joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459d30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d2630
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], cx
push 0xffffffffffffffff
push eax
mov dword [esp + 0x40], ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [esp + 0x1c], 0
jbe 0x459dc1
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x459da5
lea eax, [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push edx
push 0x4fb87c
push str._s:_obtained_0x_x:__s
push 1
push 0
call fcn.00432650
add esp, 0x18
mov eax, dword [esi + 8]
cmp eax, dword [esi + 4]
sete bl
mov dword [esp + 0x38], 1
cmp dword [esp + 0x1c], 0
jbe 0x459e04
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x459de8
lea eax, [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
push str.AutoMUTEX::AutoMUTEX
push str._s:_releasing_0x_x:__s
push 1
push 0
call fcn.00432650
add esp, 0x18
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x459e2b
mov eax, dword [esp + 0xc]
push eax
call fcn.004a9dd8
add esp, 4
test bl, bl
jne 0x459e3c
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x459d65
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret
Function at 0x45d540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfbdb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
push eax
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x18], esi
mov edi, ecx
call fcn.0045d3b0
mov ebp, eax
push 0x4e4b10
lea ecx, [esp + 0x3c]
push edi
xor ebx, ebx
push ecx
mov dword [esp + 0xa4], ebx
call fcn.0045d770
push ebp
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0xb0], 1
call fcn.004448c0
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0xbc], 2
call fcn.0040b870
add esp, 0x2c
mov edi, eax
mov ecx, esi
mov byte [esp + 0x90], 3
call fcn.004a92d6
mov byte [esp + 0x90], 4
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 1
push ebx
mov ebp, 0xf
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.00408200
mov edi, 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
cmp dword [esp + 0x60], edi
jb 0x45d633
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.004a9dd8
add esp, 4
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x28], edi
jb 0x45d652
mov edx, dword [esp + 0x14]
push edx
call fcn.004a9dd8
add esp, 4
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], edi
jb 0x45d671
mov eax, dword [esp + 0x30]
push eax
call fcn.004a9dd8
add esp, 4
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp dword [esp + 0x7c], edi
jb 0x45d690
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004a91d2
add esp, 0x84
ret 4

Function at 0x45d980
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4d24e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
xor edi, edi
push ecx
mov dword [esp + 0x14], edi
call fcn.0046ae30
push eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], edi
call fcn.0046c140
push eax
push esi
call fcn.0046ae30
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x45d9f0
call fcn.004aba07
jmp 0x45d9f5
call fcn.004a98d1
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x24
ret 8
Function at 0x45df40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d24e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.0046cf20
add esi, 0x34
push esi
mov edi, eax
mov dword [esp + 0x30], 0
call fcn.0046b080
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov esi, eax
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x45dfb0
call fcn.004aba07
jmp 0x45dfb5
call fcn.004a98d1
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x45e740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0045e710
push 2
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x45e79b
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x45e7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0045e740
push 0x348
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x45e80e
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x473050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d1300
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x52828c
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 8
Function at 0x476670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0045e7b0
push 0x1bb8d
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x4766ce
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4766f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00476670
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x47674b
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x476760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004766f0
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x4767bb
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4767d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d0668
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00476760
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.0045e680
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
je 0x476831
push eax
call fcn.004a9dd8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d11a8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x527d94
push str.InsertLineBreaks
mov ecx, esi
mov byte [esp + 0x1c], 1
call edx
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x14]
push ecx
push 0x527da0
push str.MaxLineLength
mov ecx, esi
mov dword [esp + 0x20], 0x48
call edx
mov al, byte [esp + 0x10]
mov ecx, 0x4e1134
test al, al
jne 0x47830b
mov ecx, 0x4e10ad
mov ebx, dword [edi + 0x44]
movzx eax, al
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x18], 6
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x4e19f0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
cmp ecx, edx
je 0x47834d
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x478340
sub eax, edi
xor edx, edx
jmp 0x47834f
xor eax, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov byte [esp + 0x2c], 0
mov dword [esp + 0x78], 3
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], edx
cmp ecx, edx
je 0x478380
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x478375
sub eax, edi
jmp 0x478382
xor eax, eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov byte [esp + 0x44], 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x60]
push edx
mov ecx, str.EncodingLookupArray
mov byte [esp + 0x80], 7
call fcn.004784f0
add esp, 8
mov byte [esp + 0x78], 8
movzx ecx, byte [eax + 8]
push ecx
push str.PaddingByte
mov edi, eax
call fcn.00478660
movzx edx, byte [eax + 8]
push edx
lea ecx, [esp + 0x20]
push ecx
push str.GroupSize
mov edi, eax
call fcn.00414510
movzx edx, byte [eax + 8]
push edx
lea ecx, [esp + 0x48]
push ecx
push str.Separator
mov edi, eax
call fcn.00414460
movzx edx, byte [eax + 8]
push edx
lea ecx, [esp + 0x30]
push ecx
push str.Terminator
mov edi, eax
call fcn.00414460
push 1
lea edx, [esp + 0x1c]
push edx
push str.Log2Base
mov edi, eax
call fcn.00414510
mov dword [esp + 0x20], vtable.CryptoPP::CombinedNameValuePairs.0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call edx
mov byte [esp + 0x78], 7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x47844e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.004a98d1
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.004a98d1
add esp, 8
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 4
Function at 0x479600
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
je 0x479630
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
jmp 0x479620
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
dec ecx
jne 0x479620
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x479659
add edx, eax
add esi, eax
test edi, edi
je 0x479659
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
jmp 0x479650
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x479650
pop edi
pop esi
pop ebx
ret

Function at 0x479660
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x4796a4
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x479688
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x4796cd
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x4796cd
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x4796c0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4796e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x47971a
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x479704
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x479731
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x47975f
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x479754
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret

Function at 0x479ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d1129
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x20]
mov ecx, edi
call fcn.0046ad40
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push ecx
mov dword [esp + 0x20], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
push edx
push edi
mov ecx, esi
mov dword [esp + 0x1c], 1
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x47dcb0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d054b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edi, [esp + 0x7c]
neg edi
mov ebx, ecx
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, 0x10
and edi, 0xf
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea edi, [esp + edi + 0x7c]
mov dword [esp + 0x74], ecx
mov al, 1
mov dword [esp + 0xcc], ecx
lea edx, [esp + 0x2c]
mov ecx, 8
mov esi, 0x503df4
mov byte [esp + 0x6d], al
mov dword [esp + 0x78], edx
mov byte [esp + 0xc5], al
mov dword [esp + 0x14], edi
mov dword [esp + 0xd0], edi
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], vtable.CryptoPP::SHA256.0
mov dword [esp + 0xe8], 2
mov eax, dword [ebx + 0x34]
push 0x20
push eax
lea ecx, [esp + 0x24]
call fcn.0047d5f0
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.0047d5f0
mov eax, dword [esp + 0x1c]
mov esi, dword [ebx + 0x34]
lea edi, [eax + 0x38]
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 0x1c]
call eax
mov edx, dword [edi]
push eax
push esi
lea ecx, [esp + 0x24]
call edx
mov edi, dword [esp + 0xd0]
mov byte [ebx + 0x5c], 0
cmp edi, dword [esp + 0x14]
jne 0x47ddb9
mov ecx, dword [esp + 0xcc]
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x2c]
cmp edi, eax
jne 0x47ddcd
mov ecx, dword [esp + 0x74]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 8

Function at 0x47e1c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x4cf8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, dword [esp + 0x64]
call fcn.0047e4a0
mov ecx, dword [esp + 0x68]
mov eax, dword [eax]
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x47e24d
push 0xe
push 0x504374
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.004082f0
lea ecx, [esp + 8]
lea esi, [esp + 0x24]
mov dword [esp + 0x5c], 0
call fcn.0047dec0
push 0x5158a8
mov edx, esi
push edx
call fcn.004aba66
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004a91d2
add esp, 0x58
ret 8
Function at 0x47eb40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x47eb50
movzx edx, byte [esi + 0x4e1390]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x52cbf0], edx
mov dword [esi*8 + 0x52cbf4], eax
inc esi
cmp esi, 0x100
jl 0x47eb50
mov dword [0x52d3f8], edi
mov dword [0x52d3fc], edi
mov dword [0x52d3f0], edi
mov dword [0x52d3f4], edi
pop edi
pop esi
mov byte [0x52d42e], 1
pop ebx
ret

Function at 0x47ebd0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x4e1490]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x52c3e8], edx
mov dword [eax*8 + 0x52c3ec], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x47ebe0
pop edi
pop esi
pop ebp
mov byte [0x52d42f], 1
pop ebx
add esp, 0x10
ret