joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e2f8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022411
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.Year_is_out_of_valid_range:_1400..10000
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1000daf0
mov dword [esi], vtable.std::out_of_range.0
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x1001e350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022411
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1000daf0
mov dword [esi], vtable.std::out_of_range.0
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x1001e368
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022411
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1000daf0
mov dword [esi], vtable.std::out_of_range.0
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x1001efa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000f420
test edi, edi
mov dword [esp + 0x14], 0
je 0x1001efd9
add edi, 0x28
jmp 0x1001efdb
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x1001eff1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [edi + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x38], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1001f040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000dc60
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
test edi, edi
mov dword [esp + 0x14], 0
je 0x1001f07f
add edi, 0x28
jmp 0x1001f081
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x1001f097
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [edi + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x38], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1001f0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000dc60
mov dword [esi], vtable.boost::gregorian::bad_year.0
test edi, edi
mov dword [esp + 0x14], 0
je 0x1001f11f
add edi, 0x28
jmp 0x1001f121
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x1001f137
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [edi + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x38], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1001f180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10022468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000dc60
mov dword [esi], vtable.boost::gregorian::bad_month.0
test edi, edi
mov dword [esp + 0x14], 0
je 0x1001f1bf
add edi, 0x28
jmp 0x1001f1c1
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x1001f1d7
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [edi + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x38], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1001fce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10022528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1002ad94]
test eax, eax
push ebp
push esi
jne 0x1001fd05
xor esi, esi
jmp 0x1001fd0e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 8], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x14], 0
je 0x1001fd57
push ebx
push edi
mov eax, dword [esi + 0x14]
test eax, eax
mov eax, dword [esi + 0x10]
jne 0x1001fd94
test eax, eax
jne 0x1001fda0
push 0x1001e450
push 0x1002ad8c
call fcn.1001ea50
mov ecx, dword [0x1002ad94]
add esp, 8
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop ebx
test esi, esi
mov dword [esp + 0x14], 0xffffffff
je 0x1001fd83
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x1001fd83
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
test eax, eax
je 0x1001fddd
jmp 0x1001fda0
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1001fdca
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, dword [ebx]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1001fda0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1001fd2b
jmp 0x1001fdf0
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1001fe09
mov eax, dword [edi + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1001fe36
lea ecx, [ebx + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1001fe36
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1001fe36
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x1001fdf0
jmp 0x1001fd26
Function at 0x100202a0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10022638
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x1001fe50
push 0
push 0
call dword [sym.imp.MSVCR71.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10020301
lea ecx, [esp + 8]
call dword [sym.imp.MSVCR71.dll_public:_void___thiscall_exception::constructor_void_]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], vtable.boost::thread_resource_error.0
lea edx, [esp + 8]
push edx
mov dword [esp + 0x24], ebx
call fcn.1000ec10
mov eax, dword [edi]
push esi
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x10020328
cmp eax, 0xffffffff
je 0x10020328
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x1c]
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x10032a2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1003ae84
in al, 0xcc
int3
stc
cmp cl, dh
jmp 0x1004470b
aad 0x1d
rdtsc
rdtsc
xchg ah, dh
mov dword [ebp - 0x30], ecx
sar eax, cl
push 0x9aaf2af8
mov edx, dword [ebp - 0x24]
xchg cx, ax
not ax
mov eax, dword [edx + 0x94]
or cl, 0
mov dword [ebp - 0x20], eax
cmp dl, 0xbd
bsf cx, bx
rcr cx, 4
mov ecx, dword [ebp - 0x20]
clc
push ebp
sub ecx, dword [ebp - 0x30]
bt si, dx
call fcn.100358ef
mov dword [ebp - 0x28], edx
mov word [esp], di
cmp dword [ebp - 0x24], 0
pushfd
push 0xc9761dc3
push esp
lea esp, [esp + 0x44]
je 0x1004ee82
shrd cx, cx, cl
inc dx
mov eax, dword [ebp - 0x24]
xor dx, 0x2fff
mov ecx, dword [eax + 0x90]
jns 0x10035343
stc
bts dx, bp
rcl dh, 6
mov dword [ebp - 0x30], ecx
btr ax, sp
mov edx, dword [ebp - 0x24]
rcl ch, 5
aas
shrd eax, eax, 9
btc ax, cx
mov eax, dword [edx + 0x94]
neg ecx
shr cl, cl
mov dword [ebp - 0x20], eax
shr ch, 6
bt ebx, eax
mov ecx, dword [ebp - 0x20]
test bx, si
pushfd
cmc
cmp di, 0xf785
sub ecx, dword [ebp - 0x30]
pushfd
shr ecx, 2
jmp 0x1004e457
mov dword [ebp - 0x3c], ecx
lea esp, [esp + 8]
jbe 0x1001cd15
pushal
mov dword [ebp - 0x40], 0
pushfd
mov byte [esp + 4], 0x96
pushal
lea esp, [esp + 0x44]
jmp 0x1004868d
Function at 0x10032f15
Capabilities:
Encode data using xor

Disassembly:
mov bx, 0x2055
mov ecx, dword [ebp - 0x10]
movsx di, dl
call fcn.1004f824
add dword [eax], eax
xor ebp, dword [edi - 0x681ac4e5]
imul edx, dword [ebx], 1
adc al, 0x2c
push ss
out 0x93, eax
pop es
fadd dword [edx]
mov al, 0x80
stosd dword es:[edi], eax
mov bl, 0x74
pop edx
jp 0x100319ef
sub ch, al
bound ebx, qword [ebx - 0x24dbdc22]
test bh, 0x50
add ecx, dword [esi + edi*8]
enter 0xffffffffffff9076, 0x6c
js 0x10031a76
pop ss
sbb ebx, dword [ebx - 0x3be0a771]
out 0xcf, eax
mov esp, 0x35f01d38
fidiv dword [eax - 0x6b22b47d]
jge 0x10031a53
mov bl, 0x8f
idiv byte [ebp - 0x33]
outsd dx, dword [esi]
mov eax, 0x716c6998
inc esi
lea ebp, [edi]
add eax, 0x856187de
dec eax
aam 0x7a
cmp dword [eax + ebp*4 + 0x4f7e1cac], esi
jle 0x10031aa1
mov byte [ebp + 0x1f724210], ch
lodsd eax, dword [esi]
adc byte [edx + 0x72], al
pop ds
jecxz 0x10031a50
dec edi
push 0x4e
sbb ecx, dword [edx + 0x3201b9c3]
invalid
test eax, 0x2d4d75d5
lahf
xchg byte [edi], dl
invalid
xchg esi, eax
xchg esi, eax
ret 0x55fb
dec eax
movsb byte es:[edi], byte [esi]
loop 0x10031a64
in eax, 0x33
pop ds
cwde
dec ebp
jg 0x10031b11
dec eax
jb 0x10031a58
mov byte [ebx + ebp*2 - 0x3d00d5a], bh
rcl dword [bx + 5]
iretd
bound edi, qword [ecx + 0x4c67288]
and al, 0xd
pushfd
lea esp, [esp + 0x20]
jmp fcn.1001c49e
mov dword [ebp - 4], 0xffffffff
mov byte [esp + 4], 0x81
push edi
pushal
push 0x830f1dcb
lea esp, [esp + 0x30]
jmp 0x1003b914
xchg al, ch
ja 0x1003eed7
not ax
mov ch, 0xa
mov eax, dword [ebp - 0x34]
bswap cx
not di
mov ecx, dword [ebp - 0x10]
call fcn.1003733e
mov eax, esi
movsx edi, bl
cwde
mov eax, dword [ebp - 0x34]
jmp 0x100319e1

Function at 0x1003e332
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
js 0x10041dde
push 0x6ab77e6e
lea esp, [esp + 4]
call fcn.10019740
sete dh
or dh, 0xca
add dh, 0xe2
btr dx, 7
add esp, 0x14
stc
shrd edx, ecx, cl
rol dh, cl
call fcn.1004605e
call fcn.10048f48
mov eax, dword [ebp - 0x24]
lea ecx, [ebx + 0x22d84cee]
mov dword [esp], eax
push 0x5973c94d
cwde
pushal
mov dword [esp + 0x20], 0x41700000
bswap cx
bswap cx
mov ecx, dword [ebp - 0x28]
rdtsc
rdtsc
xchg dx, ax
jmp 0x10052355
jnp 0x10056bd8
pushfd
mov dword [esp], eax
lea esp, [esp + 4]
call fcn.10019740
lea edx, [ebx - 0xeb65d16]
cmc
dec dh
add esp, 0x14
shl ah, 6
rol ah, cl
mov ah, 0xe4
btr eax, 0xc
mov edx, dword [ebp - 0x34]
shrd cx, dx, cl
call fcn.1002e8b5
mov edx, dword [ecx]
bswap eax
movsx cx, cl
mov dword [esp + 0x1c], edx
push 0x30408746
mov eax, dword [ebp - 0x2c]
jmp 0x10056fc8
mov byte [esp], bl
mov ecx, 0xea2ed971
mov ecx, dword [eax]
pushal
mov dword [esp + 0x3c], ecx
jmp 0x10034f62

Function at 0x1003e719
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x50]
call fcn.10005cb0
pushfd
bsf dx, ax
das
bsr ax, di
add esp, 0xc
movsx ax, al
mov ecx, ebx
pushfd
rdtsc
lea eax, [ebp - 0x128]
pop ecx
push eax
bswap ax
not al
rdtsc
movzx cx, cl
lea ecx, [ebp - 0x13c]
movsx dx, al
rdtsc
movsx dx, cl
cwde
push ecx
cwde
lea edx, [ebp - 0x14c]
setge ah
push edx
push 0x2073ed7f
jmp 0x100429e1
mov byte [esp], cl
jmp 0x1003c540
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x404502
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x404511
pop dword [ebp - 0x2c]
mov eax, 0xb063d4e4
sub eax, 0xb0238fd3
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x35546
push 0
mov eax, 0x48dbabeb
sub eax, 0x489acb13
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xf81fd091
sub ecx, 0xf81f980d
xor edi, edi
add edi, eax
mov esi, 0x3ea8cdcb
sub esi, 0x3e679207
add esi, dword [ebp - 0x2c]
mov ebx, 0x591aee79
sub ebx, 0xa4eacbe1
add dword [ebp - 0x18], 0x7798e5ef
mov edx, dword [esi]
add dword [ebp - 0x1c], 0xfaaf5186
sub edx, ebx
xor dword [ebp - 0x24], 0x6842997d
mov dword [edi], edx
add dword [ebp - 0x18], esi
add edi, 0xf8b96d79
add edi, 0x746928b
add esi, 0xb291f3a4
add esi, 0x4d6e0c60
loop 0x404572
add eax, 0x236b075d
add eax, 0xdc95cd86
mov ebx, eax
add eax, 0xf380e69c
sub eax, 0xf380e697
mov ecx, 0x39e83fae
add ecx, 0xc657c052
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x402b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402b27
pop dword [ebp - 0x28]
mov eax, 0x402b27
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x286b768
add dword [ebp - 0x38], 0x4bcb8de3
mov dword [ebp - 0x34], 0x8a7b4df
add dword [ebp - 0x34], 0x298b9766
mov dword [ebp - 0x30], 0x4250ba95
add dword [ebp - 0x30], 0x9fb8999
mov dword [ebp - 0x2c], 0x266aa1f6
add dword [ebp - 0x2c], 0xd9955e0a
lea eax, [ebp - 0x38]
push eax
mov eax, 0xf842d024
add eax, 0x7ff6050
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x633e7fcd
add dword [ebp - 0x38], 0x1133e989
mov dword [ebp - 0x34], 0xee08cf15
sub dword [ebp - 0x34], 0xac9c6da0
mov dword [ebp - 0x30], 0x96788cb
sub dword [ebp - 0x30], 0xa5f81c5f
mov dword [ebp - 0x2c], 0xe42cb3e8
add dword [ebp - 0x2c], 0x1bd34c18
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xc941ebac
sub eax, 0xc8ffba88
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3f624
push 0
call eax
mov ecx, 0xa1fcc52e
sub ecx, 0xa1fc7678
mov ebx, eax
mov edi, 0x7d7a8ed5
add edi, 0x82c8b52b
add edi, dword [ebp - 0x28]
mov edx, 0xbe0b31c
add edx, 0xecd8f33d
xor dword [ebp - 0x20], ebx
mov esi, dword [edi]
xor dword [ebp - 0x10], eax
xor esi, edx
xor dword [ebp - 0x18], edi
mov dword [ebx], esi
sub dword [ebp - 8], edi
add ebx, 0x98f0af81
add ebx, 0x670f5083
add edi, 4
loop 0x402c44
add eax, 0x9316317f
add eax, 0x6ceafc2c
mov ebx, eax
add eax, 0xbc94f90a
sub eax, 0xbc94f905
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4034db
pop dword [ebp - 0x2c]
mov eax, 0x4034db
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xb0c6e742
add dword [ebp - 0x3c], 0x9d8b5e09
mov dword [ebp - 0x38], 0x2a6e74b1
add dword [ebp - 0x38], 0x7c4d794
mov dword [ebp - 0x34], 0xf1c2380f
add dword [ebp - 0x34], 0x5a8a0c1f
mov dword [ebp - 0x30], 0xd85797ba
add dword [ebp - 0x30], 0x27a86846
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x306cf49b
add dword [ebp - 0x3c], 0x440574bb
mov dword [ebp - 0x38], 0xac41c0cb
sub dword [ebp - 0x38], 0x6ad55f56
mov dword [ebp - 0x34], 0xc10a2308
sub dword [ebp - 0x34], 0x5d9ab69c
mov dword [ebp - 0x30], 0x8f1e550c
sub dword [ebp - 0x30], 0x8f1e550c
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xf902a444
add eax, 0x73d9c0c
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37af8
push 0
call eax
mov ecx, 0x1008b6d6
add ecx, 0xeff7945d
xor edx, edx
add edx, eax
mov ebx, 0xe2a3a5ee
sub ebx, 0xe26321ee
add ebx, dword [ebp - 0x2c]
mov edi, 0x5111b37e
sub edi, 0x297056d8
xor dword [ebp - 0x1c], 0x93af987d
mov esi, dword [ebx]
add dword [ebp - 0x28], ecx
sub esi, edi
sub dword [ebp - 0x28], ebx
mov dword [edx], esi
add dword [ebp - 4], edi
add edx, 4
add ebx, 4
loop 0x4035f5
add eax, 0xe8ecccf2
add eax, 0x171452ad
mov ebx, eax
add eax, 0xfc04d9b5
add eax, 0x3fb2650
mov ecx, 0x26c13d52
sub ecx, 0x26813d52
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x44f363
Capabilities:
Encode data using xor

Disassembly:
jmp 0x467532
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x467626
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x5154f8
mov bl, byte [esi + edi]
push str.ugAyuisyx
push ebp
call fcn.0044e233
xor edx, edx
mov eax, esi
div dword [esp + 0x24]
pop ecx
pop ecx
push 0x451edd
push str.Bicycle_water
mov bh, byte [edx + section..REMO]
push 0x5155e0
xor bh, bl
call fcn.0044e233
pop ecx
pop ecx
mov ecx, eax
call fcn.004512a8
mov bl, byte [esi + edi]
push 0x451edd
push str.dijovhyuGSYYSyus
push ebp
call fcn.0044e233
pop ecx
pop ecx
mov ecx, eax
call fcn.004512a8
add byte [esi + edi], bh
push 0x451edd
push str.fdiogiuAsdoiHYUAUAY87234
push ebp
call fcn.0044e233
pop ecx
pop ecx
mov ecx, eax
call fcn.004512a8
dec byte [esi + edi]
push str.suih89Ah3
push ebp
call fcn.0044e233
add byte [esi + edi], 0xfe
push str.XScdyhjkujktyyt
push ebp
call fcn.0044e233
sub byte [esi + edi], bl
push str.sJBCsKJ2BJN
push ebp
call fcn.0044e233
inc byte [esi + edi]
push str.sDGTFsE
push ebp
call fcn.0044e233
inc byte [esi + edi]
push str.ZASwe23
push ebp
call fcn.0044e233
inc byte [esi + edi]
push str.uhgiyGAuyisua
push ebp
call fcn.0044e233
add esp, 0x30
inc esi
cmp esi, dword [esp + 0x18]
jb 0x46754b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x4513a2
Capabilities:
Parse pe header

Disassembly:
jmp 0x48d600
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48d63f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48d63f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48d63f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48d63f
cmp dword [ecx + 0x74], 0xe
jbe 0x48d63f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4516b8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x466a65
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x551d88], eax
pop edi
pop esi
ret
Function at 0x401bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 9], 0xbf
call fcn.0040181c
push eax
push esi
push dword [ebp + 8]
call fcn.004017d1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
invalid
inc ebp

Function at 0x401bf5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35