joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x36
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x78
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe4
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x19
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x58
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x87
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x56
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 2
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xbc
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe6
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40a820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40a87b
cmp byte [esi + ebx - 1], 0xa
je 0x40a84f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x416ea0], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40b910
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x88c
mov dword [ebp - 0x86c], eax
test byte [0x415030], 8
jne 0x40bab0
mov eax, dword [ebp - 0x86c]
mov dword [esp + 4], 0x4b0
lea esi, [ebp - 0x818]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 8
mov edi, eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1f51
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
xor ecx, ecx
mov edx, esi
mov eax, edi
sub esp, 0x10
call sym._add_listview_item
lea eax, [ebp - 0x85c]
mov dword [esp + 4], 0x41731a
mov dword [esp + 8], eax
mov eax, dword [0x415a44]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x40ba3d
mov eax, dword [ebp - 0x86c]
call sym._init_comboboxes
lea eax, [ebp - 0x854]
mov dword [esp], edi
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x854], 8
mov dword [ebp - 0x848], 3
mov dword [ebp - 0x844], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104c
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
inc ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edx, esi
mov ecx, eax
mov eax, edi
call sym._add_listview_item
lea eax, [ebp - 0x858]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x858], 0x400
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x40ba28
mov eax, dword [ebp - 0x85c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40b9b9
mov dword [esp + 0xc], 0x417316
mov dword [esp + 8], str.init_appsheet
mov dword [esp + 4], 0x415030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x40b92f

Function at 0x40bbd0
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
sub esp, 0x24
mov dword [esp + 8], 0x415a44
mov dword [esp + 4], str.SoftwareWine
mov dword [esp], Ordinal_2
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x40bc08
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 1
test byte [0x4150a0], 2
je 0x40bbfd
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegOpenKey_failed_on_wine_config_key___ld__n
mov dword [esp + 8], str.initialize
mov dword [esp + 4], 0x4150a0
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_7
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40c950
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [ebp - 0x220]
sub esp, 0x68c
mov dword [esp + 4], 0x7f02
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadCursorW]
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.user32.dll_SetCursor]
mov dword [ebp - 0x674], eax
call eax
mov dword [ebp - 0x670], eax
mov eax, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str.WINEBUILDDIR
mov dword [ebp - 0x66c], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x40cb30
xor eax, eax
jmp 0x40c9f1
xor ecx, ecx
mov edx, ebx
mov eax, edi
call sym._load_library_list_from_dir
mov dword [esp + 4], 0x4231e0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, edi
xor ecx, ecx
mov edx, ebx
call sym._load_library_list_from_dir
mov eax, esi
mov dword [esp + 0xc], eax
lea esi, [eax + 1]
lea eax, [ebp - 0x660]
mov dword [esp + 8], str.WINEDLLDIR_u
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sym._swprintf_1
lea eax, [ebp - 0x660]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x66c]
mov dword [esp + 8], 0x104
call eax
sub esp, 0xc
test eax, eax
jne 0x40c9c8
lea eax, [ebp - 0x620]
mov dword [esp], edi
mov ebx, 1
lea esi, [ebp - 0x420]
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.user32.dll_SendDlgItemMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x148
mov dword [esp + 4], 0x1f44
mov dword [ebp - 0x66c], eax
call eax
sub esp, 0x14
lea esi, [esi]
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0x66c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x148
mov dword [esp + 4], 0x1f44
mov dword [esp], edi
call eax
sub esp, 0x14
test eax, eax
js 0x40cb10
lea eax, [ebp - 0x620]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x40caf0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x66c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x144
mov dword [esp + 4], 0x1f44
mov dword [esp], edi
call eax
sub esp, 0x14
jmp 0x40ca80
lea eax, [ebp - 0x620]
mov dword [esp + 4], esi
inc ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
jmp 0x40ca80
mov eax, dword [ebp - 0x670]
mov dword [esp], eax
mov eax, dword [ebp - 0x674]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp + 4], str.dlls
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscat]
mov ecx, 1
mov edx, esi
mov eax, edi
call sym._load_library_list_from_dir
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40c9c0
Function at 0x40f030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x220]
push ebx
mov ebx, 0x4150e4
sub esp, 0x23c
mov edi, dword [sym.imp.shell32.dll_SHGetFolderPathW]
lea esi, [esi]
mov eax, dword [ebx - 4]
mov byte [ebx], 0
mov dword [esp + 0x10], esi
or ah, 0x40
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call edi
sub esp, 0x14
test eax, eax
js 0x40f095
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._query_shell_folder
add ebx, 0x108
cmp ebx, 0x41581c
jne 0x40f050
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x234
mov eax, dword [0x416ec4]
test eax, eax
je 0x40f1a3
mov dword [esp + 8], 0
mov dword [esp + 4], sym._theme_dsa_destroy_callback_8
mov dword [esp], eax
call dword [sym.imp.comctl32.dll_DSA_DestroyCallback]
mov dword [0x416ec4], 0
mov dword [0x416ec8], 0
sub esp, 0xc
lea ebx, [ebp - 0x210]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x38
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
js 0x40f24e
mov dword [esp + 4], 1
mov dword [esp], 0x18
call dword [sym.imp.comctl32.dll_DSA_Create]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x210], 0
mov dword [0x416ec4], eax
je 0x40f211
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x40f208
xor eax, eax
mov ecx, 0x5c
jmp 0x40f227
movzx ecx, word [eax + str.Themes]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40f220
mov dword [esp + 8], 0
mov dword [esp + 4], sym._myEnumThemeProc_24
mov dword [esp], ebx
call sym._EnumThemes_12
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40fd90
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [ebp - 0x1c], ecx
mov edi, dword [sym.imp.user32.dll_SendDlgItemMessageW]
mov dword [esp + 4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x147
mov dword [esp], eax
call edi
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x150
mov dword [esp + 4], esi
mov dword [esp], ebx
call edi
lea edx, [eax - 1]
sub esp, 0x14
cmp edx, 0xfffffffd
jbe 0x40fe20
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.SoftwareWineDrivers_
mov dword [esp], Ordinal_2
mov dword [esp + 8], eax
call sym._set_reg_key
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax]
mov dword [esp + 0xc], eax
jmp 0x40fdfa
Function at 0x4141c0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x41425b
cmp ax, 9
je 0x414248
cmp ax, 0x20
je 0x414248
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x4142b0
cmp ax, 0x22
je 0x4142c0
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x41425b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x414200
test edi, 1
jne 0x414200
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x414248
cmp ax, 0x20
je 0x414248
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x4142d8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x41421b
and dword [ebp - 0x6c], 1
jne 0x414214
xor edi, 1
jmp 0x41421b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x414274

Function at 0x4142f0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x79
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x94
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xe8
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa4
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0xaf
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa3
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 8
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf0
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x6c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x47
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x70
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xc8
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xc
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x6c
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0xac9e70
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
add ebp, eax
call fcn.01157ba9
mov edx, 0x380a95b6
mov ecx, dword [esi + edx*2 - 0x70152b6c]
movsx eax, dl
shl dx, 0x86
lea esi, [esi + edx*2 - 0x7014dafc]
xor ecx, ebx
ror dx, 0xa1
dec eax
adc eax, eax
lea ecx, [edx + ecx + 0x4a179add]
call fcn.00b4e564
sub esi, 4
mov edx, dword [esi]
call fcn.00b51245

Function at 0xacb26b
Capabilities:
Encode data using base64

Disassembly:
rol eax, 1
dec ebp
lea esp, [ebp - 0x3b5ab84b]
dec esp
lea eax, [edx*8 + 0x39149603]
not eax
dec edx
mov dword [esp + ebp*2 - 0x28], ecx
inc edx
rol byte [esp + ebp - 5], 0x85
ror eax, 2
inc esi
xchg dword [esp + ebp*2 - 0x1c], esp
dec edx
neg dword [esp + ebp*2 - 0x27]
dec eax
neg word [esp + edx - 0x70b4710f]
dec eax
mov dword [esp + edx - 0x70b4710c], esi
inc edx
xor dword [esp + ebp*2 - 0x20], eax
dec eax
mov esi, dword [esp + edx - 0x70b4710c]
dec eax
arpl ax, ax
inc esp
movsx edx, dx
dec esp
mov dword [esp + edx - 0x70b4710c], edx
dec eax
add edi, eax
inc cx
sar edx, 0xa4
inc ecx
sar ah, 0x21
inc cx
mov edx, dword [ebx + edx - 0x70b47114]
inc dx
sub dword [esp + ebp*4 - 0x4d], 0xfe41c5aa
enter 0xffffffffffffff42, 0x4c
sub al, 0xef
inc ebx
mov cl, byte [ebp + ebx - 0x12]
dec ebx
lea ebx, [ebp - 0x3bfcd55d]
dec edi
lea ebx, [ebp + ebx - 0x12]
inc esp
and edx, ebx
sal dx, cl
inc bx
mov dword [ebx - 0xa], edx
inc ecx
movzx ebp, al
inc ecx
xor ebx, eax
call fcn.00adc14e
movsx eax, cl
lea esi, [esi + eax - 0x30]
mov eax, dword [esi + eax - 0x2c]
lea edx, [ecx*2 + 0x9b1b996]
dec dx
xor eax, ebx
shr cl, 0x26
lea eax, [eax + edx - 0x1763d263]
rol eax, 3
call fcn.00afa287
Function at 0xacb33c
Capabilities:
Encode data using base64

Disassembly:
bswap eax
xor ebx, eax
sal cl, cl
not edx
adc ebp, eax
push ecx
add edx, ecx
movsx eax, cx
mov ax, word [edi + eax*4 - 0x1b424]
je 0xf9af66
cmovs ecx, dword [esp + edx*2 - 0x3e1f80a8]
lea edi, [edi + edx - 0x1f0fc05d]
movzx edx, byte [edx + esi - 0x1f0fc056]
sal cl, 7
sbb esi, 0xfffffffa
xor dl, bl
bswap ecx
call fcn.011265e3
push 0x400b52af
mov edx, dword [esi]
shl dword [esp], 0x54
mov eax, 0x46185121
lea esi, [esi + eax - 0x4618511d]
mov ecx, eax
xor edx, ebx
dec edx
xor eax, dword [esp + ecx - 0x46185121]
xor eax, ecx
cmovg ecx, eax
not edx
bswap edx
inc word [esp + eax - 0x2aefffff]
push eax
rol edx, 1
not byte [esp + eax*2 - 0x55dffffc]
xchg word [esp + eax - 0x2aefffff], ax
and eax, 0xfc37899a
bswap edx
jg 0xae213f
mov esi, 0x74399b3a
mov edi, esi
pop edi
mov edx, 0x12023cb9
mov ebx, 0x312da515
pop esi
pop ebx
shl dl, 0xc2
popfd
not edx
push edx
mov edx, dword [esp + 4]
jmp 0x113e1af
bswap ecx
inc edx
call fcn.00b559f0
neg cx
and cl, 0xb7
lea edx, [edx + eax*2 + 0x3f2232ae]
xor dword [esp + eax - 0x28307ffe], ecx
not edx
shl cx, 1
ror ecx, 8
sbb ecx, ecx
neg edx
xor eax, ecx
sub ecx, 0xa4360cbc
sbb eax, eax
sub edx, 0xfc9777a6
shl word [esp + ecx - 0x5bc9f33f], cl
pop eax
xchg word [esp + ecx - 0x5bc9f344], cx
xor ebx, edx
bswap eax
not word [esp + ecx - 0x5bc9b00e]
add edi, edx
movsx edx, byte [esp + ecx - 0x5bc9b00f]
mov eax, ebp
lea ebp, [edx + ebp - 0x48]
call fcn.01020f0e
mov ecx, 0x949dd889
mov ecx, dword [esi]
add esi, 4
mov edx, 0x2ab7b99
xor ecx, ebx
bswap edx
movsx eax, dx
ror eax, 0x7b
not ecx
adc edx, edx
dec ecx
rol eax, 0x65
jb 0xaccca8
neg ebx
dec ebp
lea edx, [esp + ecx*8 + 0x1e0f4e24]
inc ebp
mov eax, edx
inc edx
lea ebx, [ebx + eax*2 - 0x7910ae0e]
bswap ebx
dec esp
lea edx, [ecx*2 - 0x19cb5958]
not ebx
pop ecx
push esi
inc ebp
xor esp, edx
dec ecx
adc eax, 0x132c24a7
push ecx
inc edx
xor dword [esp + eax - 0x289f965f], ebx
jmp fcn.00b4281f
jns 0xfa7db1
jmp 0xb72e3d
movsx ebx, ax
mov ebx, edx
dec eax
adc ax, 0x8624
mov edx, ebx
shl edx, 2
or ax, 0x3628
xadd dword [esp + eax*4 - 0x42d8bc], eax
rol eax, 0x32
mov eax, ebp
jp 0xfb323a
lea esp, [esp + 8]
ret
Function at 0xad17ca
Capabilities:
Encode data using xor

Disassembly:
inc eax
neg ch
inc eax
ror ch, 1
inc esp
xor esp, dword [esp + edx - 0x8901f32]
inc eax
sbb ch, 0x95
inc ecx
shl ebp, 0x78
inc ecx
sar ebp, 0xc4
inc ebp
movzx eax, ch
inc eax
rol ch, 1
call fcn.00fa7c16
sub edx, eax
bswap ecx
xor ebx, ecx
add edi, ecx
add edx, 0xd331d3a1
call fcn.00af17b6
stosb byte es:[edi], al
je 0xad17cb
jnp 0xad1842
mov bl, 0x6d
xor bl, byte [edi + 0x6dcb7804]
xor bl, byte [edi + 0x6df74e58]
xor bl, byte [edi + 0x6dc76c6c]
xor bl, byte [edi - 0x3a8be98e]
pop esp
lahf
xor edx, dword [edi]
invalid
push ebx
sti
test cl, 0x81
push ebx
and al, 0x26
sbb al, 0xcb
push 0xe5449ec4
pop esi
jl 0xad1865
scasd eax, dword es:[edi]
invalid
int 0xab
aam 1
shl dword [ecx - 0x5d3c6f8b], 1
out dx, eax
shr byte [ebx + ebp*4], 0x75
salc
not byte [ebp + 0x72]
loopne 0xad18ce
ficom dword [esi]
invalid
cli
pop eax
push eax
lea eax, [ebx + ecx*2]
sbb dword [edi + 0x63], esp
push 0x588c20b4
push es
dec ebx
cmp dword [esi + 0x66], ebp
cmp byte [esi], dh
mov word [eax + 0x15], fs
fstp dword [esi - 0x3b]
clc
inc eax
cwde
in eax, dx
cli
or al, 0xb
invalid
insb byte es:[edi], dx
movsb byte es:[edi], byte ds:[esi]
or bl, dl
call 0xe85059db
shr dword [esi], cl
test eax, 0x104d6bb3
fidivr word [edi + 0x1e5a8261]
bound ecx, qword [edx]
mov word [esi + 0x40], ss
jp 0xad18a4
push es
test dword [ecx + edi*8 - 0x20aebfcf], 0xebb92ae3
jecxz 0xad1926
outsd dx, dword [esi]
mov eax, dword [0x48426127]
mov al, 0x56
daa
outsb dx, byte [esi]
or byte [esi + 0x1b], cl
in eax, 0x75
xchg ebx, eax
test byte [edi], dl
sal byte [ecx], cl
sahf
mov byte [edi - 0x2c], dl
dec eax
mov dh, 0xae
lds ecx, [ecx - 0x73]
inc esi
sbb eax, 0x105317e8
test ebx, eax
jg 0xad18a6
add dword [edx + 0x7c], esp
or dl, bh
jl 0xad1932
xlatb
sub byte [eax + 0x18cb2140], bh
not edi
test dword [edi], ebp
das
inc eax
or ah, byte [ebx - 0x681dd503]
std
sub esi, dword [ebx*8 + 0x34196139]
scasb al, byte es:[edi]
push esi
jl 0xad1958
push ss
dec esi
inc eax
cdq
imul edx, dword [ebx + 0x31cc6bdf], 0xffffffc5
hlt
or byte [bx + 0x2270], cl
imul eax, dword [eax], 0xffffff8a
mov byte [ecx + 0xe5e15fc], ch
mov ch, 0x65
imul esp, dword es:[esi - 0x21942811], 0x3e
or ebp, dword [edi + edx*4]
test dl, al
jp 0xad19db
call dword [ebp - 0x6c]
invalid
push esp
retf 0x4d