Function at 0x467f4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
mov dword [ebp - 0x1c], esi
call fcn.004efe1a
push str.ani_Control.Ani
push 0x56aef0
mov dword [esi], 0x533560
call sub.MSVCRT.dll_strcpy
push str.ani_Magic.Ani
push 0x56aed0
call sub.MSVCRT.dll_strcpy
add esp, 0x10
mov byte [0x56adb3], bl
mov byte [0x56adb4], bl
mov byte [0x56adb6], bl
mov byte [0x56adb5], 5
mov byte [0x56adb1], bl
mov byte [0x56adb2], bl
mov byte [0x56adb0], bl
mov dword [0x56adb8], 0x27d8
mov byte [0x56adbf], bl
mov byte [0x56adc0], bl
mov byte [0x56adc2], bl
mov byte [0x56adc1], 0xa
mov byte [0x56adbd], bl
mov byte [0x56adbe], bl
mov byte [0x56adbc], bl
mov dword [0x56adc4], 0x27d9
mov byte [0x56adcb], bl
mov byte [0x56adce], bl
mov byte [0x56adcd], 0xf
mov byte [0x56adc9], bl
mov byte [0x56adca], bl
mov byte [0x56adc8], bl
mov dword [0x56add0], 0x27da
mov byte [0x56add7], bl
mov byte [0x56add8], 5
mov byte [0x56adda], bl
mov byte [0x56add9], bl
mov byte [0x56add5], bl
mov byte [0x56add6], bl
mov byte [0x56add4], bl
mov dword [0x56addc], 0x27db
mov byte [0x56ade3], bl
mov byte [0x56ade4], 0xa
mov byte [0x56ade6], bl
mov byte [0x56ade5], bl
mov byte [0x56ade1], bl
mov byte [0x56ade2], bl
mov byte [0x56ade0], bl
mov dword [0x56ade8], 0x27dc
mov byte [0x56adef], bl
mov byte [0x56adf0], 0xf
mov byte [0x56adf2], bl
mov byte [0x56adf1], bl
mov byte [0x56aded], bl
mov byte [0x56adee], bl
mov byte [0x56adec], bl
mov dword [0x56adf4], 0x27dd
mov byte [0x56adfb], bl
mov byte [0x56adfc], bl
mov byte [0x56adfe], 5
mov byte [0x56adfd], bl
mov byte [0x56adf9], bl
mov byte [0x56adfa], bl
mov byte [0x56adf8], bl
mov dword [0x56ae00], 0x27de
mov byte [0x56ae07], bl
mov byte [0x56ae08], bl
mov byte [0x56ae0a], 0xa
mov byte [0x56ae09], bl
mov byte [0x56ae05], bl
mov byte [0x56ae06], bl
mov byte [0x56ae04], bl
mov dword [0x56ae0c], 0x27df
mov byte [0x56ae13], bl
mov byte [0x56ae14], bl
mov byte [0x56ae16], 0xf
mov byte [0x56ae15], bl
mov byte [0x56ae11], bl
mov byte [0x56ae12], bl
mov byte [0x56ae10], bl
mov dword [0x56ae18], 0x27e0
mov byte [0x56ae1f], bl
mov byte [0x56ae20], bl
mov byte [0x56ae22], bl
mov byte [0x56ae21], bl
mov byte [0x56ae1d], bl
mov byte [0x56ae1e], 0xa
mov byte [0x56ae1c], bl
mov dword [0x56ae24], 0x27e1
mov byte [0x56ae2b], bl
mov byte [0x56ae2c], bl
mov byte [0x56ae2e], bl
mov byte [0x56ae2d], bl
mov byte [0x56ae29], bl
mov byte [0x56ae2a], 0xf
mov byte [0x56ae28], bl
mov dword [0x56ae30], 0x27e2
mov byte [0x56ae37], bl
mov byte [0x56ae38], bl
mov byte [0x56ae3a], bl
mov byte [0x56ae39], bl
mov byte [0x56ae35], bl
mov byte [0x56ae36], 0x19
mov byte [0x56ae34], bl
mov dword [0x56ae3c], 0x27e3
mov byte [0x56ae43], 0x32
mov byte [0x56ae44], bl
mov byte [0x56ae46], bl
mov byte [0x56ae45], bl
mov byte [0x56ae41], bl
mov byte [0x56ae42], bl
mov byte [0x56ae40], bl
mov dword [0x56ae48], 0x27e4
mov byte [0x56ae4f], 0x64
mov byte [0x56ae50], bl
mov byte [0x56ae52], bl
mov byte [0x56ae51], bl
mov byte [0x56ae4d], bl
mov byte [0x56ae4e], bl
mov byte [0x56ae4c], bl
mov dword [0x56ae54], 0x27e5
mov byte [0x56ae5b], 0xc8
mov byte [0x56ae5c], bl
mov byte [0x56ae5e], bl
mov byte [0x56ae5d], bl
mov byte [0x56ae59], bl
mov byte [0x56ae5a], bl
mov byte [0x56ae58], bl
mov dword [0x56ae60], 0x27e6
mov byte [0x56ae67], bl
mov byte [0x56ae68], bl
mov byte [0x56ae6a], bl
mov byte [0x56ae69], bl
mov byte [0x56ae65], bl
mov byte [0x56ae66], bl
mov byte [0x56ae64], 0x1e
mov dword [0x56ae6c], 0x27e7
mov byte [0x56ae73], bl
mov byte [0x56ae74], bl
mov byte [0x56ae76], bl
mov byte [0x56ae75], bl
mov byte [0x56ae71], bl
mov byte [0x56ae72], bl
mov byte [0x56ae70], 0x32
mov dword [0x56ae78], 0x27e8
mov byte [0x56ae7f], bl
mov byte [0x56ae80], bl
mov byte [0x56ae82], bl
mov byte [0x56ae81], bl
mov byte [0x56ae7d], bl
mov byte [0x56ae7e], bl
mov byte [0x56ae7c], 0x64
mov dword [0x56ae84], 0x27e9
mov byte [0x56ae8b], bl
mov byte [0x56ae8c], bl
mov byte [0x56ae8e], bl
mov byte [0x56ae8d], bl
mov byte [0x56ae89], 0xf
mov byte [0x56ae8a], bl
mov byte [0x56ae88], bl
mov dword [0x56ae90], 0x27ea
mov byte [0x56ae97], bl
mov byte [0x56ae98], bl
mov byte [0x56ae9a], bl
mov byte [0x56ae99], bl
mov byte [0x56ae95], 0x1e
mov byte [0x56ae96], bl
mov byte [0x56ae94], bl
mov dword [0x56ae9c], 0x27eb
mov byte [0x56aea3], bl
mov byte [0x56aea4], bl
mov byte [0x56aea6], bl
mov byte [0x56aea5], bl
mov byte [0x56aea1], 0x32
mov byte [0x56aea2], bl
mov byte [0x56aea0], bl
mov dword [0x56aea8], 0x27ec
mov byte [0x56aeaf], bl
mov byte [0x56aeb0], bl
mov byte [0x56aeb2], bl
mov byte [0x56aeb1], bl
mov byte [0x56aead], bl
mov byte [0x56aeae], bl
mov byte [0x56aeac], bl
mov dword [0x56aeb4], 0x28d9
mov byte [0x56aebb], bl
mov byte [0x56aebc], bl
mov byte [0x56aebe], bl
mov byte [0x56aebd], bl
mov byte [0x56aeb9], bl
mov byte [0x56aeba], bl
mov byte [0x56aeb8], bl
mov dword [0x56aec0], 0x28da
mov byte [0x56aec7], bl
mov byte [0x56aec8], bl
mov byte [0x56aeca], bl
mov byte [0x56aec9], bl
mov byte [0x56aec5], bl
mov byte [0x56aec6], bl
mov byte [0x56aec4], bl
mov dword [0x56aecc], 0x28db
push str.wininet.dll
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x56af38], eax
je 0x4685c2
push edi
push 5
pop ecx
mov esi, str.C:windows_system32
lea edi, [ebp - 0x11c]
push 0x3a
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x108]
mov byte [ebp - 0x14], 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
mov byte [ebp - 0x13], 0x54
push eax
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 0x12
mov byte [ebp - 0x10], 0x1b
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 1
mov byte [ebp - 0xd], 0x1b
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 3
mov byte [ebp - 0xa], 0x39
mov byte [ebp - 9], 0x1d
mov byte [ebp - 8], 0x2c
mov byte [ebp - 7], 1
mov byte [ebp - 6], 0x18
mov byte [ebp - 5], 0x24
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, eax
xor ecx, ecx
pop edi
mov eax, ecx
cdq
idiv esi
mov al, byte [ebp + edx - 0x11c]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0x10
jl 0x46855a
lea eax, [ebp - 0x14]
push eax
push dword [0x56af38]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x18]
mov dword [0x56af44], eax
push ecx
push 8
push 0x56af30
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x18]
mov dword [0x55dad5], 0x467c49
push eax
push 8
push 0x55dad4
push dword [0x56af44]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [ebp - 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret