joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576808
push 0x566288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x562329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x562329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005651d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x562329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x562329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x56232c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00562351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x562d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x562d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x562d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x562d94
push eax
push esi
call fcn.0056520b
add esp, 8
pop esi
ret 0x10

Function at 0x562da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x562e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x562e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x57b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00564dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x562dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x562e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x562ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x562eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x57b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00564dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x562eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x562e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x563000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x563131
push esi
call fcn.00566145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00555080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x563131
push 0
push ebp
call fcn.005553a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00555260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x56308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005552f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x563121
push 0x57b918
push edi
call fcn.005643f0
push eax
push ebx
push esi
call fcn.00562f60
push 0x57b8f8
push edi
call fcn.005643f0
push eax
push ebx
push esi
call fcn.00562f60
push 0x57b8d8
push edi
call fcn.005643f0
push eax
push ebx
push esi
call fcn.00562f60
push 0x57b8c0
push edi
call fcn.005643f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00562f60
push 0x57b8a0
push edi
call fcn.005643f0
push eax
push ebx
push esi
call fcn.00562f60
push 0x57b888
push edi
call fcn.005643f0
push eax
push ebx
push esi
call fcn.00562f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5641b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00564140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00564140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00564140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00564140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x564bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x564c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x57687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x564c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x564c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x575f170
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b4b000]
push edi
or ebp, 0xffffffff
jmp 0x575f192
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x575f199
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x575f188
mov eax, 1
add ebx, ebx
jne 0x575f1ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x575f1bc
jne 0x575f1db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x575f1db
dec eax
add ebx, ebx
jne 0x575f1c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x575f1a0
add ebx, ebx
jne 0x575f1d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x575f22d
xor ecx, ecx
sub eax, 3
jb 0x575f1f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x575f262
sar eax, 1
mov ebp, eax
jmp 0x575f1fe
add ebx, ebx
jne 0x575f1fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x575f1cc
inc ecx
add ebx, ebx
jne 0x575f20c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x575f1cc
add ebx, ebx
jne 0x575f219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x575f20e
jne 0x575f22a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x575f20e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x575f24c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x575f23e
jmp 0x575f18e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x575f24c
add edi, ecx
jmp 0x575f18e
pop esi
mov edi, esi
mov ecx, 0xd3f96
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x575f26a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x575f26f
lea edi, [esi + 0x535a000]
mov eax, dword [edi]
or eax, eax
je 0x575f2d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5387bc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5387dc4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x575f295
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5387dcc]
or eax, eax
je 0x575f2d1
mov dword [ebx], eax
add ebx, 4
jmp 0x575f2b2
call dword [esi + 0x5387dc8]
mov ebp, dword [esi + 0x5387dd0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x575f30b
sub esp, 0xffffff80
jmp 0x2057f30
Function at 0x434c39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x434c48
pop dword [ebp - 0x10]
mov eax, 0x268d242b
sub eax, 0x2649d7e3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x17c49fd5
add dword [ebp - 0x20], 0x368da576
mov dword [ebp - 0x1c], 0x7d3b9e6e
sub dword [ebp - 0x1c], 0x4b085229
mov dword [ebp - 0x18], 0x96eee2be
sub dword [ebp - 0x18], 0x4aa29e90
mov dword [ebp - 0x14], 0x8a99269c
add dword [ebp - 0x14], 0x7566d964
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc527d511
add eax, 0x3b21bb43
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xdf4331f7
sub dword [ebp - 0x20], 0x6ad0c8a1
mov dword [ebp - 0x1c], 0x4b811d7b
sub dword [ebp - 0x1c], 0xa14bc06
mov dword [ebp - 0x18], 0x5757be5e
sub dword [ebp - 0x18], 0xf3e851f2
mov dword [ebp - 0x14], 0x46c94735
add dword [ebp - 0x14], 0xb936b8cb
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x74b19
push 0
call eax
mov ecx, 0x352f97d6
sub ecx, 0x352f337d
xor ebx, ebx
add ebx, eax
mov edi, 0xde0cb5f9
add edi, 0x223fa807
add edi, dword [ebp - 0x10]
mov edx, 0x2f19f634
sub edx, 0xe107e7
mov esi, dword [edi]
mov dword [ebp - 0xc], 0x6a96ebbc
xor esi, edx
sub dword [ebp - 8], 0x5c495f2d
mov dword [ebx], esi
sub dword [ebp - 4], eax
add ebx, 0xe9dcc82d
sub ebx, 0xe9dcc829
add edi, 0x9ea8519f
add edi, 0x6157ae65
loop 0x434d67
add eax, 0x12412aaa
add eax, 0xedc0598d
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x403e76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b760
cmp edx, dword [eax]
je 0x403e98
add eax, 8
inc ecx
cmp eax, 0x40b7f0
jl 0x403e89
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b760]
jne 0x403fc6
mov eax, dword [0x40e6d8]
cmp eax, 1
je 0x403fa0
test eax, eax
jne 0x403ec9
cmp dword [0x40b694], 1
je 0x403fa0
cmp edx, 0xfc
je 0x403fc6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403f00
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406370
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403f43
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4098b8
push edi
call fcn.00407c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406370
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406380
lea eax, [ebp - 0xa0]
push 0x409898
push eax
call fcn.00406380
push dword [esi + 0x40b764]
lea eax, [ebp + 8]
lea esi, [esi + 0x40b764]
push 0
push eax
push dword [esi]
call fcn.00406460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x407de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x407e04
jmp 0x407e0e
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407df4
mov esp, ebp
pop ebp
ret

Function at 0x40917b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40919b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040bb7e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4091bc
test byte [esp + 8], 2
je 0x4091bc
mov dword [0x418f10], 0xd
mov dword [0x418f14], 5
jmp 0x409197
xor eax, eax
ret

Function at 0x40b48d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4118a0
cmp edx, dword [eax]
je 0x40b4af
add eax, 8
inc ecx
cmp eax, 0x411930
jl 0x40b4a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4118a0]
jne 0x40b5dd
mov eax, dword [0x418f64]
cmp eax, 1
je 0x40b5b7
test eax, eax
jne 0x40b4e0
cmp dword [0x411328], 1
je 0x40b5b7
cmp edx, 0xfc
je 0x40b5dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b517
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407f60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004080b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b55a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004080b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4104fc
push edi
call fcn.00408c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407f60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407f70
lea eax, [ebp - 0xa0]
push 0x4104dc
push eax
call fcn.00407f70
push dword [esi + 0x4118a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407f70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040df55
add esp, 0x2c
pop edi
jmp 0x40b5dd
lea eax, [ebp + 8]
lea esi, [esi + 0x4118a4]
push 0
push eax
push dword [esi]
call fcn.004080b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x5f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x2a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x60
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x38
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x75
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xd6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x32
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd3
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, eax
or bh, ch
push esi
sbb eax, 0x85147d8b
dec eax
xchg ecx, eax
div dword [ebx + ecx - 0x75]
inc ebp
adc bh, al
add byte [eax], al
add byte [eax], al
add bl, ch
adc cl, byte [ebx - 0x3fccefab]
cli
test eax, 0x85c0aa0f
ror byte [ecx - 0x40fd8bfe], 0xd9
mov eax, 0xcccbcccd
xor al, byte [eax - 0x153e1e09]
add ecx, dword [edx - 0x5109773e]
sub cl, al
add cl, 0x30
mov byte [esi], cl
mov ecx, edx
cmp dl, dl
jne 0x408122
cmp ebx, dword ds:[eax]
sub edi, esi
aaa
cmp byte [ebx + 0x5bd45fc6], cl
pop ebp
ret

Function at 0x40ae7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [esi]
inc esi
cmp al, 0x63
mov byte [ebp + 0x10], al
jbe 0x40ae1d
mov eax, dword [ebp + 0x10]
mov ebx, 0xe5
add byte [eax], al
and eax, 0xff
cdq
neg dword [esi + 0x55883004]
adc byte [eax + 0x4eb4101], cl
popfd
or dword [esi + 0x17], esi
mov eax, dword [ebp + 0x10]
mov ebx, 0xa
and eax, 0x6e69
cdq
idiv ebx
aaa
inc esp
mov byte [ebp + 0x4c28ae6], dh
xor byte [eax + 0x1c64101], cl
inc ecx
dec edi
jne 0x40adf9
mov eax, dword [ebp + 0xc]
pop edi
pop esi
invalid
wait
jnp 0x40ae09
and al, 0xa3
test eax, eax
jne 0x40aee2
jl 0x40aeb7
push 0x14
into
xor ebp, dword [esi]
call 0x1a404a60
mov ecx, eax
sub edi, dword [eax]
mov dword [eax + 4], edi
mov ebp, ebp
or byte [ecx + 0x57570c78], cl
push edi
mov dword [eax + 0x10], edi
push edi
mov dword [ebx + 0xc], ecx
dec esp
in al, dx
rol byte [eax], 0x61
push ebx
or al, 0x89
inc edx
adc byte [esi], al
inc ebx
or al, 0x8b
dec eax
stc
test dword [eax + 0x54], edi
and eax, 0xc098aa8b
inc eax
jge 0x40aec3
jmp [edi]
das
test eax, eax
jne 0x40aed2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x86
call esi
pop edi
in al, dx
add eax, 0xa9c80
pop ebx
mov esp, ebp
add eax, edx
or al, 0xb6
in eax, 3
ret 0xb60c
mov eax, dword [ebx + 0x30]
sbb dword [eax], 0xffffffff
cmp eax, edi
mov eax, dword [ebp + 0x60]
je 0x40af17
mov cl, byte [ebx + 0x30]
mov byte [eax], cl
or edx, dword [esi]
mov byte [esi - 0x77], al
push ss
mov dword [ebx + 0xc], edi
mov ecx, dword [esi]
mov dword [ebp - 0x3f], eax
test ecx, ecx
jne 0x40aedd
mov dword [esi], 0xb85d0001
insb byte es:[edi], dx
pop esi
xor eax, eax
pop ebp
mov eax, 0xc0335e6c
pop ebx
mov esi, dword [esi + 0xcc2ae]
mov cl, byte [ebx + 0x2c]
test cl, cl
inc esp
test byte [0x8bd600dd], bl
jge 0x40af87
mov edi, dword [esi]
jg 0x40aeb2
inc ebp
cld
mov dword [ebp - 8], edi
call 0x2526a3d0
sbb dword [ebx + 0x12], edi
add dword [ebp + 0x2d], esi
push ebx
call fcn.0040b2d0
leave
mov dword [ebp + 0x51], eax
cmp eax, ecx
je 0x40af5d
mov eax, dword [ebx + 0x58]
push eax
call 0xffdaa2db
mov esp, ebx
or byte [edi + 0x5e], bl
pop ebx
mov esp, ebp
pop ebp
ret 0x7d0c
mov dword [ebx + 0x3c], ecx
cmp al, 0x2b
dec eax
mov dword [ebx + 0x44], ecx
mov dword [ebp - 0x2a], 0xdc0000
jmp 0x40af0a
mov ecx, dword [ebx + 0x38]
movsd dword es:[edi], dword [esi]
push ebp
hlt