joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46de00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xb
sub eax, edi
or eax, ecx
jge 0x46de6b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46de7c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x16], dx
mov ecx, 0x53c578
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46de90
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46de72
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x16], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ded0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xd
sub eax, edi
or eax, ecx
jge 0x46df3b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46df4c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x1a], dx
mov ecx, 0x53c590
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46df60
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46df42
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1a], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xc
sub eax, edi
or eax, ecx
jge 0x46e1ab
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e1bc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x18], dx
mov ecx, 0x53c5d0
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e1d0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e1b2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x18], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov edi, 0x10
sub eax, edi
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edi
or eax, ecx
jge 0x46e34d
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e35e
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x20], dx
mov ecx, 0x53c5fc
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e372
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e354
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x20], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xb
sub eax, edi
or eax, ecx
jge 0x46e41b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e42c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x16], dx
mov ecx, 0x53c61c
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e440
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e422
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x16], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x12
sub eax, edi
or eax, ecx
jge 0x46e4eb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e4fc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x24], dx
mov ecx, 0x53c634
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e510
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e4f2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x24], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xd
sub eax, edi
or eax, ecx
jge 0x46e5bb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e5cc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x1a], dx
mov ecx, 0x53c658
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e5e0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e5c2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1a], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x13
sub eax, edi
or eax, ecx
jge 0x46e75b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e76c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x26], dx
mov ecx, 0x53c688
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e780
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e762
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x26], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x15
sub eax, edi
or eax, ecx
jge 0x46e82b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e83c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x2a], dx
mov ecx, 0x53c6b0
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e850
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e832
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x2a], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x14
sub eax, edi
or eax, ecx
jge 0x46e8fb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e90c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x28], dx
mov ecx, 0x53c70c
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e920
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e902
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x28], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x17
sub eax, edi
or eax, ecx
jge 0x46e9cb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46e9dc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x2e], dx
mov ecx, 0x53c734
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46e9f0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46e9d2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x2e], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ea30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x1b
sub eax, edi
or eax, ecx
jge 0x46ea9b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46eaac
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x36], dx
mov ecx, 0x53c764
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46eac0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46eaa2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x36], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46eb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xe
sub eax, edi
or eax, ecx
jge 0x46eb6b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46eb7c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x1c], dx
mov ecx, 0x53c79c
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46eb90
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46eb72
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1c], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ebd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xb
sub eax, edi
or eax, ecx
jge 0x46ec3b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46ec4c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x16], dx
mov ecx, 0x53c7b8
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46ec60
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46ec42
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x16], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46eca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x23
sub eax, edi
or eax, ecx
jge 0x46ed0b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46ed1c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x46], dx
mov ecx, 0x53c7d0
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46ed30
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46ed12
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x46], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ef10
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5254cc
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x587978]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp eax, ebx
je 0x46ef63
cmp dword [ebp - 0x128], 6
jae 0x46ef6a
xor al, al
jmp 0x46f038
lea ecx, [ebp - 0x13c]
push ecx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x144], 4
call fcn.0046d5f0
mov esi, eax
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x140]
push edx
call fcn.0046d110
add esp, 8
mov byte [ebp - 4], 1
mov esi, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x144]
push ecx
lea edx, [ebp - 0x134]
push edx
lea ecx, [ebp - 0x138]
push ecx
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
setne byte [ebp - 0x12d]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x140]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46eff8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x13c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46f021
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x12d], bl
jne 0x46ef63
xor eax, eax
cmp dword [ebp - 0x134], ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eb16b
mov esp, ebp
pop ebp
ret
Function at 0x46f470
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee40
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0x562788
push 1
push 0
push 0x562858
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x46f4c6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
call fcn.0046d790
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.0046f210
test al, al
sete bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46f50e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret