joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57959e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b107c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CBattle_GTournament.0
lea eax, [edi + 0x28]
lea esi, [eax + 4]
mov dword [eax], vtable.CBattleTeam.0
mov dword [ebp - 0x10], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea eax, [ebx + 0x20]
mov byte [ebp - 4], 1
call fcn.004939a0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CBattleTeam_GTournament.0
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
push 0x425d50
push 0x425d40
push 0xa
push 0x20
lea eax, [edi + 0xd0]
mov byte [ebp - 4], 2
push eax
mov dword [edi + 0xbc], vtable.CImageNumber.0
call fcn.00576426
fldz
fst dword [edi + 0xc0]
mov dword [edi + 0x210], ebx
fstp dword [edi + 0xc4]
mov dword [edi + 0x214], 9
mov dword [edi + 0x218], ebx
mov dword [edi + 0x21c], 0x20
mov dword [edi + 0x220], ebx
mov eax, vtable.cImage.0
mov dword [edi + 0x234], eax
mov dword [edi + 0x238], ebx
mov dword [edi + 0x254], eax
mov dword [edi + 0x258], ebx
mov dword [edi + 0x274], eax
mov dword [edi + 0x278], ebx
mov dword [edi + 0x294], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x569a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f4d1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x3c], edi
call fcn.00421860
lea esi, [edi + 0x23c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esi
mov dword [edi], vtable.CTitanBreakDlg.0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
call fcn.004236f0
push 0xffffffffffffffff
push ebx
push 0x28
push 0x28
mov byte [ebp - 4], 1
push ebx
mov eax, 0x8b
push ebx
mov ecx, esi
mov dword [esi], vtable.CVirtualItem.0
mov dword [esi + 0x2a4], ebx
mov word [esi + 0xc], ax
call fcn.004238b0
push 0x4b8130
push 0x4b8080
push 0x19
push 0x2ac
lea ecx, [edi + 0x4e4]
push ecx
mov byte [ebp - 4], 2
call fcn.00576426
mov dword [edi + 0x234], ebx
mov dword [edi + 0x238], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], vtable.cImage.0
lea edx, [ebp - 0x30]
push edx
xor eax, eax
lea ecx, [ebx + 0x3f]
mov byte [ebp - 4], 4
call fcn.0042b870
mov ebx, esi
add ebx, 0x50
call fcn.00428e10
xor eax, eax
lea esi, [ebx + 0x10]
lea edi, [ebp - 0x30]
mov word [ebx + 0xc], ax
mov dword [ebx + 0x30], 0xffffff
call fcn.00401a10
mov esi, dword [ebp - 0x34]
mov dword [ebx + 0x34], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0xa0], 0xdc
call fcn.00429230
xor ecx, ecx
mov eax, esi
call fcn.00402ba0
mov esi, dword [ebp - 0x3c]
add esi, 0x564
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0x19
jmp 0x569b33
mov esi, dword [ebp - 0x34]
lea ebx, [esi - 0x30]
call fcn.00428e10
xor ecx, ecx
mov word [esi - 0x24], cx
mov dword [esi], 0xffffff
add esi, 0xffffffe0
lea edi, [ebp - 0x30]
call fcn.00401a10
mov esi, dword [ebp - 0x34]
mov dword [esi + 4], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0x20], 0xdc
call fcn.00429230
lea eax, [esi - 0x80]
xor ecx, ecx
call fcn.00402ba0
add esi, 0x2ac
dec dword [ebp - 0x38]
mov dword [ebp - 0x34], esi
jne 0x569b30
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret
Function at 0x56a4d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f526
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x34], edi
call fcn.00421860
lea esi, [edi + 0x238]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.CTitanDissolutionDlg.0
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call fcn.004236f0
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push 0x28
push 0x28
mov byte [ebp - 4], 1
push ebx
mov eax, 0x8b
push ebx
mov ecx, esi
mov dword [esi], vtable.CVirtualItem.0
mov dword [esi + 0x2a4], ebx
mov word [esi + 0xc], ax
call fcn.004238b0
mov dword [edi + 0x234], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], vtable.cImage.0
lea ecx, [ebp - 0x30]
push ecx
xor eax, eax
lea ecx, [ebx + 0x3f]
mov byte [ebp - 4], 3
call fcn.0042b870
lea ebx, [esi + 0x50]
call fcn.00428e10
xor edx, edx
lea esi, [ebx + 0x10]
lea edi, [ebp - 0x30]
mov word [ebx + 0xc], dx
mov dword [ebx + 0x30], 0xffffff
call fcn.00401a10
mov esi, dword [ebp - 0x38]
mov dword [ebx + 0x34], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0xa0], 0xdc
call fcn.00429230
xor ecx, ecx
mov eax, esi
call fcn.00402ba0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret

Function at 0x56e630
Capabilities:
Print debug messages

Disassembly:
push ebx
push edi
push 0x80
lea ebx, [esi + 0x18]
push str.TitanPartsKind
push ebx
call dword [sym.imp.MSVCR100.dll_strncpy]
lea eax, [esi + 4]
add esp, 0xc
cmp dword [eax], 0
mov dword [esi + 0xc], 0xa
jne 0x56e66c
push eax
mov edi, 0x64
call fcn.0056e8a0
mov eax, dword [esi + 4]
add esp, 4
mov dword [esi + 8], eax
push 0xa
push 0x64
push ebx
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], 0x64
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push 0x64
push ebx
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
push edi
call fcn.00574d40
add esp, 0x24
pop edi
pop ebx
ret
Function at 0x56e6d0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x56e6de
xor eax, eax
pop esi
ret
call fcn.0056e950
test eax, eax
jne 0x56e7d0
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
push ebx
push edi
test eax, eax
jne 0x56e760
mov edi, dword [esi + 0xc]
lea ebx, [esi + 4]
push ebx
call fcn.0056e8a0
mov ecx, dword [ebx]
mov edx, dword [esi + 0x14]
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
push edx
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0xc]
push ecx
push eax
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push 0x588a30
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
add dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Increse_t_d_t_d_t_d_t_d_t_d_n
jmp 0x56e7b6
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push eax
push ecx
push edx
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push str.___s_alloc_Band
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
sub dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Decrese_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
push edi
call fcn.00574d40
add esp, 0x24
pop edi
pop ebx
mov ecx, esi
pop esi
jmp fcn.0056e6d0
inc dword [esi + 0x14]
pop esi
ret
Function at 0x571f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f526
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x34], edi
call fcn.00421860
lea esi, [edi + 0x238]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.CTitanRegisterDlg.0
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call fcn.004236f0
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push 0x28
push 0x28
mov byte [ebp - 4], 1
push ebx
mov eax, 0x8b
push ebx
mov ecx, esi
mov dword [esi], vtable.CVirtualItem.0
mov dword [esi + 0x2a4], ebx
mov word [esi + 0xc], ax
call fcn.004238b0
mov dword [edi + 0x234], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], vtable.cImage.0
lea ecx, [ebp - 0x30]
push ecx
xor eax, eax
lea ecx, [ebx + 0x3f]
mov byte [ebp - 4], 3
call fcn.0042b870
lea ebx, [esi + 0x50]
call fcn.00428e10
xor edx, edx
lea esi, [ebx + 0x10]
lea edi, [ebp - 0x30]
mov word [ebx + 0xc], dx
mov dword [ebx + 0x30], 0xffffff
call fcn.00401a10
mov esi, dword [ebp - 0x38]
mov dword [ebx + 0x34], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0xa0], 0xdc
call fcn.00429230
xor ecx, ecx
mov eax, esi
call fcn.00402ba0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret
Function at 0x572840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f4d1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x3c], edi
call fcn.00421860
lea esi, [edi + 0x23c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esi
mov dword [edi], vtable.CTitanUpgradeDlg.0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
call fcn.004236f0
push 0xffffffffffffffff
push ebx
push 0x28
push 0x28
mov byte [ebp - 4], 1
push ebx
mov eax, 0x8b
push ebx
mov ecx, esi
mov dword [esi], vtable.CVirtualItem.0
mov dword [esi + 0x2a4], ebx
mov word [esi + 0xc], ax
call fcn.004238b0
push 0x4b8130
push 0x4b8080
push 0x19
push 0x2ac
lea ecx, [edi + 0x4e4]
push ecx
mov byte [ebp - 4], 2
call fcn.00576426
mov dword [edi + 0x234], ebx
mov dword [edi + 0x238], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], vtable.cImage.0
lea edx, [ebp - 0x30]
push edx
xor eax, eax
lea ecx, [ebx + 0x3f]
mov byte [ebp - 4], 4
call fcn.0042b870
mov ebx, esi
add ebx, 0x50
call fcn.00428e10
xor eax, eax
lea esi, [ebx + 0x10]
lea edi, [ebp - 0x30]
mov word [ebx + 0xc], ax
mov dword [ebx + 0x30], 0xffffff
call fcn.00401a10
mov esi, dword [ebp - 0x34]
mov dword [ebx + 0x34], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0xa0], 0xdc
call fcn.00429230
xor ecx, ecx
mov eax, esi
call fcn.00402ba0
mov esi, dword [ebp - 0x3c]
add esi, 0x564
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0x19
jmp 0x572973
mov esi, dword [ebp - 0x34]
lea ebx, [esi - 0x30]
call fcn.00428e10
xor ecx, ecx
mov word [esi - 0x24], cx
mov dword [esi], 0xffffff
add esi, 0xffffffe0
lea edi, [ebp - 0x30]
call fcn.00401a10
mov esi, dword [ebp - 0x34]
mov dword [esi + 4], 0x33517d
push 0x5861b8
mov eax, ebx
mov dword [esi + 0x20], 0xdc
call fcn.00429230
lea eax, [esi - 0x80]
xor ecx, ecx
call fcn.00402ba0
add esi, 0x2ac
dec dword [ebp - 0x38]
mov dword [ebp - 0x34], esi
jne 0x572970
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret

Function at 0x5762ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5b107c]
jne 0x5762f8
repz ret
jmp fcn.00576957
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x47
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x39
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x23
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdd
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xea
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc8
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x88
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x44
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x51
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2b
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x54
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xba
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa5
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 2
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x17a1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x17a11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x17a107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17a106a
add dl, dl
jne 0x17a1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17a10dc
xor eax, eax
add dl, dl
jne 0x17a1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17a117d
add dl, dl
jne 0x17a10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17a10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17a10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17a10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17a10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x17a1075
mov eax, 1
add dl, dl
jne 0x17a10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17a10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17a10e1
sub eax, ebx
mov ebx, 1
jne 0x17a1128
mov ecx, 1
add dl, dl
jne 0x17a110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17a1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17a1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17a1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x17a113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17a114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17a1136
cmp eax, 0x7d00
jae 0x17a116d
cmp eax, 0x500
jb 0x17a1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17a1075
cmp eax, 0x7f
ja 0x17a1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17a1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x17a119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x17a1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401b5a
pop dword [ebp - 0x28]
mov eax, 0x401b5a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x78b20ae4
add dword [ebp - 0x38], 0xd5a03a67
mov dword [ebp - 0x34], 0x56f0d57f
add dword [ebp - 0x34], 0xdb4276c6
mov dword [ebp - 0x30], 0xa3ccf526
add dword [ebp - 0x30], 0xa87f4f08
mov dword [ebp - 0x2c], 0x4daf0118
add dword [ebp - 0x2c], 0xb250fee8
lea eax, [ebp - 0x38]
push eax
mov eax, 0xcb6f7b73
sub eax, 0xcb2eab1f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8b4d6ec5
add dword [ebp - 0x38], 0xe924fa91
mov dword [ebp - 0x34], 0x936c5553
sub dword [ebp - 0x34], 0x51fff3de
mov dword [ebp - 0x30], 0xcae501b8
add dword [ebp - 0x30], 0x988a6ab4
mov dword [ebp - 0x2c], 0xc172d9ce
add dword [ebp - 0x2c], 0x3e8d2632
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x9d00aa3f
sub eax, 0x9cbfd9f3
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3bdf9
push 0
call eax
mov ecx, 0xae95c6d3
add ecx, 0x516a89dd
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x28]
mov esi, 0xa2b2c26
add esi, 0xbad22230
xor dword [ebp - 4], 0x33a506da
mov edx, dword [ebx]
sub dword [ebp - 0x24], ecx
sub edx, esi
mov dword [ebp - 8], 0x282c77ac
mov dword [edi], edx
xor dword [ebp - 0x24], 0x6b59dae2
add edi, 0xe22b4d7e
sub edi, 0xe22b4d7a
add ebx, 4
loop 0x401c71
add eax, 0x13593
mov ebx, eax
add eax, 5
mov ecx, 0x2311f6b3
add ecx, 0xdd2e094d
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53