp]
sub ebx, ebp
sub esi, edi
jmp 0x45f1e0
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec esi
jne 0x45f1e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45f200
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, esi
shr edi, 2
test edi, edi
je 0x45f246
mov esi, ebp
mov dword [esp + 0x10], edi
mov edx, ecx
sub esi, ecx
jmp 0x45f230
mov eax, dword [esi + edx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
dec edi
jne 0x45f230
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x45f25a
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add ecx, eax
mov edx, ebx
mov eax, ebx
shr edx, 0x18
shr eax, 0x10
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
test esi, esi
je 0x45f28e
sub ebp, ecx
lea esp, [esp]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
dec esi
jne 0x45f280
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x4603d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e483
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6f77c8]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x6f77c8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x64]
mov dword [esi + 0xc], eax
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], 0
mov dword [esp + 0x5c], 2
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
push 0
mov dword [esi + 0x2c], 0
call fcn.0045c220
mov dword [esi + 0x30], 0
mov dword [esp + 0x60], 3
push 0
mov dword [esi + 0x4c], 0
call fcn.0045c220
add esp, 8
mov dword [esi + 0x50], 0
cmp byte [esp + 0x70], 0
mov byte [esp + 0x5c], 4
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 0x54], edi
jne 0x46052f
push 0
push 0x706fc0
push 0x706f94
push 0
push edi
call fcn.00620cfe
add esp, 0x14
test eax, eax
je 0x46052f
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0045e5e0
lea ecx, [esp + 0x28]
mov byte [esp + 0x5c], 5
call fcn.0062066b
push 0xffffffffffffffff
mov byte [esp + 0x60], 6
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], vtable.CryptoPP::Exception.0
mov dword [esp + 0x40], 1
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
call fcn.0045ee10
push 0x6d73b8
lea eax, [esp + 0x2c]
mov byte [esp + 0x60], 5
push eax
mov dword [esp + 0x30], vtable.CryptoPP::InvalidArgument.0
call fcn.0061694d
push ecx
lea eax, [esp + 0x70]
mov edx, str.BlockPaddingScheme
push eax
lea ecx, [esp + 0x18]
call fcn.00461390
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x60], 7
call fcn.0045fb30
mov byte [esp + 0x5c], 4
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x460566
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0061693e
add esp, 0x54
ret 0x10