joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e3c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
cmp edx, 0x7f
ja 0x46e579
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x46e467
test esi, esi
jle 0x46e4ae
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
inc ecx
sub esi, 1
jne 0x46e450
jmp 0x46e4ae
xor ebp, ebp
test esi, esi
jle 0x46e4ae
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x46e494
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x46e490
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, reloc.WS2_32.dll_getsockopt
jns 0x46e4c1
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x46e502
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0055a67a
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x46e514
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055a67a
add esp, 0x34
ret
Function at 0x46e6b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0055bc20
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [eax]
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x20]
test ebx, ebx
je 0x46e6f9
test edi, edi
je 0x46e6f9
mov cl, byte [ebx + esi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc ebx
dec edi
and ebx, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebx
jne 0x46e6d0
cmp edi, 0x10
jb 0x46e777
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
shr eax, 4
mov ebx, ecx
mov ebp, edx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebx, esi
sub ebp, esi
add edx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edi, edi
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push edx
push esi
push eax
call dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add esp, 0xc
call fcn.0046e680
mov eax, esi
mov ecx, 4
mov edx, dword [eax + ebp]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [ebx + eax - 4], edx
jne 0x46e752
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
sub dword [esp + 0x10], 1
jne 0x46e730
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x46e7bf
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
push eax
push esi
push ebp
call dword [esp + 0x40]
add esp, 0xc
mov edx, ebp
call fcn.0046e680
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea eax, [ebx + esi]
sub ebp, esi
sub ecx, esi
add ebx, edi
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec edi
mov byte [eax + ecx], dl
inc eax
test edi, edi
jne 0x46e7a5
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
pop ecx
ret
Function at 0x46e800
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0055bc20
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x46e84c
test ebp, ebp
je 0x46e84c
mov ecx, dword [esp + 0x2c]
mov dl, byte [eax + ecx]
mov esi, dword [esp + 0x18]
xor dl, byte [esi]
mov ecx, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
inc esi
inc eax
dec ebp
and eax, 0xf
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
jne 0x46e820
mov esi, dword [esp + 0x28]
movzx ebx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx edx, byte [esi + 0xe]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 0xf]
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, ecx
cmp ebp, 0x10
jb 0x46e8ec
mov edi, ebp
shr edi, 4
add ebx, edi
cmp ebx, edi
jae 0x46e883
sub edi, ebx
xor ebx, ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x48]
mov edx, ebx
mov eax, ebx
mov ecx, ebx
shr edx, 0x18
shr eax, 0x10
shr ecx, 8
add esp, 0x14
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], al
mov byte [esi + 0xe], cl
mov byte [esi + 0xf], bl
test ebx, ebx
jne 0x46e8d6
mov eax, 0xc
mov ecx, 1
movzx edx, byte [eax + esi - 1]
dec eax
add ecx, edx
mov byte [eax + esi], cl
shr ecx, 8
test eax, eax
jne 0x46e8c4
shl edi, 4
add dword [esp + 0x1c], edi
add dword [esp + 0x18], edi
sub ebp, edi
cmp ebp, 0x10
jae 0x46e874
mov eax, dword [esp + 0x10]
test ebp, ebp
je 0x46e96a
mov edi, dword [esp + 0x2c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
push 1
push edi
push edi
call dword [esp + 0x48]
inc ebx
mov ecx, ebx
mov edx, ebx
mov eax, ebx
shr ecx, 0x18
shr edx, 0x10
shr eax, 8
add esp, 0x14
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], al
mov byte [esi + 0xf], bl
test ebx, ebx
jne 0x46e939
mov edx, esi
call fcn.0046e7d0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea eax, [edx + edi]
sub ecx, edi
sub esi, edi
add edx, ebp
mov edi, edi
mov bl, byte [ecx + eax]
xor bl, byte [eax]
dec ebp
mov byte [esi + eax], bl
inc eax
test ebp, ebp
jne 0x46e950
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
pop ecx
ret
Function at 0x46f100
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0055bc20
push ebx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
cmp ebp, 0xc
jne 0x46f15d
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov ecx, dword [ecx + 8]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], al
mov byte [esi + 0xd], al
mov byte [esi + 0xe], al
mov byte [esi + 0xf], 1
lea ebx, [eax + 1]
jmp 0x46f297
push edi
lea edi, [esi + 0x40]
mov ebx, ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
cmp ebp, 0x10
jb 0x46f1d8
mov eax, ebp
shr eax, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0x41]
inc ecx
mov edx, 4
movzx ebx, byte [ecx - 1]
xor byte [eax - 1], bl
movzx ebx, byte [ecx]
xor byte [eax], bl
movzx ebx, byte [ecx + 1]
xor byte [eax + 1], bl
movzx ebx, byte [ecx + 2]
xor byte [eax + 2], bl
add ecx, 4
add eax, 4
sub edx, 1
jne 0x46f191
lea eax, [esi + 0x60]
push eax
push edi
call fcn.0046ecc0
add dword [esp + 0x28], 0x10
add esp, 8
sub ebp, 0x10
sub dword [esp + 0x1c], 1
jne 0x46f184
mov ebx, dword [esp + 0x10]
xor eax, eax
cmp ebp, eax
je 0x46f1fa
jbe 0x46f1ed
mov ecx, dword [esp + 0x20]
mov dl, byte [eax + ecx]
xor byte [edi + eax], dl
inc eax
cmp eax, ebp
jb 0x46f1e2
lea eax, [esi + 0x60]
push eax
push edi
call fcn.0046ecc0
add esp, 8
mov eax, dword [esp + 0x14]
shld eax, ebx, 3
mov edx, eax
shr edx, 0x18
xor byte [esi + 0x48], dl
mov edx, eax
shr edx, 0x10
xor byte [esi + 0x49], dl
add ebx, ebx
add ebx, ebx
mov edx, eax
shr edx, 8
xor byte [esi + 0x4a], dl
add ebx, ebx
mov ecx, ebx
mov edx, eax
xor byte [esi + 0x4b], dl
xor byte [esi + 0x4f], cl
mov ebx, eax
mov edx, ecx
shrd edx, ebx, 0x18
xor byte [esi + 0x4c], dl
shr ebx, 0x18
mov ebx, eax
mov edx, ecx
shrd edx, ebx, 0x10
xor byte [esi + 0x4d], dl
mov edx, ecx
shrd edx, eax, 8
xor byte [esi + 0x4e], dl
shr eax, 8
lea eax, [esi + 0x60]
push eax
push edi
shr ebx, 0x10
call fcn.0046ecc0
movzx ebx, byte [esi + 0x4c]
movzx ecx, byte [esi + 0x4d]
movzx edx, byte [esi + 0x4e]
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, ecx
mov ecx, dword [edi]
shl ebx, 8
or ebx, edx
mov edx, dword [edi + 4]
shl ebx, 8
or ebx, eax
mov eax, dword [esi + 0x48]
add esp, 8
mov dword [esi], ecx
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
mov dword [esi + 0xc], ecx
xor eax, eax
pop edi
mov edx, dword [esi + 0x174]
mov ecx, dword [esi + 0x170]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
push edx
lea eax, [esi + 0x20]
push eax
push esi
call ecx
inc ebx
add esp, 0xc
mov edx, ebx
mov eax, ebx
mov ecx, ebx
shr edx, 0x18
shr eax, 0x10
shr ecx, 8
mov byte [esi + 0xf], bl
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], al
mov byte [esi + 0xe], cl
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x46f2e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x46f2f4
mov eax, 0xfffffffe
pop esi
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x46f3a9
jb 0x46f318
test ecx, ecx
ja 0x46f3a9
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x46f359
mov edi, edi
test ebx, ebx
je 0x46f345
mov cl, byte [ebp]
xor byte [edi + esi + 0x40], cl
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x46f330
jmp 0x46f349
test edi, edi
jne 0x46f39c
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.0046ecc0
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x46f37f
push eax
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
mov ecx, ebp
call fcn.0046ee40
mov eax, dword [esp + 0x20]
add esp, 0xc
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x46f39c
xor eax, eax
mov edi, ebx
test ebx, ebx
jbe 0x46f39c
jmp 0x46f390
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x46f390
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
pop ebx
or eax, 0xffffffff
pop esi
ret
Function at 0x470e90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x24], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
test bl, 0x40
jne 0x470ee8
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
mov dword [esp + 0x20], ebx
cmp eax, 0xf
jae 0x470f17
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x470f04
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x470f3e
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0055a67a
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
test edi, edi
je 0x470f7f
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x40]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x470fda
shr edx, 4
mov ecx, esi
call fcn.00470c50
test ebp, ebp
je 0x470fda
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
jbe 0x470fc9
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub edi, ecx
sub ebx, edx
lea ecx, [ecx]
lea edx, [esp + eax + 0x2c]
mov cl, byte [edi + edx]
xor cl, byte [edx]
inc eax
mov byte [ebx + edx], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebp
jb 0x470fb0
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
pop edi
cmp ebx, 0x10
jae 0x470ff6
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.0055bfc0
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0055a67a
add esp, 0x30
ret
Function at 0x471710
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0055bc20
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [esp + 0x18]
cmp esi, ebx
jbe 0x4717b8
mov eax, dword [ebp + 0x18]
cmp esi, eax
jb 0x471769
mov edx, dword [ebp + 0x40]
mov ecx, esi
sub ecx, eax
add ecx, 4
and ecx, 0xfffffffc
add eax, ecx
push 0x71
mov dword [ebp + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push edx
call fcn.00466c80
add esp, 0x10
test eax, eax
jne 0x471766
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebp + 0x40], eax
cmp ebx, esi
jae 0x4717b5
push edi
mov edi, ebx
sub esi, ebx
shl edi, 4
add ebx, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
nop
mov eax, dword [ebp + 0x40]
mov bl, byte [edi + eax]
lea edx, [edi + eax]
lea esi, [edx + 0x10]
shr bl, 7
push esi
neg bl
push 1
and bl, 0x87
call fcn.00471650
xor byte [esi + 0xf], bl
add esp, 8
add edi, 0x10
sub dword [esp + 0x18], 1
jne 0x471780
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
pop edi
mov dword [ebp + 0x14], ebx
mov eax, esi
shl eax, 4
add eax, dword [ebp + 0x40]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x472c10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 4], ecx
test eax, eax
jne 0x472c51
pop edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0055a67a
add esp, 0x30
ret
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 0x18]
push ebx
mov ebx, dword [edi + 0x20]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
dec eax
lea esi, [edi + 0x10]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov al, 0x7f
push 1
mov dword [esp + 0x28], ecx
and byte [esp + 0x28], al
mov dword [esp + 0x2c], edx
and byte [esp + 0x2c], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push ebx
mov dword [esp + 0x2c], ebp
call fcn.00463a40
add esp, 0x18
test eax, eax
je 0x472d40
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
push ebx
call fcn.00461e80
add esp, 0x14
test eax, eax
je 0x472d40
lea edx, [esp + 0x2c]
push ebp
push edx
mov edx, dword [esp + 0x18]
mov ecx, edi
call fcn.00472670
add esp, 8
test eax, eax
je 0x472d40
mov ebp, esi
lea eax, [esp + 0x2c]
xor ecx, ecx
sub ebp, eax
lea ecx, [ecx]
lea eax, [esp + ecx + 0x2c]
movzx edx, byte [eax + ebp]
xor byte [eax], dl
movzx edx, byte [esi + ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [esi + ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [esi + ecx + 3]
xor byte [eax + 3], dl
add ecx, 4
cmp ecx, 0x10
jl 0x472cf0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
or eax, dword [esp + 0x2c]
or ecx, dword [esp + 0x30]
or eax, ecx
mov eax, dword [esp + 0x50]
je 0x472d55
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0046b340
add esp, 8
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0055a67a
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
pop esi
pop ebp
pop ebx
mov dword [edi + 0x2c], 0
pop edi
xor ecx, esp
call fcn.0055a67a
add esp, 0x30
ret
Function at 0x479040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4790cb
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x4790ca
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x4790a3
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x479db0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.0055bc20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004695c0
mov ebx, eax
push ebx
push esi
call fcn.00469770
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x479e3c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x479e16
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x479e09
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00469800
push esi
call fcn.00469460
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x479e3c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004695c0
mov ebx, eax
push ebx
push esi
call fcn.00469770
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x479eae
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x479e94
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x479e87
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.00469800
push esi
call fcn.00469460
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x479e34
push esi
call fcn.00469460
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47da00
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.00496f80
push 0x62
push esi
mov edi, eax
mov ebp, 1
call fcn.0055cd90
add esp, 0x10
test eax, eax
jne 0x47da2c
lea ebp, [eax + 0x11]
test edi, edi
jne 0x47dad1
call fcn.004671d0
push str.BIO_new_file
push 0x45
push str.crypto_bio_bss_file.c
call fcn.00467260
add esp, 0xc
push esi
push ebx
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.004673f0
add esp, 0x14
call fcn.0055deec
cmp dword [eax], 2
je 0x47daa3
call fcn.0055deec
cmp dword [eax], 6
je 0x47daa3
call fcn.004671d0
push str.BIO_new_file
push 0x4f
push str.crypto_bio_bss_file.c
call fcn.00467260
push edi
push 2
push 0x20
call fcn.004673f0
add esp, 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call fcn.004671d0
push str.BIO_new_file
push 0x4d
push str.crypto_bio_bss_file.c
call fcn.00467260
push 0
push 0x80
push 0x20
call fcn.004673f0
add esp, 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x58a638
call fcn.0047c190
mov esi, eax
add esp, 4
test esi, esi
jne 0x47daf4
push edi
call fcn.0055d0bf
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.0047c370
push edi
push ebp
push 0x6a
push esi
call fcn.0047ca40
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x47e880
Capabilities:
Allocate thread local storage

Disassembly:
push 0x47e850
push 0x5e2320
call fcn.00469de0
add esp, 8
neg eax
sbb eax, eax
neg eax
ret