joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46260f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47ded0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46264f
cmp byte [ebx], 0xa
jne 0x46264f
or byte [eax + edi + 0x28], 4
jmp 0x462654
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x462752
mov al, byte [edx]
cmp al, 0x1a
je 0x462734
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x462683
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4626a8
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4626b2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x462665
jmp 0x462752
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46272f
cmp dword [ebp - 0xc], 0
je 0x46272f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47ded0]
test byte [eax + edi + 0x28], 0x48
je 0x462709
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4626f4
mov byte [esi], dl
jmp 0x462705
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47ded0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x462752
cmp byte [ebp - 1], 0xa
jne 0x462718
cmp esi, ebx
jne 0x462718
mov byte [esi], 0xa
jmp 0x462751
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004605d7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x462752
mov byte [esi], 0xd
jmp 0x462751
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47ded0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46274e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x462752
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x46275b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47ded0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46279e
cmp word [esi], dx
jne 0x46279e
or byte [edi + eax + 0x28], 4
jmp 0x4627a3
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4628f6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4628d6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4627e5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x46281b
cmp eax, edx
jae 0x462827
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4627bd
jmp 0x4628f6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4628d2
cmp dword [ebp - 0x14], 0
je 0x4628d2
mov eax, dword [ebx*4 + 0x47ded0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4628aa
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x462873
mov word [esi], cx
jmp 0x4628a6
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47ded0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47ded0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47ded0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4628f6
pop ebx
cmp word [ebp - 4], bx
jne 0x4628bb
cmp esi, dword [ebp + 0xc]
jne 0x4628bb
mov word [esi], bx
jmp 0x4628f3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004605d7
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4628f6
push 0xd
jmp 0x4628ef
mov ecx, dword [ebx*4 + 0x47ded0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4628ed
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4628f6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4629ba
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4629cb
pop esi
ret
push ebx
push edi
push esi
call fcn.00462a08
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0045d70f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4629f3
push ebx
push esi
push edi
call fcn.00448eb0
add esp, 0xc
push 0
call fcn.0045cdc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x462a3f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462a4a

Function at 0x4660a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004660ae

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6a3e778e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5ad27853
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x408953
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408972
sub ecx, esi
xor dword [ebx], eax
sub esi, ecx
inc ebx
cmp ebx, edx
jne fcn.00408953
mov ecx, 0x855bfb9e
add esi, esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x417e0f83
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1c78636b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40166c
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x40abb9
call fcn.00409c2a
call fcn.00401509
lea eax, [ebp - 0x18]
push eax
mov edi, str.K9PCUDiskOptimizer
call fcn.00401bae
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov edi, str.K9PCUDefragSrv.exe
mov dword [ebp - 4], ebx
call fcn.00401bae
mov byte [ebp - 4], 1
call fcn.0040110b
test al, al
je 0x4016b9
push str.K9PCUDefragSrv64.exe
lea eax, [ebp - 0x14]
push eax
call fcn.00401c56
mov eax, dword [0x40f984]
add eax, 0xfffffff0
call fcn.004020e5
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push 0x40cbbc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00401de5
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004021cb
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00402447
push ebx
push ebx
push 0x40cbc0
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov edi, 0x40cc54
call fcn.00401bae
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov esi, esp
call fcn.004020e5
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.004019cb
add esp, 0xc
cmp eax, ebx
setne al
cmp al, bl
jne 0x4017c0
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401bae
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x18]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov esi, esp
call fcn.004020e5
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.004019cb
add esp, 0xc
cmp eax, ebx
setne al
cmp al, bl
jne 0x4017c0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00402447
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00402447
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00402447
mov eax, ebx
call fcn.00409c93
ret
xor ebx, ebx
inc ebx
jmp 0x401797
Function at 0x4017c5
Capabilities:
Create process on windows

Disassembly:
push 0x10
mov eax, 0x40ab6e
call fcn.00409c2a
call fcn.00401509
lea eax, [ebp - 0x1c]
push eax
mov edi, str.K9PCUDiskOptimizer
call fcn.00401bae
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov edi, str.K9PCUDefragSrv.exe
call fcn.00401bae
mov byte [ebp - 4], 1
call fcn.0040110b
test al, al
je 0x401811
push str.K9PCUDefragSrv64.exe
lea eax, [ebp - 0x10]
push eax
call fcn.00401c56
mov eax, dword [0x40f984]
add eax, 0xfffffff0
call fcn.004020e5
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0x40cbbc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401de5
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.004021cb
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00402447
mov esi, dword [ebp - 0x14]
push 0
push 0
push str._Remove
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.00402447
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00402447
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00402447
xor eax, eax
inc eax
call fcn.00409c93
ret

Function at 0x4018c5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
push esi
mov esi, dword [ebp + 0x7bc]
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x820
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00403870
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40193f
lea eax, [ebp - 0x80]
push eax
lea edi, [ebp - 0x78]
call fcn.00401bae
lea eax, [ebp - 0x80]
call fcn.00401c06
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
call fcn.00402447
lea eax, [ebp - 0x7c]
push eax
mov edi, esi
call fcn.00401bae
lea eax, [ebp - 0x7c]
call fcn.00401cb5
lea eax, [ebp - 0x7c]
call fcn.00401cde
mov eax, dword [ebp - 0x7c]
cmp dword [eax - 0xc], 0
je 0x4019a5
push str.killservice
lea esi, [ebp - 0x7c]
call fcn.00401c8a
test eax, eax
jl 0x401979
call fcn.00401509
push str.installservice
lea esi, [ebp - 0x7c]
call fcn.00401c8a
test eax, eax
jl 0x40198f
call fcn.0040166c
push str.removeservice
lea esi, [ebp - 0x7c]
call fcn.00401c8a
test eax, eax
jl 0x4019a5
call fcn.004017c5
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
call fcn.00402447
mov ecx, dword [ebp + 0x7a8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00403029
add ebp, 0x7ac
leave
ret 0x10
Function at 0x4023d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4023e7
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40241c
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x402418
cmp edi, eax
jae 0x40241c
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40240a
cmp edi, eax
jb 0x402420
xor eax, eax
jmp 0x402429
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4024cb
Capabilities:
Link many functions at runtime

Disassembly:
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push edi
mov dword [esi], vtable.CEnumProcess.0
mov byte [esi + 4], bl
push str.Kernel32
mov byte [esi + 5], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x40], eax
cmp eax, ebx
je 0x402595
push 0x40cc6c
push eax
mov dword [esi + 0x44], 0x22c
mov dword [esi + 0x270], 0x428
call edi
push str.Process32First
push dword [esi + 0x40]
mov dword [esi + 0x698], eax
call edi
push str.Process32Next
push dword [esi + 0x40]
mov dword [esi + 0x69c], eax
call edi
push str.Module32First
push dword [esi + 0x40]
mov dword [esi + 0x6a0], eax
call edi
push str.Module32Next
push dword [esi + 0x40]
mov dword [esi + 0x6a4], eax
call edi
mov dword [esi + 0x6a8], eax
cmp dword [esi + 0x698], ebx
je 0x402595
cmp dword [esi + 0x69c], ebx
je 0x402595
cmp dword [esi + 0x6a0], ebx
je 0x402595
cmp dword [esi + 0x6a4], ebx
je 0x402595
cmp eax, ebx
je 0x402595
mov byte [esi + 5], 1
push str.PSAPI
call ebp
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x4025e7
push str.EnumProcesses
push eax
mov dword [esi + 0x10], 0x100
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call edi
push str.EnumProcessModules
push dword [esi + 0xc]
mov dword [esi + 0x2c], eax
call edi
push str.GetModuleFileNameEx
push dword [esi + 0xc]
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
cmp dword [esi + 0x2c], ebx
je 0x4025e7
cmp dword [esi + 0x30], ebx
je 0x4025e7
cmp eax, ebx
je 0x4025e7
mov byte [esi + 4], 1
mov ecx, esi
mov dword [esi + 8], ebx
call fcn.0040268e
push 2
pop ecx
mov edx, eax
pop edi
or edx, ecx
pop ebp
pop ebx
cmp eax, edx
jne 0x402602
mov dword [esi + 8], ecx
xor ecx, ecx
inc ecx
mov edx, eax
or edx, ecx
cmp eax, edx
jne 0x402610
mov dword [esi + 8], ecx
mov eax, esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x1a
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4c
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x5d
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf3
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa6
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc4
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7f
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x40
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x52
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x66
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x52
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451bc9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bda
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b072
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b083
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af59
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b0ab
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x7ce36067
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x65890bc6
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x68
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x87
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x10
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xec
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa5
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x61
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x93
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret