joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa2d6e0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esi + 0x10]
movzx ecx, word [eax + 6]
mov edx, dword [eax + 0x54]
push ebx
lea ecx, [ecx + ecx*4]
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
call fcn.00a81c00
mov edx, dword [esi + 0x10]
xor eax, eax
add esp, 0xc
xor ebx, ebx
cmp ax, word [edx + 6]
jae 0xa2d74d
push edi
xor edi, edi
mov ecx, dword [esi + 0x14]
lea eax, [ecx + edi]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xa2d73d
mov edx, dword [eax + 0x10]
test edx, edx
je 0xa2d73d
push edx
mov edx, dword [eax + 0x14]
add edx, dword [esp + 0x18]
add ecx, ebp
push edx
push ecx
call fcn.00a81c00
add esp, 0xc
mov eax, dword [esi + 0x10]
movzx ecx, word [eax + 6]
inc ebx
add edi, 0x28
cmp ebx, ecx
jl 0xa2d715
pop edi
mov dword [esi + 0xc], ebp
mov edx, dword [ebp + 0x3c]
lea eax, [edx + ebp]
mov dword [esi + 0x10], eax
add eax, 0xf8
pop ebp
mov dword [esi + 0x14], eax
pop ebx
ret 8

Function at 0xa2ea10
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ecx
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 0x10]
push esi
je 0xa2eaea
test ebp, ebp
je 0xa2eaea
call fcn.00a2e970
test al, al
je 0xa2eaea
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [esp + 0x1c], eax
xor esi, esi
lea ecx, [ecx]
test eax, eax
ja 0xa2ea7b
mov ecx, dword [0xafce94]
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push ecx
call edi
push 0x3e8
call ebx
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, 0x14
jl 0xa2ea50
pop edi
pop ebx
test eax, eax
je 0xa2eaea
push eax
call fcn.00a76ab6
mov esi, eax
add esp, 4
test esi, esi
je 0xa2eaea
mov edx, dword [esp + 0x14]
push edx
push 0
push esi
call fcn.00a827a0
mov ecx, dword [esp + 0x20]
mov edx, dword [0xafce94]
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xa2eae1
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x14]
jne 0xa2eae1
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
mov dword [ebp], eax
pop esi
mov al, 1
pop ebp
pop ecx
ret 8
push esi
call fcn.00a7b356
add esp, 4
mov eax, dword [0xafce94]
cmp eax, 0xffffffff
je 0xa2eb05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0xafce94], 0xffffffff
pop esi
xor al, al
pop ebp
pop ecx
ret 8

Function at 0xa2eb10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0xafce94]
mov dword [esp + 4], 1
cmp eax, 0xffffffff
je 0xa2eb75
push esi
push 0
lea ecx, [esp + 8]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov eax, dword [0xafce94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov dword [0xafce94], 0xffffffff
pop esi
je 0xa2eb6f
cmp dword [esp], 4
jne 0xa2eb6f
mov eax, 1
add esp, 8
ret
xor eax, eax
add esp, 8
ret
xor al, al
add esp, 8
ret
Function at 0xa33270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xad2bc1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ebx, 7
xor edi, edi
xor eax, eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], edi
mov word [esi + 0x1c], ax
mov dword [esp + 0x1c], edi
xor ecx, ecx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], edi
mov word [esi + 0x38], cx
xor edx, edx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], edi
mov word [esi + 0x54], dx
lea eax, [esi + 0x8c]
push eax
mov byte [esp + 0x20], 2
call fcn.00a13960
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xb8], edi
xor ecx, ecx
mov word [esi + 0xa8], cx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xdc], edi
xor edx, edx
mov word [esi + 0xcc], dx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0xf8], edi
xor eax, eax
mov word [esi + 0xe8], ax
mov dword [esi + 0x118], ebx
mov dword [esi + 0x114], edi
mov word [esi + 0x104], cx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x130], edi
mov word [esi + 0x120], dx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x14c], edi
mov word [esi + 0x13c], ax
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x168], edi
mov word [esi + 0x158], cx
mov dword [esi + 0x188], ebx
mov dword [esi + 0x184], edi
mov word [esi + 0x174], dx
mov dword [esi + 0x1a4], ebx
mov dword [esi + 0x1a0], edi
mov word [esi + 0x190], ax
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c0], edi
mov word [esi + 0x1b0], cx
mov eax, 1
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], edi
mov dword [esi + 0xc], 0x3e8
mov dword [esi + 0x10], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0xa37440
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xad185b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00a13960
lea eax, [esi + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.00a13960
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00a13960
lea edx, [esi + 0x48]
push edx
mov byte [esp + 0x18], 2
call fcn.00a13960
lea eax, [esi + 0x60]
push eax
mov byte [esp + 0x18], 3
call fcn.00a13960
lea ecx, [esi + 0x78]
push ecx
mov byte [esp + 0x18], 4
call fcn.00a13960
lea edx, [esi + 0x90]
push edx
mov byte [esp + 0x18], 5
call fcn.00a13960
lea eax, [esi + 0xa8]
push eax
mov byte [esp + 0x18], 6
call fcn.00a13960
lea ecx, [esi + 0xc0]
push ecx
mov byte [esp + 0x18], 7
call fcn.00a13960
lea edx, [esi + 0xe8]
push edx
mov byte [esp + 0x18], 8
call fcn.00a13960
lea eax, [esi + 0x100]
push eax
mov byte [esp + 0x18], 9
call fcn.00a13960
lea ecx, [esi + 0x118]
push ecx
mov byte [esp + 0x18], 0xa
call fcn.00a13960
lea edx, [esi + 0x130]
push edx
mov byte [esp + 0x18], 0xb
call fcn.00a13960
lea eax, [esi + 0x148]
push eax
mov byte [esp + 0x18], 0xc
call fcn.00a13960
lea ecx, [esi + 0x160]
push ecx
mov byte [esp + 0x18], 0xd
call fcn.00a13960
lea edx, [esi + 0x178]
push edx
mov byte [esp + 0x18], 0xe
call fcn.00a13960
mov byte [esp + 0x14], 0xf
lea eax, [esi + 0x190]
push eax
call fcn.00a13960
mov dword [esi + 0x1bc], ebx
mov eax, 0xf
mov dword [esi + 0x1c0], eax
mov byte [esi + 0x1ac], bl
mov dword [esi + 0x1e8], eax
mov dword [esi + 0x1e4], ebx
mov byte [esi + 0x1d4], bl
mov dword [esi + 0x1c8], 1
mov byte [esi + 0x1c4], bl
mov dword [esi + 0x1cc], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0xa3bd80
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0xad4876
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0xaf97a0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
mov edi, ecx
lea ecx, [esp + 0x52]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov word [esp + 0x58], ax
call fcn.00a827a0
add esp, 0xc
push 1
push 0x23
lea edx, [esp + 0x54]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LocalAppData
lea eax, [esp + 0x50]
push 0x104
push eax
call fcn.00a7a994
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0xa3be20
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x38]
call fcn.00a11c90
push 1
push 0xae5acc
lea esi, [esp + 0x38]
mov dword [esp + 0x268], ebx
call fcn.00a1b430
call fcn.00a36c20
lea esi, [esp + 0x14]
call fcn.00a3f0e0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x26c], 1
call fcn.00a1b770
mov byte [esp + 0x260], bl
cmp dword [esp + 0x2c], 8
jb 0xa3be93
mov eax, dword [esp + 0x18]
push eax
call fcn.00a7ac28
add esp, 4
push 7
push str.kit.dt
lea esi, [esp + 0x38]
call fcn.00a1b430
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00a11910
call fcn.00a132c0
add esp, 0x1c
cmp dword [esp + 0x48], 8
jb 0xa3bee3
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00a7ac28
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00a7a967
add esp, 0x254
ret
Function at 0xa3d170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xad03fe
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ecx
mov byte [esi + 4], cl
mov dword [esp + 0x14], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
mov byte [esi + 0x20], cl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ecx
mov byte [esi + 0x3c], cl
mov eax, edi
mov byte [esp + 0x14], 2
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0xa3d1c6
sub eax, ebx
push eax
push edi
mov ecx, esi
call fcn.00a111b0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0xa3d7c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xad3337
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0xaec36c
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00a1fe10
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00a21d00
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0xafcfe0]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0xa3f140
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0xa3f1d7
test ebp, ebp
je 0xa3f1d7
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xa3f160
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.00a76ab6
mov esi, eax
add esp, 4
test esi, esi
je 0xa3f1d2
push edi
push 0
push esi
call fcn.00a827a0
push esi
push ebp
mov eax, ebx
call fcn.00a11e10
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0xa3f1ab
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0xa3f1a3
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov bl, 1
call fcn.00a7b356
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0xa3f330
Capabilities:
Create thread
Terminate thread

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00a2ea10
test al, al
je 0xa3f433
push ebp
mov ebp, dword [esp + 4]
test ebp, ebp
je 0xa3f432
call fcn.00a2eb10
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xa3f371
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 1]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00a76ab6
mov edi, eax
add esp, 4
test edi, edi
je 0xa3f430
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.00a827a0
push edi
push ebp
call fcn.00a3f140
add esp, 0x14
call fcn.00a36c20
mov ecx, eax
call fcn.00a2ef60
test al, al
je 0xa3f421
call fcn.00a3d690
call fcn.00a3bf10
test al, al
je 0xa3f421
push 0
push 0
push 0
push 0xa3f1e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0xa3f421
call fcn.00a36c20
mov eax, dword [eax + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xa3f41a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00a7b356
push ebp
call fcn.00a7b356
add esp, 8
pop edi
pop esi
pop ebp
call fcn.00a36c20
mov eax, dword [eax + 0x3c]
cmp eax, 0x64
jl 0xa3f445
mov eax, 0x63
add esp, 8
ret 0x10
Function at 0xa422e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0xad2529
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0xaf97a0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x70]
xor ebx, ebx
mov dword [esp + 0x3c], ebp
mov edi, ecx
mov dword [esp + 0x38], ebx
mov esi, 1
push ebp
mov dword [esp + 0x6c], esi
call fcn.00a13960
mov dword [esp + 0x38], esi
cmp edi, ebx
je 0xa42486
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa42342
sub eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x88], eax
jb 0xa42486
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.00a11650
mov byte [esp + 0x68], 2
cmp dword [esp + 0x54], ebx
jbe 0xa42472
lea esp, [esp]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa42395
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x48]
push ecx
xor eax, eax
call fcn.00a12db0
mov esi, eax
cmp esi, ebx
jge 0xa423bd
cmp dword [esp + 0x54], ebx
ja 0xa42390
jmp 0xa42472
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0xa423cc
lea eax, [esp + 0x44]
push esi
mov edi, 0xf
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00a111b0
lea edx, [esp + 0x1c]
push edx
mov ebx, ebp
mov byte [esp + 0x6c], 3
call fcn.00a28440
mov byte [esp + 0x68], 2
cmp dword [esp + 0x34], 0x10
jb 0xa42412
mov eax, dword [esp + 0x20]
push eax
call fcn.00a7ac28
add esp, 4
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
add esi, ecx
push esi
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00a11650
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 4
call fcn.00a11650
mov byte [esp + 0x68], 2
cmp dword [esp + 0x34], 0x10
jb 0xa42466
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00a7ac28
add esp, 4
lea edx, [esp + 0x40]
push edx
mov ebx, ebp
call fcn.00a28440
cmp dword [esp + 0x58], 0x10
jb 0xa42486
mov eax, dword [esp + 0x44]
push eax
call fcn.00a7ac28
add esp, 4
cmp dword [esp + 0x8c], 0x10
jb 0xa4249d
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00a7ac28
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00a7a967
add esp, 0x58
ret
Function at 0xa42ae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xad03b6
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.CChildPage.0
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], ebx
mov word [esi + 0xc], ax
lea ecx, [esi + 0x48]
push ecx
mov dword [esp + 0x18], ebx
call fcn.00a13960
lea edx, [esi + 0x60]
push edx
mov byte [esp + 0x18], 1
call fcn.00a13960
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0x2710
mov dword [esi + 0x40], 0x3a98
mov dword [esi + 0x44], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x78], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0xa436f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push ebp
lea ebp, [ecx + 0x60]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x14], ecx
cmp esi, dword [ebp + 0x10]
jbe 0xa43711
call fcn.00a7c884
mov eax, dword [ebp]
mov dword [esp + 0x18], eax
xor ebx, ebx
lea ebx, [ebx]
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], edi
jbe 0xa4372d
call fcn.00a7c884
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp]
cmp ecx, ebx
je 0xa4373c
cmp ecx, eax
je 0xa43741
call fcn.00a7c884
cmp esi, edi
je 0xa437f6
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0xa437eb
call fcn.00a7c884
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0xa43766
call fcn.00a7c884
mov edi, dword [esi]
cmp edi, ebx
je 0xa437ca
mov eax, dword [edi + 8]
mov byte [edi + 0x2c], bl
cmp eax, ebx
je 0xa4377d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0xa437af
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xa437a2
mov ecx, dword [edi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], ebx
mov eax, dword [edi + 8]
cmp eax, ebx
je 0xa437c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0xa437f2
call fcn.00a7c884
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0xa437e3
call fcn.00a7c884
add esi, 4
jmp 0xa43720
mov eax, dword [eax]
jmp 0xa4375c
mov eax, dword [eax]
jmp 0xa437d9
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], esi
jbe 0xa43803
call fcn.00a7c884
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp]
cmp edi, dword [ebp + 0x10]
jbe 0xa43813
call fcn.00a7c884
mov eax, dword [ebp]
push esi
push ebx
push edi
push eax
lea ebx, [esp + 0x28]
mov esi, ebp
call fcn.00a2c7e0
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x58]
add esi, 0x48
cmp dword [esi + 0xc], edi
jbe 0xa43839
call fcn.00a7c884
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0xa43848
call fcn.00a7c884
mov eax, dword [esi]
push edi
push ebp
push ebx
push eax
lea ebx, [esp + 0x28]
call fcn.00a2c7e0
mov edi, dword [esp + 0x14]
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
push eax
call esi
mov eax, dword [edi + 0x24]
push eax
call esi
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xa442a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0xad6490
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xaf97a0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
xor ebp, ebp
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x64], ebp
jbe 0xa44462
push 0xaeb938
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x78]
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebp
push edx
mov word [ecx + 4], ax
call fcn.00a11910
lea ecx, [esp + 0x44]
call fcn.00a43bc0
mov byte [esp + 0x48], 1
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0xa44427
mov dword [esp + 0x18], ebp
push 0x9c
call fcn.00a7acb0
add esp, 4
test eax, eax
je 0xa4435b
mov esi, eax
call fcn.00a45770
mov esi, eax
jmp 0xa4435d
xor esi, esi
mov dword [esp + 0x1c], esi
test esi, esi
je 0xa443fa
mov ecx, dword [ebx + 4]
mov dword [esi + 0x38], ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov dword [esi + 0x34], eax
mov ecx, dword [ebx + 0x70]
sub ecx, dword [ebx + 0x6c]
lea edi, [ebx + 0x60]
sar ecx, 2
push ecx
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x34]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0xa443aa
call fcn.00a7c884
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
sub esp, 0x1c
lea eax, [ecx + edx]
mov ecx, esp
mov dword [esp + 0x5c], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov word [ecx + 4], dx
call fcn.00a11910
push esi
call fcn.00a45890
lea ebx, [esp + 0x1c]
call fcn.00a45280
cmp byte [esp + 0x6c], 0
jne 0xa443f6
call fcn.00a14aa0
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
add dword [esp + 0x18], 0x1c
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
cmp ebp, eax
jb 0xa4433f
xor ebp, ebp
cmp esi, ebp
je 0xa44449
mov ecx, dword [esp + 0x3c]
push ecx
mov eax, esi
call fcn.00a145e0
mov edx, dword [esp + 0x34]
add esp, 4
push edx
call fcn.00a7ac28
add esp, 4
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
call fcn.00a7ac28
add esp, 4
cmp byte [esp + 0x6c], 0
je 0xa4449c
mov ecx, dword [ebx + 0x24]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0xa4449c
mov edx, dword [ebx + 0x24]
push 0x2711
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebx + 0x24]
push 0
push 0x3e8
push 0x2712
push eax
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [esp + 0x68], 8
jb 0xa444b0
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00a7ac28
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x20