joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a4a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, edx
mov dword [ebp - 0x10], eax
movsx eax, al
push esi
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmmword [ebp - 0x30], xmm0
test ecx, ecx
je 0x44a5cd
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x44a5cd
mov esi, dword [ebx + 0x10]
test esi, esi
jle 0x44a5cd
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x44a5cd
cmp dword [ebx + 0x18], 0
je 0x44a5cd
cmp dword [eax], 0
jne 0x44a5cd
lea eax, [esi + 0x50]
mov dword [ebp - 0x14], eax
push eax
mov eax, dword [ecx + 8]
call eax
mov ecx, eax
add esp, 4
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x44a5cd
xor eax, eax
cmp esi, 0x20
jb 0x44a595
lea edx, [ecx + 0x50]
add ecx, 0x4f
add ecx, esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
lea ecx, [edi - 1]
add ecx, esi
cmp edx, ecx
ja 0x44a554
cmp dword [ebp - 8], edi
jae 0x44a595
mov ecx, esi
and ecx, 0x8000001f
jns 0x44a563
dec ecx
or ecx, 0xffffffe0
inc ecx
movdqa xmm1, xmmword [ebp - 0x30]
mov edx, esi
sub edx, ecx
mov ecx, dword [ebp - 0xc]
nop
movdqu xmm0, xmmword [edi + eax]
pxor xmm0, xmm1
movdqu xmmword [ecx + eax], xmm0
movdqu xmm0, xmmword [edi + eax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [ecx + eax + 0x10], xmm0
add eax, 0x20
cmp eax, edx
jl 0x44a570
cmp eax, esi
jge 0x44a5b2
mov edx, dword [ebp - 0x10]
lea esp, [esp]
mov cl, byte [eax + edi]
mov esi, dword [ebp - 4]
xor cl, dl
mov byte [esi + eax + 0x50], cl
inc eax
cmp eax, dword [ebx + 0x10]
jl 0x44a5a0
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44a5e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
mov eax, edx
mov dword [ebp - 0x10], eax
movsx eax, al
push esi
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmmword [ebp - 0x20], xmm0
test ecx, ecx
je 0x44a719
mov edi, dword [ebx + 8]
test edi, edi
je 0x44a719
mov esi, dword [ebx + 0xc]
test esi, esi
jle 0x44a719
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x44a719
cmp dword [ebx + 0x14], 0
je 0x44a719
cmp dword [eax], 0
jne 0x44a719
mov eax, dword [ecx + 8]
push esi
call eax
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x44a719
xor edx, edx
cmp esi, 0x20
jb 0x44a6db
lea eax, [edi - 1]
add eax, esi
cmp ecx, eax
ja 0x44a684
lea eax, [esi - 1]
add eax, ecx
cmp eax, edi
jae 0x44a6db
mov eax, esi
and eax, 0x8000001f
jns 0x44a692
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 4], esi
mov esi, ecx
sub dword [ebp - 4], eax
sub esi, edi
mov dword [ebp - 0xc], esi
mov eax, edi
mov esi, dword [ebx + 0xc]
mov edi, dword [ebp - 0xc]
lea esp, [esp]
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [ecx + edx + 0x10], xmm0
add edx, 0x20
cmp edx, dword [ebp - 4]
jl 0x44a6b0
mov edi, dword [ebx + 8]
cmp edx, esi
jge 0x44a704
sub edi, dword [ebp - 8]
add ecx, edx
sub esi, edx
mov edx, dword [ebp - 0x10]
lea esp, [esp]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
dec esi
jne 0x44a6f0
mov esi, dword [ebx + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebx + 0x10]
mov dword [eax], ecx
mov eax, dword [ebx + 0x14]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x45e870
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x45e907
cmp dword [esp + 8], 6
jb 0x45e907
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0046b2e2
add esp, 0x118
ret
Function at 0x45e930
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x479f8c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push str.wintrust.dll
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.004065f0
mov dword [esp + 0x50], 0
mov eax, dword [0x497368]
test al, 1
jne 0x45e9cf
or eax, 1
mov dword [0x497368], eax
mov byte [esp + 0x50], 1
mov dword [0x497364], 0
call fcn.004361f0
push 0x47b770
call fcn.0046b3dd
add esp, 4
mov byte [esp + 0x50], 0
lea eax, [esp + 0x18]
mov ecx, 0x497364
push eax
call fcn.004364a0
mov edi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x2c], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x45e9fe
push dword [esp + 0x18]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xb
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], eax
push str.crypt32.dll
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
call fcn.004065f0
mov dword [esp + 0x50], 2
mov eax, dword [0x497368]
test al, 1
jne 0x45ea7d
or eax, 1
mov dword [0x497368], eax
mov byte [esp + 0x50], 3
mov dword [0x497364], 0
call fcn.004361f0
push 0x47b770
call fcn.0046b3dd
add esp, 4
mov byte [esp + 0x50], 2
lea eax, [esp + 0x30]
mov ecx, 0x497364
push eax
call fcn.004364a0
mov ebp, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x45eaa6
push dword [esp + 0x30]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
test edi, edi
je 0x45eb39
test ebp, ebp
je 0x45eb39
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push ebp
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x460360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47a19e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00405d40
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00405d40
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00405d40
mov byte [esp + 0x18], 2
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov al, byte [esi + 0x64]
mov byte [edi + 0x64], al
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4618d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x47a2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x24]
mov edi, dword [esp + 0x54]
push esi
push eax
call fcn.00461fd0
mov dword [esp + 0x48], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov byte [esp + 0x48], 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.004218b0
xorps xmm0, xmm0
lea eax, [esp + 0x14]
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov byte [esp + 0x20], 0
test eax, eax
jne 0x461969
xor bl, bl
jmp 0x461988
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x461981
cmp eax, 0x80
je 0x461981
xor bl, bl
jmp 0x461988
mov byte [esp + 0x18], 1
mov bl, 1
mov byte [esp + 0x20], bl
mov byte [esp + 0x48], 2
lea eax, [esp + 0x13]
push eax
push edi
push esi
mov byte [esp + 0x1f], 0
call fcn.00461a60
test al, al
jne 0x4619bb
cmp byte [esp + 0x13], al
je 0x4619bb
cmp dword [esi + 0x14], 8
jb 0x4619b4
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x48], 1
test bl, bl
je 0x4619d8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4619d3
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x48], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4619fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp + 0x48], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x461a1f
push dword [esp + 0x24]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0046b2e2
add esp, 0x3c
ret 8
Function at 0x4640e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x47a7e6
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [esp + 0x3c]
push eax
push 0x3fe
call edi
mov ebx, eax
test ebx, ebx
je 0x4641af
lea eax, [esp + 0x3c]
xor esi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x848], esi
cmp ebx, 0x3fe
jbe 0x4641d9
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b09a
add esp, 4
mov ebp, eax
mov esi, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x38], esi
push ebp
push ebx
call edi
test eax, eax
je 0x464196
cmp eax, ebx
ja 0x464196
xor ecx, ecx
mov ebx, eax
mov dword [ebp + eax*2], ecx
jmp 0x464201
mov dword [esp + 0x848], 0xffffffff
test ebp, ebp
je 0x4641af
push ebp
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor al, al
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.0046b2e2
add esp, 0x838
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x4642a3
xor ecx, ecx
mov word [esp + eax + 0x3c], cx
add eax, 2
cmp eax, 0x800
jae 0x4642a3
mov word [esp + eax + 0x3c], cx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x464283
mov esi, dword [esp + 0x18]
mov ebp, 2
cmp word [esi + ebp - 2], 0
jne 0x464277
cmp eax, edi
je 0x464277
lea eax, [esi + eax*2]
push eax
lea ecx, [esp + 0x24]
call fcn.00405340
mov byte [esp + 0x848], 1
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
call fcn.00417b30
mov byte [esp + 0x848], 0
cmp dword [esp + 0x34], 8
jb 0x46425d
push dword [esp + 0x20]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov word [esp + 0x20], ax
lea eax, [edi + 1]
mov dword [esp + 0x30], 0
inc edi
add ebp, 2
cmp edi, ebx
jb 0x464212
mov esi, dword [esp + 0x38]
mov dword [esp + 0x848], 0xffffffff
test esi, esi
je 0x46429c
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov al, 1
jmp 0x4641b1
call fcn.0046b9b4
int3
Function at 0x465410
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x47ab5e
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esi + 4], eax
push 0x11c
push 0
mov byte [eax], 0
lea eax, [esp + 0x18]
push eax
call sub.MSVCR120.dll_memset
add esp, 0x10
mov dword [esp + 0xc], 0x11c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x465494
cmp dword [esp + 0x10], 6
mov ecx, dword [esi + 4]
setae dl
mov byte [ecx], dl
mov dword [esp + 0x134], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0046b2e2
add esp, 0x130
ret
Function at 0x466600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ada7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.RC::RCFileHash.0
mov dword [edi + 4], 0
mov dword [esp + 0x14], edi
mov byte [edi + 8], 0
mov dword [esp + 0x38], 0
mov dword [edi], vtable.RC::RCFileHashCalc.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [esp + 0x38], 2
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x20], 0
mov dword [edi], vtable.RC::RCMD5.0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 3
push 8
movq qword [esp + 0x28], xmm0
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 4
test eax, eax
je 0x4666d5
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
call fcn.00468320
jmp 0x4666d7
xor eax, eax
mov byte [esp + 0x38], 3
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00466e50
mov byte [esp + 0x38], 5
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.004669a0
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.00468820
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x466748
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x466748
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x466748
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [esp + 0x38], 2
mov esi, dword [esp + 0x18]
test esi, esi
je 0x466787
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00463990
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0046b2e2
add esp, 0x2c
ret
Function at 0x468d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x496f70], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x497070], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x497170], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x496e70], al
inc esi
cmp esi, 0x100
jl 0x468ea0
pop esi
add esp, 0x80
ret

Function at 0x710c61
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
push 0x3cdfd736
pop eax
call fcn.00710c9f
and esi, esi
add eax, 0xe05b1831
xor dword [edi], ebx
dec eax
add eax, esi
push 0x42305c58
pop esi
inc edi
sub esi, esi
cmp edi, ecx
jne fcn.00710c61
mov esi, eax
push 0x587dd7a7
pop eax
inc eax
ret
Function at 0x414940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0x78
push 0
push 0
mov ebx, dword [edi + 0x10]
push dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
call eax
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414a1d
add dword [ebx + 0x44], 0x78
mov edx, edi
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x1c]
mov dword [esi], eax
movzx eax, byte [ecx + 0x14]
mov dword [ecx + 0x1c], esi
and al, 3
mov byte [esi + 5], al
mov ecx, esi
mov byte [esi + 4], 8
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x36], 0x1000000
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x30], 0
mov word [esi + 0x34], ax
mov byte [esi + 6], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x50], eax
call fcn.00414710
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
movzx eax, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, esi
pop edi
mov dword [esi + 0x40], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 4
mov ecx, edi
call fcn.0041b6a0
int3

Function at 0x416200
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x74]
test eax, eax
je 0x41627d
mov edi, dword [esi + 0x20]
add edi, eax
cmp dword [edi + 8], 6
je 0x416220
mov edx, 5
call fcn.0041b6a0
mov ecx, dword [esi + 8]
mov eax, dword [ecx - 0x10]
mov dword [ecx], eax
mov eax, dword [ecx - 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ecx - 8]
mov dword [ecx + 8], eax
mov ecx, dword [esi + 8]
mov eax, dword [edi]
mov dword [ecx - 0x10], eax
mov eax, dword [edi + 4]
mov dword [ecx - 0xc], eax
mov eax, dword [edi + 8]
mov dword [ecx - 8], eax
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 8]
cmp eax, 0x10
jg 0x416267
mov edx, dword [esi + 0x2c]
mov ecx, esi
cmp edx, 1
jl 0x416261
add edx, edx
jmp 0x416262
inc edx
call fcn.0041b800
add dword [esi + 8], 0x10
mov ecx, esi
mov edx, dword [esi + 8]
push 1
add edx, 0xffffffe0
call fcn.0041c1c0
add esp, 4
mov edx, 2
mov ecx, esi
pop edi
pop esi
jmp fcn.0041b6a0