joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457c10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49e280]
jne 0x457c1a
repz ret
jmp fcn.004604a4

Function at 0x46ceeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00462091
and dword [ebp - 4], 0
cmp dword [0x4a3914], 0
mov ebx, eax
jne 0x46cf9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46d04d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46d04d
push eax
call fcn.0046201f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a3914], eax
call esi
push eax
call fcn.0046201f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a3918], eax
call esi
push eax
call fcn.0046201f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a391c], eax
call esi
push eax
call fcn.0046201f
pop ecx
mov dword [0x4a3924], eax
test eax, eax
je 0x46cf9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046201f
pop ecx
mov dword [0x4a3920], eax
mov eax, dword [0x4a3920]
cmp eax, ebx
je 0x46cff4
cmp dword [0x4a3924], ebx
je 0x46cff4
push eax
call fcn.0046209a
push dword [0x4a3924]
mov esi, eax
call fcn.0046209a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46cff4
test edi, edi
je 0x46cff4
call esi
test eax, eax
je 0x46cfeb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46cfeb
test byte [ebp - 0xc], 1
jne 0x46cff4
or dword [ebp + 0x10], 0x200000
jmp 0x46d02d
mov eax, dword [0x4a3918]
cmp eax, ebx
je 0x46d02d
push eax
call fcn.0046209a
pop ecx
test eax, eax
je 0x46d02d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46d02d
mov eax, dword [0x4a391c]
cmp eax, ebx
je 0x46d02d
push eax
call fcn.0046209a
pop ecx
test eax, eax
je 0x46d02d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a3914]
call fcn.0046209a
pop ecx
test eax, eax
je 0x46d04d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46d04f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x7c], edx
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x80]
mov dword [esi + 0x84], 0x4082a0
mov edi, dword fs:[0]
mov dword [esi + 0x80], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 0xc
mov dword [esi + 0xc], edx
add eax, 0x30
mov dword [esi + 0x10], eax
mov dword [esi + 0x78], ecx
mov byte [esi + 0x77], 1
mov byte [esi + 0x76], 1
mov dword [esi + 0x88], 1
mov eax, esp
mov dword [eax], 0x418d91
lea ecx, [esi + 0x5c]
call fcn.00408380
sub esp, 4
jmp 0x4021f5
mov byte [esi + 0x5b], 0
mov dword [esi + 0x88], 2
mov eax, esp
mov dword [eax], str.yuwpuvzoshrocikhjkrwbxlbm
lea ecx, [esi + 0x40]
call fcn.00408380
sub esp, 4
jmp 0x40221b
mov dword [esi + 0x3c], 0x9a4
mov dword [esi + 0x34], 0x40d064c0
mov dword [esi + 0x30], 0
mov dword [esi + 0x88], 3
mov eax, esp
mov dword [eax], str.uixfkz
lea ecx, [esi + 0x18]
call fcn.00408380
sub esp, 4
jmp 0x402252
mov dword [esi + 0x14], 0x260
lea ecx, [esi + 0x18]
call fcn.00408440
lea ecx, [esi + 0x40]
call fcn.00408440
lea ecx, [esi + 0x5c]
call fcn.00408440
mov ecx, dword [esi + 0xc]
call fcn.00408440
mov ecx, dword [esi + 0x10]
call fcn.00408440
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
fld dword [0x418194]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x5c
Function at 0x402320
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov dword [esi + 0xc], eax
mov edx, esp
mov dword [esi + 0x64], edx
mov dword [esi + 0x70], 0xffffffff
lea edx, [esi + 0x68]
mov dword [esi + 0x6c], 0x4082c0
mov edi, dword fs:[0]
mov dword [esi + 0x68], edi
mov dword fs:[0], edx
mov edx, dword [eax]
mov dword [esi + 0x10], edx
mov edx, eax
add edx, 0x10
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x2c
mov dword [esi + 0x18], edx
mov edx, eax
add edx, 0x50
mov dword [esi + 0x1c], edx
add eax, 0x68
mov dword [esi + 0x20], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x5c], 0x40d7f7c0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x40b77400
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0x40e37620
mov dword [esi + 0x48], 0
mov dword [esi + 0x70], 3
mov eax, esp
mov dword [eax], str.fkhwspzxcltffhtnfixxtrvpyouiltjnpiwlcdfcaayfjpriuhfrwfvwfkuqgkjcfmbzmbmfscwirsyjiltbqe
lea ecx, [esi + 0x30]
call fcn.00408380
sub esp, 4
jmp 0x4023cd
vmovsd xmm0, qword [0x418198]
vmovsd qword [esi + 0x28], xmm0
mov dword [esi + 0x24], 0x22
cmp dword [esi + 0x24], 0
jle 0x4023f9
mov eax, dword [esi + 0x24]
add eax, 0xffffffff
mov dword [esi + 0x24], eax
jmp 0x4023e1
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x70], 4
mov eax, esp
mov dword [eax], str.rmkuitnqmoige
call fcn.00408380
sub esp, 4
jmp 0x402418
lea ecx, [esi + 0x30]
call fcn.00408440
mov ecx, dword [esi + 0x14]
call fcn.00408440
mov ecx, dword [esi + 0x18]
call fcn.00408440
mov ecx, dword [esi + 0x1c]
call fcn.00408440
mov ecx, dword [esi + 0x20]
call fcn.00408440
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi + 0x68]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x80
Function at 0x402500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov esi, esp
mov dword [esi + 0xc], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa8], 0xffffffff
lea edx, [esi + 0xa0]
mov dword [esi + 0xa4], 0x4082e0
mov edi, dword fs:[0]
mov dword [esi + 0xa0], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 4
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x24
mov dword [esi + 0x18], edx
add eax, 0x40
mov dword [esi + 0x1c], eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0xa8], 2
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x80]
call fcn.00408380
sub esp, 4
jmp 0x40258e
mov dword [esi + 0x7c], 0x40dd4f80
mov dword [esi + 0x78], 0
mov dword [esi + 0x74], 0x40cbb200
mov dword [esi + 0x70], 0
mov dword [esi + 0xa8], 3
mov eax, esp
mov dword [eax], str.psfxaszgczajhymdkwftkwfrqvfayabhlyssalqazgusegiycskrcscfapcfelcdpjksjmzmpjounhzzwstyhulqplhtkohnf
lea ecx, [esi + 0x58]
call fcn.00408380
sub esp, 4
jmp 0x4025cc
mov byte [esi + 0x57], 1
mov byte [esi + 0x56], 1
mov dword [esi + 0xa8], 4
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x3c]
call fcn.00408380
sub esp, 4
jmp 0x4025f6
mov dword [esi + 0xa8], 5
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x24]
call fcn.00408380
sub esp, 4
jmp 0x402618
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00408470
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.00408440
lea ecx, [esi + 0x3c]
call fcn.00408440
mov al, byte [esi + 0x13]
test al, 1
jne 0x40264d
jmp 0x402671
mov dword [esi + 0x20], 0x39
cmp dword [esi + 0x20], 0
jle 0x40266c
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x402654
jmp 0x402671
lea ecx, [esi + 0x58]
call fcn.00408440
lea ecx, [esi + 0x80]
call fcn.00408440
mov ecx, dword [esi + 0x14]
call fcn.00408440
mov ecx, dword [esi + 0x18]
call fcn.00408440
mov ecx, dword [esi + 0x1c]
call fcn.00408440
mov eax, dword [esi + 0xa0]
mov dword fs:[0], eax
mov eax, 0x1016d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x68
Function at 0x403840
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
not edi
ror ebx, 0xa5
or edx, 0x1b
or esi, 0x3c
rol edi, 0xed
sbb ebx, 0xb4
not edx
not esi
mov edi, 0x6f
rcl esi, 1
neg eax
bswap ebx
imul ebx
neg eax
sub ebx, 0xc9
neg esi
ror edx, 0x62
and esi, 0x27
sub edx, 0x65
not esi
add esi, 0x99
rcr eax, 0x7e
rcl esi, 0xb1
not ebx
neg esi
add esi, 0x1e
rcr esi, 0xf0
not edx
rcr edx, 0x8b
inc edx
ror esi, 0xb9
not eax
sub edi, 0x90
sbb esi, 0xed
not ebx
inc eax
neg edx
imul eax
inc ebx
or eax, 0x44
sub ebx, 0xe5
mov ebx, 0xd4
or esi, 0xc0
inc edi
not esi
not edx
sbb ebx, 0x36
or esi, 0xd3
sbb esi, 0x31
sub edx, 0x32
xor ecx, ecx
xor edi, edi
inc edi
inc edi
and edi, 0xde
sbb ebx, 0xa
dec ebx
rcr eax, 0x1e
bswap edi
dec eax
inc edi
imul eax
not edi
bswap esi
ror eax, 0xb5
sbb esi, 0x29
and edx, 0x47
not esi
rcl edx, 0xa4
imul ebx
sub ebx, 0xbb
bswap edx
rcr edi, 0xc8
inc eax
and ebx, 0x50
or eax, 0xa2
or edi, 0x5d
add ebx, 0xdb
neg esi
dec edi
inc eax
inc esi
bswap eax
and edi, 0x34
dec ebx
sub esi, 0x63
or edi, 0xf4
ror ebx, 0xfd
rcr edi, 0xf
inc edi
dec esi
mov edi, 0x52
rcl esi, 0x13
and edx, 0x96
rol ebx, 0xff
or edi, 0x5b
imul ebx
rcl edi, 0x50
dec edi
not edi
mov ebx, 0xb9
dec edi
mov ecx, dword [ebp + 0xc]
sub edx, 0xa
add ebx, 0x52
bswap eax
mov esi, 0xf
ror eax, 0x2b
rcl edi, 0xaa
neg esi
dec edi
not esi
sub eax, 0x95
sub edi, 0x7c
neg edx
not ebx
mov ebx, 0xfd
mov eax, 0xc9
sbb edi, 0xf
sbb esi, 0x98
rcl esi, 0x5d
dec edi
rcr edx, 0x22
bswap ebx
rcr ebx, 0xb8
ror ebx, 0xe2
rcr edx, 0x1e
bswap esi
dec esi
not esi
add edx, 0xbf
mov edi, 0xae
not edx
neg ebx
imul eax
or edx, 0x2c
dec eax
imul eax
neg ebx
bswap edx
dec edi
bswap eax
rcl ebx, 0xf9
bswap ebx
mov ebx, 0xda
imul esi
rol edx, 0x82
or ebx, 0x29
add ebx, 0x70
not eax
dec ebx
neg ebx
imul edx
mov edi, dword [ebp + 8]
xor eax, ebx
xor eax, eax
xor ebx, esi
mov esi, eax
xor eax, esi
mov esi, ebx
mov eax, eax
mov eax, ebx
xor eax, eax
xor esi, eax
xor ebx, esi
mov esi, esi
not byte [edi]
mov ebx, esi
mov eax, esi
xor ebx, ebx
xor esi, esi
mov ebx, eax
mov esi, eax
xor eax, ebx
mov ebx, eax
mov eax, ebx
sub byte [edi], 0x98
mov eax, esi
mov eax, eax
xor esi, eax
xor eax, esi
mov esi, esi
mov eax, ebx
mov esi, ebx
mov eax, ebx
xor ebx, eax
add byte [edi], 0x53
mov eax, esi
xor eax, eax
mov eax, esi
mov ebx, ebx
mov eax, eax
mov esi, eax
xor ebx, ebx
mov esi, eax
mov esi, eax
imul byte [edi]
inc edi
loop 0x4039ff
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409be3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409c22
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409c22
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409c22
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409c22
cmp dword [ecx + 0x74], 0xe
jbe 0x409c22
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x410fcb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x411068
push ebx
push esi
call fcn.00410f94
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00410edd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x411015
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x411067
push edi
push eax
call fcn.0040f9ab
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x411035
call fcn.0040f9f9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x411066
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00410edd
add esp, 0x20
test eax, eax
jne 0x411054
push edi
call fcn.0040f9f9
jmp 0x41105c
push ebx
call fcn.0040f9f9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x412260
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b4b8
push 0x41b4b0
push str.FlsAlloc
push 0x1e
call fcn.00412121
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412294
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
jmp 0x41229a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4122de
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b4c8
push 0x41b4c0
push str.FlsGetValue
push 0x20
call fcn.00412121
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412315
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x4ca24450
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
mov ecx, 0x31c83690
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x406294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062b8
xor eax, eax
test eax, eax
je 0x4062ca
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4062ca
xor ecx, ecx
jmp 0x4062cd
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4063b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42229c], 0
push esi
jne 0x4063f0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4063ca
mov dword [ecx*4 + 0x422298], eax
inc ecx
cmp ecx, 0x100
jl 0x4063c5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406421
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422298]
xor eax, esi
inc ecx
dec edx
jne 0x406403
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x59616169
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x52bb2e41
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402760
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 8], ecx
cmp edi, 0x38
jg 0x4028bb
push ebx
push ebp
push edi
call fcn.00424380
add esp, 4
mov ebp, eax
test edi, edi
jle 0x40279e
mov ebx, dword [esp + 0x18]
mov ecx, ebp
sub ebx, ebp
mov edx, edi
nop
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x402790
xor esi, esi
mov ebx, section..data
mov eax, esi
cdq
idiv edi
lea eax, [esi + 1]
movzx ecx, byte [edx + ebp]
cdq
idiv edi
shl ecx, 8
movzx eax, byte [edx + ebp]
add ecx, eax
lea eax, [esi + 2]
cdq
idiv edi
shl ecx, 8
movzx eax, byte [edx + ebp]
add ecx, eax
lea eax, [esi + 3]
cdq
idiv edi
shl ecx, 8
movzx eax, byte [edx + ebp]
add ecx, eax
lea eax, [esi + 4]
cdq
idiv edi
xor dword [ebx], ecx
add ebx, 4
mov esi, edx
cmp ebx, 0x465048
jl 0x4027a5
mov esi, dword [esp + 0x10]
mov edi, 0x465004
pop ebp
pop ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
nop dword [eax]
mov ecx, esi
call fcn.004028e0
mov eax, dword [esi + 4]
mov dword [edi - 4], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
add edi, 8
cmp edi, 0x46504c
jl 0x402810
mov edi, 0x465434
mov ecx, esi
call fcn.004028e0
mov eax, dword [esi + 4]
mov dword [edi - 4], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
add edi, 8
cmp edi, 0x465834
jl 0x402832
mov edi, 0x465834
mov ecx, esi
call fcn.004028e0
mov eax, dword [esi + 4]
mov dword [edi - 4], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
add edi, 8
cmp edi, 0x465c34
jl 0x402854
mov edi, 0x465c34
mov ecx, esi
call fcn.004028e0
mov eax, dword [esi + 4]
mov dword [edi - 4], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
add edi, 8
cmp edi, 0x466034
jl 0x402876
mov edi, 0x466034
mov ecx, esi
call fcn.004028e0
mov eax, dword [esi + 4]
mov dword [edi - 4], eax
mov eax, dword [esi + 8]
mov dword [edi], eax
add edi, 8
cmp edi, 0x466434
jl 0x402898
pop edi
pop esi
pop ecx
ret 8
push 0x456c98
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x38
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x4028e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
mov ebp, 0x465008
push esi
mov ebx, dword [edi + 4]
xor ebx, dword [section..data]
mov eax, dword [edi + 8]
mov dword [edi + 4], ebx
nop word [eax + eax]
mov ecx, ebx
mov edx, ebx
shr ecx, 0x10
movzx ecx, cl
shr edx, 0x18
mov esi, dword [ecx*4 + 0x465830]
mov ecx, ebx
add esi, dword [edx*4 + 0x465430]
shr ecx, 8
movzx ecx, cl
xor esi, dword [ecx*4 + 0x465c30]
movzx ecx, bl
add esi, dword [ecx*4 + 0x466030]
xor esi, dword [ebp - 4]
xor eax, esi
mov ecx, eax
mov dword [edi + 8], eax
shr ecx, 0x10
mov edx, eax
movzx ecx, cl
shr edx, 0x18
mov esi, dword [ecx*4 + 0x465830]
mov ecx, eax
add esi, dword [edx*4 + 0x465430]
shr ecx, 8
movzx ecx, cl
xor esi, dword [ecx*4 + 0x465c30]
movzx ecx, al
add esi, dword [ecx*4 + 0x466030]
xor esi, dword [ebp]
add ebp, 8
xor ebx, esi
mov dword [edi + 4], ebx
cmp ebp, 0x465048
jl 0x402900
xor eax, dword [0x465044]
pop esi
mov dword [edi + 8], ebx
mov dword [edi + 4], eax
pop edi
pop ebp
pop ebx
ret
Function at 0x4029a0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x1c], ebx
push edi
and eax, 0x80000007
jns 0x4029bf
dec eax
or eax, 0xfffffff8
inc eax
cmp byte [esp + 0x1c], bl
je 0x4029d3
test eax, eax
jne 0x402a3c
mov edi, dword [esp + 0x18]
mov eax, esi
mov dword [edi], esi
jmp 0x4029f8
mov ecx, esi
test eax, eax
je 0x4029de
sub ecx, eax
add ecx, 8
mov edi, dword [esp + 0x18]
movzx eax, dl
inc eax
lea eax, [ecx + eax*8]
mov dword [edi], eax
test dl, dl
je 0x4029f8
mov ebx, 8
mov dword [esp + 0x20], ebx
push eax
call fcn.00424380
mov edx, eax
add esp, 4
xor ecx, ecx
add ebx, edx
test esi, esi
jle 0x402a1c
push ebp
mov ebp, dword [esp + 0x14]
mov al, byte [ecx + ebp]
mov byte [ebx + ecx], al
inc ecx
cmp ecx, esi
jl 0x402a10
pop ebp
mov ecx, dword [esp + 0x20]
add ecx, esi
cmp ecx, dword [edi]
jge 0x402a34
mov al, byte [esi + ebx - 1]
xor al, 0xcc
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [edi]
jl 0x402a26
pop edi
pop esi
mov eax, edx
pop ebx
ret 0x14
push 0x456c98
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x402cf0
Capabilities:
Create thread
Encode data using xor
Resume thread

Disassembly:
sub esp, 0x30
mov eax, dword [0x466ec0]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
push 0
push 4
mov esi, ecx
push esi
push 0x402fd0
push 0
push 0
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
xor edx, edx
mov dword [esp + 4], 0x67
mov byte [esp + 8], 0x29
mov byte [esp + 9], 0x13
mov byte [esp + 0xa], 0x34
mov byte [esp + 0xb], 2
mov byte [esp + 0xc], 0x13
mov byte [esp + 0xd], 0x2e
mov byte [esp + 0xe], 9
mov byte [esp + 0xf], 1
mov byte [esp + 0x10], 8
mov byte [esp + 0x11], 0x15
mov byte [esp + 0x12], 0xa
mov byte [esp + 0x13], 6
mov byte [esp + 0x14], 0x13
mov byte [esp + 0x15], 0xe
mov byte [esp + 0x16], 8
mov byte [esp + 0x17], 9
mov byte [esp + 0x18], 0x33
mov byte [esp + 0x19], 0xf
mov byte [esp + 0x1a], 0x15
mov byte [esp + 0x1b], 2
mov byte [esp + 0x1c], 6
mov byte [esp + 0x1d], 3
mov al, byte [esp + 8]
mov byte [esp + 0x1e], 0
nop dword [eax]
mov al, byte [esp + edx + 8]
mov ecx, dword [esp + 4]
xor cl, al
mov byte [esp + edx + 8], cl
inc edx
cmp edx, 0x16
jb 0x402da0
mov byte [esp + 0x1e], 0
xor edx, edx
mov dword [esp + 0x20], 0x28
mov byte [esp + 0x24], 0x46
mov byte [esp + 0x25], 0x5c
mov byte [esp + 0x26], 0x4c
mov byte [esp + 0x27], 0x44
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], 6
mov byte [esp + 0x2a], 0x4c
mov byte [esp + 0x2b], 0x44
mov byte [esp + 0x2c], 0x44
mov al, byte [esp + 0x24]
mov byte [esp + 0x2d], 0
nop dword [eax]
mov al, byte [esp + edx + 0x24]
mov ecx, dword [esp + 0x20]
xor cl, al
mov byte [esp + edx + 0x24], cl
inc edx
cmp edx, 9
jb 0x402e00
lea eax, [esp + 0x24]
mov byte [esp + 0x2d], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0x11
push dword [esi]
call eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0042434f
add esp, 0x30
ret
Function at 0x4048f0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push ebx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x10
jb 0x4048f4
pop ebx
mov byte [ecx + 0x14], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404920
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push ebx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 4
jb 0x404924
pop ebx
mov byte [ecx + 8], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404970
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x39
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x404980
mov byte [edi + 0x3d], 0
pop edi
pop esi
pop ebx
ret