joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed330
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6edd6f
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], 1
call fcn.004e2d20
add esp, 4
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x4ed3fb
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4ed3f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ed541
push ecx
push edx
call fcn.005be247
add esp, 8
test edi, edi
jne 0x4ed406
xor al, al
jmp 0x4ed524
test esi, esi
je 0x4ed522
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005be278
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
xorps xmm0, xmm0
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], 2
call fcn.004e2d20
add esp, 8
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x4ed4b8
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4ed4ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ed546
push ecx
push edx
call fcn.005be247
add esp, 8
sub esp, 8
xor edx, edx
mov edi, esp
mov eax, esi
mov dword [edi], esi
cmp word [esi], dx
je 0x4ed4d2
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x4ed4c8
lea ecx, [ebp - 0x30]
mov dword [edi + 4], edx
call fcn.004e2de0
mov ecx, dword [ebp - 0x34]
add esp, 8
push eax
call fcn.00475440
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x4ed519
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ed50f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ed54b
push ecx
push edx
call fcn.005be247
add esp, 8
push esi
call fcn.004eddf0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 0xc
call fcn.005c44be
call fcn.005c44be
call fcn.005c44be
int3
Function at 0x4ee7e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80c
mov eax, dword [0x7ce4e4]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [0x7d7fe8]
mov dword [esp + 4], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x4ee85b
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
cmp eax, ebx
je 0x4ee826
mov ebx, eax
mov dword [esp + 0xc], ebx
jmp 0x4ee83b
int3
mov ecx, ebx
mov edx, 0x7d7fe8
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x4ee85b
push ebx
call esi
mov ebx, dword [0x7d7fe8]
mov dword [esp + 0xc], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ee867
int3
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
call fcn.005c0be0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x800
call fcn.005be278
add esp, 4
lea esi, [esp + 0x10]
mov ebx, eax
mov ecx, 0x200
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x814]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4f0250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ee115
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
sub esp, 8
mov dword [ebp - 4], esi
mov ecx, 0x7faa94
push 0x7faa98
call fcn.004ebbc0
add esp, 0xc
lea ecx, [ebp - 0x1c]
push eax
call fcn.004de190
mov byte [ebp - 4], 1
call fcn.004f01d0
mov edx, dword [edi + 4]
xor ecx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x44], edx
test edx, edx
je 0x4f02dd
mov eax, edx
cmp byte [edx], cl
je 0x4f02dd
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x4f02d4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x40], ecx
push eax
call fcn.004f1260
mov ecx, dword [eax]
test ecx, ecx
jne 0x4f03f2
mov edx, dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov ecx, edx
mov dword [eax], edi
movups xmmword [ebp - 0x3c], xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x20], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f0310
sub ecx, dword [ebp - 0x20]
push ecx
push edx
lea ecx, [ebp - 0x3c]
call fcn.00475810
mov eax, dword [0x7faa9c]
mov edx, 0x811c9dc5
add eax, 0x20
cmp dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp dword [ebp - 0x2c], ecx
jbe 0x4f035c
mov esi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x2c]
jb 0x4f0348
xor esi, esi
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x3c]
push edx
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004adf30
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4f0380
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x4f03b6
mov edx, dword [ebp - 0x3c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f03ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f042f
push ecx
push edx
call fcn.005be247
add esp, 8
mov ecx, dword [0x7faa9c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
cmp eax, dword [ecx + 0x24]
je 0x4f03fa
cmp dword [eax + 0x20], 0
mov eax, dword [edi + 8]
mov esi, dword [ebp - 0x18]
je 0x4f03ea
or eax, 0x20
mov dword [edi + 8], eax
jmp 0x4f03fa
and eax, 0xffffffdf
mov dword [edi + 8], eax
jmp 0x4f03fa
cmp edi, ecx
je 0x4f03fa
mov esi, edi
mov edi, ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test esi, esi
je 0x4f040f
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.005c44be
int3
Function at 0x4f14c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x4f14db
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4f1504
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4f14f0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004adf30
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4f1524
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f6600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx]
sub eax, esi
sar eax, 2
test eax, eax
je 0x4f6671
push ebx
push edi
mov edi, eax
mov ebx, dword [esi]
lea esi, [esi + 4]
movzx edx, al
movzx ecx, bl
xor edx, ecx
shr eax, 8
mov ecx, ebx
shr ecx, 8
xor eax, dword [edx*4 + 0x782170]
movzx edx, cl
movzx ecx, al
xor edx, ecx
shr eax, 8
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
xor eax, dword [edx*4 + 0x782170]
movzx edx, cl
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x782170]
movzx ecx, al
xor ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x782170]
sub edi, 1
jne 0x4f6613
pop edi
pop ebx
pop esi
ret
Function at 0x4f67b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x141c
call fcn.005beef0
mov eax, dword [0x7ce4e4]
xor eax, esp
mov dword [esp + 0x1418], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 3
je 0x4f67e1
test eax, eax
jne 0x4f690e
mov eax, dword [0x7d7fe8]
cmp eax, 0xffffffff
je 0x4f690e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4f690e
mov eax, dword [0x7d7fe8]
cmp ebx, 1
jne 0x4f6812
push 0
push eax
jmp 0x4f6908
mov ecx, 0x200
mov dword [esp + 0x10], eax
mov esi, ebx
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.004eddf0
add esp, 4
call fcn.004ee750
mov esi, eax
mov eax, dword [0x7fa188]
mov dword [esp + 0xc], esi
test eax, eax
je 0x4f6857
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x4f6888
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push esi
movq qword [esp + 0x18], xmm0
call fcn.004e3b90
push eax
lea ecx, [esp + 0x1c]
call fcn.004e6740
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea ecx, [esp + 0x14]
call fcn.004e6130
push dword [esp + 0xc]
mov ecx, 0x300
lea edi, [esp + 0x824]
mov esi, 0x801e68
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, 0x100
nop word [eax + eax]
xor dl, dl
lea esi, [esp + 0x828]
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [esp + edi*8 + 0x20]
test ecx, ecx
je 0x4f68ed
cmp dword [esi - 8], 0
je 0x4f68ed
mov eax, dword [esp + edi*8 + 0x24]
cmp eax, dword [esi]
jne 0x4f68ed
mov eax, dword [esi - 4]
test eax, eax
je 0x4f68ed
push ecx
mov dword [esp + edi*8 + 0x24], 0
call eax
add esp, 4
mov dl, 1
inc edi
add esi, 0xc
cmp edi, 0x100
jl 0x4f68c0
dec ebx
test ebx, ebx
jle 0x4f6902
test dl, dl
jne 0x4f68b0
push 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x1424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005be209
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f7ec0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7d7ff0], 0
push esi
mov esi, edx
je 0x4f7f15
push dword [0x7d7ff8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f7f15
cmp dword [eax], 1
jbe 0x4f7f15
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x4f7f15
push 0
push 0x7d9954
push 0x7d96a0
push 0
push eax
call fcn.005c1512
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x4f7f15
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov byte [esi], al
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x4f91c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eebdb
mov eax, dword fs:[0]
push eax
sub esp, 0x5d0
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0049f040
push 0
push 0
push 0
push 0
push 0
add eax, 0xc
lea ecx, [ebp - 0x138]
push eax
call fcn.0049aba0
push 0
push 0
push 0
push 0
push 0
push str.HWSignature.dll
lea ecx, [ebp - 0x388]
mov dword [ebp - 4], 0
call fcn.0049a8e0
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x138]
call fcn.0049af30
cmp byte [ebp - 0x26c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4f926c
mov eax, dword [ebp - 0x380]
lea ecx, [ebp - 0x37c]
cmp eax, ecx
je 0x4f926c
push eax
call fcn.005cff1c
add esp, 4
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f92aa
shr eax, 4
not al
test al, 1
je 0x4f92aa
lea eax, [ebp - 0x138]
mov ecx, esi
push eax
call fcn.00499d10
mov bl, 1
jmp 0x4f93b9
lea ecx, [ebp - 0x260]
call fcn.00499a50
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 1
call fcn.004aa7f0
test al, al
je 0x4f938b
cmp byte [ebp - 0x144], 0
lea eax, [ebp - 0x254]
push 0
cmove eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x4b0]
push 0
push 0
push 0
push 0
add eax, 4
push eax
call fcn.0049a8e0
lea eax, [ebp - 0x4b0]
mov ecx, esi
push eax
call fcn.00499d10
cmp byte [ebp - 0x394], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4f9333
mov eax, dword [ebp - 0x4a8]
lea ecx, [ebp - 0x4a4]
cmp eax, ecx
je 0x4f9333
push eax
call fcn.005cff1c
add esp, 4
push 0
push 0
push 0
push 0
push 0
push str.HWSignature.dll
lea ecx, [ebp - 0x5d8]
call fcn.0049a8e0
lea eax, [ebp - 0x5d8]
mov ecx, esi
push eax
call fcn.0049af30
cmp byte [ebp - 0x4bc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4f9387
mov eax, dword [ebp - 0x5d0]
lea ecx, [ebp - 0x5cc]
cmp eax, ecx
je 0x4f9387
push eax
call fcn.005cff1c
add esp, 4
mov bl, 1
jmp 0x4f938d
xor bl, bl
cmp byte [ebp - 0x144], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4f93b9
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x254]
cmp eax, ecx
je 0x4f93b9
push eax
call fcn.005cff1c
add esp, 4
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x138], vtable.t_str.0
jne 0x4f93e2
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x4f93e2
push eax
call fcn.005cff1c
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4f9d90
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x7ce4e4]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x4f9f4e
test edi, edi
je 0x4f9f4e
lea eax, [edi + edi]
mov dword [esp + 0x14], 0
push eax
call fcn.005be278
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x14]
mov edx, edi
push ecx
push ecx
mov ecx, dword [esp + 0x18]
push eax
call fcn.004ff9f0
add esp, 0xc
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4f9ece
xor edi, edi
call fcn.005006b0
mov dword [esp + 0x28], eax
test eax, eax
je 0x4f9ec6
push dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, eax
call fcn.00500960
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x4f9eba
mov eax, dword [esp + 0xc]
test al, 0xf
je 0x4f9e5b
shr eax, 4
inc eax
shl eax, 4
jmp 0x4f9e5e
add eax, 0x10
push eax
mov dword [esp + 0xc], eax
call fcn.005be278
mov edi, dword [esp + 0xc]
push edi
push 0
push eax
mov dword [esp + 0x20], eax
call fcn.005c0be0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push dword [esp + 0x28]
call fcn.005c0660
add esp, 0x1c
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
push 0
push 1
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push dword [esp + 0x14]
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
jne 0x4f9eef
mov eax, dword [esp + 0x1c]
push 1
push ecx
push dword [esp + 0x28]
mov edx, eax
push ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00500a20
add esp, 0x18
mov edi, eax
push 1
push dword [esp + 0x1c]
call fcn.005be247
push dword [esp + 0x10]
mov edx, edi
lea ecx, [esp + 0x3c]
call fcn.00500520
push 1
push edi
call fcn.005be247
xorps xmm0, xmm0
add esp, 0x14
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, esi
movups xmm0, xmmword [esp + 0x30]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x40]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x5c]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
pop edi
mov byte [esi], 0
pop esi
xor ecx, esp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4fa570
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x7137c4
lea eax, [ebx*4]
mov dword [ebp - 0x10], edx
push eax
mov dword [ebp - 4], ecx
call fcn.005bef1b
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x4fa5a7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ecx, dword [ebp - 0x10]
push edi
push esi
call fcn.00500400
mov eax, dword [ebp - 4]
add esp, 8
lea ecx, [eax + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ecx
cmp ecx, 0xffffffff
je 0x4fa647
xor ebx, ebx
call fcn.005006b0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4fa6ca
push dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov ecx, eax
call fcn.00500960
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x4fa6bf
mov esi, dword [ebp + 8]
push esi
call fcn.005be278
push esi
mov ebx, eax
push 0
push ebx
call fcn.005c0be0
push dword [ebp + 8]
mov esi, dword [ebp - 0x14]
push esi
push ebx
call fcn.005c0660
add esp, 0x1c
lea eax, [ebp + 8]
push eax
push ebx
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4fa6b1
push ebx
call fcn.004eddf0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push ecx
push eax
push ecx
push dword [ebp - 0x10]
mov edx, ecx
mov ecx, esi
push edi
call fcn.00500a20
push esi
mov ebx, eax
call fcn.004eddf0
add esp, 0x1c
test ebx, ebx
je 0x4fa6f0
mov eax, dword [ebx]
bswap eax
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4fa6dd
push eax
call fcn.005be278
push dword [ebp - 0x10]
mov edi, eax
lea ecx, [ebx + 4]
mov eax, dword [ebp + 0xc]
push edi
mov edx, dword [eax]
sub edx, 4
call fcn.004ffce0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push 1
push ebx
mov dword [ecx], eax
call fcn.005be247
mov ebx, edi
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 8]
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x4fa641
push esi
call fcn.004eddf0
add esp, 4
jmp 0x4fa66c
push 1
push ebx
mov dword [edi], 0
call fcn.005be247
add esp, 8
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fa970
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eed86
mov eax, dword fs:[0]
push eax
sub esp, 0x5a8
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x258]
mov ebx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push 0
push str..sgbak
call fcn.0049a8e0
mov dword [ebp - 4], 0
lea eax, [ebx + 0xc]
cmp byte [ebx + 0x11c], 0
jne 0x4fa9d6
mov eax, dword [ebx + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x134]
push eax
call fcn.0049a8e0
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x134]
call fcn.0049af30
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4faa2d
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x4faa2d
push eax
call fcn.005cff1c
add esp, 4
push ecx
lea ecx, [ebp - 0x5b0]
call fcn.004a91b0
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x25c], 0x794d44
mov byte [ebp - 4], 3
lea eax, [ebp - 0x128]
cmp byte [ebp - 0x18], 0
push 0x80
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
lea eax, [ebp - 0x134]
push eax
push esi
lea ecx, [ebp - 0x5b0]
call fcn.004a9310
test al, al
jne 0x4faa94
mov edi, 0x794e0c
jmp 0x4fab2f
push dword [edi + 0x10]
lea ecx, [ebp - 0x25c]
push dword [edi + 8]
push esi
call fcn.004b2e70
test al, al
jne 0x4faab1
mov edi, 0x79a51c
jmp 0x4fab2f
lea ecx, [ebp - 0x5b0]
call fcn.004a9530
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4fab2a
shr eax, 4
not al
test al, 1
je 0x4fab2a
push 0
push ebx
push esi
lea ecx, [ebp - 0x134]
call fcn.0049bf00
test al, al
jne 0x4faaff
mov edi, 0x794e0c
jmp 0x4fab2f
push dword [edi + 8]
call fcn.005cff1c
add esp, 4
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov bl, 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
jmp 0x4fab47
mov edi, 0x79a560
mov ecx, esi
call fcn.0049c7f0
push edi
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
xor bl, bl
lea ecx, [ebp - 0x5b0]
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.004a9250
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4fab8f
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4fab8f
push eax
call fcn.005cff1c
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 8