joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d30
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x470050]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x440d4f
cmp dword [ebp + 0x10], 0
jne 0x440d59
mov eax, 0x80070057
jmp 0x440e66
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x440e63
lea eax, [ebp - 8]
push eax
push 0x4595bc
push 1
push 0
push 0x4595cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x440e5d
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
cmp dword [ebp + 0xc], 0
je 0x440dbf
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x2c]
call ecx
cmp dword [ebp + 0x14], 0
je 0x440e0b
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x410]
push eax
push 0x200
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [ebp - 0x414], 0
je 0x440df6
xor edx, edx
mov eax, dword [ebp - 0x414]
mov word [eax], dx
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x24]
call edx
lea eax, [ebp - 0xc]
push eax
push 0x4595dc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x440e4f
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x18]
call eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c1e9
mov esp, ebp
pop ebp
ret
Function at 0x440e80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x470050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x440ea5
cmp dword [ebp + 0x10], 0
je 0x440ea5
cmp dword [ebp + 0x14], 0
jne 0x440eaf
mov eax, 0x80070057
jmp 0x441004
cmp dword [ebp + 8], 2
jne 0x440ecc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x440ee1
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [0x45b004]
mov dword [ebp - 0xc20], edx
mov eax, dword [0x45b008]
mov dword [ebp - 0xc1c], eax
mov ecx, dword [0x45b00c]
mov dword [ebp - 0xc18], ecx
mov edx, dword [0x45b010]
mov dword [ebp - 0xc14], edx
lea eax, [ebp - 0xc20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00440570
add esp, 8
mov dword [ebp - 0xc24], eax
cmp dword [ebp - 0xc24], 0
jge 0x440f3d
mov eax, dword [ebp - 0xc24]
jmp 0x441004
push 0x100
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x440f64
mov eax, 0x80004005
jmp 0x441004
cmp dword [ebp + 0x20], 0
je 0x440f76
mov dword [ebp - 0xc28], str.SupportTasks
jmp 0x440f80
mov dword [ebp - 0xc28], str.PlayTasks
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 0xc28]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str._sMicrosoftWindowsGameExplorer_s_s_d
push 0x200
lea edx, [ebp - 0xc10]
push edx
call fcn.004012c0
add esp, 0x1c
push 0
lea eax, [ebp - 0xc10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xc10]
push edx
push str._s_s.lnk
push 0x200
lea eax, [ebp - 0x610]
push eax
call fcn.004012c0
add esp, 0x14
mov ecx, dword [ebp + 0x24]
push ecx
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00440d30
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c1e9
mov esp, ebp
pop ebp
ret
Function at 0x441020
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa50
mov eax, dword [0x470050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x441043
mov eax, 0x80070057
jmp 0x441248
xor eax, eax
mov word [ebp - 0x628], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.0042e060
add esp, 0xc
lea edx, [ebp - 0x840]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x441091
mov eax, dword [ebp - 0x844]
jmp 0x441248
lea eax, [ebp - 0xa50]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x4410c0
mov eax, dword [ebp - 0x844]
jmp 0x441248
mov ecx, dword [0x45b004]
mov dword [ebp - 0x638], ecx
mov edx, dword [0x45b008]
mov dword [ebp - 0x634], edx
mov eax, dword [0x45b00c]
mov dword [ebp - 0x630], eax
mov ecx, dword [0x45b010]
mov dword [ebp - 0x62c], ecx
lea edx, [ebp - 0x638]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00440570
add esp, 8
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x44111c
mov eax, dword [ebp - 0x844]
jmp 0x441248
push 0x100
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x638]
push edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x441143
mov eax, 0x80004005
jmp 0x441248
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x840]
push ecx
push 0x459f18
push 0x200
lea edx, [ebp - 0x628]
push edx
call fcn.004012c0
add esp, 0x14
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x441184
mov eax, dword [ebp - 0x844]
jmp 0x441248
push 0x1e
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.0042e060
add esp, 0xc
mov dword [ebp - 0x224], 3
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x220], ecx
mov edx, 0x414
mov word [ebp - 0x218], dx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0xa50]
push edx
push str._sMicrosoftWindowsGameExplorer_s
push 0x200
lea eax, [ebp - 0x628]
push eax
call fcn.004012c0
add esp, 0x14
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jge 0x441204
mov eax, dword [ebp - 0x844]
jmp 0x441248
push 0x1e
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.0042e060
add esp, 0xc
mov dword [ebp - 0x224], 3
lea edx, [ebp - 0x628]
mov dword [ebp - 0x220], edx
mov eax, 0x414
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c1e9
mov esp, ebp
pop ebp
ret
Function at 0x442b40
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 0x45aa60
push 1
push 0
push 0x45aa50
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x442ba9
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x442ba9
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
cmp dword [ebp - 4], 0
je 0x442bbd
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x10], 0
je 0x442bd1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ecx + 8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x44a0a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x44a0d9
call fcn.0042de0a
mov dword [eax], esi
call fcn.0042ddf7
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0042c4ae
add esp, 0x14
push 0x16
pop eax
jmp 0x44a12e
test dword [ebp + 0xc], 0xfffffff9
jne 0x44a0b5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44a106
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042de1d
pop ecx
call fcn.0042ddf7
mov eax, dword [eax]
jmp 0x44a12e
test al, 0x10
jne 0x44a12c
test al, 1
je 0x44a12c
test byte [ebp + 0xc], 2
je 0x44a12c
call fcn.0042de0a
mov dword [eax], 5
call fcn.0042ddf7
mov dword [eax], 0xd
jmp 0x44a0fd
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4049da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x404a32
push esi
jne 0x4049db
invalid
call dword [eax - 0x146f3fcf]
or al, 0x4a
pop ss
loope 0x404a5b
enter 0xffffffffffff913e, 0x7b
aad 0xff
insb byte es:[edi], dx
mov ch, 0xac

Function at 0x404a03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edx + 0x14]
nop
nop
jmp 0x404a18
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
jmp 0x404a31
xor edi, edi
nop
xor eax, eax
nop
jmp 0x404a45
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jl 0x404a5e
nop
jmp 0x404a5b
sub al, 0x20
nop
nop
invalid
Function at 0x43b64a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop edi
mov edx, 0x41d5412f
call fcn.0043b683
push edx
pop edx
add esi, esi
add edx, esi
xor dword [ecx], edi
and edx, esi
mov esi, 0xd265a516
inc ecx
and esi, edx
sub edx, 0x6214a07d
cmp ecx, ebx
jne fcn.0043b64a
add esi, esi
mov edx, esi
or edx, edx
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x11
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xcf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xdc
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x75
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf4
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6e
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x2f922786
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x36985c77
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412cf0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412e9a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1f
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x10
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe2
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1f
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x90
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x74
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7a
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8a
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xce
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9c
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6d
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x6e
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1c
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x55
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d10
pop ebx
pop edi
pop esi
ret

Function at 0x4035d5
Capabilities:
Terminate process

Disassembly:
jmp 0x451b59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451b6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058fd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403706
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b002
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b013
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aee9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b03b
push ebx
push esi
push edi
call fcn.004056f0
add esp, 0xc
push 0
call fcn.0040623a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x557370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x55738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x580074
push ecx
mov edi, eax
call fcn.0056b198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5573cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0056b02e
push esi
call fcn.0056afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x55a850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x55a8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x585720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x55a8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0056b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x55a8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x585720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x55a92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0056c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x55a957
mov word [eax], si
add eax, 2
push eax
call fcn.0056c030
add esp, 4
jmp 0x55a959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x55a8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x55a8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x55aff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x55b080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x55b0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x580458
push ecx
call fcn.0056b1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0056b1e1
add esp, 0x10
jmp 0x55b0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0056b20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0056adff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0055b050
mov eax, dword [0x585728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x55b13b
push esi
call fcn.0055afb0
add esp, 4
mov dword [0x585728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x55b14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0055aff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x55e440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x55e4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x55e48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x55e471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x55e47e
add edx, ecx
cmp ebx, edx
jb 0x55e48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x55e467
xor ecx, ecx
jmp 0x55e4a2
test eax, eax
jne 0x55e492
xor ecx, ecx
jmp 0x55e4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0055e3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret