joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010de3b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1010ddb7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1010dfaa
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1010dfaa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1010df5f
jg 0x1010de97
test eax, eax
je 0x1010df55
push 1
push 0x1000
call fcn.100ff161
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1010deba
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1010df4c
push 0x8000
push ebx
call fcn.1010dce8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1010dee3
jg 0x1010dede
cmp ecx, 0x1000
jb 0x1010dee3
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1010564b
add esp, 0x10
cmp eax, 0xffffffff
je 0x1010df28
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1010dede
jl 0x1010df0f
test ecx, ecx
jne 0x1010ded0
push dword [ebp - 0xc]
push ebx
call fcn.1010dce8
push esi
call fcn.100fa59d
add esp, 0xc
xor ebx, ebx
jmp 0x1010dfb8
cmp byte [edi + 0x24], 0
je 0x1010df3f
cmp dword [edi + 0x20], 5
jne 0x1010df3f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1010df4a
mov ebx, dword [edi + 0x18]
jmp 0x1010df4c
xor ebx, ebx
push esi
call fcn.100fa59d
pop ecx
jmp 0x1010dfb8
test ecx, ecx
jg 0x1010df21
jl 0x1010df5f
test eax, eax
jae 0x1010df21
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1010621e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1010df7f
cmp byte [edi + 0x1c], 0
je 0x1010df21
jmp 0x1010dfb0
push ebx
call fcn.10108e7e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1010df21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1010dfb8
cmp byte [edi + 0x1c], 0
je 0x1010dfb5
mov ebx, dword [edi + 0x18]
jmp 0x1010dfb8
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1010621e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1010fda0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010fdcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010fdcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406811
pop dword [ebp - 0x2c]
mov eax, 0x406811
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6f8e0113
add dword [ebp - 0x3c], 0xdec44438
mov dword [ebp - 0x38], 0xad2fa0fc
sub dword [ebp - 0x38], 0x7afc54b7
mov dword [ebp - 0x34], 0xb303b1c7
add dword [ebp - 0x34], 0x99489267
mov dword [ebp - 0x30], 0x85c321
add dword [ebp - 0x30], 0xff7a3cdf
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x261669b8
sub eax, 0x25d588bc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4b0d670a
sub dword [ebp - 0x3c], 0xd69afdb4
mov dword [ebp - 0x38], 0x79f48740
add dword [ebp - 0x38], 0xc777da35
mov dword [ebp - 0x34], 0x63d9957a
sub dword [ebp - 0x34], 0x6a290e
mov dword [ebp - 0x30], 0x58f85f0d
add dword [ebp - 0x30], 0xa707a0f3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x9c388aa5
sub eax, 0x9bf7aa1d
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x353ee
push 0
call eax
mov ecx, 0x3e2c
mov esi, eax
mov edx, 0x98ccaa49
add edx, 0x677545b7
add edx, dword [ebp - 0x2c]
mov ebx, 0x7e1222ac
sub ebx, 0x65e839ca
sub dword [ebp - 8], 0x53d36def
mov edi, dword [edx]
xor dword [ebp - 8], 0xd8ec22ca
sub edi, ebx
xor dword [ebp - 0x18], 0x3bce63c7
mov dword [esi], edi
mov dword [ebp - 4], 0x844d2680
add esi, 0xe5da5aaa
add esi, 0x1a25a55a
add edx, 4
loop 0x406928
add eax, 0xeb83
xor ebx, ebx
add ebx, eax
add eax, 0xc52d08ff
sub eax, 0xc52d08fa
mov ecx, 0xfce718fd
add ecx, 0x358e703
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret
Function at 0x40ac05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40ac49
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40ac18
jmp 0x40ac49
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40ac39
pop esi
pop ebp
ret

Function at 0x40b9a1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b9d6
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40ba00
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40ba00
test edi, edi
je 0x40b9cd
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b9cd
test edi, edi
je 0x40ba08
mov eax, edi
jmp 0x40b9cf
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b9cf
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040e70a
add esp, 0xc
int3
Function at 0x40e73e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestArray.exe_gMozillaPoisonSize], eax
call fcn.0040b9a1
pop ecx
mov ecx, dword [sym.TestArray.exe_gMozillaPoisonSize]
mov dword [sym.TestArray.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40e776
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestArray.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x407730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.XdylwLzm
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407752
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407748
mov eax, 1
add ebx, ebx
jne 0x40776b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407760
jne 0x40777c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407760
xor ecx, ecx
sub eax, 3
jb 0x407790
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407802
mov ebp, eax
add ebx, ebx
jne 0x40779b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4077a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4077cc
inc ecx
add ebx, ebx
jne 0x4077b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4077ad
jne 0x4077c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4077ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4077dd
jmp 0x40774e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4077ec
add edi, ecx
jmp 0x40774e
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x40784b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407809
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x706c]
or eax, eax
je 0x407845
mov dword [ebx], eax
add ebx, 4
jmp 0x407826
call dword [esi + 0x7068]
mov ebp, dword [esi + 0x7070]
lea edi, [esi - 0x1000]
mov ebx, pe_overlay
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40787f
sub esp, 0xffffff80
jmp section.rUGnmMhn
Function at 0x45c3d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39000]
push edi
jmp 0x45c3ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c3f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c3e0
mov eax, 1
add ebx, ebx
jne 0x45c403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c3f8
jne 0x45c414
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c3f8
xor ecx, ecx
sub eax, 3
jb 0x45c428
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c49a
mov ebp, eax
add ebx, ebx
jne 0x45c433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c440
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c464
inc ecx
add ebx, ebx
jne 0x45c450
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c445
jne 0x45c461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c445
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c484
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c475
jmp 0x45c3e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c484
add edi, ecx
jmp 0x45c3e6
pop esi
mov edi, esi
mov ecx, 0x20
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c4a2
cmp byte [edi], 0
jne 0x45c4a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c4a7
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45c516
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c5d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c628]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c4d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c630]
or eax, eax
je 0x45c510
mov dword [ebx], eax
add ebx, 4
jmp 0x45c4f1
call dword [esi + 0x5c62c]
mov ebp, dword [esi + 0x5c634]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c54a
sub esp, 0xffffff80
jmp 0x401930
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40345b
pop dword [ebp - 0x4c]
mov eax, 0xe9bdf967
sub eax, 0xe97dc50c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x99b19fbf
sub dword [ebp - 0x5c], 0x4b5f5a74
mov dword [ebp - 0x58], 0x60ca1a8c
add dword [ebp - 0x58], 0xd16931b9
mov dword [ebp - 0x54], 0x4f5d074d
sub dword [ebp - 0x54], 0x310c31f
mov dword [ebp - 0x50], 0x22712372
sub dword [ebp - 0x50], 0x22712372
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xf5cc6829
add eax, 0xa73d82b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x66d49cfd
sub dword [ebp - 0x5c], 0xf26233a7
mov dword [ebp - 0x58], 0xe0d9adc8
add dword [ebp - 0x58], 0x6092b3ad
mov dword [ebp - 0x54], 0x13b62cdd
sub dword [ebp - 0x54], 0xb046c071
mov dword [ebp - 0x50], 0x7959262c
sub dword [ebp - 0x50], 0x7959262c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xc9e45311
add eax, 0x365bed3f
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x338ab
push 0
call eax
mov ecx, 0xa4607ac1
add ecx, 0x5b9fbff4
mov esi, eax
mov edx, 0x408400
add edx, dword [ebp - 0x4c]
mov ebx, 0x151c3032
sub ebx, 0x6eb6b862
xor dword [ebp - 0x10], 0xdc314c5c
mov edi, dword [edx]
sub dword [ebp - 0x30], 0xcf38f5f0
add edi, ebx
add dword [ebp - 0x28], ebx
mov dword [esi], edi
add dword [ebp - 0x14], 0xbf8cfda3
add esi, 0x91d9435c
add esi, 0x6e26bca8
add edx, 0x3d48fbfd
sub edx, 0x3d48fbf9
loop 0x403577
add eax, 0xf6bcb2af
sub eax, 0xf6bbd508
mov ebx, eax
add eax, 5
mov ecx, 0x7928636c
add ecx, 0x87179c94
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401750
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [0xe6c028]
push eax
add ecx, 0xffffff87
push 0xfad274
push ecx
call dword [0x1e40c180]
mov eax, dword [0x4102ac]
xchg ebx, eax
mov dword [eax*4 + 0x761b74c0], ecx
and cl, byte [edx + edx*8 - 0x6f00ffc0]
rol dword fs:[eax + 0x3a], 0x1a
les ecx, [eax]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
leave

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov al, 0xec
js 0x401e9d
mov esp, esp
or al, 0x56
lea eax, [ebp + 0x7e]
push 0x78
xor eax, 0x686de88a
add byte [eax], al
mov edi, ebp
or byte [edx + 0x40c0c8b1], dh
add byte [eax + 0x51], dl
add edx, 0xffffff9a
and al, 0xac
aam 0x40
add byte [edx + 0x68], dl
adc eax, sym.imp.MSVCRT.dll_fprintf
xchg ecx, eax
lodsb al, byte [esi]
add al, byte [ecx + 6]
add dword [ecx + 0x14], 0x69
rol byte [eax + 0x54685045], 0x60
push esp
pushal
inc eax
dec edi
call dword [str.Usage:__s__options___http:___hostname_:port__path_n]
add esp, 0x36
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
int1
nop
nop
nop
nop
outsd dx, dword [esi]
nop
nop
sub al, 0x90
nop

Function at 0x403a90
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x4d]
test eax, eax
jne 0x403ac4
mov eax, dword [esi + 0x867]
test dword [ebx - 0x4b5e0df1], ebp
add al, byte [ecx + 0x5d]
sub al, al
das
test byte [ecx + eax], ch
add byte [eax - 0x5d], cl
mov ah, 2
push eax
add cl, ch
popal
add dword [eax], eax
add byte [eax + 0x3d], bh
js 0x403b03
mov ah, 2
inc ecx
add byte [ecx], al
jne 0x403b0a
mov eax, dword [esi + 0x10]
mov word cs:[edx], es
inc ecx
add bl, ch
and al, 0x8b
dec esi
adc bh, bh
mov word [ecx - 0x3796ff3c], ds
je 0x403afb
mov ecx, dword [0x4102b8]
mov eax, dword [0x410251]
inc ecx
test dword [ecx + 0x4102b823], 0x23ba3ed
inc ecx
add byte [ecx - 0x252ffd54], ah
mov eax, dword [0xdad002ac]
mov ebx, dword [edx]
inc cl
inc eax
add byte [ebx], bh
rol dword [eax], 0x3b
ror dword [edi], 0x8d
pop ss
jle 0x403b0d
add byte [ebx + 0x410be515], cl
add dh, al
clc
shl edi, 0xb4
imul edi, edx, 0x2ac4a2e
inc ecx
pop ds
fisubr dword es:[esi]
add cl, bl
mov dword [0x96bea0], eax
mov dword [0x4189a4], edx
mov dword [esi + 0x850], eax
mov edx, dword [0x410ba4]
mov ebx, dword [ecx + 0x830]
mov dword [esi + 0xb0868], edx
mov dword [edi], eax
push eax
pushal
xor al, 8
add byte [esi - 0x74fbb077], dl
pop eax
cmp byte [ebx], ch
mov ecx, dword cs:[ebx + 0x30]
mov edi, 0xe1010000
xor al, 0xac
mov esp, 0xf3c82b00
xchg dh, ah
jp 0x403be3
add byte [ebx], bl
invalid
or al, 0x8b
or eax, 0xd56f14
test ecx, ecx
je 0x403c25
mov edi, dword [0x4102e9]
mov eax, edi
cdq
idiv ecx
test dword [edi + 0x75], ecx
sub byte [ebx + 0x40fcc83a], cl
add byte [edi - 0x7d], dl
ret 0x1140
mov eax, dword [0x2e4117f8]
mov ecx, dword [esi + 4]
lds edx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x7c0064
push edx
jns 0xe429348b
and eax, 0x988bc000
add al, 0xac
call fcn.00406810
push esi
mov dword [esi + 8], 0x860000
call fcn.00403860
add al, ah
add al, 0xbe
pop esi
sbb esp, ebp
push ds
pop ss
Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
call fcn.00408848
sub ecx, ecx
sub ecx, 0xffffff8b
call 0x408948
rcr byte [esi - 0x7f], 0x76
push cs
and al, 0xf7
arpl word [esi - 0x1d03117d], cx
hlt
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401bd7
pop dword [ebp - 0x44]
mov eax, 0x401bd7
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5ce45d72
sub dword [ebp - 0x54], 0xe921827
mov dword [ebp - 0x50], 0xce938dd9
sub dword [ebp - 0x50], 0x9c604194
mov dword [ebp - 0x4c], 0x6882cc89
add dword [ebp - 0x4c], 0xe3c977a5
mov dword [ebp - 0x48], 0xc1383baa
add dword [ebp - 0x48], 0x3ec7c456
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x57f7bd7a
add dword [ebp - 0x54], 0x1c7aabdc
mov dword [ebp - 0x50], 0x3efb97b3
add dword [ebp - 0x50], 0x270c9c2
mov dword [ebp - 0x4c], 0x567822ae
sub dword [ebp - 0x4c], 0xf308b642
mov dword [ebp - 0x48], 0x8d1ded7d
add dword [ebp - 0x48], 0x72e21283
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x6ae719cc
sub eax, 0x6aa6a8cc
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3799f
push 0
call eax
mov ecx, 0xc175ac9
sub ecx, 0xc170eae
xor edx, edx
add edx, eax
mov ebx, 0x25af7452
sub ebx, 0x256e7452
add ebx, dword [ebp - 0x44]
mov esi, 0xf79a4ed7
add esi, 0xaf17a226
xor dword [ebp - 4], 0x8af36878
mov edi, dword [ebx]
mov dword [ebp - 0x20], 0x18dd9924
xor edi, esi
add dword [ebp - 0x30], esi
mov dword [edx], edi
add dword [ebp - 0x24], 0x21fbf363
add edx, 4
add ebx, 0x55d5cfed
add ebx, 0xaa2a3017
loop 0x401cf1
add eax, 0x1233f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd665d458
add ecx, 0x29da2ba8
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x401464
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.user32.dll_LoadIconW]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Chicken1
mov dword [ebp - 0x44], 0x401186
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.user32.dll_LoadCursorW]
mov esi, dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4059e0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.gdi32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.user32.dll_RegisterClassExW]
test ax, ax
je 0x401583
push 1
push dword [0x4059e0]
call dword [sym.imp.user32.dll_LoadBitmapW]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Window
push str.Chicken1
push edi
call dword [sym.imp.user32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4059e8], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [0x4059e8]
push ecx
call dword [sym.imp.user32.dll_UpdateWindow]
mov esi, dword [sym.imp.user32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401583
mov edi, dword [sym.imp.user32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.user32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401566
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret