joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464090
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov esi, ecx
call fcn.0044b9b0
add esp, 4
test al, al
je 0x4640ab
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00463fc0
test al, al
jne 0x4640a4
push ebx
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4640eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x464140
movzx ebx, bx
or ebx, 0x80070000
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x464113
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x46412a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x46412c
movzx ebx, bx
or ebx, 0x80070000
jmp 0x46412c
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x46413d
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x464150
Capabilities:
Modify service

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, ecx
call fcn.00464210
add esp, 4
test al, al
je 0x464168
pop esi
xor eax, eax
pop ebx
ret
mov ecx, esi
call fcn.00464490
test eax, eax
js 0x464206
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4641a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x464203
movzx ebx, bx
pop edi
or ebx, 0x80070000
pop esi
mov eax, ebx
pop ebx
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4641d6
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x4641ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4641ef
movzx ebx, bx
or ebx, 0x80070000
jmp 0x4641ef
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x464200
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x464390
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4643df
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x46447b
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
push ebx
push 0x14
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x464407
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x464464
movzx ebx, bx
or ebx, 0x80070000
jmp 0x464464
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x464436
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x464462
cmp eax, 2
je 0x464462
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x464462
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x46445a
movzx ebx, bx
or ebx, 0x80070000
cmp ebx, 0x80070420
jne 0x464464
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x464475
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x464490
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572000
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0
test edi, edi
jne 0x4644f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4645fe
movzx eax, ax
or eax, 0x80070000
jmp 0x4645fe
push 0x24
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
test esi, esi
jne 0x46452e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x4645e7
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x30], eax
jmp 0x4645e7
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46459f
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4645e0
cmp eax, 3
je 0x4645a2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
push eax
xorps xmm0, xmm0
push 1
push esi
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x46459f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x4645e7
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x30], eax
jmp 0x4645e7
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4645e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x28], 1
mov edi, eax
je 0x4645dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1f40
jae 0x464619
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x28], 1
jne 0x4645b5
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4645f8
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 1
je 0x4645dd
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0x800705b4
jmp 0x4645e7
Function at 0x464630
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, edx
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x464666
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4646be
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
pop ebp
ret
push 0
push 0
push 0x5acf58
push 0
push 0
push dword [ebp + 8]
push 1
push 2
push dword [ebp + 0xc]
push 0xf01ff
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4646b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4646b9
movzx edi, di
push esi
or edi, 0x80070000
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
xor edi, edi
call ebx
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x470b80
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x9e3779b9
mov dword [ebp - 0x10], 0
jmp 0x470bb7
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x10
jge 0x470c3a
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 8]
shr ecx, 5
mov edx, 4
shl edx, 0
mov esi, dword [ebp + 0x10]
add ecx, dword [esi + edx]
xor eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 0x10]
add eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov edx, dword [ebp - 4]
shr edx, 5
mov ecx, 4
imul ecx, ecx, 3
mov esi, dword [ebp + 0x10]
add edx, dword [esi + ecx]
xor eax, edx
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x470bae
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x470c50
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x9e3779b9
mov ecx, dword [ebp - 0x14]
shl ecx, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x470c90
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x10
jge 0x470d1b
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 0x10]
add eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov edx, dword [ebp - 4]
shr edx, 5
mov ecx, 4
imul ecx, ecx, 3
mov esi, dword [ebp + 0x10]
add edx, dword [esi + ecx]
xor eax, edx
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 8]
shr ecx, 5
mov edx, 4
shl edx, 0
mov esi, dword [ebp + 0x10]
add ecx, dword [esi + edx]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
jmp 0x470c87
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470d90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4746e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x200]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x208]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
jmp 0x474728
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x4747af
movzx ecx, byte [ebp - 8]
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx]
movzx ecx, byte [ebp - 1]
add ecx, eax
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + edx]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dl, byte [esi + edx]
mov byte [ecx + eax], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 2]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + edx]
movzx eax, byte [ebp - 1]
mov esi, dword [ebp - 0xc]
movzx eax, byte [esi + eax]
add edx, eax
movzx edx, dl
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + edx]
xor ecx, edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov byte [eax], cl
jmp 0x47471f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x200], edx
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x208], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4747d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x204]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x100
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x209]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
jmp 0x47481e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x4748a5
movzx ecx, byte [ebp - 8]
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx]
movzx ecx, byte [ebp - 1]
add ecx, eax
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + edx]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dl, byte [esi + edx]
mov byte [ecx + eax], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 2]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + edx]
movzx eax, byte [ebp - 1]
mov esi, dword [ebp - 0xc]
movzx eax, byte [esi + eax]
add edx, eax
movzx edx, dl
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + edx]
xor ecx, edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov byte [eax], cl
jmp 0x474815
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x204], edx
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x209], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x474bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov byte [ebp - 2], 0
jmp 0x474bd3
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x474c39
mov byte [ebp - 1], 0
jmp 0x474beb
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x474c37
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp + 8]
shl edx, 2
movzx esi, byte [ebp - 2]
shl esi, 2
lea edx, [esi + edx*4]
movzx esi, byte [ebp - 1]
add esi, dword [ebp + 0x10]
movzx edx, byte [esi + edx]
movzx eax, byte [eax + ecx]
xor eax, edx
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov esi, dword [ebp + 0xc]
lea edx, [esi + edx*4]
mov byte [edx + ecx], al
jmp 0x474be2
jmp 0x474bcb
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x474c40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], 0
jmp 0x474c52
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x474ca0
mov byte [ebp - 1], 0
jmp 0x474c6a
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x474c9e
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 2]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 2]
mov dl, byte [edx + str.cw]
mov byte [eax + ecx], dl
jmp 0x474c61
jmp 0x474c4a
mov esp, ebp
pop ebp
ret

Function at 0x475c10
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], 0
jmp 0x475c22
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x475c70
mov byte [ebp - 1], 0
jmp 0x475c3a
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x475c6e
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 2]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 2]
mov dl, byte [edx + 0x5a7150]
mov byte [eax + ecx], dl
jmp 0x475c31
jmp 0x475c1a
mov esp, ebp
pop ebp
ret

Function at 0x475ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x476002
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0x10
jge 0x47602f
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
jmp 0x475ffa
mov esp, ebp
pop ebp
ret
Function at 0x476ba0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
push edi
mov edi, edx
mov dword [ebp - 0x28], 0
mov esi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], esi
cmp dword [edi + 0x14], 0x10
jb 0x476bc6
mov eax, dword [edi]
jmp 0x476bc8
mov eax, edi
push dword [edi + 0x10]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
push eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004082e0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x476c0f
mov dword [esi + 0x10], ecx
lea eax, [ebp - 0x1c]
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
mov ecx, esi
push eax
call fcn.00408740
jmp 0x476d25
cmp dword [eax + 0x14], 0x10
jb 0x476c1a
mov eax, dword [eax]
mov dword [ebp + 8], eax
push ebx
xor bh, bh
xor eax, eax
nop
mov byte [ebp + eax - 0x12c], al
inc eax
cmp eax, 0x100
jb 0x476c20
mov edi, dword [ebp + 8]
xor esi, esi
mov word [ebp - 0x2c], 0
nop word [eax + eax]
mov eax, esi
mov bl, byte [ebp + esi - 0x12c]
xor edx, edx
div ecx
lea ecx, [ebp - 0x12c]
movzx eax, byte [edx + edi]
add al, bl
add bh, al
movzx eax, bh
add ecx, eax
movzx eax, byte [ecx]
mov byte [ebp + esi - 0x12c], al
inc esi
mov byte [ecx], bl
mov ecx, dword [ebp - 0x20]
cmp esi, 0x100
jb 0x476c40
mov edi, dword [ebp - 0x24]
lea ebx, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
cmovae ebx, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x476c91
mov edi, dword [edi]
mov esi, dword [ebp - 4]
test eax, eax
je 0x476d08
mov dl, byte [ebp - 0x2c]
sub edi, ebx
mov esi, eax
nop
inc dl
lea ebx, [ebx + 1]
mov byte [ebp - 0x2c], dl
movzx eax, dl
lea edx, [ebp - 0x12c]
add edx, eax
mov al, byte [ebp - 0x2b]
add al, byte [edx]
mov byte [ebp - 0x2b], al
mov cl, byte [edx]
movzx eax, al
movzx eax, byte [ebp + eax - 0x12c]
mov byte [edx], al
movzx eax, byte [ebp - 0x2b]
mov byte [ebp + eax - 0x12c], cl
movzx ecx, byte [ebp - 0x2b]
mov dl, byte [ebp - 0x2c]
movzx eax, dl
movzx ecx, byte [ebp + ecx - 0x12c]
add cl, byte [ebp + eax - 0x12c]
movzx eax, cl
movzx eax, byte [ebp + eax - 0x12c]
xor al, byte [edi + ebx - 1]
mov byte [ebx - 1], al
sub esi, 1
jne 0x476ca0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00408740
pop ebx
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x476d3a
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408800
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x476e30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573579
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
push esi
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx], 0
mov dword [ebp - 4], 0
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test edi, edi
je 0x477000
nop dword [eax]
mov al, byte [edx]
dec edi
mov byte [ebp + esi - 0x14], al
inc edx
mov ch, byte [ebp - 0x12]
inc esi
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xe], ch
mov byte [ebp + 0xb], ah
mov byte [ebp - 0xd], cl
cmp esi, 3
jne 0x476f2a
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, ah
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop word [eax + eax]
cmp dword [0x5d7410], 0x10
mov ecx, 0x5d73fc
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x5d73fc]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.00410b60
inc esi
cmp esi, 4
jl 0x476ef0
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ah, byte [ebp + 0xb]
mov cl, byte [ebp - 0xd]
mov ch, byte [ebp - 0xe]
test edi, edi
jne 0x476e90
mov dword [ebp + 8], esi
test esi, esi
je 0x477000
mov edi, 3
cmp esi, edi
jge 0x476f6d
mov ecx, edi
xor eax, eax
sub ecx, esi
lea edi, [ebp - 0x14]
mov edx, ecx
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ch, byte [ebp - 0x12]
mov edi, 3
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shr al, 4
and ah, 0xf
shl cl, 4
add cl, al
shl ah, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add ah, al
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x16], ah
lea eax, [esi + 1]
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x476fe3
xor edi, edi
mov esi, eax
nop dword [eax]
cmp dword [0x5d7410], 0x10
mov ecx, 0x5d73fc
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x5d73fc]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
push 1
call fcn.00410b60
inc edi
cmp edi, esi
jl 0x476fb0
mov esi, dword [ebp + 8]
mov edi, 3
cmp esi, 3
jge 0x477000
sub edi, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, ebx
call fcn.00410b60
sub edi, 1
jne 0x476ff0
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret