joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9518
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x65b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x445476
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], 0
mov word [eax], cx
lea eax, [ebp - 0x34]
push eax
push 0x101
push ecx
push str.HardwareDescriptionSystem
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x445624
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x30]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push str.SystemBiosVersion
push dword [ebp - 0x34]
call ebx
test eax, eax
jne 0x44550a
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x44550a
push eax
call fcn.00574000
mov edi, eax
add esp, 4
test edi, edi
je 0x44550a
lea eax, [ebp - 0x30]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push str.SystemBiosVersion
push dword [ebp - 0x34]
call ebx
test eax, eax
jne 0x445501
mov eax, dword [ebp - 0x30]
mov ecx, esi
shr eax, 1
push eax
push edi
call fcn.00419250
push edi
call fcn.00573cbd
add esp, 4
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x445514
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
mov ecx, esi
jb 0x445520
mov ecx, dword [esi]
mov edi, eax
xor edx, edx
sub edi, ecx
inc edi
shr edi, 1
cmp ecx, eax
cmova edi, edx
test edi, edi
je 0x445546
lea eax, [edx + 0x3a]
cmp word [ecx], 0
jne 0x44553e
mov word [ecx], ax
inc edx
add ecx, 2
cmp edx, edi
jne 0x445535
lea eax, [ebp - 0x30]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push str.SystemBiosDate
push dword [ebp - 0x34]
call ebx
test eax, eax
jne 0x44561b
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x44561b
push eax
call fcn.00574000
mov edi, eax
add esp, 4
test edi, edi
je 0x44561b
lea eax, [ebp - 0x30]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push str.SystemBiosDate
push dword [ebp - 0x34]
call ebx
test eax, eax
jne 0x445612
mov eax, dword [ebp - 0x30]
xor ecx, ecx
shr eax, 1
dec eax
mov word [ebp - 0x2c], cx
push eax
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
call fcn.00419250
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov ecx, esi
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00425f10
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x445612
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x445608
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x445642
push edx
push ecx
call fcn.00573caf
add esp, 8
push edi
call fcn.00573cbd
add esp, 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057374d
mov esp, ebp
pop ebp
ret 4
call fcn.0057f4be
int3
Function at 0x445b00
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a95d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x65b0c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], edi
push ecx
mov ecx, 5
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.004301a0
add esp, 4
test al, al
jne 0x445c25
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
sub esp, 8
movq qword [ebp - 0x68], xmm0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x48], xmm0
call fcn.004463f0
mov ecx, dword [ebp - 0x64]
mov eax, 0x1948b0fd
mov esi, dword [ebp - 0x68]
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x288
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x445c1b
mov esi, dword [ebp - 0x68]
or eax, 0xffffffff
cmp dword [esi + 0x19c], eax
jae 0x445c09
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push 0x644e68
lea eax, [ebp - 0x58]
push 0x12
push eax
call fcn.00444aa0
mov eax, dword [esi + 0x19c]
add esp, 0x24
mov esi, dword [esi]
test esi, esi
jne 0x445bb8
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x34]
call fcn.00444a50
lea ecx, [ebp - 0x68]
call fcn.00446460
jmp 0x445c6c
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x445c4c
cmp esi, 1
je 0x445c4c
cmp esi, 0x80010106
jne 0x445c56
push ecx
lea eax, [ebp - 0x34]
push eax
call fcn.00445cc0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x445c66
cmp esi, 1
jne 0x445c6c
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x34]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445c85
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00419250
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057374d
mov esp, ebp
pop ebp
ret 4
Function at 0x4510b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa33e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00457470
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::JSON::ParseHandler.0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00573cce
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.0045ad40
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x34], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x455760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00455bf0
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00573cce
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov al, cl
and al, 1
shr ecx, 1
mov byte [edi + 0x1c], al
and cl, 1
mov byte [edi + 0x1d], cl
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x464040
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5aafb8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x464081
push 0
push 0x128
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463320
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00463cd0
add esp, 8
lea edx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea ecx, [edi + 0x1c]
cmovae edx, dword [ebp - 0x24]
cmp dword [ecx + 0x14], 8
jb 0x4640bd
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
and eax, 1
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4640ea
lea ecx, [ebp - 0x24]
call fcn.00419180
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.004642c0
int3
Function at 0x464230
Capabilities:
Check for software breakpoints
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x46424f
push 0
push 0x5e
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463320
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46425a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x464286
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x46427b.4
movzx eax, byte [eax + 0x46429c]
jmp dword [eax*4 + 0x464294]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.004642c0
nop
add byte [edx + 0x46], 0
mov al, byte [edx + 70]
add byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
invalid

Function at 0x4642c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ab018
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x464620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x464642
push 0
push 0x9f
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463320
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46464d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x464660
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.004642c0
int3
Function at 0x464970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573cce
mov edi, eax
add esp, 4
test edi, edi
je 0x4649bc
push 1
mov dword [ebp - 4], 0
call fcn.005714fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x4649be
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp + 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, 0x48
mov dword [esi + 0x40], edx
and edx, 1
mov dword [esi], vtable.Poco::Base64EncoderBuf.0
cmovne eax, ecx
mov dword [esi + 0x48], 0
mov ecx, dword [ebp + 8]
test edx, edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov dword [esi + 0x54], eax
mov eax, 0x5b1750
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x46eaa0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x46eab0
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
push 0x288
mov dword [esp + 0xc], 0x288
mov dword [edi], eax
mov word [edi + 4], ax
call fcn.00574000
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x46eafd
push esi
call fcn.00573cbd
push dword [esp + 0xc]
call fcn.00574000
add esp, 8
mov esi, eax
jmp 0x46eb01
test eax, eax
jne 0x46eb5a
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x46eb51
xor dl, dl
mov eax, esi
test esi, esi
je 0x46eb51
nop dword [eax]
test dl, dl
jne 0x46eb51
cmp dword [eax + 0x1a0], 6
jne 0x46eb4b
cmp dword [eax + 0x190], 6
jne 0x46eb4b
mov ecx, dword [eax + 0x194]
mov dl, 1
mov dword [edi], ecx
mov cx, word [eax + 0x198]
mov word [edi + 4], cx
mov eax, dword [eax]
test eax, eax
jne 0x46eb20
push esi
call fcn.00573cbd
add esp, 4
pop edi
pop esi
pop ecx
ret
Function at 0x46eb60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab3b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573cce
mov edi, eax
add esp, 4
test edi, edi
je 0x46ebac
push 1
mov dword [ebp - 4], 0
call fcn.005714fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x46ebae
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
push 0x100
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.00574000
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::RandomBuf.0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46fdd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab554
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0046e730
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::Crypto::CipherKeyImpl.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040a1b0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ebx, [esi + 0x34]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.0046f9e0
mov byte [ebp - 4], 4
call fcn.0046fd50
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x46fe6a
mov eax, dword [edi]
push eax
call fcn.004b52b0
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x46ff5e
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x14], 0x10
jb 0x46fe89
mov eax, dword [eax]
push eax
call fcn.004b52e0
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x46ffa0
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470230
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443a50
mov edi, eax
lea ecx, [esi + 0x28]
cmp ecx, edi
je 0x46fee4
call fcn.00438910
mov ecx, dword [edi]
mov dword [esi + 0x28], ecx
mov eax, dword [edi + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438910
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470220
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443a50
mov edi, eax
cmp ebx, edi
je 0x46ff31
mov ecx, ebx
call fcn.00438910
mov ecx, dword [edi]
mov dword [ebx], ecx
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438910
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00470100
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
push edi
lea eax, [ebp - 0x28]
push str.Cipher
push eax
call fcn.0040f1a0
push 0x5c8de8
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.00442a00
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.0045b650
push 0x6519b8
lea eax, [ebp - 0x6c]
push eax
call fcn.005763d7
push edi
lea eax, [ebp - 0x40]
push str.Digest
push eax
call fcn.0040f1a0
push 0x5c8de8
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.00442a00
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.0045b650
push 0x6519b8
lea eax, [ebp - 0x6c]
push eax
call fcn.005763d7
int3
Function at 0x471400
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab3b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573cce
mov edi, eax
add esp, 4
test edi, edi
je 0x47144c
push 1
mov dword [ebp - 4], 0
call fcn.005714fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x47144e
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call fcn.00574000
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c5130
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005749e0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4c51b0
mov cl, byte [edi]
test cl, cl
je 0x4c51b0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4c5160
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4c52c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005749e0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x4c5345
mov al, byte [ebx]
test al, al
je 0x4c5345
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.004f0100
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or eax, esi
xor eax, edi
mov esi, eax
mov al, byte [ebx]
mov dword [esp + 0x10], esi
test al, al
jne 0x4c52e7
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4d3970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4d3997
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4d3986
pop edi
movzx eax, dl
pop esi
ret