joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001aefd
pop dword [ebp - 0x38]
mov eax, 0x2c1eaaea
add eax, 0xe3e30413
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6385f46c
add dword [ebp - 0x48], 0xeacc50df
mov dword [ebp - 0x44], 0xd0cfb7b1
sub dword [ebp - 0x44], 0x9e9c6b6c
mov dword [ebp - 0x40], 0x3900bd6c
add dword [ebp - 0x40], 0x134b86c2
mov dword [ebp - 0x3c], 0x301f3a3e
add dword [ebp - 0x3c], 0xcfe0c5c2
lea eax, [ebp - 0x48]
push eax
mov eax, 0xa37f7f84
add eax, 0x6c8240fc
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x5ace4a3d
add dword [ebp - 0x48], 0x19a41f19
mov dword [ebp - 0x44], 0x71cfcc95
add dword [ebp - 0x44], 0xcf9c94e0
mov dword [ebp - 0x40], 0xe7e2c95a
add dword [ebp - 0x40], 0x7b8ca312
mov dword [ebp - 0x3c], 0xa5752ec
add dword [ebp - 0x3c], 0xf5a8ad14
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x64b3f142
add eax, 0xab4dcebe
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3366a
push 0
call eax
mov ecx, 0x37e3
xor edi, edi
add edi, eax
mov esi, 0x10026800
add esi, dword [ebp - 0x38]
mov ebx, 0x6dda9910
sub dword [ebp - 0x10], 0x62262ac
mov edx, dword [esi]
xor dword [ebp - 0x30], 0xd5b18301
add edx, ebx
sub dword [ebp - 0x18], 0xa0755c9a
mov dword [edi], edx
add dword [ebp - 0x28], 0x748e7380
add edi, 0x2dd4e092
add edi, 0xd22b1f72
add esi, 0x6f30953e
sub esi, 0x6f30953a
loop 0x1001b00f
add eax, 0x2748e69e
add eax, 0xd8b7ebc1
xor ebx, ebx
add ebx, eax
add eax, 0xd9b86dcc
sub eax, 0xd9b86dc7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1b75160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1b752b0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1b75186
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b75172
add dl, dl
jne 0x1b75191
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b751e4
xor eax, eax
add dl, dl
jne 0x1b7519e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b75285
add dl, dl
jne 0x1b751ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b751b8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b751c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b751ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1b751da
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1b7517d
mov eax, 1
add dl, dl
jne 0x1b751f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b751fd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b751e9
sub eax, ebx
mov ebx, 1
jne 0x1b75230
mov ecx, 1
add dl, dl
jne 0x1b75216
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b75221
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b7520d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7517d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1b75247
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b75252
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b7523e
cmp eax, 0x7d00
jae 0x1b75275
cmp eax, 0x500
jb 0x1b75270
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7517d
cmp eax, 0x7f
ja 0x1b75278
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7517d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1b752a6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1b7517d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.00405b70
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov ebx, eax
shl cl, 4
mov edx, eax
shr ebx, 8
neg edx
and bl, cl
shr edx, 4
mov ecx, eax
shr ecx, 4
xor bl, cl
mov cl, al
shl cl, 2
xor bl, cl
mov cl, al
add cl, cl
and dl, cl
or bl, dl
mov byte [ebp + eax - 0xa1808], bl
inc eax
cmp eax, 0xa17fc
jb 0x403f74
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404eb7
mov esp, ebp
pop ebp
ret
Function at 0x4044f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.00405b70
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 0xd
mov ebx, eax
and dl, al
shr ecx, 6
or dl, cl
shr ebx, 8
mov dword [ebp - 0xa1824], edx
mov edx, eax
shr edx, 9
or dl, bl
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov ecx, dword [ebp - 0xa1824]
and dl, bl
and dl, 0x2e
xor cl, dl
mov byte [ebp + eax - 0xa1808], cl
inc eax
cmp eax, 0xa17fc
jb 0x404574
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa1840], 0xa17fc
mov dword [ebp - 0xa1844], eax
lea eax, [ebp - 0xa1844]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa183c], 0
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1844]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1844]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404eb7
mov esp, ebp
pop ebp
ret
Function at 0x404670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea640
call fcn.00405b70
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
lea eax, [ebp - 0xea61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea61c], 0x10001
push eax
mov dword [ebp - 0xea618], 0x7d00
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov cl, al
shr edx, 3
and dl, 1
shl cl, 5
neg dl
xor dl, cl
mov byte [ebp + eax - 0xea608], dl
inc eax
cmp eax, 0xea600
jb 0x4046f3
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404eb7
mov esp, ebp
pop ebp
ret
Function at 0x4056f0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40572f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40572f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40572f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40572f
cmp dword [ecx + 0x74], 0xe
jbe 0x40572f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10011ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10011baf
pop dword [ebp - 0x28]
mov eax, 0x5befdaa7
sub eax, 0x4beebef8
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x14ae5576
sub dword [ebp - 0x38], 0xc65c102b
mov dword [ebp - 0x34], 0xd4205f17
add dword [ebp - 0x34], 0x5e12ed2e
mov dword [ebp - 0x30], 0x6744585b
add dword [ebp - 0x30], 0xe507ebd3
mov dword [ebp - 0x2c], 0xf352a2d1
add dword [ebp - 0x2c], 0xcad5d2f
lea eax, [ebp - 0x38]
push eax
mov eax, 0x5938fce6
sub eax, 0x4934fcaa
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x85e6a3c1
add dword [ebp - 0x38], 0xee8bc595
mov dword [ebp - 0x34], 0x95b1b163
sub dword [ebp - 0x34], 0x54454fee
mov dword [ebp - 0x30], 0x9e515fe3
sub dword [ebp - 0x30], 0x3ae1f377
mov dword [ebp - 0x2c], 0x2d82f18b
sub dword [ebp - 0x2c], 0x2d82f18b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x765a2df6
sub eax, 0x66562dc6
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x47194
push 0
call eax
mov ecx, 0x493c
xor edx, edx
add edx, eax
mov ebx, 0x4e913585
add ebx, 0xc174387b
add ebx, dword [ebp - 0x28]
mov esi, 0xd8c76f6c
sub esi, 0xd98c2e3a
xor dword [ebp - 0xc], eax
mov edi, dword [ebx]
xor dword [ebp - 0xc], 0x80bbd386
sub edi, esi
xor dword [ebp - 0x1c], edx
mov dword [edx], edi
add dword [ebp - 0x10], 0x236049c4
add edx, 0xae6ce9f2
add edx, 0x51931612
add ebx, 0x48d08838
sub ebx, 0x48d08834
loop 0x10011ccd
add eax, 0x780b6628
add eax, 0x87f5b19b
xor ebx, ebx
add ebx, eax
add eax, 0xfce836e7
add eax, 0x317c91e
mov ecx, 0x9011de3f
add ecx, 0x7fee21c1
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call sym.ahclient.dll_FetchSearchHelpPage
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call sym.ahclient.dll_FetchSearchHelpPage
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call sym.ahclient.dll_FetchSearchHelpPage
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x1861210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x1861282
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.01861180
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x1861230
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x18612f5
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x186129f
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0187be20
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x18612b8
push eax
push 0
push ecx
call fcn.0187be50
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.01861180
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1861300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x1861402
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x18613c9
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x1861350
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.01863610
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x1861350
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x1861401
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.01863610
add esp, 0x10
xor eax, eax
test esi, esi
je 0x1861401
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x18613f2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18636b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.0187c510
add esp, 0xc
test eax, eax
je 0x186371e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x186379f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x186379f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x1863795
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x1863795
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x1863795
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.0187c510
add esp, 0xc
test eax, eax
jne 0x1863795
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x18647b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call fcn.0187be50
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.0187be50
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.0186af00
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.0187c230
mov ecx, dword [esi + 0xba0]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x1c
push esi
call fcn.01874e40
add esp, 0x44
pop esi
test eax, eax
je 0x18648b5
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret