joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e090
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x4e9874]
cmp eax, 2
je 0x44e143
push esi
push edi
call fcn.00433cd0
mov esi, eax
xor edx, edx
mov ecx, 1
mov edi, 0x4e9874
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
cmovne edx, eax
sub edx, 0
je 0x44e106
sub edx, 1
je 0x44e0e0
sub edx, 1
je 0x44e141
push 1
push str.Unknown_WinSock_state.
mov ecx, esi
call fcn.00433ca0
pop edi
pop esi
ret
mov eax, dword [0x4e9874]
sub eax, 1
je 0x44e0ff
sub eax, 1
je 0x44e141
push 1
push str.Unknown_WinSock_state.
mov ecx, esi
call fcn.00433ca0
jmp 0x44e0e0
call fcn.004393d0
jmp 0x44e0e0
push 0x4e9878
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44e133
xor ecx, ecx
mov eax, 1
lock cmpxchg dword [edi], ecx
push 1
push str.Could_not_initialize_WinSock.
mov ecx, esi
call fcn.00433ca0
mov ecx, 2
mov eax, 1
lock cmpxchg dword [edi], ecx
pop edi
pop esi
ret

Function at 0x44e150
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor esi, esi
push esi
push dword [ebx + 4]
push dword [ebx + 0x10]
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x44e199
test edi, edi
je 0x44e1af
mov eax, dword [ebx + 4]
add esi, edi
cmp esi, eax
jge 0x44e1af
push 0
sub eax, esi
push eax
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44e173
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.004907ed
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x44e290
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
test esi, esi
je 0x44e312
cmp esi, 0x1fffffff
ja 0x44e3b8
lea ebx, [esi*8]
cmp ebx, 0x1000
jb 0x44e2e6
lea eax, [ebx + 0x23]
cmp eax, ebx
jbe 0x44e3bd
push eax
call fcn.004723fa
add esp, 4
test eax, eax
je 0x44e3b3
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x44e2f9
test ebx, ebx
je 0x44e2f7
push ebx
call fcn.004723fa
add esp, 4
mov edi, eax
jmp 0x44e2f9
xor edi, edi
lea eax, [esi*8]
add ebx, edi
push eax
push 0
push edi
mov dword [esp + 0x18], ebx
call fcn.0048a240
add esp, 0xc
push ebp
xor ebp, ebp
test esi, esi
je 0x44e343
mov ebx, dword [esp + 0x20]
mov edx, edi
nop
xorps xmm0, xmm0
lea edx, [edx + 8]
movq qword [edx - 8], xmm0
mov ecx, dword [ebx + ebp*4]
inc ebp
mov eax, dword [ecx + 0x10]
mov dword [edx - 4], eax
mov eax, dword [ecx + 8]
mov dword [edx - 8], eax
cmp ebp, esi
jne 0x44e320
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push esi
push edi
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_WSASend]
pop ebp
cmp eax, 0xffffffff
jne 0x44e37b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.004907ed
mov dword [eax], esi
xor esi, esi
jmp 0x44e37f
mov esi, dword [esp + 0x18]
test edi, edi
je 0x44e3ac
sub ebx, edi
and ebx, 0xfffffff8
cmp ebx, 0x1000
jb 0x44e3a2
mov ecx, dword [edi - 4]
add ebx, 0x23
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x44e3b3
mov edi, ecx
push ebx
push edi
call fcn.0047242a
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
call fcn.0048d2da
call fcn.004089e0
call fcn.00408580
int3
Function at 0x457e80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6128
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e42e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov edi, esi
cmp dword [esi + 0x14], 0x10
jb 0x457eba
mov edi, dword [esi]
mov ebx, dword [esi + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x457edc
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x457ec8
mov eax, dword [ebp - 0x10]
push edx
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [eax + 0x14]
call fcn.00456fd0
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x457fc5
mov esi, dword [edi + 0x24]
test esi, esi
je 0x457f03
lock inc dword [esi + 4]
mov esi, dword [edi + 0x24]
mov edi, dword [edi + 0x20]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov ecx, dword [edi + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [edi]
movzx ebx, word [edi + 0xe]
imul ecx
mov dword [ebp - 4], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jbe 0x457fcf
mov ecx, dword [edi]
lea eax, [ebx + ebx*2]
lea ecx, [ecx + eax*8]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
je 0x457f57
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x457f4e
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00408c80
inc word [edi + 0xe]
movzx eax, word [edi + 0x10]
mov ebx, eax
movzx edx, word [edi + 0xe]
cmp word [edi + 0xe], ax
jne 0x457f73
xor eax, eax
xor edx, edx
mov word [edi + 0xe], ax
movzx eax, word [edi + 0xc]
cmp dx, ax
jne 0x457f8c
inc eax
mov word [edi + 0xc], ax
cmp ax, bx
jne 0x457f8c
xor eax, eax
mov word [edi + 0xc], ax
test esi, esi
je 0x457fb1
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x457fb1
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x457fb1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.invalid_unordered_map_K__T__key
call fcn.0045d151
call fcn.00419530
int3
Function at 0x457fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6158
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e42e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 0x38]
push esi
mov dword [ebp - 0x10], esi
call fcn.0045ee55
add esp, 4
test eax, eax
jne 0x4580b3
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
cmp dword [edi + 0x14], 0x10
jb 0x458035
mov eax, dword [edi]
mov dword [ebp + 8], eax
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x458059
mov esi, dword [ebp + 8]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x458044
lea esi, [ebx + 0x38]
push edx
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x14]
call fcn.00456fd0
mov eax, dword [eax + 4]
test eax, eax
jne 0x458071
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x18]
jne 0x45807e
push edi
mov ecx, ebx
call fcn.00457bf0
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.00457e80
push esi
mov dword [ebp - 4], 1
call fcn.0045ee7a
add esp, 4
test eax, eax
jne 0x4580b9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.0045e082
push eax
call fcn.0045e082
int3
Function at 0x458e20
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6288
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4e42e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
cmp byte [esi + 0xb4], 0
jne 0x458e64
mov ecx, esi
call fcn.0045b770
cmp dword [esi + 0x58], 0
mov al, byte [esi + 0xb4]
je 0x458eb9
test al, al
jne 0x458e7b
mov ecx, esi
call fcn.0045b770
call fcn.004907ed
cmp dword [esi + 0x5c], 0x10
lea edi, [esi + 0x48]
mov ebx, eax
jb 0x458e8d
mov edi, dword [edi]
push 0xa
lea eax, [ebp - 0x2c]
mov dword [ebx], 0
push eax
push edi
call fcn.00498852
add esp, 0xc
cmp edi, dword [ebp - 0x2c]
je 0x458fb3
cmp dword [ebx], 0x22
je 0x458fbd
movzx edi, ax
jmp 0x458f28
test al, al
jne 0x458ec4
mov ecx, esi
call fcn.0045b770
mov edi, dword [esi + 0x14]
mov eax, esi
cmp edi, 0x10
jb 0x458ed0
mov eax, dword [esi]
mov ebx, dword [esi + 0x10]
push 4
push str.http
push ebx
push eax
call fcn.004033f0
add esp, 0x10
test al, al
je 0x458eef
mov edi, 0x50
jmp 0x458f28
cmp byte [esi + 0xb4], 0
jne 0x458f05
mov ecx, esi
call fcn.0045b770
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov eax, esi
cmp edi, 0x10
jb 0x458f0e
mov eax, dword [esi]
push 5
push str.https
push ebx
push eax
call fcn.004033f0
add esp, 0x10
test al, al
je 0x458f74
mov edi, 0x1bb
cmp byte [esi + 0xb4], 0
jne 0x458f38
mov ecx, esi
call fcn.0045b770
add esi, 0x30
cmp dword [esi + 0x14], 0x10
jb 0x458f43
mov esi, dword [esi]
push 1
push 0
push 3
push 0
push 0
push edi
push esi
push dword [ebp - 0x30]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472897
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00459010
push eax
lea eax, [ebp - 0x28]
push str.Send_PostRequest_failed:_use_unsupported_protocol_
push eax
call fcn.00419eb0
add esp, 0xc
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00408d70
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040c7f0
push 0x4d8ed4
lea eax, [ebp - 0x3c]
push eax
call fcn.0048927d
push str.invalid_stoi_argument
call fcn.0045d111
push str.stoi_argument_out_of_range
call fcn.0045d151
int3
Function at 0x4597e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b63b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4e42e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0x34]
lea ecx, [esi + 0x34]
test al, al
jne 0x459869
mov al, 1
xchg byte [ecx], al
push 8
call fcn.004723fa
add esp, 4
test eax, eax
je 0x45982f
mov dword [eax], esi
mov dword [eax + 4], 0x4598f0
jmp 0x459831
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x418800
push 0
push 0
call fcn.004905a6
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x459879
cmp dword [esi + 0x2c], 0
jne 0x459887
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call fcn.0045e0af
call fcn.0048eabe
int3
Function at 0x4751d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4a1cf7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a1b6d
Function at 0x40103a
Capabilities:
Accept command line arguments
Check mutex on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x401063
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push str.DSound.dll
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x401144
push str.DirectSoundCreate
push esi
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push ebx
call eax
test eax, eax
jl 0x40113d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x401134
xor eax, eax
inc eax
push 2
mov word [ebp - 0x4c], ax
pop eax
mov word [ebp - 0x4a], ax
push 4
pop eax
mov word [ebp - 0x40], ax
push 0x10
pop eax
mov word [ebp - 0x3e], ax
push 0x12
pop eax
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x28], 0x24
mov dword [ebp - 0x24], 0x8002
mov dword [ebp - 0x20], 0x40998
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
lea edx, [ebp - 0x38]
push edx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x48], 0x5622
mov dword [ebp - 0x44], 0x15888
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x401134
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x30], edx
mov edx, dword [eax + 0x30]
push ecx
mov dword [ebp - 0x34], edx
call dword [eax + 8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x22
pop eax
xor ecx, ecx
cmp ax, word [esi]
jne 0x401159
inc ecx
inc esi
inc esi
movzx eax, word [esi]
xor edx, edx
cmp dx, ax
je 0x401179
inc esi
inc esi
cmp ecx, ebx
jne 0x40116d
push 0x20
jmp 0x40116f
push 0x22
pop edx
cmp dx, ax
jne 0x401159
jmp 0x401179
inc esi
inc esi
push 0x20
pop eax
cmp ax, word [esi]
je 0x401177
push str.VolumeControl32
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
test ebx, ebx
jne 0x40119d
or eax, 0xffffffff
jmp 0x4011d9
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call dword [sym.imp.HookDll.dll_int___cdecl_SetDirectSoundMethods_int____stdcall___void___int____stdcall___void__]
push esi
call dword [sym.imp.HookDll.dll_int___cdecl_InstallHook_wchar_t__]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
add esp, 0xc
push 0
mov edi, section..text
push edi
call esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.HookDll.dll_int___cdecl_UninstallHook_void_]
push 0
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004011ea
leave
ret 0x10
Function at 0x4011ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x4011f4
repz ret
jmp fcn.004013a9

Function at 0x403333
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040220e
and dword [ebp - 4], 0
cmp dword [0x40b668], 0
mov ebx, eax
jne 0x4033e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403495
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403495
push eax
call fcn.0040219c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.0040219c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b66c], eax
call esi
push eax
call fcn.0040219c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b670], eax
call esi
push eax
call fcn.0040219c
pop ecx
mov dword [0x40b678], eax
test eax, eax
je 0x4033e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040219c
pop ecx
mov dword [0x40b674], eax
mov eax, dword [0x40b674]
cmp eax, ebx
je 0x40343c
cmp dword [0x40b678], ebx
je 0x40343c
push eax
call fcn.00402217
push dword [0x40b678]
mov esi, eax
call fcn.00402217
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40343c
test edi, edi
je 0x40343c
call esi
test eax, eax
je 0x403433
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403433
test byte [ebp - 0xc], 1
jne 0x40343c
or dword [ebp + 0x10], 0x200000
jmp 0x403475
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x403475
push eax
call fcn.00402217
pop ecx
test eax, eax
je 0x403475
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403475
mov eax, dword [0x40b670]
cmp eax, ebx
je 0x403475
push eax
call fcn.00402217
pop ecx
test eax, eax
je 0x403475
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b668]
call fcn.00402217
pop ecx
test eax, eax
je 0x403495
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403497
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x4074b0
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
je 0x4074db
mov ebp, dword [esi - 0x10]
lea eax, [ecx + eax]
cmp edx, 0xc8001d00
jb 0x4074c7
mov eax, 0x1ff
xor eax, dword [ebp - 0x47]
jae 0x4074db
dec esi
mov byte [esi], 0x70
mov edi, dword [esp + edi*8 - 0x764dc483]
dec ebp
cld
jb 0x40753c
mov eax, dword [ebp - 0x57]
test esi, ebp
pop ebp
test ch, bh
add dword [edi - 0x4573991], edi
bnd jmp 0x13bc9c3
fstp qword [edx - 0x3c]
adc al, 0x8b
invalid

Function at 0x40a4b0
Capabilities:
Terminate process

Disassembly:
inc eax
inc ecx
push ebp
mov ebp, esp
mov eax, dword [ebp - 0x3b]
jae 0x40a443
xor dword [eax], ecx
neg eax
sal bh, 0xd8
dec eax
fmul dword [ebx - 0xafebe7]
adc eax, sym.imp.KERNEL32.dll_WaitForSingleObject
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x73
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x41
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x2b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x70
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x90
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd3
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x85
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6f
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x94
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3f
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x46
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x17
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe6
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret