joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa03ba0
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0xa8a521
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
lea eax, [esp]
push str.debug_dataavailable
push eax
call fcn.00a03d00
add esp, 8
mov ecx, eax
mov dword [esp + 0x428], 0
call fcn.00a15640
push eax
push 1
push 0
push 0
call fcn.00a24110
lea ecx, [esp]
mov dword [0xaf4178], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
lea ecx, [esp]
push str.debug_slotavailable
push ecx
call fcn.00a03d00
add esp, 8
mov ecx, eax
mov dword [esp + 0x428], 1
call fcn.00a15640
push eax
push 1
push 1
push 0
call fcn.00a24110
lea ecx, [esp]
mov dword [0xaf4174], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
lea edx, [esp + 0x210]
push str.debug_data
push edx
call fcn.00a03d00
add esp, 8
mov eax, dword [eax + 8]
mov dword [esp + 0x428], 2
push eax
push 0x268
push 0
push 4
push 0
push 0xffffffffffffffff
call fcn.00a22c00
lea ecx, [esp + 0x210]
mov dword [0xaf417c], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
mov eax, dword [0xaf417c]
test eax, eax
je 0xa03cc1
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0xaf4180], eax
mov eax, dword [0xaf417c]
mov ecx, dword [0xaf4178]
test ecx, ecx
je 0xa03ce2
mov ecx, dword [0xaf4174]
test ecx, ecx
je 0xa03ce2
test eax, eax
je 0xa03ce2
mov eax, dword [0xaf4180]
test eax, eax
jne 0xa03ce7
call fcn.00a03de0
mov ecx, dword [esp + 0x420]
mov dword fs:[0], ecx
add esp, 0x42c
ret
Function at 0xa041b0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8a581
push eax
mov eax, dword [0xaa3448]
mov dword fs:[0], esp
sub esp, 0x420
test eax, eax
jge 0xa0432e
push 0
push 0
push str.TS_DEBUGGED
call fcn.00a202c0
test eax, eax
je 0xa04327
push 0
push str.TS_DEBUGGED
call fcn.00a20410
lea eax, [esp]
push str.debug_dataavailable
push eax
call fcn.00a03d00
add esp, 8
mov ecx, eax
mov dword [esp + 0x428], 0
call fcn.00a15640
push eax
push 0
push 2
call fcn.00a241f0
lea ecx, [esp]
mov dword [0xaf4178], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
lea ecx, [esp]
push str.debug_slotavailable
push ecx
call fcn.00a03d00
add esp, 8
mov ecx, eax
mov dword [esp + 0x428], 1
call fcn.00a15640
push eax
push 0
push 0x100002
call fcn.00a241f0
lea ecx, [esp]
mov dword [0xaf4174], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
lea edx, [esp + 0x210]
push str.debug_data
push edx
call fcn.00a03d00
add esp, 8
mov ecx, eax
mov dword [esp + 0x428], 2
call fcn.00a15640
push eax
push 0
push 6
call fcn.00a22d00
lea ecx, [esp + 0x210]
mov dword [0xaf417c], eax
mov dword [esp + 0x428], 0xffffffff
call fcn.00a155e0
mov eax, dword [0xaf417c]
test eax, eax
je 0xa042fa
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0xaf4180], eax
mov eax, dword [0xaf417c]
mov ecx, dword [0xaf4178]
test ecx, ecx
je 0xa04322
mov ecx, dword [0xaf4174]
test ecx, ecx
je 0xa04322
test eax, eax
je 0xa04322
mov eax, dword [0xaf4180]
test eax, eax
je 0xa04322
mov eax, 1
jmp 0xa04329
call fcn.00a03de0
xor eax, eax
mov dword [0xaa3448], eax
xor ecx, ecx
test eax, eax
setg cl
mov al, cl
mov ecx, dword [esp + 0x420]
mov dword fs:[0], ecx
add esp, 0x42c
ret
Function at 0xa07c40
Capabilities:
Query service status

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
call fcn.00a04af0
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xa07c76
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0xa07c6b
push str.__OpenAsController____0_
push eax
call fcn.00a16060
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 0xc
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.00a06400
test eax, eax
je 0xa07c91
cmp dword [esp + 0x10], 1
jne 0xa07cae
mov eax, dword [esi]
cmp eax, ebx
je 0xa07cda
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0xa07cda
cmp dword [esp + 0x10], 1
je 0xa07cda
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0xa07cc4
push str._Service_already_running_
push eax
call fcn.00a16060
add esp, 8
push 0x420
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 0xc
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x20]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x7d0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00a06370
test eax, eax
jne 0xa07d26
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0xc
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
mov ecx, edi
mov dword [esi + 0x30], 1
call fcn.00a052e0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0xc
Function at 0xa0a320
Capabilities:
Start service

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
push edi
push ebx
call fcn.00a0a270
add esp, 0x14
test al, al
jne 0xa0a355
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
ret

Function at 0xa0a4b0
Capabilities:
Query service status

Disassembly:
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push eax
push esi
push edi
call fcn.00a0a500
add esp, 0xc
test al, al
jne 0xa0a4e9
mov eax, dword [esp + 0xc]
push esi
test eax, eax
push edi
je 0xa0a4de
call eax
pop edi
pop esi
ret 0xc
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
pop edi
pop esi
ret 0xc
mov eax, dword [esp + 0x14]
pop edi
pop esi
ret 0xc
Function at 0xa0f4d0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0xa8ab8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
lea ecx, [esp]
call fcn.00a155c0
lea eax, [esp]
push 0
push eax
push 0x10
mov dword [esp + 0x224], 0
call fcn.00a35890
mov ecx, dword [esp + 0x22c]
add esp, 8
push eax
push ecx
push 0
call fcn.00a24810
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0xa0fc20
Capabilities:
Get file size
Get system information on windows
Read file on windows
Read file via mapping

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
call fcn.00a35860
mov esi, eax
mov dword [esp + 0x1c], esi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
or eax, ecx
je 0xa0fd87
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x60]
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x34]
push 0xc
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0x14]
push 0
push 0
push 0
push 2
add edi, 0xc
push 0
push ebx
adc ebp, 0
call fcn.00a22c00
test eax, eax
mov dword [esp + 0x14], eax
je 0xa0fd87
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x2c]
xor ebx, ebx
lea eax, [ecx - 1]
and ebx, ebp
not eax
mov esi, eax
mov ebp, edi
and esi, edi
sub ebp, esi
add edx, ebp
lea edi, [edx + ecx - 1]
mov ecx, dword [esp + 0x60]
and edi, eax
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, edi
xor ecx, ecx
add edx, esi
mov dword [esp + 0x24], eax
adc ecx, ebx
cmp ecx, dword [esp + 0x28]
jl 0xa0fcf2
jg 0xa0fcee
cmp edx, eax
jbe 0xa0fcf2
sub eax, esi
mov edi, eax
mov edx, dword [esp + 0x14]
push edi
push esi
push ebx
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0xa0fd87
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
lea eax, [esp + 0x20]
push 0
push eax
add esi, ebp
call edi
mov ecx, dword [esp + 0x70]
push eax
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [esp + 0x18]
push 0
push edx
call fcn.00a50c20
mov edi, dword [esp + 0x6c]
add esp, 8
test edi, edi
jne 0xa0fd47
xor eax, eax
jmp 0xa0fd50
push edi
call fcn.00a7e07a
add esp, 4
push eax
push edi
mov ecx, 0xaf4c10
call fcn.00a15a90
mov eax, dword [esp + 0x1c]
push 0
push esi
mov ecx, dword [eax + 0x20]
mov dword [0xaf4768], ecx
mov edx, dword [eax + 0x24]
mov dword [0xaf476c], edx
call fcn.00a50c20
add esp, 8
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x4c
ret
Function at 0xa0fda0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0xa8abeb
push eax
mov eax, 0x1294
mov dword fs:[0], esp
call fcn.00a7e750
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x94]
call fcn.00a155c0
mov ebx, dword [esp + 0x12b4]
mov dword [esp + 0x12ac], 0
test ebx, ebx
je 0xa0fdf0
push ebx
call fcn.00a7e07a
add esp, 4
jmp 0xa0fdf2
xor eax, eax
push eax
push ebx
lea ecx, [esp + 0x9c]
call fcn.00a15880
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
push eax
call esi
push eax
push str..tmp__x_x
lea eax, [esp + 0x20]
push 0x40
push eax
call fcn.00a7f1ff
lea ecx, [esp + 0x28]
add esp, 0x14
test ecx, ecx
je 0xa0fe37
lea edx, [esp + 0x14]
push edx
call fcn.00a7e07a
add esp, 4
jmp 0xa0fe39
xor eax, eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x9c]
call fcn.00a15880
mov ecx, dword [esp + 0x9c]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ecx
call fcn.00a227b0
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
je 0xa0ff2e
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x2a4]
lea edx, [esp + 0x2a4]
push 0x1000
push edx
rep stosd dword es:[edi], eax
call fcn.00a50b20
add esp, 8
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2a4]
push 0
push eax
push 0x1000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov edx, dword [esp + 0x9c]
push ebx
push edx
call fcn.00a1faf0
test eax, eax
jne 0xa0fee1
mov eax, dword [esp + 0x9c]
push eax
call fcn.00a20610
jmp 0xa0ff2e
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebx
call fcn.00a227b0
mov esi, eax
cmp esi, ebp
je 0xa0ff2e
mov ecx, dword [esp + 0x12b8]
push ecx
push esi
call fcn.00a511b0
add esp, 8
test al, al
je 0xa0ff2b
lea ecx, [esp + 0x94]
mov dword [esp + 0x12ac], ebp
call fcn.00a155e0
mov al, 1
jmp 0xa0ff43
push esi
call edi
lea ecx, [esp + 0x94]
mov dword [esp + 0x12ac], ebp
call fcn.00a155e0
xor al, al
mov ecx, dword [esp + 0x12a4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12a0
ret
Function at 0xa0ff60
Capabilities:
Check if file exists
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0xa8ac0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov eax, dword [esp + 0x254]
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x25c]
mov dword [esp + 0x10], ebx
mov byte [eax], bl
push edi
call fcn.00a20610
cmp eax, ebx
jne 0xa0ffe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0xa0ffe6
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
call fcn.00a227b0
mov esi, eax
cmp esi, 0xffffffff
jne 0xa100ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0xa100cf
jmp 0xa100bd
lea ecx, [esp + 0x3c]
call fcn.00a155c0
mov dword [esp + 0x254], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push ebp
push edi
lea ecx, [esp + 0x4c]
push str._ls._ls._x_x
push ecx
call fcn.00a16060
mov edx, dword [esp + 0x5c]
add esp, 0x18
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push edx
call fcn.00a227b0
mov esi, eax
cmp esi, 0xffffffff
je 0xa10132
push 0x10
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x24], 0x82002901
call fcn.00a7e178
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ebx
push ecx
push 0x24
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x44]
push edi
push eax
call fcn.00a1faf0
cmp eax, ebx
je 0xa1009f
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
call fcn.00a227b0
cmp eax, 0xffffffff
jne 0xa10148
jmp 0xa100a9
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00a20610
lea ecx, [esp + 0x3c]
mov dword [esp + 0x254], 0xffffffff
call fcn.00a155e0
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x14
mov dword [esp + 0x10], eax
jb 0xa0ff9c
xor al, al
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x248
ret
lea edx, [esp + 0x14]
push ebx
push edx
lea eax, [esp + 0x20]
push 0x24
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 0x82002901
je 0xa10111
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xa100cf
lea ecx, [esp + 0x1c]
push ebp
push ecx
mov word [esp + 0x42], bx
call fcn.00a886d0
add esp, 8
test eax, eax
jne 0xa10108
mov dword [0xaa49dc], esi
mov al, 1
jmp 0xa100d1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x254], 0xffffffff
call fcn.00a155e0
jmp 0xa100cf
mov edx, dword [esp + 0x264]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x254], 0xffffffff
mov byte [edx], 1
mov dword [0xaa49dc], eax
call fcn.00a155e0
mov al, 1
jmp 0xa100d1
Function at 0xa11df0
Capabilities:
Get file version info

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8ad78
push eax
mov dword fs:[0], esp
sub esp, 0x34
xor edx, edx
push ebx
mov ebx, dword [esp + 0x4c]
push esi
push edi
mov al, byte [ebx]
mov ecx, ebx
test al, al
je 0xa11e2b
cmp al, 0x5c
je 0xa11e21
cmp al, 0x2f
jne 0xa11e23
mov edx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0xa11e19
mov eax, str.uxtheme.dll
mov dword [esp + 0x14], 0xa9ed20
test edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], str.twain.dlltwain_32.dll
mov dword [esp + 0x1c], str.ws2_32.dll
mov dword [esp + 0x20], str.ddraw.dll
mov dword [esp + 0x24], str.dinput.dll
mov dword [esp + 0x28], str.dsound.dll
mov dword [esp + 0x2c], str.wsock32.dll
mov dword [esp + 0x30], 0xa9ecb0
mov dword [esp + 0x34], 0xa9e524
mov dword [esp + 0x38], str.user32.dll
mov dword [esp + 0x3c], 0
mov edi, ebx
je 0xa11e95
lea edi, [edx + 1]
mov ecx, eax
lea esi, [esp + 0x10]
test ecx, ecx
je 0xa11ebb
push edi
push eax
call fcn.009e37e0
add esp, 8
test eax, eax
je 0xa11f46
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0xa11e9f
push edi
push str.shlwapi.dll
call fcn.009e37e0
add esp, 8
test eax, eax
jne 0xa11f67
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0xa11f46
push edi
call fcn.009ef3b0
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0xa11f01
mov dword [esp + 0x48], 0xffffffff
jmp 0xa11f39
lea edx, [esp + 0xc]
lea eax, [esp + 0x54]
push edx
push eax
push 0xa9ec94
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0xa11f24
mov dword [esp + 0x48], 0xffffffff
jmp 0xa11f39
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x48], 0xffffffff
cmp dword [ecx + 8], 0x40048
ja 0xa11f5a
test esi, esi
je 0xa11f46
push esi
call fcn.009ef440
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
test esi, esi
je 0xa11f67
push esi
call fcn.009ef440
add esp, 4
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0xa13800
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
xor esi, esi
push edi
xor bl, bl
mov edi, ecx
mov dword [eax], esi
xor ebp, ebp
mov ecx, dword [esp + 0x14]
mov dx, word [ecx]
push edx
call fcn.00a7ede6
mov edx, dword [edi + 4]
lea ecx, [esi + esi*4]
add esp, 4
lea ecx, [edx + ecx*2]
mov dx, word [ecx]
cmp ax, dx
jae 0xa1383f
xor esi, esi
mov si, word [ecx + 2]
test esi, esi
je 0xa138b7
jmp 0xa13812
jbe 0xa1384d
xor esi, esi
mov si, word [ecx + 4]
test esi, esi
je 0xa138b7
jmp 0xa13812
mov ax, word [ecx + 8]
inc ebp
test ax, ax
je 0xa1388b
mov edx, dword [edi + 0x14]
and eax, 0xffff
mov bl, 1
mov eax, dword [edx + eax*8 - 8]
mov edx, dword [esp + 0x20]
mov dword [edx], eax
mov edx, dword [edi + 0x14]
xor eax, eax
mov ax, word [ecx + 8]
mov eax, dword [edx + eax*8 - 4]
mov edx, dword [esp + 0x24]
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], ebp
cmp word [ecx + 6], 0
je 0xa138ae
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
dec eax
add esi, 2
test eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
je 0xa138b7
xor esi, esi
mov si, word [ecx + 6]
jmp 0xa13812
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret 0x14
Function at 0xa17c40
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 8]
push str._d.themm
push eax
call fcn.009e3530
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x8780
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.009e3750
push 0
push 0
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x80
mov dword [0xaf46c4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0xaf46c4]
push eax
add ecx, 0x100
push ecx
call fcn.009e3880
add esp, 0xc
pop esi
pop ecx
ret

Function at 0xa17ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x10
push 1
push esi
xor edi, edi
call fcn.00a23120
test eax, eax
je 0xa17f41
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0xa17f41
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0xa17f41
lea esi, [eax + 0xc]
push esi
call fcn.00a7e07a
lea eax, [esi + eax*2 + 5]
add esp, 4
and al, 0xfc
cmp dword [eax], 0xfeef04bd
jne 0xa17f41
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
pop edi
pop esi
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
mov eax, 1
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0xa180c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b04e
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
push str.kernel32
call fcn.00a222a0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0xa181ec
lea eax, [esp + 0x1c]
mov ebp, 1
push eax
mov dword [esp + 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0xa18120
cmp dword [esp + 0x2c], ebp
je 0xa1811e
cmp dword [esp + 0x20], 4
jae 0xa18120
xor ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddRefActCtx
push esi
call edi
cmp eax, ebx
mov dword [0xaf472c], eax
jne 0xa18148
cmp ebp, ebx
je 0xa18148
push str._SxS:_Failed_to_get_address_of_AddRefActCtx
call fcn.009fe320
add esp, 4
push str.ActivateActCtx
push esi
call edi
cmp eax, ebx
mov dword [0xaf4730], eax
jne 0xa1816a
cmp ebp, ebx
je 0xa1816a
push str._SxS:_Failed_to_get_address_of_ActivateActCtx
call fcn.009fe320
add esp, 4
push str.CreateActCtxW
push esi
call edi
cmp eax, ebx
mov dword [0xaf4734], eax
jne 0xa1818c
cmp ebp, ebx
je 0xa1818c
push str._SxS:_Failed_to_get_address_of_CreateActCtxW
call fcn.009fe320
add esp, 4
push str.DeactivateActCtx
push esi
call edi
cmp eax, ebx
mov dword [0xaf4738], eax
jne 0xa181ae
cmp ebp, ebx
je 0xa181ae
push str._SxS:_Failed_to_get_address_of_DeactivateActCtx
call fcn.009fe320
add esp, 4
push str.QueryActCtxW
push esi
call edi
cmp eax, ebx
mov dword [0xaf473c], eax
jne 0xa181d0
cmp ebp, ebx
je 0xa181d0
push str._SxS:_Failed_to_get_address_of_QueryActCtxW
call fcn.009fe320
add esp, 4
push str.ReleaseActCtx
push esi
call edi
cmp eax, ebx
mov dword [0xaf4740], eax
jne 0xa181f9
cmp ebp, ebx
je 0xa181f9
push str._SxS:_Failed_to_get_address_of_ReleaseActCtx
jmp 0xa181f1
push str.SxS:_Failed_to_get_kernel32_handle
call fcn.009fe320
add esp, 4
push 0x10
call fcn.009ef380
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
mov dword [esp + 0xb8], ebx
je 0xa182ac
mov cl, byte [esp + 0x13]
mov dl, byte [esp + 0x13]
push 0x18
mov byte [esi], cl
mov byte [esi + 1], dl
mov byte [esi + 8], bl
call fcn.009ef380
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.00a7d900
cmp dword [0xab5360], ebx
jne 0xa18263
mov dword [0xab5360], edi
mov dword [edi], ebx
mov eax, dword [0xab5360]
xor ebp, ebp
mov dword [eax + 8], ebx
mov ecx, dword [0xab535c]
inc ecx
mov dword [0xab535c], ecx
lea ecx, [esp + 0x14]
call fcn.00a7d99c
cmp ebp, ebx
je 0xa18286
push ebp
call fcn.00a7d8f0
add esp, 4
mov edi, dword [0xab5360]
push 0x18
call fcn.009ef380
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
jmp 0xa182ae
xor esi, esi
push 0xaf46f8
mov dword [0xaf46c8], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret
Function at 0xa1faf0
Capabilities:
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b5fb
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x20c
test al, al
je 0xa1fb41
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
test esi, esi
jne 0xa1fb63
mov dword [esp + 0x218], 0
jmp 0xa1fbd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebp, eax
call fcn.00a7e07a
mov edi, eax
add esp, 4
cmp edi, 0xff
jg 0xa1fbac
push 0
push 0
lea edx, [esp + 0x120]
push 0x100
push edx
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
test eax, eax
je 0xa1fbac
lea eax, [esp + 0x118]
mov dword [esp + 0x218], eax
jmp 0xa1fbcf
lea edi, [edi + edi*2 + 3]
push edi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x218], eax
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x22c]
mov ecx, dword [esp + 0x218]
xor eax, eax
mov dword [esp + 0x10], ecx
cmp edi, eax
mov dword [esp + 0x224], eax
jne 0xa1fbfe
mov dword [esp + 0x114], eax
jmp 0xa1fc6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa1fc41
push 0
push 0
lea edx, [esp + 0x1c]
push 0x100
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa1fc41
lea eax, [esp + 0x14]
mov dword [esp + 0x114], eax
jmp 0xa1fc64
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x114], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
mov eax, dword [esp + 0x114]
test eax, eax
je 0xa1fc9c
lea ecx, [esp + 0x14]
cmp eax, ecx
je 0xa1fc9c
push eax
call fcn.00a1fd20
add esp, 4
mov eax, dword [esp + 0x218]
mov dword [esp + 0x224], 0xffffffff
test eax, eax
je 0xa1fcc6
lea edx, [esp + 0x118]
cmp eax, edx
je 0xa1fcc6
push eax
call fcn.00a1fd20
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret 8