joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4989c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6598c2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x498a27
lea eax, [ebx + 0x70]
mov dword [ebx], 0x67ee64
mov dword [ebp + 8], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 0x10]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 8], esi
call fcn.004066a0
mov dword [ebp - 4], 2
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005e9c63
mov edi, eax
add esp, 4
test edi, edi
je 0x498a80
push 1
call fcn.005e859c
add esp, 4
mov dword [edi + 4], eax
jmp 0x498a82
xor edi, edi
mov ecx, dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [esi + 0x34], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea edi, [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], edi
lea edx, [ecx + 0x24]
mov dword [ecx + 0x2c], edx
add esi, 0x18
mov dword [ecx + 0x20], esi
add ecx, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], ecx
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x20]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x30]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0xc]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x2c]
mov dword [eax], 0
mov byte [ebp - 4], 3
mov eax, ebx
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, eax
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
lea eax, [ebx + 8]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [0x6ee9e8]
mov dword [ebx + 0x40], eax
mov eax, dword [0x6ee9ec]
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659c41
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x268], esi
push eax
mov dword [ebp - 0x264], 0
call fcn.00465c80
mov ecx, eax
call fcn.004e9a60
mov dword [ebp - 4], 1
cmp dword [ebp - 0x238], 0
jne 0x49a1b4
movups xmm0, xmmword [ebp - 0x248]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x248], ax
movq xmm0, qword [ebp - 0x238]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x264], 1
jmp 0x49a36c
call fcn.00409870
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], 0x54746547
push ecx
push eax
mov dword [ebp - 0x224], 0x436b6369
mov dword [ebp - 0x220], 0x746e756f
mov byte [ebp - 0x21c], 0
call fcn.0048a530
add esp, 8
test eax, eax
jne 0x49a1f6
xor edi, edi
jmp 0x49a1fa
call eax
mov edi, eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00607da0
push edi
push 0x681980
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00471cf0
add esp, 0x1c
lea ecx, [ebp - 0x248]
push 1
push 0x6801a0
call fcn.00421790
lea ecx, [ebp - 0x218]
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a244
sub ecx, edi
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00421790
lea eax, [ebp - 0x248]
push eax
call fcn.004991e0
add esp, 4
test al, al
je 0x49a294
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.00406970
mov ecx, eax
mov byte [ebp - 4], 2
mov eax, 2
jmp 0x49a2e8
xor eax, eax
mov dword [ebp - 0x220], 0
push eax
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
push 0x67ed6c
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.0040cbc0
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 3
mov eax, 4
mov dword [ebp - 0x264], eax
xor edx, edx
mov dword [esi + 0x10], 0
or eax, 1
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], dx
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], 2
test al, 4
je 0x49a34d
and eax, 0xfffffffb
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x264], eax
call fcn.00407b80
mov eax, dword [ebp - 0x264]
mov dword [ebp - 4], 1
test al, 2
je 0x49a36c
and eax, 0xfffffffd
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x264], eax
call fcn.00407b80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00407b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x49a3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659ce1
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x248]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x26c], esi
push eax
mov dword [ebp - 0x264], 0
call fcn.00465c80
mov ecx, eax
call fcn.004e9a60
mov dword [ebp - 4], 1
cmp dword [ebp - 0x238], 0
jne 0x49a457
movups xmm0, xmmword [ebp - 0x248]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x248], ax
movq xmm0, qword [ebp - 0x238]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x264], 1
jmp 0x49a638
call fcn.00409870
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], 0x54746547
push ecx
push eax
mov dword [ebp - 0x224], 0x436b6369
mov dword [ebp - 0x220], 0x746e756f
mov byte [ebp - 0x21c], 0
call fcn.0048a530
add esp, 8
test eax, eax
jne 0x49a49d
mov dword [ebp - 0x268], eax
jmp 0x49a4a5
call eax
mov dword [ebp - 0x268], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00607da0
push dword [ebp - 0x268]
lea eax, [ebp - 0x218]
push 0x681980
push 0x104
push eax
call fcn.00471cf0
add esp, 0x1c
lea ecx, [ebp - 0x248]
push 1
push 0x6801a0
call fcn.00421790
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x49a4f3
mov ecx, dword [edi]
push dword [edi + 0x10]
push ecx
mov ecx, eax
call fcn.00421790
lea ecx, [ebp - 0x218]
mov edx, eax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49a510
sub ecx, edi
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00421790
lea eax, [ebp - 0x248]
push eax
call fcn.004991e0
add esp, 4
test al, al
je 0x49a560
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.00406970
mov ecx, eax
mov byte [ebp - 4], 2
mov eax, 2
jmp 0x49a5b4
xor eax, eax
mov dword [ebp - 0x220], 0
push eax
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
push 0x67ed6c
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.0040cbc0
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 3
mov eax, 4
mov dword [ebp - 0x264], eax
xor edx, edx
mov dword [esi + 0x10], 0
or eax, 1
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], dx
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], 2
test al, 4
je 0x49a619
and eax, 0xfffffffb
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x264], eax
call fcn.00407b80
mov eax, dword [ebp - 0x264]
mov dword [ebp - 4], 1
test al, 2
je 0x49a638
and eax, 0xfffffffd
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x264], eax
call fcn.00407b80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00407b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x49ced0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x10]
test edx, edx
je 0x49cf81
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x49cf81
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x49cefb
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
push ebx
mov ebx, edi
jb 0x49cf06
mov ebx, dword [edi]
cmp edx, eax
jne 0x49cf2b
test edx, edx
je 0x49cf21
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x49cf2b
add ecx, 2
sub edx, 1
jne 0x49cf10
pop ebx
pop edi
mov eax, 2
pop esi
pop ebp
ret
push edi
call fcn.0049b960
add esp, 4
test al, al
jne 0x49cf42
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
pop ebp
ret
push esi
call fcn.0049b960
add esp, 4
test al, al
je 0x49cf5a
push 1
push esi
call fcn.00499550
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x49cf62
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x49cf6a
mov edi, dword [edi]
push esi
push edi
call fcn.0061110a
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffffc
pop ebx
pop edi
inc eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4a1050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00409870
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54746547
push ecx
push eax
mov dword [ebp - 0x10], 0x436b6369
mov dword [ebp - 0xc], 0x746e756f
mov byte [ebp - 8], 0
call fcn.0048a530
add esp, 8
test eax, eax
jne 0x4a109d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x4eb1d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x681bd4
push dword [ebp + 8]
call fcn.0061184c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4eb20f
push esi
push ebx
push dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
call fcn.0060b6a5
push ebx
mov esi, eax
call fcn.0060afac
add esp, 0x14
cmp esi, dword [ebp + 0xc]
pop esi
jne 0x4eb20f
mov al, 1
pop ebx
pop ebp
ret
xor al, al
pop ebx
pop ebp
ret

Function at 0x4eb280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x681bd8
push dword [ebp + 8]
call fcn.0061184c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4eb2bf
push esi
push ebx
push dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
call fcn.0060bd39
push ebx
mov esi, eax
call fcn.0060afac
add esp, 0x14
cmp esi, dword [ebp + 0xc]
pop esi
jne 0x4eb2bf
mov al, 1
pop ebx
pop ebp
ret
xor al, al
pop ebx
pop ebp
ret

Function at 0x4ec0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66228b
mov eax, dword fs:[0]
push eax
mov eax, 0x6c60
call fcn.005e9f60
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x6f1e34]
mov dword [ebp - 0x6c68], 0
mov dword [ebp - 0x6c4c], 0x568
mov dword [ebp - 0x6c6c], 0x6c20
call fcn.00491110
add esp, 4
mov dword [0x6f1e34], eax
test eax, eax
jne 0x4ec1e1
mov dword [ebp - 0x6c54], eax
mov dword [ebp - 0x6c50], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x6c54], eax
mov word [ebp - 0x6c64], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x610052
lea edx, [eax + 2]
mov dword [ebp - 0x28], 0x610073
mov dword [ebp - 0x24], 0x690070
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x6c50], 7
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ec190
sub eax, edx
lea ecx, [ebp - 0x6c64]
sar eax, 1
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040cbc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6c64]
push eax
call fcn.0048d690
add esp, 4
mov dword [0x6f1e34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c64]
call fcn.00407b80
mov eax, dword [0x6f1e34]
push str.RasEnumConnectionsW
push eax
call fcn.0048a530
add esp, 8
test eax, eax
je 0x4ec219
lea ecx, [ebp - 0x6c68]
push ecx
lea ecx, [ebp - 0x6c6c]
push ecx
lea ecx, [ebp - 0x6c4c]
push ecx
call eax
test eax, eax
jne 0x4ec219
cmp dword [ebp - 0x6c68], eax
seta al
jmp 0x4ec21b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x4ee460
Capabilities:
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6626e1
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x170], esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x16c], 1
mov dword [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00406970
mov byte [ebp - 4], 2
mov byte [ebp - 0x15c], 0x5f
mov byte [ebp - 0x15b], 0x46
mov byte [ebp - 0x15a], 0x5f
mov byte [ebp - 0x159], 0
mov byte [ebp - 0x160], 0x5f
mov byte [ebp - 0x15f], 0x59
mov byte [ebp - 0x15e], 0x5f
mov byte [ebp - 0x15d], 0
mov byte [ebp - 0x164], 0x5f
mov byte [ebp - 0x163], 0x53
mov byte [ebp - 0x162], 0x5f
mov byte [ebp - 0x161], 0
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004876f0
mov edi, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.004876f0
mov esi, eax
mov byte [ebp - 4], 4
push dword [ebp - 0x170]
lea eax, [ebp - 0xd4]
push eax
call fcn.004876f0
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004edff0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x160]
push ecx
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00494570
mov byte [ebp - 4], 7
push esi
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00405030
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x164]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00494570
add esp, 0x48
mov byte [ebp - 4], 9
push edi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00405030
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
call fcn.00407b00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8c]
call fcn.00407b00
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa4]
call fcn.00407b00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xbc]
call fcn.00407b00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd4]
call fcn.00407b00
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xec]
call fcn.00407b00
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c]
call fcn.00407b00
lea ecx, [ebp - 0x158]
call fcn.00522a20
lea ecx, [ebp - 0x158]
call fcn.00522f00
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x158]
call fcn.005239f0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x158]
call fcn.00522f30
mov byte [ebp - 4], 0x12
push eax
mov ecx, ebx
call fcn.00408470
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c]
call fcn.00407b00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00407b00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00407b80
mov dword [ebp - 4], 0
mov eax, ebx
jmp 0x4ee6de
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4
Function at 0x502aa3
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword ds:[edx]
shl ecx, 4
movups xmm1, xmmword ds:[edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, ds:[edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword ds:[edx + ecx]
add ecx, 0x10
jmp 0x502b03
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword ds:[edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword ds:[edx + ecx - 0x10]
jne 0x502af4
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret

Function at 0x502b7d
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword ds:[edx]
shl ecx, 4
movups xmm1, xmmword ds:[edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword ds:[edx + 0x20]
lea edx, ds:[edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword ds:[edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword ds:[edx + ecx - 0x10]
jne 0x502b9f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x502bd8
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword ds:[edx]
shl ecx, 4
movups xmm1, xmmword ds:[edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword ds:[edx + 0x20]
lea edx, ds:[edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword ds:[edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword ds:[edx + ecx - 0x10]
jne 0x502bfe
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x502c4b
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword ds:[edx]
movups xmm1, xmmword ds:[edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword ds:[edx + 0x20]
lea edx, ds:[edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword ds:[edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword ds:[edx + ecx - 0x10]
jne 0x502c75
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret
Function at 0x503290
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword ss:[esp + 8]
mov ecx, dword ss:[esp + 0xc]
mov edx, dword ss:[esp + 0x10]
call fcn.00502ce0
mov edx, dword ss:[esp + 0x10]
shl ecx, 4
test eax, eax
jne 0x50330a
lea eax, ds:[edx + ecx + 0x10]
movups xmm0, xmmword ds:[edx]
movups xmm1, xmmword ds:[eax]
movups xmmword ds:[eax], xmm0
movups xmmword ds:[edx], xmm1
lea edx, ds:[edx + 0x10]
lea eax, ds:[eax - 0x10]
movups xmm0, xmmword ds:[edx]
movups xmm1, xmmword ds:[eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, ds:[edx + 0x10]
lea eax, ds:[eax - 0x10]
movups xmmword ds:[eax + 0x10], xmm0
movups xmmword ds:[edx - 0x10], xmm1
cmp eax, edx
ja 0x5032cd
movups xmm0, xmmword ds:[edx]
aesimc xmm0, xmm0
movups xmmword ds:[edx], xmm0
pxor mm0, mm0
pxor mm1, mm1
xor eax, eax
ret
Function at 0x50bb50
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x665426
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2f50
call fcn.005e9f60
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2f54], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2f5c], ebx
mov dword [ebp - 4], 0
push 0x2d0c
push 0
lea eax, [ebp - 0x2f20]
push eax
call fcn.00607da0
add esp, 0xc
test ebx, ebx
je 0x50bdcf
xor ebx, ebx
mov dword [ebp - 0x2f58], ebx
xor esi, esi
mov dword [ebp - 0x2f60], esi
nop word [eax + eax]
mov dword [ebp - 0x2f28], 0
mov dword [ebp - 0x2f24], 0
mov dword [ebp - 0x2f28], 0
mov dword [ebp - 0x2f24], 7
xor eax, eax
mov word [ebp - 0x2f38], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2f50]
push eax
call fcn.00506480
add esp, 4
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x50bc20
mov eax, dword [eax]
push esi
push eax
push 0x100
lea eax, [ebp - 0x214]
push eax
call fcn.004943a0
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2f50]
call fcn.00407b80
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x2f38]
call fcn.0042d790
lea edi, [ebp - 0x2f38]
cmp dword [ebp - 0x2f24], 8
cmovae edi, dword [ebp - 0x2f38]
call fcn.00409870
push 0x681828
push eax
call fcn.0048a530
add esp, 8
test eax, eax
je 0x50bdac
push 0
push 0
push 3
push 0
push 3
push 0
push edi
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x50bdac
lea eax, [ebp - 0x2f1c]
mov dword [eax], 0
xorps xmm0, xmm0
movq qword [ebp - 0x2f18], xmm0
mov dword [ebp - 0x2f10], 0
lea eax, [ebp - 0x2f14]
mov dword [eax], 0
push 0x2710
push 0
lea eax, [ebp - 0x2f0c]
push eax
call fcn.00607da0
call fcn.00409870
push 0x681d10
push eax
call fcn.0048a530
add esp, 0x14
test eax, eax
je 0x50bd8f
push 0
lea ecx, [ebp - 0x2f1c]
push ecx
push 0x2710
lea ecx, [ebp - 0x2f0c]
push ecx
push 0xc
lea ecx, [ebp - 0x2f18]
push ecx
push 0x2d1400
push edi
call eax
test eax, eax
je 0x50bd8f
push 0x3e8
push 0
lea eax, [ebp - 0x7fc]
push eax
call fcn.00607da0
add esp, 0xc
lea eax, [ebp - 0x7fc]
push eax
push 0
lea eax, [ebp - 0x2f0c]
push eax
push dword [ebp - 0x2ef4]
mov ecx, dword [ebp - 0x2f54]
call fcn.0050b960
push SysReAllocString
lea eax, [ebp - 0x7fc]
push eax
push eax
push 0x104
push dword [ebp - 0x2f5c]
mov ecx, dword [ebp - 0x2f54]
call fcn.0050c700
test eax, eax
mov eax, 1
cmove ebx, eax
mov dword [ebp - 0x2f58], ebx
push edi
call fcn.00492a20
test ebx, ebx
je 0x50bdac
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2f38]
call fcn.00407b80
mov eax, ebx
jmp 0x50bdeb
inc esi
mov dword [ebp - 0x2f60], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2f38]
call fcn.00407b80
cmp esi, 0x10
jl 0x50bbd0
mov eax, ebx
jmp 0x50bdeb
mov ebx, dword [ebp - 0x2f58]
mov eax, ebx
jmp 0x50bdeb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4