joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455500
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfe08
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.004839ea
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x4fc60c
push eax
call fcn.00486095
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 8
push eax
call fcn.00486f54
add esp, 0xc
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00401e90
mov dword [esi], vtable.boost::program_options::detail::utf8_codecvt_facet.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4560d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dff68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51b170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
mov edx, 2
test edi, edi
mov eax, 1
cmove edi, eax
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00499b11
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x456146
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x456148
xor eax, eax
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.00456bc0
mov edi, dword [ebp + 8]
mov ecx, esi
add esp, 0xc
xor eax, eax
mov dword [edi + 0x10], 0
lea edx, [ecx + 2]
mov dword [edi + 0x14], 7
mov word [edi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456174
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00417920
push esi
call fcn.004996f9
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4561f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dffa0
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.00413b60
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x45629f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x5c
mov ecx, dword [ebp - 0x14]
je 0x456298
cmp ecx, 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x2f
mov ecx, dword [ebp - 0x14]
je 0x456298
cmp ecx, 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x45629f
mov edx, 0x4e75e4
jmp 0x4562a4
mov edx, 0x4e75dc
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x294], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4562b0
sub ecx, dword [ebp - 0x294]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0041a380
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x298]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x456335
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ecx], 0
call edi
cmp eax, 2
je 0x456321
call edi
cmp eax, 0x12
je 0x456321
call edi
push 0x4fe210
push eax
mov ecx, esi
call fcn.004038e0
jmp 0x456417
xor eax, eax
mov ecx, esi
push 0x4fe210
push eax
call fcn.004038e0
jmp 0x456417
lea edx, [ebp - 0x264]
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x456340
sub edx, ecx
lea eax, [ebp - 0x264]
mov ecx, dword [ebp - 0x29c]
sar edx, 1
push edx
push eax
call fcn.00417920
mov eax, dword [ebp - 0x290]
test eax, 0x400
je 0x456380
mov dword [edi], 0
mov dword [ebx], 0
jmp 0x456406
test al, 0x10
je 0x456392
mov dword [edi], 3
mov dword [ebx], 3
jmp 0x45639e
mov dword [edi], 2
mov dword [ebx], 2
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4563c0
sub ecx, edx
lea eax, [ebp - 0x264]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00417920
push dword [ebp - 0x290]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00456e80
add esp, 8
mov dword [edi + 4], eax
lea ecx, [ebp - 0x40]
call fcn.00404ac0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x4fe210
lea ecx, [ebp - 0x28]
call fcn.00404ac0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret
Function at 0x456f80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov eax, ebx
and eax, 0x3000
cmp eax, 0x3000
je 0x457039
test eax, eax
je 0x456fa4
test bl, 0x92
je 0x457039
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x456fb3
mov eax, dword [edi]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test esi, esi
jne 0x456fc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x456fcb
xor eax, eax
push str.boost::filesystem::permissions
push dword [esp + 0x1c]
push edi
push eax
call fcn.00456af0
add esp, 0x10
test al, al
jne 0x457037
test ebx, 0x1000
je 0x456fef
and esi, 0xfffffffe
jmp 0x457004
test ebx, 0x2000
jne 0x457001
test bl, 0x92
je 0x457001
and esi, 0xfffffffe
jmp 0x457004
or esi, 1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x45700e
mov eax, dword [edi]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x457022
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x457024
xor eax, eax
push str.boost::filesystem::permissions
push dword [esp + 0x1c]
push edi
push eax
call fcn.00456af0
add esp, 0x10
pop esi
pop edi
pop ebx
ret

Function at 0x457170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x457183
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4571ab
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00457040
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4571c4
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x4fe210
test ebx, 0x400
je 0x4571fa
push esi
call fcn.00456c90
add esp, 4
test al, al
je 0x4571ef
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x457280
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
cmp eax, 1
jne 0x4572ad
mov eax, dword [esp + 0x14]
test eax, eax
je 0x457336
pop edi
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x4fe210
xor al, al
pop esi
ret
cmp eax, 3
je 0x4572ce
cmp eax, 0xb
je 0x4572ce
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4572c5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4572e3
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4572dc
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x45731d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x45731d
cmp eax, 3
je 0x45731d
cmp eax, 0x7b
je 0x45731d
cmp eax, 0xf
je 0x45731d
cmp eax, 0x15
je 0x45731d
cmp eax, 0x57
je 0x45731d
cmp eax, 0xa1
je 0x45731d
cmp eax, 0x35
je 0x45731d
call edi
jmp 0x45731f
xor eax, eax
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.00456af0
add esp, 0x10
test al, al
je 0x45733b
pop edi
xor al, al
pop esi
ret
pop edi
mov al, 1
pop esi
ret

Function at 0x457340
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x457350
mov eax, dword [esi]
mov edi, dword [esp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x45735e
mov ecx, dword [edi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x457374
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x457376
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.00456a20
add esp, 0x14
pop edi
pop esi
ret
Function at 0x457410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0190
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
cmp dword [edi + 0x14], 8
jb 0x457451
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x457470
push esi
push edi
push ebx
call fcn.00457040
add esp, 0xc
jmp 0x45758f
test eax, 0x400
je 0x457556
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x457485
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4574a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00417920
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00404ac0
cmp esi, 0xffffffff
jne 0x457509
push dword [ebp - 0x2c]
push edi
push ebx
call fcn.00457040
add esp, 0xc
jmp 0x45758f
push edi
call fcn.00456c90
add esp, 4
test al, al
jne 0x45753b
push dword [ebp - 0x30]
push edi
call fcn.00456e80
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45758f
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x45756b
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x4fe210
push eax
push edi
test al, 0x10
je 0x45757d
call fcn.00456e80
mov ecx, 3
jmp 0x457587
call fcn.00456e80
mov ecx, 2
add esp, 8
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret
Function at 0x4575b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x4575c0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4575e5
push dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.00457040
add esp, 0xc
mov eax, esi
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4575fe
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x4fe210
push ebx
test edi, 0x400
je 0x457636
push esi
call fcn.00456c90
push edi
push esi
mov bl, al
call fcn.00456e80
add esp, 0xc
mov ecx, eax
mov edx, 4
test bl, bl
jne 0x457629
mov edx, 9
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
ret
push edi
push esi
mov ebx, edi
call fcn.00456e80
add esp, 8
mov edx, eax
and ebx, 0x10
je 0x45764f
mov esi, dword [esp + 0x14]
jmp 0x457655
mov esi, edx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
setne cl
add ecx, 2
test ebx, ebx
pop ebx
cmove edx, esi
mov dword [eax], ecx
pop edi
mov dword [eax + 4], edx
pop esi
ret
Function at 0x4606e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xor cl, cl
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
push esi
push edi
test bl, 3
jne 0x460810
test al, 3
jne 0x460810
mov edi, edx
mov dword [ebp - 4], 0
shr edi, 2
xor esi, esi
mov dword [ebp - 0xc], edi
test edi, edi
je 0x4607cb
cmp edi, 8
jb 0x460797
mov ecx, edi
mov edx, ebx
and ecx, 0xfffffff8
add eax, 0x10
sub edx, dword [ebp + 0xc]
xorps xmm3, xmm3
mov dword [ebp - 8], edx
xorps xmm2, xmm2
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, ecx
jb 0x460745
mov eax, dword [ebp + 0xc]
por xmm2, xmm3
mov edi, dword [ebp - 0xc]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [ebp - 4], xmm2
cmp esi, edi
jae 0x4607cf
mov dword [ebp - 8], ebx
lea ecx, [eax + esi*4]
sub dword [ebp - 8], eax
mov ebx, edi
mov edx, dword [ebp - 8]
sub ebx, esi
mov esi, edi
mov edi, dword [ebp - 4]
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or edi, eax
sub ebx, 1
jne 0x4607b0
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edi
jmp 0x4607d2
xor edi, edi
jmp 0x4607d2
mov edi, dword [ebp - 4]
shl esi, 2
sub edx, esi
jne 0x4607e5
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, esi
add eax, esi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, eax
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, dword [ebp - 4]
shr eax, 8
or cl, al
mov eax, dword [ebp - 8]
or cl, byte [ebp - 4]
mov dword [ebp - 4], ecx
xor edi, edi
test edx, edx
je 0x4608e0
cmp edx, 0x20
jb 0x4608ba
mov esi, edx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [ebp - 0xc], esi
mov esi, ebx
sub esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
lea esi, [ebx + 0x10]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ecx + edi]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x460850
por xmm2, xmm3
mov ecx, dword [ebp - 4]
movaps xmm0, xmm2
mov ebx, dword [ebp + 8]
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or cl, al
cmp edi, edx
jae 0x4608e0
mov eax, dword [ebp - 8]
sub ebx, eax
sub edx, edi
lea esi, [edi + eax]
nop dword [eax + eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or cl, al
sub edx, 1
jne 0x4608d0
pop edi
test cl, cl
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test cl, 3
jne 0x460c78
test bl, 3
jne 0x460c78
mov edx, dword [ebp + 0x10]
xor edi, edi
mov esi, edx
shr esi, 2
mov dword [ebp - 4], esi
test esi, esi
je 0x460c64
cmp esi, 0x10
jb 0x460c35
lea eax, [ebx - 4]
lea eax, [eax + esi*4]
cmp ecx, eax
ja 0x460bc3
lea eax, [ecx - 4]
lea eax, [eax + esi*4]
cmp eax, ebx
jae 0x460c35
mov eax, esi
mov esi, ebx
and eax, 0xfffffff0
sub esi, ecx
mov dword [ebp - 8], esi
lea esi, [ebx + 0x30]
mov dword [ebp - 0xc], eax
lea eax, [ecx + 0x10]
mov ecx, dword [ebp - 8]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x10
lea eax, [eax + 0x40]
lea esi, [esi + 0x40]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ecx + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, dword [ebp - 0xc]
jb 0x460be0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp edi, esi
jae 0x460c64
mov esi, dword [ebp - 4]
lea ecx, [ecx + edi*4]
mov eax, ebx
sub eax, dword [ebp + 8]
sub esi, edi
mov edi, dword [ebp - 4]
mov ebx, eax
nop dword [eax + eax]
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub esi, 1
jne 0x460c50
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
shl edi, 2
sub edx, edi
je 0x460d2e
add ecx, edi
add ebx, edi
mov dword [ebp + 8], ecx
jmp 0x460c7b
mov edx, dword [ebp + 0x10]
xor ecx, ecx
test edx, edx
je 0x460d2e
mov esi, dword [ebp + 8]
cmp edx, 0x40
jb 0x460d10
lea eax, [ebx - 1]
lea edi, [esi - 1]
add eax, edx
add edi, edx
cmp esi, eax
ja 0x460ca3
cmp edi, ebx
jae 0x460d10
mov edi, edx
mov eax, esi
and edi, 0xffffffc0
mov dword [ebp - 0xc], edi
mov edi, ebx
sub edi, esi
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + esi - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + ecx + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + ecx + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + ecx + 0x30]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edi
jb 0x460cc0
mov esi, dword [ebp + 8]
cmp ecx, edx
jae 0x460d2e
sub ebx, esi
lea eax, [ecx + esi]
sub edx, ecx
nop dword [eax + eax]
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x460d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test bl, 3
je 0x4733b0
test esi, esi
je 0x4733b0
movzx ecx, byte [ebx]
inc ebx
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4e98d8]
dec esi
jmp 0x473391
cmp esi, 4
jb 0x473401
mov edx, esi
shr edx, 2
nop word [eax + eax]
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x4e98d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e98d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e98d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e98d8]
sub edx, 1
jne 0x4733c0
test esi, esi
je 0x47341f
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4e98d8]
sub esi, 1
jne 0x473405
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x476ac0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1058
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x51b170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x476b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x476b36
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x476b54
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004996e8
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00414010
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00476c20
push 0x514b64
lea eax, [ebp - 0x50]
push eax
call fcn.004b0fc9
int3
Function at 0x479c70
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret