joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483866
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
sub esp, 0x438
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push edi
push 2
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x4839cb
push 0x400
lea eax, [esp + 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4839c4
push ebp
push esi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x58]
push eax
push edi
push 2
push 0x110
push 0xf01ff
push str.Mesh_Agent_background_service
push str.Mesh_Agent
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebp, eax
test ebp, ebp
je 0x483959
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
lea eax, [esp + 0x10]
push eax
push 1
push ebp
mov dword [esp + 0x1c], str.Remote_monitoring_and_management_service.
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
push 3
push ebp
call esi
mov eax, 0xea60
lea edi, [esp + 0x18]
mov dword [esp + 0x30], eax
xor ecx, ecx
mov dword [esp + 0x38], eax
inc ecx
mov dword [esp + 0x40], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
push 2
push ebp
mov dword [esp + 0x24], 0x15180
mov dword [esp + 0x30], 3
call esi
push ebp
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4839c2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x431
jne 0x483992
call esi
push eax
push edi
push 0x1b6
mov edx, 0x766318
mov ecx, 0x766328
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Mesh_service_already_exists.
push 0x766368
jmp 0x4839ba
call esi
push eax
push edi
push 0x1ba
mov edx, 0x76637c
mov ecx, 0x76638c
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Mesh_service_was_not_Installed_Successfully.
push 0x7663ec
call fcn.004010b4
add esp, 0xc
pop esi
pop ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x43c]
mov eax, edi
pop edi
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x438
ret
Function at 0x4839e4
Capabilities:
Delete service
Query service status

Disassembly:
sub esp, 0x20
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push 1
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x483b3b
push edi
push 0x10004
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x483b33
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x483b2c
cmp dword [esp + 0x14], 1
jne 0x483af2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x483a55
inc ebx
jmp 0x483b2c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x483a90
call esi
push eax
push 0
push 0x1e0
mov edx, 0x766400
mov ecx, 0x766410
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Access_denied_while_trying_to_remove_mesh_service
push 0x766478
jmp 0x483b24
cmp eax, 6
jne 0x483ac0
call esi
push eax
push 0
push 0x1e3
mov edx, 0x76648c
mov ecx, 0x76649c
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Handle_invalid_while_trying_to_remove_mesh_service
push 0x766504
jmp 0x483b24
cmp eax, 0x430
jne 0x483b2c
call esi
push eax
push 0
push 0x1e6
mov edx, 0x766518
mov ecx, 0x766528
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Mesh_service_already_marked_for_deletion
push 0x766580
jmp 0x483b24
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
pop ebx
call esi
push eax
push 0
push 0x1ef
mov edx, 0x766594
mov ecx, 0x7665a4
call fcn.0047145c
add esp, 0xc
call esi
push eax
push str.Mesh_service_is_still_running
push 0x7665e4
call fcn.004010b4
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x20
ret

Function at 0x483bbf
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x14
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x483c30
push edi
push 0x14
push str.Mesh_Agent
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x483c28
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x483c21
cmp dword [ebp - 0x1c], 1
jne 0x483c1e
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
cmp eax, 1
jne 0x483c21
inc esi
jmp 0x483c21
push 2
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059b3f0
mov esp, ebp
pop ebp
ret
Function at 0x483c42
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x20
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push edi
push 0x24
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x483cfd
push ebx
push 0x24
push str.Mesh_Agent
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x483cf5
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x483cee
cmp dword [esp + 0x10], 1
je 0x483cee
lea eax, [esp + 0xc]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x483ce0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x246
mov edx, 0x7665f8
mov ecx, 0x766608
call fcn.0047145c
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_stop_service
push 0x766638
call fcn.004010b4
add esp, 0xc
jmp 0x483cee
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
inc edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop ebp
xor ecx, esp
call fcn.0059b3f0
add esp, 0x20
ret

Function at 0x483d10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
push edi
push 0x32
pop ebx
push 0x40
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0x44
push 0
xor edi, edi
mov ebp, edx
push eax
mov esi, ecx
inc edi
call fcn.0059de40
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push edi
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x483da5
test ebp, ebp
je 0x483d91
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, eax
xor eax, eax
cmp dword [esp + 0x10], 0x103
cmove edi, eax
test edi, edi
jne 0x483d91
mov eax, ebx
dec ebx
test eax, eax
jg 0x483d60
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x18]
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4ca2b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4ca2d7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4ca2c6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x4cbd70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0059bb50
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4cbef7
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, 0x10
jb 0x4cbdf0
mov eax, esi
shr eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
sub edx, ebp
sub eax, ebp
mov ecx, ebp
mov dword [esp + 0x14], eax
mov ebx, 4
mov esi, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [esi + ecx - 4], eax
sub ebx, 1
jne 0x4cbdb7
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edx, edi
sub esi, 0x10
add esp, 0xc
add ebp, 0x10
mov dword [esp + 0x30], esi
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x4cbda4
test esi, esi
je 0x4cbeea
mov ebx, edi
mov ecx, edx
sub ebx, ebp
sub ecx, ebp
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 1
mov dword [esp + 0x20], ecx
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov ebx, 2
sub ebx, ebp
mov dword [esp + 0x18], ebx
mov ebx, 3
sub ebx, ebp
mov dword [esp + 0x1c], ebx
nop dword [eax + eax]
cmp eax, esi
jae 0x4cbea2
mov esi, dword [esp + 0x14]
lea ebx, [eax + ebp]
mov cl, byte [ecx + ebx]
xor cl, byte [ebx]
mov byte [esi + ebx], cl
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
add ecx, ebx
cmp ecx, esi
jae 0x4cbea1
mov cl, byte [eax + ebp + 1]
xor cl, byte [eax + edx + 1]
mov byte [edi + eax + 1], cl
mov ecx, dword [esp + 0x18]
add ecx, ebx
cmp ecx, esi
jae 0x4cbe9c
mov cl, byte [eax + ebp + 2]
xor cl, byte [eax + edx + 2]
mov byte [edi + eax + 2], cl
mov ecx, dword [esp + 0x1c]
add ecx, ebx
cmp ecx, esi
jae 0x4cbe97
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + edx + 3]
mov byte [edi + eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x20]
cmp eax, 0x10
jb 0x4cbe30
jmp 0x4cbec1
add eax, 3
jmp 0x4cbea2
add eax, 2
jmp 0x4cbea2
inc eax
cmp eax, 0x10
jae 0x4cbec1
mov ebx, 0x10
lea ecx, [eax + edi]
sub edx, edi
sub ebx, eax
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub ebx, 1
jne 0x4cbeb3
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov edx, edi
cmp esi, 0x10
jbe 0x4cbeea
sub esi, 0x10
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x30], esi
test esi, esi
jne 0x4cbdf8
mov eax, dword [esp + 0x38]
movups xmm0, xmmword [edx]
pop edi
pop ebp
movups xmmword [eax], xmm0
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x4cc020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0059bb50
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x4cc06d
mov edx, dword [esp + 0x30]
test esi, esi
je 0x4cc06d
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebp], al
inc ecx
inc ebp
mov dword [esp + 0x10], ecx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x4cc050
mov ebx, dword [esp + 0x2c]
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x4cc127
mov edi, ebx
nop
mov ebx, esi
shr ebx, 4
add edx, ebx
mov dword [esp + 0x24], edx
cmp edx, ebx
jae 0x4cc0b7
sub ebx, edx
xor edx, edx
mov dword [esp + 0x24], edx
push edi
push dword [esp + 0x2c]
push ebx
push ebp
push ecx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x4cc109
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + edi - 1]
dec edx
add ecx, eax
mov byte [edx + edi], cl
shr ecx, 8
test edx, edx
jne 0x4cc0f3
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
shl ebx, 4
sub esi, ebx
add ecx, ebx
add ebp, ebx
mov dword [esp + 0x10], ecx
cmp esi, 0x10
jae 0x4cc0a0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x2c]
test esi, esi
je 0x4cc195
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ebx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
inc ecx
mov eax, ecx
mov byte [ebx + 0xf], cl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xe], al
test ecx, ecx
jne 0x4cc172
push ebx
call fcn.004cc1e0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
mov edx, dword [esp + 0x10]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebp - 1], al
sub esi, 1
jne 0x4cc183
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4ccad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x38]
or eax, dword [ebx + 0x3c]
je 0x4ccae4
mov eax, 0xfffffffe
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, esi
add eax, dword [ebx + 0x30]
adc ecx, dword [ebx + 0x34]
cmp ecx, 0x20000000
ja 0x4ccb99
jb 0x4ccb09
test eax, eax
jne 0x4ccb99
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [ebx + 0x16c]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
test edi, edi
je 0x4ccb49
nop
test esi, esi
je 0x4ccb35
mov al, byte [ebp]
dec esi
xor byte [edi + ebx + 0x40], al
inc ebp
inc edi
and edi, 0xf
jne 0x4ccb20
jmp 0x4ccb39
test edi, edi
jne 0x4ccb8c
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004ce160
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x4ccb6e
push eax
push ebp
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004cdf20
add ebp, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x4ccb8c
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x4ccb8c
nop word [eax + eax]
mov al, byte [ecx + ebp]
xor byte [ebx + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x4ccb80
mov dword [ebx + 0x16c], edi
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x4cdcd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.0059bb50
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x4cdd3c
mov eax, dword [esp + 0x20]
mov ebx, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x4cde95
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x4c], 0
push ebp
mov ebp, dword [esp + 0x24]
push edi
lea edi, [esi + 0x40]
cmp ebx, 0x10
jb 0x4cdddc
lea eax, [esi + 0x60]
mov dword [esp + 0x14], eax
lea ecx, [esi + 0x41]
mov eax, ebx
mov dword [esp + 0x18], ecx
shr eax, 4
mov esi, edi
mov dword [esp + 0x2c], eax
mov eax, ecx
lea edx, [ebp + 1]
mov edi, 4
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub edi, 1
jne 0x4cdd90
push dword [esp + 0x14]
push esi
call fcn.004ce160
mov ecx, dword [esp + 0x20]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x2c], 1
jne 0x4cdd83
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x40]
test ebx, ebx
je 0x4cddfe
xor ecx, ecx
test ebx, ebx
je 0x4cddf1
mov al, byte [ecx + ebp]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x4cdde6
lea eax, [esi + 0x60]
push eax
push edi
call fcn.004ce160
add esp, 8
mov ebx, dword [esp + 0x1c]
xor edx, edx
shld edx, ebx, 3
xor byte [esi + 0x4b], dl
mov eax, edx
shr eax, 0x18
xor byte [esi + 0x48], al
mov eax, edx
shr eax, 0x10
xor byte [esi + 0x49], al
mov eax, edx
shr eax, 8
xor byte [esi + 0x4a], al
mov eax, edx
shl ebx, 3
xor byte [esi + 0x4f], bl
mov ecx, ebx
shrd ecx, eax, 0x18
xor byte [esi + 0x4c], cl
mov ecx, ebx
shr eax, 0x18
mov eax, edx
shrd ecx, eax, 0x10
xor byte [esi + 0x4d], cl
shr eax, 0x10
mov eax, ebx
shrd eax, edx, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
shr edx, 8
push edi
call fcn.004ce160
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
pop edi
mov dword [esi + 0xc], eax
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4ce160
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0059bb50
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x64e0a8]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x64e0a8]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x64e0a8]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x4ce200
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x4d3940
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.00507be0
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.0059e050
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x4d39e6
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004982a0
push 0x64e1b4
push esi
push 0x64e1b8
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.00497a00
add esp, 0x2c
call fcn.005ca460
cmp dword [eax], 2
je 0x4d39cb
call fcn.005ca460
cmp dword [eax], 6
je 0x4d39cb
push edi
push edi
push 2
push 0x6d
push 0x20
call fcn.004982a0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push 0
push 0x80
push 0x6d
push 0x20
call fcn.004982a0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x64e174
call fcn.0049f190
mov esi, eax
add esp, 4
test esi, esi
jne 0x4d3a08
push edi
call fcn.005ac520
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0049eab0
push edi
push ebx
push 0x6a
push esi
call fcn.0049eae0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret