joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c283
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x49c1cc
add ebx, 0
push ecx
call 0x49c1e1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x72e7639e
sub ebx, dword [0x72e95bdd]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x72e95bcd
call fcn.00497cab
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.004971b9
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x49c33f
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x49c33f
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x49c2f6
mov eax, 1
lock xchg dword [0x72e95bd9], eax
push 0x3dd1fc71
call 0x49c283
push esi
add esp, 8
cmp eax, 0
jne 0x49c26c
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x49c292
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x49c2a7
cmp ecx, edx
cmp eax, 0
je 0x49c2cc
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x49c2b6
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.0049c2e5
dec eax
loope 0x49c2e8
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x72e95bd9], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x49c31c
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x49c331
jmp 0x49c33c
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x49c22a

Function at 0x4a33a4
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4a367a
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x72e82851
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x72e79817
push 0xffffffffffffffff
call fcn.0049a5a4
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x4a340e
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.004a3426
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4a366e
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x4a3642
Function at 0x4b2fe8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4b3032
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4b2fd9
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4b2fe8
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x8b8c8b
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4b3039
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.00499eaf
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4b30d8
add edi, 4
add eax, 2
dec ecx
jne 0x4b301e
call 0x4b3085
loope 0x4b307b
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4b30d5
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4b30e6
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4b3099
cmp eax, ecx
ja 0x4b3099
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4b3123
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4b3119
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0049a38e
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x394a1326
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7cb75117
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x6e941820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6e94187b
cmp byte [esi + ebx - 1], 0xa
je 0x6e94184f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6e946084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6e941dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x6e946094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x6e941f90
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x6e946094]
movzx eax, al
bt eax, esi
jae 0x6e941ff0
mov ecx, dword [0x6e946084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x6e941e96
test byte [0x6e943030], 8
jne 0x6e941f30
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x6e943040], 8
jne 0x6e941ee0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6e941e65
cmp esi, 3
jbe 0x6e941ea0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x6e9451a0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x6e941e65
mov ecx, dword [0x6e946094]
test ecx, ecx
je 0x6e941fd0
mov dword [esp], 0x6e943040
call dword [0x6e946094]
test al, 8
je 0x6e941e3c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x6e941e3c
mov ebx, dword [0x6e946094]
test ebx, ebx
je 0x6e941fb0
mov dword [esp], 0x6e943030
call dword [0x6e946094]
test al, 8
je 0x6e941e29
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x6e941e2f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6e946094
call sym._load_func.part.0
jmp 0x6e941df0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6e946094
call sym._load_func.part.0
jmp 0x6e941f3a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6e946094
call sym._load_func.part.0
jmp 0x6e941eee
mov eax, 0xffffffff
jmp 0x6e941e96
Function at 0x4015d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401607
cmp dword [esp + 0x10], 2
jne 0x401607
cmp dword [esp + 4], 6
jb 0x401607
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x401610
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 4]
mov edx, dword [esp + 0x4c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x14], str.runas
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
add esp, 0x3c
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x76226251
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x67db44b4
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4061b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43189c], 0
push esi
jne 0x4061f0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061ca
mov dword [ecx*4 + 0x431898], eax
inc ecx
cmp ecx, 0x100
jl 0x4061c5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406221
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431898]
xor eax, esi
inc ecx
dec edx
jne 0x406203
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x38bf4242
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2e562a8a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4ad01389
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ad33b38]
jne 0x4ad1f325
test ecx, 0xffff0000
jne 0x4ad1f325
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [0x4ad3d6a8], eax
mov dword [0x4ad3d6a4], ecx
mov dword [0x4ad3d6a0], edx
mov dword [0x4ad3d69c], ebx
mov dword [0x4ad3d698], esi
mov dword [0x4ad3d694], edi
mov word [0x4ad3d6c0], ss
mov word [0x4ad3d6b4], cs
mov word [0x4ad3d690], ds
mov word [0x4ad3d68c], es
mov word [0x4ad3d688], fs
mov word [0x4ad3d684], gs
pushfd
pop dword [0x4ad3d6b8]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
add ecx, 4
mov dword [0x4ad3d6bc], ecx
mov dword [0x4ad3d6b0], eax
mov dword [0x4ad3d5f8], 0x10001
lea ecx, [ebp + 4]
mov ecx, dword [ecx - 4]
mov dword [0x4ad3d5b4], eax
mov eax, dword [0x4ad33b38]
mov dword [ebp - 4], eax
mov eax, dword [0x4ad38884]
xor edi, edi
inc edi
mov dword [ebp - 4], eax
push 0
mov dword [0x4ad3d6ac], ecx
mov dword [0x4ad3d5a8], 0xc0000409
mov dword [0x4ad3d5ac], edi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x4ad1f408
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
mov dword [ebp - 0x320], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
leave
ret

Function at 0x4ad01682
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
mov byte [0x4ad2f9f4], 0
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad02386
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [0x4ad2b090]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.4ad016df
mov dword [0x4ad2b090], eax
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret 8

Function at 0x4ad016df
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
xor ebx, ebx
test edi, edi
mov dword [ebp - 4], edi
je 0x4ad01735
push esi
push edi
call fcn.4ad01740
mov esi, eax
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4ad0172b
mov ecx, esi
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4ad01f78
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [0x4ad2b9e0], 0
push ebx
push esi
mov ebx, 0x2000
push ebx
mov esi, 0x4ad2b9e0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad033fa
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
adc dl, byte [esi + 0x1d]
enter 0x1082, 0x24
Function at 0x4ad0225b
Capabilities:
Encrypt data using chaskey

Disassembly:
xor eax, eax
mov ax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x4ad0224c
test byte [esi], 4
mov eax, 0x4ad34446
jne 0x4ad0223c
mov eax, 0x4ad34444
xor ecx, ecx
mov cx, word [edi]
push ecx
push eax
call fcn.4ad015d7
test eax, eax
je 0x4ad022c4
mov eax, 0x100
jmp 0x4ad022dc
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.4ad01d7f
cmp dword [0x4ad3444c], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov word [edi], ax
jne 0x4ad14bc9
mov dx, word [edi]
push ebx
movzx eax, dx
cmp eax, 0x29
push 2
pop ebx
jle 0x4ad022e3
mov ecx, eax
sub ecx, 0x3c
je 0x4ad022fa
sub ecx, ebx
je 0x4ad022fa
sub ecx, ebx
je 0x4ad04e0e
sub ecx, 0x3c
je 0x4ad022fa
mov ax, word [edi]
cmp ax, 0x5e
je 0x4ad0f357
cmp ax, 0x22
je 0x4ad03d17
test byte [esi], 0x23
je 0x4ad0221c
xor eax, eax
mov ax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswdigit]
test eax, eax
pop ecx
jne 0x4ad03382
movzx eax, word [edi]
pop ebx
pop edi
pop esi
pop ebp
ret 8
je 0x4ad02b65
sub eax, 0
je 0x4ad022f7
sub eax, 0xa
jne 0x4ad02b42
and dword [esi], 0xffffffdd
test byte [esi], 0x22
je 0x4ad0224c
jmp 0x4ad022a4
cmp eax, 0x4ad3daa0
ror dword [edx - 0x77], cl
or eax, 0x4ad3dbd9
dec edx
push ds
pop eax
ror byte [ebx + edx*4 + 0x40bc3c], 0x2b
adc eax, 0xa46f1e16
sbb byte [esi + 0x35da8da1], ah
jge 0x4ad0337b
popfd
fist dword [ebp + eax + 0x6728ec9a]
jno 0x4ad03437
xlatb
add edx, dword [edx]
push esi
sbb eax, 0x241082c8
test dword [ecx - 0x4a6d914f], esi
sbb dword [esi], esp
test dword [ecx + 0x310ff3c9], esi
sub al, 0xe8
pushfd
push edx
sub byte [ebp - 0x41], dh
sbb cl, byte [edi + 0x1e]
pop es
ja 0x4ad0344e
sub bh, byte [edi - 0x63]
out dx, eax
and eax, 0x21d69305
mov edi, 0x33979ac3
nop
sub byte [edx - 0x49], bh
mov edx, 0xe89a6ae
aaa
das
test dword [ecx + 0x310ff3c9], esi
leave
rdtsc
sub al, 0x19
int 0x47
invalid
pop eax
and eax, 0xfde0d933
fchs
std
call 0xea9014bc
wait
jb 0x4ad033f8
popal
popal
push ds
sub cl, 0xdd
xchg esp, eax
cmp al, 0x9d
adc byte es:[edi - 0x34], ah
or al, 0x97
inc ebx
ja 0x4ad034de
xor edx, dword [bx]
mov dword [0xd56661a1], eax
je 0x4ad034be
ja 0x4ad034ea
jge 0x4ad0344b
mov dword [ebp - 0x5d8b8c68], ebx
or eax, ebp
nop
xor ch, byte [ebp + 0x48]
ja 0x4ad03492
cdq
lds esi, [esi]
sbb eax, 0xa15f9d35
mov ebx, 0x5c470a7a
jp 0x4ad0349e
inc edi
pop esp
xchg dword [0xebfe1622], edx
pop ebp
xchg esp, eax
popfd
adc byte es:[edi - 0x34], ah
or al, 0x97
inc ebx
ja 0x4ad0351a
int 0x4f
popfd
and eax, 0x2a003a99
sahf
or eax, 0xc22c2c25
dec edx
and eax, 0xddd86404
fcmovb st(0), st(1)
and al, 0x2c
sahf
shl dword [esp + ebp], 0x9e
or eax, 0xea807b52
push ebx
and eax, 0x8d02ac04
les edx, [edx]
push ds
jae 0x4ad0350a
mov ebx, dword [ebp + 0x22d0890]
cmpsd dword [esi], dword es:[edi]
in eax, 0x69
cmp ch, byte [edx + 0x44]
mov al, 0x15
sbb ch, byte [esp + eax*4]
push ebp
and eax, 0xb208c04
jne 0x4ad0355c
jno 0x4ad034a3
mov bh, 0x98
cwde
xchg esp, eax
xor dh, byte [edx]
pushal
push eax
invalid
in al, 0xc5
pushal
invalid
popfd
invalid
invalid
Function at 0x4ad03b73
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad33b38]
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
mov ax, word [0x4ad34440]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad03bf6
cmp eax, 2
je 0x4ad03be7
cmp eax, 5
je 0x4ad03be7
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad177c5
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01389
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad03be9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4ad03bf6
jmp 0x4ad03be7
Function at 0x4ad0469d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad3cb20], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad16411
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad29060
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad16425
cmp dword [ebp + 0x10], ebx
je 0x4ad0472a
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ac]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad04726
cmp dword [ebx], esi
jne 0x4ad04726
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4ad0471f
mov ebx, dword [ebp + 0x14]
jmp 0x4ad04717
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad04720
push ebx
push ebx
push esi
push edi
push 0x1000
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ac]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [ebp + 0xc], esi
sub dword [ebp + 0x10], esi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad04726
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
je 0x4ad046d8
jmp 0x4ad04726

Function at 0x4ad0477c
Capabilities:
Manipulate console buffer
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
je 0x4ad11bfb
pop ebp
jmp fcn.4ad05178
pop ebp
jmp fcn.4ad0bfc7