joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12d9c490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13056bfb
push eax
mov eax, dword [0x13197db4]
mov dword fs:[0], esp
sub esp, 0x228
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x12d9c4d2
mov eax, dword [0x13197db0]
pop ebx
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
add esp, 0x234
ret
push esi
mov eax, 1
push edi
mov dword [0x13197db4], eax
mov dword [0x13197db0], eax
mov esi, 0x20019
call fcn.12f9c520
test eax, eax
je 0x12d9c4f6
mov esi, 0x20219
lea ecx, [esp + 0xc]
call fcn.12f56d80
push esi
push str.softwareTECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x248], ebx
call fcn.12f56ef0
test eax, eax
je 0x12d9c582
push 4
push str.RunAs
lea ecx, [esp + 0x14]
call fcn.12f593b0
push 0xffffffffffffffff
push str.RunAs
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.12f57090
and eax, 0xff
jne 0x12d9c54f
mov dword [0x13197db0], ebx
jmp 0x12d9c571
cmp eax, 2
jne 0x12d9c55b
mov dword [0x13197db0], eax
jmp 0x12d9c571
cmp eax, 3
jne 0x12d9c567
mov dword [0x13197db0], eax
jmp 0x12d9c571
cmp eax, 4
jne 0x12d9c571
mov dword [0x13197db0], eax
lea ecx, [esp + 0xc]
call fcn.12f56f40
cmp esi, ebx
jne 0x12d9c676
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x134]
push 0x104
push eax
call fcn.12f7a8f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
mov dword [esp + 0x20], 0x130c98e8
mov dword [esp + 0x24], 0x130c98e0
mov dword [esp + 0x28], 0x130c98d4
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 4
xor edi, edi
lea esi, [esp + 0x20]
mov ecx, dword [esi]
lea edx, [esp + 0x130]
push ecx
push edx
push 0x130c4bec
lea eax, [esp + 0x38]
push 0x103
push eax
call fcn.12f5d93f
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x12d9c661
call fcn.12d9c6b0
lea edx, [esp + 0x130]
push eax
push edx
push 0x130c4bec
lea eax, [esp + 0x38]
push 0x103
push eax
call fcn.12f5d93f
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x12d9c66c
inc edi
add esi, 4
cmp edi, 3
jb 0x12d9c602
jmp 0x12d9c676
mov edx, dword [esp + edi*4 + 0x14]
mov dword [0x13197db0], edx
mov esi, dword [0x13197db0]
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], 0xffffffff
call fcn.12f56e70
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret
Function at 0x12d9cab0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x13199068]
push esi
mov esi, dword [esp + 8]
push edi
test eax, eax
mov edi, ecx
je 0x12d9cad6
push esi
push str.CompressOp::DstAdd_______lpszPath:_s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test esi, esi
je 0x12d9cb59
push 0x5c
push esi
call fcn.12f5c984
add esp, 8
test eax, eax
jne 0x12d9cb09
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call fcn.12f5c51d
push eax
push esi
push 0
call fcn.12f5c8f5
add esp, 0x10
xor esi, esi
cmp dword [edi + 0x14], 2
jne 0x12d9cb59
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x18], eax
je 0x12d9cb49
mov eax, dword [0x13196dcc]
push str.7zg.exe
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12d9cb49
mov ecx, dword [0x13196dcc]
push str.7zfm.exe
push ecx
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12d9cb59
push esi
lea ecx, [edi + 0x10]
call fcn.12f47570
mov dword [edi + 0x14], 3
pop edi
pop esi
ret 4

Function at 0x12d9cd70
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x12d9cddd
push 0x5c
push esi
call fcn.12f5c984
add esp, 8
test eax, eax
jne 0x12d9cdab
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call fcn.12f5c51d
push eax
push esi
push 0
call fcn.12f5c8f5
add esp, 0x10
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x18], eax
jne 0x12d9cddd
push esi
lea ecx, [edi + 0x10]
call fcn.12f47570
mov eax, dword [0x13199068]
test eax, eax
je 0x12d9cddd
push esi
push str.CompressOp::DstAddDirect_lpszPath:_s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
pop edi
pop esi
ret 4
Function at 0x12d9dbd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x218]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov esi, ecx
je 0x12d9dd60
cmp ebx, 0xffffffff
je 0x12d9dd60
lea eax, [esi + 0x440]
push eax
call fcn.12f5c51d
add esp, 4
test eax, eax
je 0x12d9dd60
cmp dword [esi + 0x43c], ebx
je 0x12d9dd60
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x24], eax
jne 0x12d9dd60
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push ecx
push edx
lea eax, [esp + 0x20]
push 0x104
push eax
push ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 1
call fcn.12e394d0
mov ecx, eax
call fcn.12e399e0
test eax, eax
je 0x12d9dd60
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.12d9e120
test eax, eax
jne 0x12d9dd60
mov eax, dword [0x13199068]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
je 0x12d9dcb4
lea edx, [esp + 0x18]
push edx
call ebx
push eax
mov eax, dword [esi + 0x28]
push eax
push str.CDeCompressOpCommon::DealWriteFile___08x___08x___s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
call ebx
mov ecx, dword [esi + 0x28]
add ecx, 0x7d0
cmp ecx, eax
jae 0x12d9dcdf
cmp dword [0x13199068], ebp
je 0x12d9dcdf
push str.CDeCompressOpCommon::DealWriteFile_timeout
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
lea ebp, [esi + 0x648]
push ebp
call fcn.12f5c51d
add esp, 4
test eax, eax
je 0x12d9dd04
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12d9dd60
call ebx
cmp dword [esi + 0x28], eax
ja 0x12d9dd1a
call ebx
mov ecx, dword [esi + 0x28]
add ecx, 0x7d0
cmp ecx, eax
jae 0x12d9dd40
lea edx, [esp + 0x18]
lea edi, [esi + 0x234]
push edx
push edi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12d9dd60
call ebx
mov dword [esi + 0x28], eax
mov ecx, 0x82
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push 0x103
push eax
push ebp
call fcn.12f5c57b
mov ecx, dword [esp + 0x230]
add esp, 0xc
mov dword [esi + 0x43c], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x12d9df80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13056e0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa14
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0xa34]
lea ecx, [esp + 0x14]
xor ebp, ebp
push eax
push ecx
push ebp
push ebp
lea edx, [esp + 0x28]
lea esi, [edi + 0x20c]
push ebp
push edx
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.12e30390
mov ebx, eax
add esp, 0x1c
cmp ebx, ebp
je 0x12d9e04e
lea ecx, [esp + 0x1c]
call fcn.12e02000
lea eax, [edi + 4]
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0xa30], ebp
call fcn.12e02970
push esi
lea ecx, [esp + 0x20]
call fcn.12e02a90
push 1
lea ecx, [esp + 0x20]
call fcn.12e02370
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.12e02450
push 0x17
lea ecx, [esp + 0x20]
call fcn.12e02310
push ebp
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.12e72d00
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa2c], 0xffffffff
call fcn.12e021f0
cmp dword [0x13199068], ebp
je 0x12d9e070
add edi, 4
push esi
push edi
push ebx
push str.CDeCompressOpCommon::AddLog___d___s___s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov ecx, dword [esp + 0xa24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa20
ret 4
Function at 0x12da0440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov ecx, dword [0x131987d4]
sub esp, 0x14
xor eax, eax
push ebx
push ebp
push esi
cmp ecx, eax
push edi
jbe 0x12da0514
mov word [esp + 0x14], ax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1e], eax
lea edx, [esp + 0x14]
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov edi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
cmp eax, 0xffffffff
je 0x12da04c0
mov ecx, dword [esp + 0x18]
push ecx
call ebx
mov edx, dword [esp + 0x16]
mov esi, eax
push edx
call ebp
push edi
push esi
push eax
mov ecx, 0x131987c8
call fcn.12da03b0
test eax, eax
jne 0x12da0503
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x12da0512
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x16]
mov esi, eax
push ecx
call ebp
push edi
push esi
push eax
mov ecx, 0x131987c8
call fcn.12da03b0
test eax, eax
je 0x12da0512
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x12da0930
Capabilities:
Delete file

Disassembly:
sub esp, 0x930
push ebx
push ebp
mov ebp, dword [esp + 0x93c]
push esi
mov ebx, ecx
push edi
mov ecx, 0x24b
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
xor edi, edi
test ecx, ecx
mov esi, ebp
je 0x12da0ae7
mov eax, esi
xor edx, edx
shr eax, 4
div dword [ebx + 8]
mov edx, dword [ecx + edx*4]
test edx, edx
je 0x12da0ae7
mov eax, dword [edx + 8]
cmp eax, esi
jne 0x12da098a
mov ecx, dword [edx + 0xc]
cmp ecx, edi
je 0x12da0996
mov edx, dword [edx]
test edx, edx
je 0x12da0ae7
jmp 0x12da097c
test edx, edx
je 0x12da0ae7
lea esi, [edx + 0x10]
mov ecx, 0x24c
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x12da09c6
push eax
call fcn.12f5dd2d
add esp, 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, esi
je 0x12da09dd
push eax
call fcn.12f5c050
add esp, 4
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x12da09f2
push eax
call fcn.12f5c050
add esp, 4
mov dword [esp + 0x24], esi
lea edx, [esp + 0x3c]
test edx, edx
je 0x12da0a22
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12da0a22
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x12da0a37
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], esi
cmp eax, esi
je 0x12da0a50
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esp + 0x30], esi
mov ecx, dword [ebx + 4]
mov dword [esp + 0x34], esi
mov esi, ebp
xor ebp, ebp
xor edi, edi
cmp ecx, ebp
je 0x12da0ae7
mov eax, esi
xor edx, edx
shr eax, 4
div dword [ebx + 8]
mov eax, dword [ecx + edx*4]
cmp eax, ebp
lea ecx, [ecx + edx*4]
je 0x12da0ae7
mov edx, dword [eax + 8]
cmp edx, esi
jne 0x12da0a87
mov edx, dword [eax + 0xc]
cmp edx, edi
je 0x12da0a91
mov ecx, eax
mov eax, dword [eax]
cmp eax, ebp
je 0x12da0ae7
jmp 0x12da0a79
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov dword [eax], ecx
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
dec eax
mov dword [ebx + 0xc], eax
jne 0x12da0ae7
mov esi, dword [ebx + 4]
cmp esi, ebp
je 0x12da0aca
mov eax, dword [ebx + 8]
cmp eax, ebp
jbe 0x12da0aca
mov ecx, esi
mov edx, eax
mov eax, dword [ecx]
cmp eax, ebp
je 0x12da0ac4
mov eax, dword [eax]
cmp eax, ebp
jne 0x12da0abe
add ecx, 4
dec edx
jne 0x12da0ab8
push esi
call fcn.12f5c050
mov ecx, dword [ebx + 0x14]
add esp, 4
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x10], ebp
call fcn.12f54ad0
mov dword [ebx + 0x14], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x930
ret 4
Function at 0x12da0b00
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
mov dword [esi + 8], ebp
je 0x12da0b33
push eax
call fcn.12f5dd2d
add esp, 4
mov dword [esi + 0x10], 0xffffffff
lea ebx, [esi + 0x2c]
cmp ebx, ebp
je 0x12da0b5a
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12da0b5a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x200
xor eax, eax
lea edi, [esi + 0x130]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
cmp eax, ebp
je 0x12da0b7c
push eax
call fcn.12f5c050
add esp, 4
mov dword [esi + 0xc], ebp
mov eax, dword [esi + 0x14]
cmp eax, ebp
je 0x12da0b8b
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x28], ebp
cmp eax, ebp
je 0x12da0ba1
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esi + 0x18], ebp
mov eax, dword [esi + 0x20]
mov dword [esi + 0x1c], ebp
cmp eax, ebp
je 0x12da0bb7
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esi + 0x20], ebp
sub esp, 0x930
mov ecx, 0x24c
mov edi, esp
mov dword [esi + 0x24], ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x940]
call fcn.12da0810
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x12da0be0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x13056f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x93c
push ebp
mov ebp, ecx
push esi
push 1
lea eax, [ebp + 0x1c]
lea ecx, [esp + 0xc]
push eax
call fcn.12f56170
mov edx, dword [ebp + 0xc]
xor esi, esi
cmp edx, esi
mov dword [esp + 0x94c], esi
jne 0x12da0c49
lea ecx, [esp + 8]
mov dword [esp + 0x94c], 0xffffffff
call fcn.12f561d0
pop esi
pop ebp
mov ecx, dword [esp + 0x93c]
mov dword fs:[0], ecx
add esp, 0x948
ret
xor eax, eax
push ebx
neg edx
sbb edx, edx
push edi
mov ebx, edx
mov ecx, 0x24b
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], esi
cmp ebx, esi
rep stosd dword es:[edi], eax
je 0x12da0d6a
cmp ebx, 0xffffffff
mov edx, ebx
jne 0x12da0c8b
mov esi, dword [ebp + 8]
xor eax, eax
test esi, esi
jbe 0x12da0c8b
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
test edx, edx
jne 0x12da0c8b
inc eax
add ecx, 4
cmp eax, esi
jb 0x12da0c7d
mov ebx, dword [edx]
test ebx, ebx
jne 0x12da0cb0
mov eax, dword [edx + 4]
mov esi, dword [ebp + 8]
inc eax
cmp eax, esi
jae 0x12da0cb0
mov ecx, dword [ebp + 4]
lea ecx, [ecx + eax*4]
mov ebx, dword [ecx]
test ebx, ebx
jne 0x12da0cb0
inc eax
add ecx, 4
cmp eax, esi
jb 0x12da0ca2
lea esi, [edx + 0x10]
mov ecx, 0x24c
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x12da0cd8
push eax
call fcn.12f5dd2d
add esp, 4
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x12da0cef
push eax
call fcn.12f5c050
add esp, 4
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x30]
cmp eax, esi
je 0x12da0d04
push eax
call fcn.12f5c050
add esp, 4
mov dword [esp + 0x30], esi
lea edx, [esp + 0x48]
test edx, edx
je 0x12da0d34
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12da0d34
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
cmp eax, esi
je 0x12da0d49
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], esi
cmp eax, esi
je 0x12da0d62
push eax
call fcn.12f5d1fc
add esp, 4
mov dword [esp + 0x3c], esi
cmp ebx, esi
jne 0x12da0c6a
mov esi, dword [ebp + 4]
xor edi, edi
cmp esi, edi
je 0x12da0d90
mov eax, dword [ebp + 8]
cmp eax, edi
jbe 0x12da0d90
mov ecx, esi
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
je 0x12da0d8a
mov eax, dword [eax]
cmp eax, edi
jne 0x12da0d84
add ecx, 4
dec edx
jne 0x12da0d7e
push esi
call fcn.12f5c050
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ebp + 4], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], edi
call fcn.12f54ad0
mov dword [ebp + 0x14], edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x954], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x94c]
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x948
ret
Function at 0x12da0f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13056fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 4]
lea ecx, [esp + 0x14]
push eax
call fcn.12f56170
mov edi, dword [esp + 0x2c]
mov ebp, dword [esi + 0x28]
mov eax, edi
xor edx, edx
shr eax, 4
div ebp
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x24], 0
test ecx, ecx
mov ebx, edx
je 0x12da0f8e
mov eax, dword [ecx + ebx*4]
test eax, eax
je 0x12da0f8a
cmp dword [eax + 8], edi
je 0x12da0f82
mov eax, dword [eax]
test eax, eax
jne 0x12da0f75
jmp 0x12da0f8a
test eax, eax
jne 0x12da1024
test ecx, ecx
jne 0x12da0fbe
lea edi, [ebp*4]
push edi
call fcn.12f5c05b
mov edx, eax
mov ecx, edi
mov dword [esi + 0x24], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x2c]
mov dword [esi + 0x28], ebp
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x12da0ff2
mov eax, dword [esi + 0x38]
push 0x14
lea ecx, [esi + 0x34]
push eax
push ecx
call fcn.12f54aa0
mov ecx, dword [esi + 0x38]
lea edx, [ecx + ecx*4]
dec ecx
test ecx, ecx
lea eax, [eax + edx*4 - 0xc]
jl 0x12da0ff2
inc ecx
mov edx, dword [esi + 0x30]
mov dword [eax], edx
mov dword [esi + 0x30], eax
sub eax, 0x14
dec ecx
jne 0x12da0fe4
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x2c]
inc ecx
xor edx, edx
mov dword [esi + 0x2c], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + ebx*4]
mov dword [eax], edx
mov ecx, dword [esi + 0x24]
mov dword [ecx + ebx*4], eax
mov ecx, dword [esp + 0x30]
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x12da4c00
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13057188
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
jne 0x12da4ccf
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
pop edi
cmp eax, 5
push str.TSecBxFltCDOSL
jae 0x12da4c5d
lea eax, [esp + 0x10]
push str..Global_s
push eax
jmp 0x12da4c67
lea ecx, [esp + 0x10]
push 0x130cc104
push ecx
call fcn.12f5cf6d
add esp, 0xc
lea ecx, [esp + 4]
push 0xffffffffffffffff
call fcn.12f29950
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x20]
push 0xc0000000
push edx
mov dword [esp + 0x70], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 4]
jne 0x12da4cca
call fcn.12f29980
xor eax, eax
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
call fcn.12f29980
mov ecx, dword [esp + 0x4c]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret

Function at 0x12daa300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13057288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push 0x13198dc0
lea ecx, [esp + 8]
mov esi, 1
call fcn.12f41640
push esi
push 0
push ecx
mov dword [esp + 0x44], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.safe_office_com_protect
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.12e9bfb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call fcn.12e9c180
test eax, eax
je 0x12daa381
lea ecx, [esp + 0xc]
call fcn.12e9c670
test eax, eax
jne 0x12daa377
jmp 0x12daa381
xor ecx, ecx
cmp eax, 1
sete cl
mov esi, ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.12e9c070
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.12f41f70
mov ecx, dword [esp + 0x30]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
Function at 0x12dacb60
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x12dacbbe
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x12dacb9a
push esi
call fcn.12f5c51d
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x12dacb9c
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x12dacbd0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x12dacc17
mov ecx, dword [esp]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret 0xc

Function at 0x12dacc20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x12daccba
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x12dacca4
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.12f5c05b
mov esi, eax
add esp, 4
test esi, esi
je 0x12dacca4
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8