joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa22dd0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b88b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x110
test al, al
je 0xa22e21
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret 8
push esi
push edi
lea ecx, [esp + 8]
call fcn.00a16c20
mov edi, dword [esp + 0x128]
lea ecx, [esp + 8]
push edi
mov dword [esp + 0x124], 0
call fcn.00a17310
mov edx, dword [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
test esi, esi
je 0xa22e75
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x10]
push edi
push eax
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.00a16c40
mov ecx, dword [esp + 0x118]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0xa22fe0
Capabilities:
Get common file path

Disassembly:
mov al, byte [0xaf474d]
test al, al
je 0xa22ffc
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
ret 8
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.009ef380
add esp, 4
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, eax
lea eax, [ebx + 1]
cmp esi, eax
jae 0xa23021
mov eax, esi
mov edx, dword [esp + 0x10]
push esi
push edx
push eax
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
call fcn.00a7d8f0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret 8

Function at 0xa23270
Capabilities:
Get geographical location

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa232ae
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
push eax
mov eax, dword [esp + 0x10c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add esp, 0x104
ret 0x10
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
cmp esi, 0x100
jae 0xa232c6
lea eax, [esp + 0xc]
jmp 0xa232d7
test esi, esi
je 0xa232d5
push esi
call fcn.00a1fcf0
add esp, 4
jmp 0xa232d7
xor eax, eax
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push esi
push eax
push ecx
push edx
mov dword [esp + 0x11c], eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
test ebp, ebp
je 0xa23324
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0x120]
push esi
push eax
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
mov eax, dword [esp + 0x10c]
test eax, eax
je 0xa23340
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0xa23340
push eax
call fcn.00a1fd20
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x104
ret 0x10
Function at 0xa23d80
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8ba4b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x110
test al, al
je 0xa23dd9
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x120]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret 0xc
push ebx
mov ebx, dword [esp + 0x12c]
push esi
push edi
lea edi, [ebx + 1]
push edi
call fcn.009ef380
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 0xc]
push eax
call fcn.00a16830
push edi
push esi
mov ecx, eax
mov dword [esp + 0x12c], 0
call fcn.00a16d90
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 0xc]
mov edi, eax
mov dword [esp + 0x124], 0xffffffff
call fcn.00a16c40
lea eax, [edi + 1]
cmp ebx, eax
jae 0xa23e3c
mov eax, ebx
mov ecx, dword [esp + 0x130]
push ebx
push ecx
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call fcn.00a7d8f0
mov ecx, dword [esp + 0x120]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x11c
ret 0xc

Function at 0xa23e80
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8ba6b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x114
test al, al
je 0xa23ed1
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
add esp, 0x120
ret 8
push esi
mov esi, dword [esp + 0x12c]
push edi
lea ecx, [esp + 0xc]
mov edx, dword [esi]
mov dword [esp + 8], edx
call fcn.00a16c20
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x128], 0
call fcn.00a17310
lea ecx, [esp + 8]
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edi, eax
test edi, edi
je 0xa23f35
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x14]
push eax
push ecx
push eax
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x124], 0xffffffff
call fcn.00a16c40
mov ecx, dword [esp + 0x11c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 8
Function at 0xa245d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8bb61
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x330
test al, al
je 0xa24631
mov eax, dword [esp + 0x34c]
mov ecx, dword [esp + 0x348]
mov edx, dword [esp + 0x344]
push eax
mov eax, dword [esp + 0x344]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x330]
mov dword fs:[0], ecx
add esp, 0x33c
ret 0x10
mov ecx, dword [esp + 0x34c]
push ebp
push esi
push edi
push ecx
lea ecx, [esp + 0x230]
call fcn.00a16830
mov esi, eax
mov edx, dword [esp + 0x350]
lea ecx, [esp + 0xc]
push edx
mov dword [esp + 0x348], 0
call fcn.00a16830
mov edi, eax
mov eax, dword [esp + 0x34c]
lea ecx, [esp + 0x11c]
push eax
mov byte [esp + 0x348], 1
call fcn.00a16830
mov ebp, eax
mov ecx, esi
mov byte [esp + 0x344], 2
call fcn.00a16d90
mov ecx, dword [esp + 0x354]
push eax
push ecx
mov ecx, edi
call fcn.00a16d90
push eax
mov ecx, ebp
call fcn.00a16d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x11c]
mov esi, eax
mov byte [esp + 0x344], 1
call fcn.00a16c40
lea ecx, [esp + 0xc]
mov byte [esp + 0x344], 0
call fcn.00a16c40
lea ecx, [esp + 0x22c]
mov dword [esp + 0x344], 0xffffffff
call fcn.00a16c40
mov ecx, dword [esp + 0x33c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x33c
ret 0x10

Function at 0xa24920
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8bbbb
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x110
test al, al
je 0xa24969
mov eax, dword [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
add esp, 0x11c
ret 4
mov ecx, dword [esp + 0x120]
push esi
push ecx
lea ecx, [esp + 8]
call fcn.00a16830
mov ecx, eax
mov dword [esp + 0x11c], 0
call fcn.00a16d90
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x11c], 0xffffffff
call fcn.00a16c40
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 4
Function at 0xa28320
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push eax
push esi
push edi
call fcn.00a282c0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
test al, al
jne 0xa2835c
test ebx, ebx
push esi
push edi
je 0xa28350
call ebx
mov dword [esp + 0x18], eax
jmp 0xa28360
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
test ebx, ebx
je 0xa28386
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0x15
test dl, 1
je 0xa28386
push eax
push str.GetFileSize_hFile0x_x____0x_x_n
call fcn.009fe320
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
pop esi
pop ebx
ret 0xc
Function at 0xa2a950
Capabilities:
Read file on windows

Disassembly:
mov al, byte [0xaf4e3c]
sub esp, 0xc
test al, al
push ebx
push ebp
push esi
push edi
jne 0xa2a96a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
mov edi, dword [esp + 0x20]
push edi
call fcn.00a29e30
mov esi, eax
add esp, 4
test esi, esi
jne 0xa2a987
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
cmp dword [esi], 1
je 0xa2a99f
push esi
call fcn.00a24da0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x30]
mov byte [esp + 0x13], 0
test ebp, ebp
je 0xa2a9d9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0xa2a9b8
mov byte [esp + 0x13], 1
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push esi
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push edi
call fcn.00a29f10
add esp, 0x18
mov eax, dword [esi + 0x270]
test eax, eax
jne 0xa2aa9b
mov edi, dword [esp + 0x28]
mov ebx, dword [esi + 0x288]
mov ebp, dword [esi + 0x25c]
mov edx, dword [esi + 0x258]
mov ecx, edi
xor eax, eax
add ecx, ebx
mov ebx, dword [esi + 0x28c]
adc eax, ebx
cmp eax, ebp
jl 0xa2aa56
jg 0xa2aa15
cmp ecx, edx
jbe 0xa2aa56
cmp ebx, ebp
jl 0xa2aa4e
jg 0xa2aa23
cmp dword [esi + 0x288], edx
jbe 0xa2aa4e
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
test eax, eax
mov dword [ecx], 1
je 0xa2aa3b
mov dword [eax], 0
push esi
call fcn.00a24da0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
sub edx, dword [esi + 0x288]
mov edi, edx
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
push 0
push ebx
push edi
push edx
push eax
test ebp, ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
mov edx, dword [ebx]
mov ecx, dword [esi + 0x288]
add ecx, edx
mov dword [esi + 0x288], ecx
mov eax, dword [esi + 0x28c]
adc eax, 0
mov dword [esi + 0x28c], eax
jmp 0xa2aabc
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push eax
push ecx
push edx
push edi
push esi
call fcn.00a2a4f0
mov ecx, dword [esp + 0x4c]
add esp, 0x18
mov dword [ecx], eax
push esi
call fcn.00a24da0
mov al, byte [esp + 0x17]
add esp, 4
test al, al
je 0xa2aad7
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
Function at 0xa2aaf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0x54]
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
push esi
mov esi, dword [esp + 0x5c]
push edi
mov edi, dword [esp + 0x64]
push eax
push edi
push esi
push ecx
push ebx
push edx
call fcn.00a2a950
mov ebp, dword [esp + 0x68]
add esp, 0x18
test al, al
jne 0xa2ab59
test ebp, ebp
push edi
push esi
je 0xa2ab3e
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
push eax
push ebx
push ecx
call ebp
mov dword [esp + 0x64], eax
jmp 0xa2ab5d
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x5c]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x18
mov eax, dword [esp + 0x64]
test ebp, ebp
je 0xa2abd0
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0x15
test dl, 1
je 0xa2abd0
test eax, eax
je 0xa2abae
mov esi, dword [esi]
mov edi, 0x3b
cmp esi, edi
jae 0xa2ab82
mov edi, esi
test edi, edi
jle 0xa2aba9
lea esi, [esp + 0x10]
mov ecx, ebx
sub esi, ebx
mov ebp, edi
mov dl, byte [ecx]
cmp dl, 0x21
jl 0xa2aba1
cmp dl, 0x7e
jge 0xa2aba1
mov byte [esi + ecx], dl
jmp 0xa2aba5
mov byte [esi + ecx], 0x2e
inc ecx
dec ebp
jne 0xa2ab90
mov byte [esp + edi + 0x10], 0
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push edx
push str.ReadFile_h_x_lpBuffer_x___s__sz_x_____x_n
call fcn.009fe320
mov eax, dword [esp + 0x7c]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x18
Function at 0xa30080
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0xa8c84b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00a155c0
mov ebx, dword [esp + 0x240]
mov esi, dword [esp + 0x23c]
xor edx, edx
mov edi, dword [esp + 0x238]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
test ebx, ebx
push eax
push ecx
setne dl
push edx
push 0
push 0
push 0
push esi
push edi
mov dword [esp + 0x24c], 0
call fcn.00a2f5c0
mov ebp, dword [esp + 0x254]
add esp, 0x20
test al, al
jne 0xa30102
push ebx
push esi
test ebp, ebp
push edi
je 0xa30163
call ebp
mov dword [esp + 0x10], eax
test ebp, ebp
je 0xa3012e
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0x16
test cl, 1
je 0xa3012e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
push edi
push str.CopyFileW__ls__ls_____x__ls_n
call fcn.009fe320
add esp, 0x14
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], 0xffffffff
call fcn.00a155e0
mov ecx, dword [esp + 0x224]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret 0x10
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [esp + 0x10], eax
jmp 0xa3012e

Function at 0xa31180
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0xa8cb2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00a155c0
mov ebx, dword [esp + 0x240]
mov esi, dword [esp + 0x23c]
mov edi, dword [esp + 0x238]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push esi
push edi
mov dword [esp + 0x240], 0
call fcn.00a307a0
test al, al
mov ebp, dword [esp + 0x234]
jne 0xa311f2
test ebp, ebp
je 0xa31254
push ebx
push esi
push edi
call ebp
mov dword [esp + 0x10], eax
test ebp, ebp
je 0xa3121f
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0x16
test al, 1
je 0xa3121f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push ecx
push edx
push ebx
push esi
push edi
push str.MoveFileExW_lpExistingFileName_ls_lpNewFileName_ls_dwFlags_x_____x__ls_n
call fcn.009fe320
add esp, 0x18
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], 0xffffffff
call fcn.00a155e0
mov ecx, dword [esp + 0x224]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret 0x10
mov eax, dword [0xaf4758]
test eax, eax
je 0xa31268
push ebx
push esi
push edi
call eax
mov dword [esp + 0x10], eax
jmp 0xa3121f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [esp + 0x10], eax
jmp 0xa3121f
Function at 0xa33f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8d061
push eax
mov eax, dword [0xaf4e6c]
mov dword fs:[0], esp
sub esp, 0x244
push ebx
xor ebx, ebx
cmp eax, ebx
je 0xa34189
mov eax, dword [esp + 0x258]
push ebp
push esi
push edi
mov esi, dword [eax + 4]
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xb8]
mov eax, 3
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], eax
mov edx, dword [esi + 0xc4]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x84], eax
mov ecx, dword [esi + 0xb4]
push ebx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x78], eax
call fcn.009e4180
mov dl, byte [esp + 0x1f]
add esp, 4
mov byte [esp + 0x1c], dl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x25c], ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push ecx
push 1
push edx
lea ecx, [esp + 0x28]
call fcn.00a61440
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0xa34056
mov ecx, dword [esp + 0x24]
sub ecx, eax
sar ecx, 2
cmp ecx, 0x28
jae 0xa34083
mov edx, dword [0xaf4e58]
push ebx
push 0xa33e60
push edx
push 0xa33f40
lea eax, [esp + 0x58]
push esi
push eax
call edi
push eax
call ebp
push eax
push 0x14c
call dword [0xaf4e6c]
test eax, eax
jne 0xa34023
push 1
call fcn.009e4180
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
add esp, 4
xor edi, edi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0xa3417d
mov ecx, dword [esp + 0x24]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0xa3417d
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov esi, dword [eax + edi*4]
lea edx, [esp + 0x10]
push edx
push esi
mov byte [esp + 0x264], 2
call fcn.009e4c20
add esp, 8
test al, al
je 0xa340ee
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.009e36b0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x10]
jmp 0xa3413d
lea edx, [esp + 0x2c]
push 0x1c
push edx
push esi
call ebp
test eax, eax
je 0xa3412b
cmp dword [esp + 0x3c], 0x10000
je 0xa3412b
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x150]
push 0x104
push eax
push ecx
call fcn.009e54d0
test eax, eax
je 0xa3412b
lea edx, [esp + 0x150]
push edx
jmp 0xa34130
push str.no_associated_DLL_EXE_found
lea ecx, [esp + 0x18]
call fcn.009e36f0
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
push str.__stack_trace__02d:_addr_08x___s____08x__n
call fcn.009fe320
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x25c], 1
call fcn.009e3750
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x25c], bl
cmp ecx, ebx
je 0xa34177
call fcn.009e8250
inc edi
jmp 0xa34095
push eax
call fcn.00a7d8f0
add esp, 4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x248]
pop ebx
mov dword fs:[0], ecx
add esp, 0x250
ret
Function at 0xa34a90
Capabilities:
Manipulate boot configuration

Disassembly:
push 0xffffffffffffffff
push 0xa8d0e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
cmp esi, 0xc0000005
jne 0xa34ad4
mov eax, dword [edi]
cmp dword [eax + 0x10], 2
jne 0xa34ad4
cmp dword [eax + 0x14], 8
jne 0xa34ad4
push str.A_DEP__Data_Execution_Prevention__exception_occured__check_the_boot.ini__noexecute_option_for_more_info__n
call fcn.009fe320
add esp, 4
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], eax
call fcn.00a34a80
test al, al
mov ebp, 1
je 0xa34af0
mov dword [esp + 0x24], ebp
call fcn.009fe430
test al, al
je 0xa34b0f
cmp esi, 0xc000008d
jb 0xa34b09
cmp esi, 0xc0000093
jbe 0xa34b0f
mov dword [esp + 0xc], ebp
jmp 0xa34b1b
mov eax, dword [esp + 0x24]
test eax, eax
je 0xa34c3f
xor eax, eax
mov ebp, str.unknown_module
mov dword [esp + 0x20], eax
mov ecx, dword [edi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
mov edx, dword [ecx + 0xb8]
push eax
push edx
call fcn.009e4c20
add esp, 8
test al, al
je 0xa34b4b
mov eax, dword [esp + 0x20]
mov ebp, dword [eax]
cmp esi, 0xc0000005
jne 0xa34ba4
mov eax, dword [edi]
cmp dword [eax + 0x10], 2
jne 0xa34ba4
mov ecx, dword [eax + 0x14]
sub ecx, 0
je 0xa34b80
dec ecx
je 0xa34b79
sub ecx, 7
je 0xa34b72
mov ecx, str.unknown_type_of_access_to
jmp 0xa34b85
mov ecx, str.execute_at
jmp 0xa34b85
mov ecx, str.write_to
jmp 0xa34b85
mov ecx, str.read_of
mov edx, dword [edi + 4]
mov eax, dword [eax + 0x18]
mov edx, dword [edx + 0xb8]
push edx
push ebp
push eax
push ecx
push str.ExceptionFilter_EXCEPTION_ACCESS_VIOLATION_on__s_0x_x__caller_addr_s:0x_x__n
call fcn.009fe320
add esp, 0x14
jmp 0xa34c00
mov eax, dword [0xaa829c]
xor edx, edx
cmp eax, esi
je 0xa34bc4
mov ecx, 0xaa829c
cmp eax, 0xffffffff
je 0xa34bc4
mov eax, dword [ecx + 4]
add ecx, 4
inc edx
cmp eax, esi
jne 0xa34bb4
cmp dword [edx*4 + 0xaa829c], 0xffffffff
jne 0xa34bd5
mov edx, str.Unkown_exception
jmp 0xa34bdc
mov edx, dword [edx*4 + 0xaa8254]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, dword [ecx + 0xb8]
push ecx
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 4]
push ebp
push ecx
push eax
push esi
push edx
push str.ExceptionFilter__s__x__flags_x_num_args_x_caller_addr_s:0x_x__n
call fcn.009fe320
add esp, 0x1c
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
test ecx, ecx
je 0xa34c1d
call fcn.009e8250
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x24]
test eax, eax
je 0xa34c2e
push edi
call fcn.00a33f70
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0xa34c3f
push edi
call fcn.00a341a0
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0xa354a0
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8d14b
push eax
mov dword fs:[0], esp
sub esp, 0x434
lea eax, [esp + 0x1c]
push 0x104
push eax
push str.TS_OPTIONS
call fcn.00a202c0
test eax, eax
jne 0xa354ea
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00a221b0
push ebp
push esi
push 0
push 0x80
push 3
push 0
push 1
lea edx, [esp + 0x38]
push 0x80000000
push edx
call fcn.00a227b0
push 0xaf5410
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, 0xffffffff
jne 0xa35573
lea eax, [esp + 0x24]
lea ecx, [esp + 0x22c]
push eax
call fcn.00a152e0
push 0
mov ecx, eax
mov dword [esp + 0x448], 0
call fcn.00a15680
push eax
push str.ConfigInit::Open_File_failed
push 0
call ebp
lea ecx, [esp + 0x22c]
mov dword [esp + 0x444], 0xffffffff
call fcn.00a155e0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x40
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x10
push edx
push esi
call ebx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x1c]
xor ecx, ecx
add edx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
adc ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x28]
jl 0xa355dd
jg 0xa355c5
cmp edx, eax
jbe 0xa355dd
push 0
push 0xab4cd8
push str.ConfigInit::Bad_file_format
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
push esi
call edi
mov eax, dword [esp + 0x1c]
push eax
call fcn.009ef3b0
mov edx, dword [esp + 0x20]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [0xaf4e70], eax
push 0
push ecx
push edx
push eax
push esi
call ebx
pop edi
pop ebx
test eax, eax
je 0xa3563c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0xa3563c
mov eax, dword [0xaf4e70]
cmp byte [eax], 0x74
jne 0xa3563c
cmp byte [eax + 1], 0x68
jne 0xa3563c
cmp byte [eax + 2], 0x69
jne 0xa3563c
cmp byte [eax + 3], 0x6e
je 0xa35654
push 0
push 0xab4cd8
push str.ConfigInit::Signature_not_found
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0xaf4e70]
pop esi
pop ebp
mov ax, word [ecx + 0xa2]
test ax, ax
je 0xa3567b
and eax, 0xffff
add eax, ecx
mov dword [0xaa8c00], eax
push 0
push str.SandboxName
call fcn.00a352d0
mov ecx, dword [esp + 0x43c]
mov dword [0xaf4e78], eax
mov dword fs:[0], ecx
add esp, 0x448
ret