joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467150
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi + 0x28]
cmp ecx, 0x40
jae 0x4672e4
lea eax, [ecx*8]
add dword [esi], eax
push ebx
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x2c], 0x80
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jbe 0x4671ae
cmp eax, 0x40
jae 0x467197
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x40
jb 0x467186
lea ebx, [esi + 0x2c]
mov ecx, esi
mov edx, ebx
call fcn.00466ea0
mov dword [esi + 0x28], 0
xor eax, eax
jmp 0x4671b3
lea ebx, [esi + 0x2c]
jae 0x4671c4
mov byte [eax + esi + 0x2c], 0
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp eax, 0x38
jb 0x4671b3
movzx eax, byte [esi + 7]
mov edx, ebx
mov byte [esi + 0x64], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x65], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x66], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x68], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x69], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x6a], al
movzx eax, byte [esi]
mov byte [esi + 0x6b], al
call fcn.00466ea0
movzx eax, byte [esi + 0xb]
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
movzx eax, byte [esi + 0x1f]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x1e]
mov byte [edi + 0x15], al
movzx eax, byte [esi + 0x1d]
mov byte [edi + 0x16], al
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x17], al
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x19], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x1a], al
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x1b], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x1c], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x1d], al
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x1e], al
movzx eax, byte [esi + 0x24]
mov byte [edi + 0x1f], al
pop ebx
pop edi
pop esi
ret
Function at 0x46a910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cee33
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4ef400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x4e71a0]
mov ecx, 0x10
movaps xmm2, xmmword [0x4e6c10]
movaps xmm1, xmmword [0x4e6b30]
movd eax, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x10], 0x4f06d0
mov dword [ebp - 0x1c], 0x4f4f5b
mov byte [ebp - 0x18], 1
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x28]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x2c], xmm1
movaps xmm1, xmmword [0x4e6b40]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x24]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x28], xmm1
movaps xmm1, xmmword [0x4e6b50]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x20]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x24], xmm1
movaps xmm1, xmmword [0x4e6b60]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x20], xmm1
lea eax, [ecx + 0x2a]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x13
jb 0x46aa12
push ecx
lea eax, [ebp - 0x19]
mov byte [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x2c]
mov ecx, 0x4f06d0
push eax
call fcn.0045a4c0
mov esi, accept
mov dword [ebp - 4], 0
mov ecx, dword [0x4f0754]
mov eax, esi
sub eax, ecx
cmp eax, 0xe
jb 0x46ab4e
cmp dword [0x4f0758], 0xf
mov eax, 0x4f0744
push ecx
cmova eax, dword [0x4f0744]
push eax
push 0xe
push str.Prz_Cheats___V
push ecx
push dword [ebp - 0x14]
mov ecx, 0x4f06e8
call fcn.0045c9e0
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [0x4f06e0]
sub eax, ecx
cmp eax, 0xb
jb 0x46ab4e
cmp dword [0x4f06e4], 0xf
mov eax, 0x4f06d0
push ecx
cmova eax, dword [0x4f06d0]
push eax
push 0xb
push str.Welcome_to
push ecx
push dword [ebp - 0x14]
mov ecx, 0x4f0700
call fcn.0045c9e0
mov byte [ebp - 4], 2
mov ecx, dword [0x4f0754]
sub esi, ecx
mov byte [0x4f0718], 0
cmp esi, 0x6d
jb 0x46ab4e
cmp dword [0x4f0758], 0xf
mov eax, 0x4f0744
push ecx
cmova eax, dword [0x4f0744]
push eax
push 0x6d
push str._________________________________________________________________________________________MTA___Prz_Cheats___V
push ecx
push dword [ebp - 0x14]
mov ecx, 0x4f071c
call fcn.0045c9e0
cmp dword [0x4f0730], 0xf
mov ecx, 0x4f071c
mov dword [0x4f0738], 0x44390000
mov eax, 0x4f06d0
cmova ecx, dword [0x4f071c]
mov dword [0x4f0734], ecx
mov dword [0x4f073c], 0x43e60000
mov dword [0x4f0740], 0x12a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00446680
int3
Function at 0x46c7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
cmp byte [ebx + 0x26], 0
je 0x46c948
movaps xmm5, xmmword [0x4e6b10]
mov ecx, 0x2e
movaps xmm6, xmmword [0x4e6b30]
sub ecx, ebx
movups xmm4, xmmword [0x4e6c10]
push ebp
push esi
mov dword [esp + 0x10], ecx
lea ebp, [ebx + 8]
push edi
mov edx, 0x31
mov dword [esp + 0x10], 0x2a
sub edx, ebx
mov esi, 0x30
sub esi, ebx
mov dword [esp + 0x18], edx
mov edi, 0x2f
mov dword [esp + 0x1c], esi
sub edi, ebx
mov ecx, 0x26
sub ecx, ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x24], ecx
sub dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm0, eax
add ecx, ebp
pshufd xmm1, xmm0, 0
add eax, 0x10
movd xmm0, dword [ebp - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
mov ecx, dword [esp + 0x10]
packuswb xmm1, xmm1
add ecx, ebp
packuswb xmm1, xmm1
movd dword [ebp - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebp]
packuswb xmm1, xmm1
lea edx, [esi + ebp]
packuswb xmm1, xmm1
lea esi, [edi + ebp]
movd dword [ebp - 4], xmm1
lea edi, [ebx + ebp]
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebp]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [esp + 0x20]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [esp + 0x18]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp], xmm1
movd xmm0, dword [ebp + 4]
punpcklbw xmm0, xmm0
movd xmm2, ecx
mov ecx, dword [esp + 0x24]
movd xmm1, esi
mov esi, dword [esp + 0x1c]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + 4], xmm3
add ebp, 0x10
cmp eax, 0x20
jb 0x46c820
mov ebx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
cmp eax, 0x25
jae 0x46c944
lea edx, [ebx + eax]
lea ecx, [eax + 0x2a]
inc eax
xor byte [edx], cl
cmp eax, 0x25
jb 0x46c936
mov byte [ebx + 0x26], 0
mov eax, ebx
pop ebx
add esp, 0x1c
ret

Function at 0x46c950
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x46c9ca
movups xmm4, xmmword [0x4e6c10]
mov eax, 0x2d
push ebx
push esi
lea ebx, [eax - 0x2b]
nop word [eax + eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax - 0x2d]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax - 0x2d], xmm3
add eax, 4
sub ebx, 1
jne 0x46c970
pop esi
pop ebx
mov byte [edi + 9], 0
mov eax, edi
pop edi
ret
Function at 0x46d460
Capabilities:
Execute command

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef4d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
mov eax, dword [0x4ef400]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0x10]
mov eax, accept
sub eax, edx
cmp eax, 9
jb 0x46d5ff
cmp dword [ecx + 0x14], 0xf
jbe 0x46d4b8
mov ecx, dword [ecx]
push edx
push ecx
push 9
push str.sc_query
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.0045c9e0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x38]
mov eax, edx
mov ecx, dword [ebp - 0x3c]
sub eax, ecx
push 0x2a
push str.__findstr__C:_RUNNING___C:_STOPPED____nul
cmp eax, 0x2a
jb 0x46d50e
cmp edx, 0xf
lea esi, [ebp - 0x4c]
lea eax, [ecx + 0x2a]
cmova esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [ebp - 0x3c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x4c]
jmp 0x46d51f
mov byte [ebp - 0x34], 0
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x34]
push 0x2a
call fcn.0045b0f0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x46d58c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46d582
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46d582
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
test eax, eax
sete al
mov byte [ebp - 0x2d], al
cmp ecx, 0xf
jbe 0x46d5e2
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46d5d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46d5d5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
mov al, byte [ebp - 0x2d]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca5c5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00446680
int3
Function at 0x46d610
Capabilities:
Execute command

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef4d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
mov eax, dword [0x4ef400]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0x10]
mov eax, accept
sub eax, edx
cmp eax, 9
jb 0x46d7af
cmp dword [ecx + 0x14], 0xf
jbe 0x46d668
mov ecx, dword [ecx]
push edx
push ecx
push 9
push str.sc_query
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.0045c9e0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x38]
mov eax, edx
mov ecx, dword [ebp - 0x3c]
sub eax, ecx
push 0x1c
push str.__find__STOP_PENDING____nul
cmp eax, 0x1c
jb 0x46d6be
cmp edx, 0xf
lea esi, [ebp - 0x4c]
lea eax, [ecx + 0x1c]
cmova esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [ebp - 0x3c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x1c], 0
lea eax, [ebp - 0x4c]
jmp 0x46d6cf
mov byte [ebp - 0x34], 0
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x34]
push 0x1c
call fcn.0045b0f0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x46d73c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46d732
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46d732
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
test eax, eax
sete al
mov byte [ebp - 0x2d], al
cmp ecx, 0xf
jbe 0x46d792
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46d785
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46d785
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
mov al, byte [ebp - 0x2d]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca5c5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00446680
int3
Function at 0x46e050
Capabilities:
Delete registry key

Disassembly:
sub esp, 8
mov eax, dword [0x4ef400]
xor eax, esp
mov dword [esp + 4], eax
cmp dword [ecx + 0x14], 0xf
push esi
jbe 0x46e067
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x46e0d6
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46e0cf
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Registry_key_deleted_successfully.
call fcn.00472210
push 0x4723f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov al, 1
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004ca5c5
add esp, 8
ret
mov edx, str.Failed_to_delete_registry_key._Error:
jmp 0x46e0db
mov edx, str.Failed_to_open_registry_key._Error:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00472210
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int_]
push 0x4723f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 8]
xor al, al
pop esi
xor ecx, esp
call fcn.004ca5c5
add esp, 8
ret
Function at 0x46e880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf05d
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.004cb000
mov eax, dword [0x4ef400]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x13c4], eax
mov dword [ebp - 0x13bc], eax
mov ecx, 0xf
mov dword [ebp - 0x13bc], eax
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea edi, [ebp - 0x1408]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x13b4], edx
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13b4], edx
inc ecx
cmp ecx, 0x270
jb 0x46e908
xorps xmm0, xmm0
mov dword [ebp - 0x13b8], 0x270
xor esi, esi
mov edi, 0xf
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x13c0], 0xa
nop word [eax + eax]
lea ecx, [ebp - 0x13b8]
call fcn.00472710
mov ecx, 0x3e
mul ecx
cmp eax, ecx
jae 0x46e995
cmp eax, 4
jae 0x46e995
mov edi, ecx
nop dword [eax]
lea ecx, [ebp - 0x13b8]
call fcn.00472710
mul edi
cmp eax, 4
jb 0x46e980
mov edi, dword [ebp - 0x18]
lea eax, [edx - 0x80000000]
xor eax, 0x80000000
mov cl, byte [ebp + eax - 0x1408]
mov byte [ebp - 0x30], cl
cmp esi, edi
jae 0x46e9c8
lea eax, [esi + 1]
cmp edi, 0xf
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
mov byte [eax + esi], cl
mov byte [eax + esi + 1], 0
jmp 0x46e9e1
push dword [ebp - 0x30]
mov byte [ebp - 0x13bc], 0
push dword [ebp - 0x13bc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0045afc0
sub dword [ebp - 0x13c0], 1
je 0x46e9f5
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
jmp 0x46e960
mov ecx, dword [ebp - 0x1c]
mov eax, accept
sub eax, ecx
cmp eax, 4
jb 0x46ea82
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x13c4]
cmova eax, dword [ebp - 0x2c]
push 4
push str..exe
push ecx
push eax
push ecx
push dword [ebp - 0x13c4]
mov ecx, esi
call fcn.0045c9e0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x46ea62
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46ea58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x46ea58
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004ca5d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca5c5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00446680
int3
Function at 0x46eb10
Capabilities:
Execute command
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf0b3
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x4ef400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push str.update.bat
lea ecx, [ebp - 0x28]
call fcn.00457490
push ecx
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], 0
call fcn.00454a70
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
push 2
push eax
call fcn.004557b0
mov edx, str._echo_off_n
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.00472210
mov edx, str.start__b
mov ecx, eax
call fcn.00472210
mov edx, esi
mov ecx, eax
call fcn.0045abc0
mov edx, 0x4dead0
mov ecx, eax
call fcn.00472210
mov edx, str.taskkill__f__im
mov ecx, eax
call fcn.00472210
push 0xffffffffffffffff
sub esp, 0xc
mov ecx, edi
mov esi, eax
call fcn.004720e0
add esp, 4
inc eax
mov ecx, edi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00457280
mov edx, eax
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.0045abc0
mov edx, 0x4dead0
mov ecx, eax
call fcn.00472210
mov edx, str.:Repeat_n
mov ecx, eax
call fcn.00472210
mov edx, str.del__
mov ecx, eax
call fcn.00472210
mov edx, edi
mov ecx, eax
call fcn.0045abc0
mov edx, 0x4e62d8
mov ecx, eax
call fcn.00472210
mov edx, str.if_exist__
mov ecx, eax
call fcn.00472210
mov edx, edi
mov ecx, eax
call fcn.0045abc0
mov edx, str.__goto_Repeat_n
mov ecx, eax
call fcn.00472210
mov edx, str.del__
mov ecx, eax
call fcn.00472210
lea edx, [ebp - 0x28]
mov ecx, eax
call fcn.0045abc0
mov edx, 0x4e62d8
mov ecx, eax
call fcn.00472210
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 1
call fcn.00457440
lea ecx, [ebp - 0xf0]
call fcn.00455780
lea eax, [ebp - 0x28]
mov edx, str.start__b
push eax
lea ecx, [ebp - 0x40]
call fcn.00459f30
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.004572e0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x471e40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x471f19
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x4e6c10]
movaps xmm1, xmmword [0x4e6b30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x4e6b40]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x4e6b50]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x4e6b60]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x2a]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x471f07
mov byte [esi + 0x14], 0
pop esi
ret