joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword fs:[0x2c]
push ebx
push esi
mov ebx, ecx
mov esi, dword [eax]
mov eax, dword [0x5a9cf8]
push edi
mov edi, edx
mov dword [esp + 0x10], ebx
cmp eax, dword [esi + 4]
jg 0x44a329
test edi, 0xfffffffc
jg 0x44a28e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + edi]
mov dword [esp + 0x14], 0
xor ecx, ecx
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x44a31d
mov esi, dword [0x5a9ce4]
mov ebx, dword [0x5a9ce0]
push 0x5851f42d
push 0x4c957f2d
push esi
push ebx
call fcn.00514bb0
add eax, dword [0x5a9ce8]
mov ecx, esi
mov dword [0x5a9ce0], eax
mov eax, esi
adc edx, dword [0x5a9cec]
shrd ebx, eax, 0x1b
shr ecx, 0xd
xor ebx, ecx
shr esi, 0x1b
shr eax, 0x1b
mov ecx, esi
not ecx
mov dword [0x5a9ce4], edx
inc ecx
mov dword [esp + 0x1c], 0
and ecx, 0x1f
mov al, bl
shl al, cl
mov ecx, esi
shr ebx, cl
mov ecx, dword [esp + 0x10]
or al, bl
mov byte [ecx], al
inc ecx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp eax, edi
jb 0x44a2a4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5a9cf8
call fcn.00514361
add esp, 4
cmp dword [0x5a9cf8], 0xffffffff
jne 0x44a27d
mov ecx, 0x5a9ce0
call fcn.00448960
push 0x5a9cf8
call fcn.00514322
add esp, 4
jmp 0x44a27d

Function at 0x44f460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a376
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5a4eec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00514465
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00513147
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4510a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x23c]
call fcn.00448a30
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00517500
add esp, 0xc
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push 0x103
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0x103
lea ecx, [ebp - 0x110]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [ebp - 0x21c]
test eax, eax
mov ecx, 0x556724c
cmove esi, ecx
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x21c], esi
call fcn.0044b890
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00514739
mov esp, ebp
pop ebp
ret

Function at 0x451150
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
cmp dword [ecx + 0x14], 0x10
push esi
mov esi, edx
jb 0x45116e
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x451227
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 0x10]
mov edi, eax
cmp edi, ecx
ja 0x4511bf
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], 0x10
jb 0x4511b7
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x4511cd
mov eax, esi
mov byte [eax + edi], 0
jmp 0x4511cd
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0044deb0
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 8], 0
jb 0x4511de
mov eax, dword [esi]
jmp 0x4511e0
mov eax, esi
push 0
lea ecx, [ebp - 8]
push ecx
push edi
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45121f
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x451211
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x45120b
mov esi, dword [esi]
mov byte [esi + eax], 0
jmp 0x45121d
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0044deb0
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x451240
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, edx
cmp dword [esi + 0x14], 0x10
jb 0x451263
mov eax, dword [esi]
jmp 0x451265
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0x10
jb 0x451279
mov esi, dword [esi]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4512f0
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], 0
jb 0x4512b8
mov edi, dword [edi]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 0
mov eax, 1
movzx ebx, bl
push esi
cmova ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514739
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.String2File_create_file_error_d
call fcn.00454310
mov ecx, dword [ebp - 4]
add esp, 8
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x4513e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 0x18], ecx
xor dl, dl
mov dword [ebp - 0x1c], esi
mov eax, dword [eax]
mov byte [ebp - 0xd], dl
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4514f0
push ebx
mov ebx, 0x100000
push edi
push ebx
mov dword [ebp - 8], ebx
call fcn.0051f3dc
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x451478
mov esi, dword [ebp - 0x14]
add ebx, 0x100000
push ebx
push edi
call fcn.0051f3e7
add esp, 8
mov dword [ebp - 8], ebx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x451444
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x4514c4
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 8]
cmp eax, ecx
ja 0x45149f
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x451497
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x4514ab
mov ecx, esi
mov byte [ecx + eax], 0
jmp 0x4514ab
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0044deb0
cmp dword [esi + 0x14], 0x10
jb 0x4514b3
mov esi, dword [esi]
push dword [ebp - 8]
push edi
push esi
call fcn.00516f80
add esp, 0xc
mov bl, 1
jmp 0x4514c7
mov bl, byte [ebp - 0xd]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4514dd
push edi
call fcn.0051a19c
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514739
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, dl
xor ecx, ebp
pop esi
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x451510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ae27
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
push 0x98
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00517500
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.0044bbc0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.Software84411976_A712_4e73_9E61_435EF38696BC
push esi
xor bl, bl
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x45163d
mov edx, str.create_reg:
lea ecx, [ebp - 0xb0]
call fcn.00450060
mov edx, str.Software84411976_A712_4e73_9E61_435EF38696BC
mov ecx, eax
call fcn.00450060
mov edx, str._error
mov ecx, eax
call fcn.00450060
mov edx, eax
test edx, edx
jne 0x4515e7
xor ecx, ecx
jmp 0x4515ee
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push esi
call fcn.0044c5f0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xb0]
call fcn.0044bae0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x451624
mov eax, dword [eax]
mov ecx, eax
call fcn.004541e0
lea ecx, [ebp - 0xd0]
call fcn.0044b890
xor bl, bl
jmp 0x4516ff
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x4516ff
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
jb 0x451656
mov edi, dword [edi]
push ecx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp - 0xb8]
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xb4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x451681
mov bl, 1
jmp 0x4516ff
mov edx, str.set_reg_key:
lea ecx, [ebp - 0xb0]
call fcn.00450060
mov edx, edi
mov ecx, eax
call fcn.00450060
mov edx, str._error
mov ecx, eax
call fcn.00450060
mov edx, eax
test edx, edx
jne 0x4516b0
xor ecx, ecx
jmp 0x4516b7
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push esi
call fcn.0044c5f0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xb0]
call fcn.0044bae0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x4516ed
mov eax, dword [eax]
mov ecx, eax
call fcn.004541e0
lea ecx, [ebp - 0xd0]
call fcn.0044b890
lea ecx, [ebp - 0x60]
call fcn.0044bb00
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 3
push eax
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.00513411
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x451740
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x5a4eec]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 0xc]
mov byte [esp + 0x64], 0
movq qword [esp + 0x65], xmm0
mov dword [esp + 0x6d], 0
mov word [esp + 0x71], 0
mov byte [esp + 0x73], 0
call fcn.004510a0
xor dword [esp + 0x64], 0x9a2804b3
lea edx, [esp + 0x64]
xor dword [esp + 0x68], 0x9a28050f
lea ecx, [esp + 8]
xor dword [esp + 0x6c], 0x9a28056c
xor dword [esp + 0x70], 0x9a2805ca
push 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00454f40
add esp, 4
lea ecx, [esp + 8]
mov edx, esi
call fcn.00455000
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x74]
xor eax, 0x827a037d
mov dword [edi], eax
mov eax, dword [esp + 0x68]
xor eax, 0x827a037e
mov dword [edi + 4], eax
mov eax, dword [esp + 0x6c]
xor eax, 0x827a037f
mov dword [edi + 8], eax
mov eax, dword [esp + 0x70]
xor eax, 0x827a0380
mov dword [edi + 0xc], eax
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00514739
mov esp, ebp
pop ebp
ret 8

Function at 0x4541e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b459
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0xb8]
call fcn.004540a0
mov esi, eax
push ecx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0
call fcn.004548a0
add esp, 4
push 0x59d028
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
push eax
call fcn.004539b0
add esp, 0xc
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00454830
add esp, 4
push 0x59d024
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.004539b0
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.004539b0
add esp, 0xc
push 0x59d020
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.004539b0
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.0044b890
lea ecx, [ebp - 0x58]
call fcn.0044b890
lea ecx, [ebp - 0x70]
call fcn.0044b890
lea ecx, [ebp - 0x88]
call fcn.0044b890
lea ecx, [ebp - 0xa0]
call fcn.0044b890
lea ecx, [ebp - 0xb8]
call fcn.0044b890
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x28]
call fcn.0044b890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x4558e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x5a4eec]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00454f40
add esp, 4
lea ecx, [esp + 8]
mov edx, esi
call fcn.00455000
mov ecx, dword [esp + 0x64]
mov eax, 1
pop esi
xor ecx, esp
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x456040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or eax, 0xffffffff
lea edx, [ecx + 1]
mov esi, 0x196
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x59c620]
movzx ecx, byte [edx - 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x59c620]
movzx ecx, byte [edx - 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x59c620]
movzx ecx, byte [edx - 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x59c620]
sub esi, 1
jne 0x456050
not eax
pop esi
ret

Function at 0x4560b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
test esi, esi
jle 0x45615e
cmp esi, 0x20
jb 0x456141
push ebx
lea eax, [edx - 1]
lea ebx, [ecx - 1]
add eax, esi
add ebx, esi
cmp ecx, eax
ja 0x4560e3
cmp ebx, edx
jae 0x456140
mov eax, esi
and eax, 0x8000001f
jns 0x4560f1
dec eax
or eax, 0xffffffe0
inc eax
mov ebx, esi
mov esi, edx
sub ebx, eax
sub esi, ecx
mov dword [ebp - 4], esi
mov eax, ecx
lea esi, [edx + 0x10]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edx + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ecx + edi]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ebx
jl 0x456110
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop ebx
cmp edi, esi
jge 0x45615e
sub edx, ecx
lea eax, [edi + ecx]
sub esi, edi
nop dword [eax]
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x456150
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x456170
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebx
mov bl, 1
push esi
mov esi, ecx
mov al, bl
mov dl, bl
mov cl, bl
add cl, cl
sar dl, 7
and dl, 0x1b
xor dl, cl
mov cl, al
add cl, cl
xor bl, dl
xor al, cl
mov cl, al
shl cl, 2
xor al, cl
mov cl, al
shl cl, 4
xor cl, al
mov al, cl
sar al, 7
and al, 9
xor al, cl
mov cl, al
mov dl, al
rol cl, 3
rol dl, 4
xor dl, cl
mov cl, al
rol cl, 2
xor dl, cl
mov cl, al
rol cl, 1
xor dl, cl
movzx ecx, bl
xor dl, al
xor dl, 0x63
mov byte [ecx + esi], dl
cmp bl, 1
jne 0x456178
mov byte [esi], 0x63
pop esi
pop ebx
ret
Function at 0x4564b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push 0x100
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00517500
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x128], 0x10
shr ebx, 4
mov dword [ebp - 0x124], ebx
test al, 0xf
jne 0x45650d
dec ebx
mov dword [ebp - 0x124], ebx
lea ecx, [ebp - 0x114]
call fcn.00456170
push 0xb0
call fcn.0051f3dc
push 0xb0
push 0
push eax
mov dword [ebp - 0x11c], eax
call fcn.00517500
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
push dword [ebp - 0x11c]
push 0xa
call fcn.004561e0
movups xmm0, xmmword [edi]
add esp, 0x1c
mov dword [ebp - 0x12c], 0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
js 0x4566d1
mov ecx, dword [ebp - 0x11c]
lea edx, [ebp - 0x14]
movups xmm2, xmmword [ebp - 0x14]
mov eax, ecx
sub eax, edx
lea edi, [ecx + 0x10]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edi
nop word [eax + eax]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x120], 4
nop dword [eax]
mov esi, dword [ebp - 0x130]
mov edx, 4
nop dword [eax + eax]
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x4565b0
sub dword [ebp - 0x120], 1
jne 0x4565a0
lea ebx, [edx + 1]
mov esi, edi
nop dword [eax]
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x14]
movzx eax, byte [ebp + eax - 0x114]
mov byte [ebp + ecx - 0x14], al
movzx eax, byte [ebp + ecx - 0x10]
movzx eax, byte [ebp + eax - 0x114]
mov byte [ebp + ecx - 0x10], al
movzx eax, byte [ebp + ecx - 0xc]
movzx eax, byte [ebp + eax - 0x114]
mov byte [ebp + ecx - 0xc], al
movzx eax, byte [ebp + ecx - 8]
movzx eax, byte [ebp + eax - 0x114]
mov byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 4
jb 0x4565d2
lea ecx, [ebp - 0x14]
call fcn.004562c0
cmp ebx, 0xa
jae 0x456631
lea ecx, [ebp - 0x14]
call fcn.004563a0
lea eax, [ebp - 0x14]
mov edi, 4
nop dword [eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x456645
sub edi, 1
jne 0x456640
inc ebx
cmp ebx, 0xa
jbe 0x4565d0
cmp word [ebp + 0x14], 1
mov ebx, dword [ebp - 0x118]
jne 0x45666f
movups xmm2, xmmword [ebx]
mov edi, dword [ebp - 0x12c]
lea edx, [ebp - 0x14]
mov esi, dword [ebp - 0x124]
mov ecx, ebx
mov eax, dword [ebp - 0x128]
cmp edi, esi
cmove eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x128], eax
call fcn.004560b0
add esp, 4
cmp word [ebp + 0x14], 1
jne 0x4566a8
movups xmmword [ebp - 0x14], xmm2
jmp 0x4566af
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x14], xmm0
sub dword [ebp + 0xc], 0x10
inc edi
add ebx, 0x10
mov dword [ebp - 0x12c], edi
cmp edi, esi
mov dword [ebp - 0x118], ebx
mov edi, dword [ebp - 0x134]
jle 0x456590
push dword [ebp - 0x11c]
call fcn.0051a19c
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00514739
mov esp, ebp
pop ebp
ret
Function at 0x4568a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
xor edx, edx
not eax
inc eax
div dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0xc], edx
nop dword [eax]
mov esi, dword [ebx + 4]
mov edi, dword [ebx]
push 0x5851f42d
push 0x4c957f2d
push esi
push edi
call fcn.00514bb0
add eax, dword [ebx + 8]
mov ecx, esi
mov dword [ebx], eax
mov eax, esi
adc edx, dword [ebx + 0xc]
shrd edi, eax, 0x1b
shr ecx, 0xd
xor edi, ecx
shr esi, 0x1b
mov ecx, esi
shr eax, 0x1b
not ecx
mov dword [ebx + 4], edx
inc ecx
mov dword [esp + 0x14], 0
and ecx, 0x1f
mov eax, edi
shl eax, cl
mov ecx, esi
shr edi, cl
or eax, edi
cmp eax, dword [esp + 0xc]
jb 0x4568c0
xor edx, edx
div dword [ebp + 8]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x457af0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b7e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x5a4eec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.00517500
add esp, 4
lea ecx, [ebp - 0xa8]
call fcn.0044bbc0
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb0], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x457bc1
cmp eax, 0x80010119
je 0x457bc1
push eax
mov edx, str.Failed_to_initialize_security._Error_code_0x
lea ecx, [ebp - 0xa8]
call fcn.00450060
mov ecx, eax
call fcn.0044c5f0
push eax
call fcn.00453dc0
add esp, 4
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xa8]
push eax
call fcn.0044bae0
mov byte [ebp - 4], 1
jmp 0x457cfb
lea eax, [ebp - 0xac]
push eax
push 0x592d28
push 1
push 0
push 0x592d18
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x457c1c
push eax
mov edx, str.Failed_to_create_IWbemLocator_object._Err_code_0x
lea ecx, [ebp - 0xa8]
call fcn.00450060
mov ecx, eax
call fcn.0044c5f0
push eax
call fcn.00453dc0
add esp, 4
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xa8]
push eax
call fcn.0044bae0
mov byte [ebp - 4], 2
jmp 0x457cfb
push ecx
lea ecx, [ebp - 0xb4]
call fcn.00456790
mov byte [ebp - 4], 3
mov eax, dword [eax]
test eax, eax
je 0x457c36
mov edx, dword [eax]
jmp 0x457c38
xor edx, edx
mov eax, dword [ebp - 0xac]
lea esi, [ebp - 0xb0]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00456840
test esi, esi
jns 0x457ca6
push esi
mov edx, str.Could_not_connect._Error_code_0x
lea ecx, [ebp - 0xa8]
call fcn.00450060
mov ecx, eax
call fcn.0044c5f0
push eax
call fcn.00453dc0
add esp, 4
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xa8]
push eax
call fcn.0044bae0
mov byte [ebp - 4], 4
jmp 0x457cfb
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0xb0]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x457d19
push eax
mov edx, str.Could_not_set_proxy_blanket._Error_code__0x
lea ecx, [ebp - 0xa8]
call fcn.00450060
mov ecx, eax
call fcn.0044c5f0
push eax
call fcn.00453dc0
add esp, 4
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xa8]
push eax
call fcn.0044bae0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x457d03
mov eax, dword [eax]
mov ecx, eax
call fcn.004541e0
lea ecx, [ebp - 0xcc]
call fcn.0044b890
xor esi, esi
jmp 0x457d2b
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [ebp - 0xb0]
lea ecx, [ebp - 0x58]
call fcn.0044bb00
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 6
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.00513411
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00514739
mov esp, ebp
pop ebp
ret