joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4511f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa4ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004575b0
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::JSON::ParseHandler.0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00573e1f
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.0045ae80
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x34], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4558a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00455d30
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00573e1f
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov al, cl
and al, 1
shr ecx, 1
mov byte [edi + 0x1c], al
and cl, 1
mov byte [edi + 0x1d], cl
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x464180
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ab168
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
lea esi, [edi + 4]
jne 0x4641c1
push 0
push 0x128
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463460
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00463e10
add esp, 8
lea edx, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
lea ecx, [edi + 0x1c]
cmovae edx, dword [ebp - 0x24]
cmp dword [ecx + 0x14], 8
jb 0x4641fd
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
and eax, 1
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46422a
lea ecx, [ebp - 0x24]
call fcn.00419180
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00464400
int3

Function at 0x464370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x46438f
push 0
push 0x5e
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463460
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46439a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4643c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x4643bb.4
movzx eax, byte [eax + 0x4643dc]
jmp dword [eax*4 + 0x4643d4]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00464400
nop
ret 0x4643
Function at 0x464400
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ab1c8
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x4645d8
je case.0x46444e.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x46444e.4
movzx eax, byte [eax + 0x464674]
jmp dword [eax*4 + 0x464638]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045b530
push 0x65230c
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045b410
push 0x6523e4
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045b4e0
push 0x6522c4
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045b0a0
push 0x65242c
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045b1d0
push 0x652504
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045bbf0
push 0x652474
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0045ba00
push 0x6524bc
lea eax, [ebp - 0x38]
push eax
call fcn.00576527
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.0040a170
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.0045b460
push 0x652280
lea eax, [ebp - 0x64]
push eax
call fcn.00576527
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.0040a170
mov dword [ebp - 4], 1
jmp 0x46451f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.0040a170
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.0045b9d0
push 0x6524bc
jmp 0x464534
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.0040a170
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.0045bbc0
push 0x652474
jmp 0x464534
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.0040a170
mov dword [ebp - 4], 4
jmp 0x46451f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.0045b910
push 0x652214
jmp 0x464534
cmp esi, 0x781
je case.0x46444e.3
cmp esi, 0x1779
je 0x464607
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.0045b490
push 0x652280
lea eax, [ebp - 0x90]
jmp 0x464537
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.0045b580
push 0x65239c
jmp 0x464534
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.0045b8c0
push 0x652354
jmp 0x464534
Function at 0x464760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x464782
push 0
push 0x9f
push str.d:jenkinsworkspace_n_poco_vc120poco_1.11.1_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.00463460
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x46478d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4647a0
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00464400
int3

Function at 0x464ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573e1f
mov edi, eax
add esp, 4
test edi, edi
je 0x464afc
push 1
mov dword [ebp - 4], 0
call fcn.0057164d
add esp, 4
mov dword [edi + 4], eax
jmp 0x464afe
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp + 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, 0x48
mov dword [esi + 0x40], edx
and edx, 1
mov dword [esi], vtable.Poco::Base64EncoderBuf.0
cmovne eax, ecx
mov dword [esi + 0x48], 0
mov ecx, dword [ebp + 8]
test edx, edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov dword [esi + 0x54], eax
mov eax, 0x5b1750
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46ebe0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x46ebf0
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
push 0x288
mov dword [esp + 0xc], 0x288
mov dword [edi], eax
mov word [edi + 4], ax
call fcn.00574151
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x46ec3d
push esi
call fcn.00573e0e
push dword [esp + 0xc]
call fcn.00574151
add esp, 8
mov esi, eax
jmp 0x46ec41
test eax, eax
jne 0x46ec9a
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x46ec91
xor dl, dl
mov eax, esi
test esi, esi
je 0x46ec91
nop dword [eax]
test dl, dl
jne 0x46ec91
cmp dword [eax + 0x1a0], 6
jne 0x46ec8b
cmp dword [eax + 0x190], 6
jne 0x46ec8b
mov ecx, dword [eax + 0x194]
mov dl, 1
mov dword [edi], ecx
mov cx, word [eax + 0x198]
mov word [edi + 4], cx
mov eax, dword [eax]
test eax, eax
jne 0x46ec60
push esi
call fcn.00573e0e
add esp, 4
pop edi
pop esi
pop ecx
ret

Function at 0x46eca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573e1f
mov edi, eax
add esp, 4
test edi, edi
je 0x46ecec
push 1
mov dword [ebp - 4], 0
call fcn.0057164d
add esp, 4
mov dword [edi + 4], eax
jmp 0x46ecee
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
push 0x100
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.00574151
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::RandomBuf.0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46ff10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab704
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0046e870
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::Crypto::CipherKeyImpl.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040a1b0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ebx, [esi + 0x34]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.0046fb20
mov byte [ebp - 4], 4
call fcn.0046fe90
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x46ffaa
mov eax, dword [edi]
push eax
call fcn.004b53e0
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x47009e
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x14], 0x10
jb 0x46ffc9
mov eax, dword [eax]
push eax
call fcn.004b5410
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x4700e0
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470370
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443b90
mov edi, eax
lea ecx, [esi + 0x28]
cmp ecx, edi
je 0x470024
call fcn.00438a70
mov ecx, dword [edi]
mov dword [esi + 0x28], ecx
mov eax, dword [edi + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438a70
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00470360
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443b90
mov edi, eax
cmp ebx, edi
je 0x470071
mov ecx, ebx
call fcn.00438a70
mov ecx, dword [edi]
mov dword [ebx], ecx
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.00438a70
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00470240
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
push edi
lea eax, [ebp - 0x28]
push str.Cipher
push eax
call fcn.0040f1a0
push str._was_not_found
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.00442b40
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.0045b790
push 0x651b28
lea eax, [ebp - 0x6c]
push eax
call fcn.00576527
push edi
lea eax, [ebp - 0x40]
push str.Digest
push eax
call fcn.0040f1a0
push str._was_not_found
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.00442b40
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.0045b790
push 0x651b28
lea eax, [ebp - 0x6c]
push eax
call fcn.00576527
int3
Function at 0x471540
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573e1f
mov edi, eax
add esp, 4
test edi, edi
je 0x47158c
push 1
mov dword [ebp - 4], 0
call fcn.0057164d
add esp, 4
mov dword [edi + 4], eax
jmp 0x47158e
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 4], 1
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call fcn.00574151
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c5270
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00574b30
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4c52f0
mov cl, byte [edi]
test cl, cl
je 0x4c52f0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4c52a0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4c5400
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00574b30
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x4c5485
mov al, byte [ebx]
test al, al
je 0x4c5485
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.004f0230
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or eax, esi
xor eax, edi
mov esi, eax
mov al, byte [ebx]
mov dword [esp + 0x10], esi
test al, al
jne 0x4c5427
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4d3aa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4d3ac7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4d3ab6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x596a73
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059671a

Function at 0x596a7e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005968a4

Function at 0x5a3c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573e1f
mov edi, eax
add esp, 4
test edi, edi
je 0x5a3cac
push 1
mov dword [ebp - 4], 0
call fcn.0057164d
add esp, 4
mov dword [edi + 4], eax
jmp 0x5a3cae
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryEncoderBuf.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0x48
mov dword [esi + 0x48], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a4200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573e1f
mov edi, eax
add esp, 4
test edi, edi
je 0x5a424c
push 1
mov dword [ebp - 4], 0
call fcn.0057164d
add esp, 4
mov dword [edi + 4], eax
jmp 0x5a424e
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryDecoderBuf.0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4