joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461ce0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov esi, ecx
call fcn.0044b050
add esp, 4
test al, al
je 0x461cfb
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00461c10
test al, al
jne 0x461cf4
push ebx
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x461d3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x461d90
movzx ebx, bx
or ebx, 0x80070000
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x461d63
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x461d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x461d7c
movzx ebx, bx
or ebx, 0x80070000
jmp 0x461d7c
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x461d8d
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x461da0
Capabilities:
Modify service

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, ecx
call fcn.00461e60
add esp, 4
test al, al
je 0x461db8
pop esi
xor eax, eax
pop ebx
ret
mov ecx, esi
call fcn.004620f0
test eax, eax
js 0x461e56
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x461df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x461e53
movzx ebx, bx
pop edi
or ebx, 0x80070000
pop esi
mov eax, ebx
pop ebx
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x461e26
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x461e3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x461e3f
movzx ebx, bx
or ebx, 0x80070000
jmp 0x461e3f
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x461e50
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x461ff0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b925c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x46203f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4620db
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f6456
mov esp, ebp
pop ebp
ret
push ebx
push 0x14
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x462067
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4620c4
movzx ebx, bx
or ebx, 0x80070000
jmp 0x4620c4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x462096
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x4620c2
cmp eax, 2
je 0x4620c2
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4620c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4620ba
movzx ebx, bx
or ebx, 0x80070000
cmp ebx, 0x80070420
jne 0x4620c4
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4620d5
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f6456
mov esp, ebp
pop ebp
ret
Function at 0x4620f0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5692d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b925c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0
test edi, edi
jne 0x462156
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x46225e
movzx eax, ax
or eax, 0x80070000
jmp 0x46225e
push 0x24
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
test esi, esi
jne 0x46218e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x462247
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x30], eax
jmp 0x462247
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4621ff
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x462240
cmp eax, 3
je 0x462202
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
push eax
xorps xmm0, xmm0
push 1
push esi
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4621ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x462247
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x30], eax
jmp 0x462247
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x462240
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x28], 1
mov edi, eax
je 0x46223d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1f40
jae 0x462279
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x28], 1
jne 0x462215
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x462258
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f6456
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 1
je 0x46223d
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0x800705b4
jmp 0x462247
Function at 0x462290
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, edx
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4622c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x46231e
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
pop ebp
ret
push 0
push 0
push 0x5a5ecc
push 0
push 0
push dword [ebp + 8]
push 1
push 2
push dword [ebp + 0xc]
push 0xf01ff
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x462314
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x462319
movzx edi, di
push esi
or edi, 0x80070000
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
xor edi, edi
call ebx
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46d590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov edi, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 0xc]
lea esi, [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov edx, eax
lea ebx, [ebx - 0x61c88647]
shr edx, 5
add edx, ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [ebx + eax]
xor edx, ecx
add edi, edx
mov edx, edi
mov ecx, edi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [ebx + edi]
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add eax, edx
sub esi, 1
jne 0x46d5c4
mov ecx, dword [ebp - 0x14]
mov dword [ecx], edi
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x46d620
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov edi, dword [ecx]
mov ebx, 0xe3779b90
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 8]
mov edx, dword [esi]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov esi, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
nop dword [eax]
mov edx, edi
shr edx, 5
add edx, ecx
mov ecx, edi
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + ebx]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [eax + ebx]
xor edx, ecx
lea ebx, [ebx + 0x61c88647]
mov ecx, dword [ebp - 0x10]
sub edi, edx
sub esi, 1
jne 0x46d660
mov ecx, dword [ebp - 0x14]
mov dword [ecx], edi
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x46f420
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bc43
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x5b925c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov ecx, dword [eax + 8]
cmp edx, ecx
jbe 0x46f4ad
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00408580
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x46f56f
inc ecx
push ecx
jmp 0x46f564
mov eax, dword [eax + 4]
sub ecx, edx
push ecx
add eax, edx
mov byte [ebp - 0x30], 0
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x98], 0x67452301
mov dword [ebp - 0x94], 0xefcdab89
mov dword [ebp - 0x90], 0x98badcfe
mov dword [ebp - 0x8c], 0x10325476
call fcn.0046e130
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x98]
call fcn.0046eab0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00407870
mov eax, dword [ebp - 0xa0]
cmp eax, 0x10
jb 0x46f53e
inc eax
lea ecx, [ebp - 0xb4]
push eax
push dword [ebp - 0xb4]
call fcn.00408640
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00408580
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x46f56f
inc eax
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00408640
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f6456
mov esp, ebp
pop ebp
ret 8
Function at 0x46f5a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov ebx, 4
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov cl, byte [edx + 0xd]
mov byte [eax], cl
mov cl, byte [edx + 0xe]
mov byte [esi + 0xe], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
nop word [eax + eax]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov ch, byte [eax + 2]
mov dh, byte [eax - 1]
mov byte [ebp - 3], cl
mov byte [ebp - 1], dl
mov byte [ebp - 2], ch
test bl, 3
jne 0x46f67b
movzx ecx, cl
mov dl, dh
mov dh, byte [ecx + 0x5a0308]
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x5a0308]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + 0x5a0308]
mov byte [ebp - 1], cl
movzx ecx, dl
mov dl, byte [ebp - 1]
mov cl, byte [ecx + 0x5a0308]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
xor dh, byte [ecx + 0x5a0408]
mov ch, byte [ebp - 2]
mov cl, byte [eax - 0xd]
inc ebx
xor cl, dh
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, byte [ebp - 3]
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dl
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, ch
mov byte [eax + 6], cl
add eax, 4
cmp ebx, 0x2c
jb 0x46f620
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ecx + 2]
mov esi, 4
nop
mov dl, byte [eax + 1]
lea eax, [eax + 4]
mov bh, byte [eax - 4]
mov dh, dl
mov cl, byte [eax - 6]
xor dh, bh
mov bl, byte [eax - 5]
mov byte [ebp - 2], cl
mov byte [ebp - 3], dl
mov dl, dh
xor dl, cl
xor dl, bl
mov byte [ebp - 1], dl
mov dl, cl
xor dl, bl
mov cl, dl
add dl, dl
shr cl, 7
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, bl
xor cl, byte [ebp - 2]
xor dl, bh
xor cl, byte [ebp - 1]
mov byte [eax - 6], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, byte [ebp - 3]
xor cl, bl
xor dl, byte [ebp - 2]
mov bl, byte [ebp - 1]
xor cl, bl
mov byte [eax - 5], cl
mov cl, dh
shr cl, 7
add dh, dh
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dh
xor cl, bh
xor cl, bl
mov byte [eax - 4], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
xor cl, byte [ebp - 3]
xor cl, bl
mov byte [eax - 3], cl
sub esi, 1
jne 0x46f6c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f960
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 0xc], eax
sub edx, edi
mov esi, edi
mov ebx, 4
nop dword [eax]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x46f985
sub ebx, 1
jne 0x46f980
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov dword [ebp - 8], 9
mov ebx, edi
mov dword [ebp - 4], 4
nop dword [eax + eax]
mov ecx, ebx
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5a0308]
mov byte [ecx - 4], al
sub edx, 1
jne 0x46f9c0
inc ebx
sub dword [ebp - 4], 1
jne 0x46f9b0
mov cl, byte [edi + 1]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, edi
mov byte [edi + 0xb], al
call fcn.0046f6b0
mov eax, edi
mov ebx, 4
nop dword [eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x46fa45
sub ebx, 1
jne 0x46fa40
sub dword [ebp - 8], 1
jne 0x46f9a2
mov esi, edi
lea ebx, [edx + 4]
mov ecx, esi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5a0308]
mov byte [ecx - 4], al
sub edx, 1
jne 0x46fa70
inc esi
sub ebx, 1
jne 0x46fa64
mov cl, byte [edi + 1]
lea esi, [edx + 4]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xb], al
add ecx, 0xa0
mov edx, 4
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
sub edx, 1
jne 0x46faf0
sub esi, 1
jne 0x46fae6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fb10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xa0]
nop dword [eax + eax]
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x46fb35
sub ebx, 1
jne 0x46fb30
mov eax, dword [ebp - 8]
add eax, 0x90
mov byte [ebp - 1], 9
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5a0208]
mov byte [ecx - 4], al
sub edx, 1
jne 0x46fbc0
inc edi
sub ebx, 1
jne 0x46fbb0
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x46fbf0
sub ebx, 1
jne 0x46fbe4
mov ecx, esi
call fcn.0046f760
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x46fb54
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5a0208]
mov byte [ecx - 4], al
sub edx, 1
jne 0x46fc80
inc edi
sub ebx, 1
jne 0x46fc72
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x46fcb0
sub dword [ebp - 0xc], 1
jne 0x46fca4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fcd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], eax
add eax, 0xb0
mov dword [ebp - 8], eax
mov esi, eax
push edi
mov edi, edx
test ebx, ebx
je 0x46fd25
dec ebx
shr ebx, 4
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x46fd00
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.0046f960
mov esi, edi
add edi, 0x10
sub ebx, 1
jne 0x46fcf6
mov eax, dword [ebp - 8]
movups xmm0, xmmword [esi]
pop edi
pop esi
movups xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46fd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, edx
test ebx, ebx
je 0x46fd8f
push edi
dec ebx
lea edi, [ecx + 0xb0]
shr ebx, 4
sub edi, esi
inc ebx
movups xmm0, xmmword [esi]
mov edx, ecx
mov ecx, esi
call fcn.0046fb10
mov ecx, 0x10
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x46fd71
mov ecx, dword [ebp - 4]
sub edi, 0x10
movups xmmword [ecx + 0xb0], xmm0
sub ebx, 1
jne 0x46fd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46fda0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
mov byte [ebp - 1], 0
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0x46fdc0
cmp eax, 0x100
jbe 0x46fdd4
push 0x54
push str.rc4.cpp
push 0x5a0414
call fcn.0051843d
add esp, 0xc
mov ecx, 0x40
mov dword [ebx + 0x200], 1
mov esi, 0x5a0460
mov dword [ebx + 0x204], 1
mov edi, ebx
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
xor esi, esi
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div edi
mov eax, dword [ebp - 8]
movzx eax, byte [edx + eax]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x46fe04
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46fe50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x200]
sub edx, eax
mov bh, byte [edi + 0x208]
add ecx, eax
sub esi, eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], esi
cmp eax, ecx
jae 0x46feb5
sub edx, esi
mov dword [ebp + 0xc], edx
movzx esi, al
mov bl, byte [esi + edi]
add bh, bl
movzx edx, bh
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
mov byte [edx + edi], bl
movzx ecx, byte [esi + edi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp + 0xc]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + edi]
xor cl, byte [esi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 4]
jb 0x46fe80
mov byte [edi + 0x208], bh
mov dword [edi + 0x200], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fed0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
sub dword [ebp + 8], eax
add ecx, eax
mov bh, byte [edi + 0x209]
sub edx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
cmp eax, ecx
jae 0x46ff4a
sub edx, dword [ebp + 8]
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx ecx, al
add esi, ecx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 8]
jb 0x46ff10
mov edi, dword [ebp - 0xc]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret