joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12d86cb0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4d8
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x12d86dc9
cmp dword [esp + 0x4e4], ebp
je 0x12d86dc9
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
cmp ebx, ebp
je 0x12d86d93
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebp
rep stosd dword es:[edi], eax
push 0x207
lea eax, [esp + 0xdc]
push ebx
push eax
call fcn.12f5c4ab
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
mov esi, eax
add esp, 0x18
cmp esi, 2
jle 0x12d86d93
lea edi, [esi - 2]
mov eax, dword [esp + edi*4 + 0x10]
push eax
call fcn.12e31030
add esp, 4
test eax, eax
je 0x12d86d74
mov ecx, dword [esp + 0x4f0]
mov edx, dword [esp + 0x4ec]
dec ecx
push ecx
push eax
push edx
call fcn.12f5c4ab
add esp, 0xc
mov ebp, 1
mov eax, dword [0x13198f68]
test eax, eax
je 0x12d86dba
push esi
push edi
push str.CAdbManager::GetCmdSrcName_1__dwPlace:_d___nNumber:__d_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [0x13198f68]
test eax, eax
je 0x12d86dba
mov eax, dword [esp + 0x4ec]
push ebx
push eax
push ebp
push str.CAdbManager::GetCmdSrcName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebx
pop ebp
add esp, 0x4d8
ret 8
xor eax, eax
pop ebp
add esp, 0x4d8
ret 8

Function at 0x12d86de0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x2d0
push ebx
push ebp
mov ebp, dword [esp + 0x2dc]
xor ebx, ebx
cmp ebp, ebx
je 0x12d86eca
cmp dword [esp + 0x2e0], ebx
je 0x12d86eca
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, ebx
je 0x12d86e9c
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bx
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [esp + 0xdc]
push esi
push eax
call fcn.12f5c4ab
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
add esp, 0x18
cmp eax, 2
pop edi
jle 0x12d86e9c
mov eax, dword [esp + eax*4 + 8]
push eax
call fcn.12e31030
add esp, 4
test eax, eax
je 0x12d86e9c
mov ecx, dword [esp + 0x2e4]
dec ecx
push ecx
push eax
push ebp
call fcn.12f5c4ab
add esp, 0xc
mov ebx, 1
mov eax, dword [0x13198f68]
test eax, eax
je 0x12d86ebc
push esi
push ebp
push ebx
push str.CAdbManager::GetCmdDestName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x2d0
ret 8
pop ebp
xor eax, eax
pop ebx
add esp, 0x2d0
ret 8
Function at 0x12d86fa0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4d8
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x12d870ac
cmp dword [esp + 0x4e4], ebx
je 0x12d870ac
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
cmp ebp, ebx
je 0x12d87076
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
push 0x207
lea eax, [esp + 0xdc]
push ebp
push eax
call fcn.12f5c4ab
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
mov edi, eax
add esp, 0x18
cmp edi, 1
jle 0x12d87076
mov eax, dword [esp + 0x4f0]
mov edx, dword [esp + 0x4ec]
lea esi, [edi - 1]
dec eax
push eax
mov ecx, dword [esp + esi*4 + 0x14]
push ecx
push edx
call fcn.12f5c4ab
mov eax, dword [0x13198f68]
add esp, 0xc
test eax, eax
mov ebx, 1
je 0x12d8709d
push edi
push esi
push str.CAdbManager::GetCmdDestName_1__dwPlace:_d___nNumber:__d_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [0x13198f68]
test eax, eax
je 0x12d8709d
mov eax, dword [esp + 0x4ec]
push ebp
push eax
push ebx
push str.CAdbManager::GetCmdDestName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x4d8
ret 8
xor eax, eax
pop ebx
add esp, 0x4d8
ret 8

Function at 0x12d8c0d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x13193c84]
test eax, eax
jne 0x12d8c14b
mov dword [0x13193c84], 1
call fcn.12f9c450
test eax, eax
je 0x12d8c13b
push 0
push 0x104
push 0x13193c88
call fcn.12f7a2e0
add esp, 0xc
test eax, eax
je 0x12d8c14b
push esi
push edi
mov edi, 0x130c4e54
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x13193c88
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x13193c88
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x13193c88
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x13193c88
ret

Function at 0x12d8c620
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131944c4]
test eax, eax
jne 0x12d8c67c
mov dword [0x131944c4], 1
call fcn.12f9c450
test eax, eax
je 0x12d8c66c
push 0
push 0x104
push 0x131944c8
call fcn.12f7a4e0
add esp, 0xc
test eax, eax
je 0x12d8c67c
push str.SysWow64
push 0x131944c8
call fcn.12f5c865
add esp, 8
mov eax, 0x131944c8
ret
push 0x104
push 0x131944c8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x131944c8
ret
Function at 0x12d91810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
mov ebp, dword [esp + 0xb0]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x12d91834
push ebp
call fcn.12f5c44d
add esp, 4
test eax, eax
jne 0x12d9183a
mov ebp, dword [0x13196ccc]
mov dword [esp + 0x14], str.qqeim
mov dword [esp + 0x18], 0x130c6fac
mov dword [esp + 0x1c], 0x130c6fa4
mov dword [esp + 0x20], 0x130c6f9c
mov dword [esp + 0x24], str.ypager
mov dword [esp + 0x28], str.yahoo
mov dword [esp + 0x2c], 0x130c6f78
mov dword [esp + 0x30], str.sinauc
mov dword [esp + 0x34], str.popo
mov dword [esp + 0x38], 0x130c6f50
mov dword [esp + 0x3c], 0x130c6f48
mov dword [esp + 0x40], str.rtxc
mov dword [esp + 0x44], str.sametime
mov dword [esp + 0x48], 0x130c6f18
mov dword [esp + 0x4c], str.alitalk
mov dword [esp + 0x50], str.aliim
mov dword [esp + 0x54], str.fetion
mov dword [esp + 0x58], str.googletalk
mov dword [esp + 0x5c], str.baiduhi
mov dword [esp + 0x60], str.263EM
mov dword [esp + 0x64], str.feiq
mov dword [esp + 0x68], str.officeim
mov dword [esp + 0x6c], str.msnlite
mov dword [esp + 0x70], 0x130c6e80
mov dword [esp + 0x74], str.nlnotes
mov dword [esp + 0x78], str.notes2w
mov dword [esp + 0x7c], str.notes2
mov dword [esp + 0x80], str.qqcrm
mov dword [esp + 0x84], str.amsger
mov dword [esp + 0x88], str.line
mov dword [esp + 0x8c], str.aliworkbench
mov dword [esp + 0x90], 0x130c6e04
mov dword [esp + 0x94], str.lync
mov dword [esp + 0x98], str.wechat
mov dword [esp + 0x9c], 0x130c6df0
mov dword [esp + 0xa0], str.imoclient
mov dword [esp + 0xa4], str.wxwork
mov dword [esp + 0xa8], str.dingtalk
mov dword [esp + 0xac], 0x130c6db0
mov dword [esp + 0xb0], str.lxmain
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x14]
mov esi, dword [edi]
push esi
call fcn.12f5c44d
push eax
push esi
push ebp
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
je 0x12d919cf
inc ebx
add edi, 4
cmp ebx, 0x28
jb 0x12d919a9
mov esi, dword [esp + 0x10]
jmp 0x12d919d4
mov esi, 1
mov eax, dword [0x13198f68]
test eax, eax
je 0x12d919f3
push ebp
push esi
push str.IsMatchIMAppName____d____s_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x12d939c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x131977a0]
test eax, eax
je 0x12d939cf
mov eax, 1
ret
push esi
mov esi, 0x131977a8
push esi
mov dword [0x131977a0], 1
call fcn.12f5c44d
add esp, 4
test eax, eax
jne 0x12d939f1
mov esi, str.snapb2p.dll
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x13198f68]
mov dword [0x131977a4], eax
test ecx, ecx
je 0x12d93a22
push esi
push eax
push str.CBmp2PngHelper::Initialize___08x____s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
mov eax, dword [0x131977a4]
add esp, 0x14
test eax, eax
je 0x12d93a96
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TB2P_Initialize
push eax
call esi
mov dword [0x13197788], eax
mov eax, dword [0x131977a4]
push str.TB2P_Uninitialize
push eax
call esi
mov ecx, dword [0x131977a4]
push str.TB2P_Conver
push ecx
mov dword [0x1319778c], eax
call esi
mov edx, dword [0x131977a4]
push str.TP2B_Conver
push edx
mov dword [0x13197790], eax
call esi
mov dword [0x13197794], eax
mov eax, dword [0x131977a4]
push str.TP2J_Conver
push eax
call esi
mov ecx, dword [0x131977a4]
push str.TJ2J_Conver
push ecx
mov dword [0x13197798], eax
call esi
mov dword [0x1319779c], eax
mov eax, dword [0x13197788]
pop esi
test eax, eax
je 0x12d93ad3
mov eax, dword [0x1319778c]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197790]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197794]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197798]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x1319779c]
test eax, eax
je 0x12d93ad3
mov eax, 1
ret
xor eax, eax
ret
Function at 0x12d941d0
Capabilities:
Move file

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x424]
push ebp
push edi
xor edi, edi
mov ebp, ecx
cmp ebx, edi
jne 0x12d941f6
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 8
push esi
push 0x5c
push ebx
mov dword [esp + 0x1c], edi
call fcn.12f5c8b4
mov esi, eax
add esp, 8
cmp esi, edi
je 0x12d94322
add esi, 2
je 0x12d94322
call fcn.12d91f70
test eax, eax
jne 0x12d94238
push 0x130c6408
push esi
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d94322
mov ecx, ebp
call fcn.12d93d20
mov word [esp + 0x1c], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea eax, [esp + 0x20]
push ebx
push eax
mov ecx, ebp
call fcn.12d94170
test eax, eax
je 0x12d94322
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
xor esi, esi
push ecx
push edx
push esi
push esi
push esi
lea eax, [esp + 0x30]
push esi
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
call fcn.12e30390
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0x500000
jae 0x12d942cd
cmp dword [esp + 0x18], esi
jne 0x12d942cd
mov ecx, dword [esp + 0x434]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, ebp
call fcn.12d94b00
pop esi
pop edi
pop ebp
mov dword [esp + 8], eax
pop ebx
add esp, 0x41c
ret 8
cmp eax, 0x10000000
jb 0x12d94322
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x226]
mov word [esp + 0x224], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x22c]
push str._s_large_08X
push edx
call fcn.12f5ceef
add esp, 0x10
lea eax, [esp + 0x224]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x41c
ret 8
Function at 0x12d95b60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x12d95b8a
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x13198edc
call fcn.12eb1b70
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x12d95bc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13198edc
call fcn.12eb1b70
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_finalize
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x12d95ca2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x12d95ca2
test eax, eax
je 0x12d95ca2
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x13198edc
call fcn.12eb1b70
add esp, 0x10
mov eax, 1
mov dword [esi + 0x2c], eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13198edc
call fcn.12eb1b70
add esp, 0x14
mov ecx, esi
call fcn.12d95cd0
xor eax, eax
pop esi
ret
Function at 0x12d97670
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
push esi
mov esi, dword [esp + 0x80c]
test esi, esi
push edi
jne 0x12d9768e
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
push esi
call fcn.12f5c44d
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x12d976b1
cmp word [esi], 0x2e
jne 0x12d976ce
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
cmp eax, 2
jne 0x12d976ce
cmp word [esi], 0x2e
jne 0x12d976ce
cmp word [esi + 2], 0x2e
jne 0x12d976ce
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
push 0x5c
push esi
mov dword [esp + 0x10], 0
call fcn.12f5cfc9
add esp, 8
test eax, eax
jne 0x12d976f0
push 0x2f
push esi
call fcn.12f5cfc9
add esp, 8
mov ecx, dword [esp + 0x814]
push ebx
test eax, eax
push ebp
mov dword [ecx], 0
je 0x12d97726
push esi
mov dword [ecx], edi
call fcn.12e30b60
add esp, 4
cmp eax, 0xffffffff
je 0x12d97717
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x804
ret
mov ebx, dword [esp + 0x824]
mov ebp, dword [esp + 0x820]
push ebx
push ebp
call fcn.12d8bf20
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8bfa0
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8bac0
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8ba90
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
mov ecx, 0x1ff
lea edi, [esp + 0x16]
mov word [esp + 0x14], ax
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0x130c8b14
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x12d97717
lea ecx, [esp + 0x14]
push 0x130c6c74
push ecx
call fcn.12f5d699
add esp, 8
test eax, eax
je 0x12d97717
push ebx
push ebp
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97802
push 0x130c6c74
push eax
call fcn.12f5d699
add esp, 8
test eax, eax
jne 0x12d977d1
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x804
ret
pop ebp
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
add esp, 0x804
ret
Function at 0x12d9c490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13056b2b
push eax
mov eax, dword [0x13197cb4]
mov dword fs:[0], esp
sub esp, 0x228
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x12d9c4d2
mov eax, dword [0x13197cb0]
pop ebx
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
add esp, 0x234
ret
push esi
mov eax, 1
push edi
mov dword [0x13197cb4], eax
mov dword [0x13197cb0], eax
mov esi, 0x20019
call fcn.12f9c450
test eax, eax
je 0x12d9c4f6
mov esi, 0x20219
lea ecx, [esp + 0xc]
call fcn.12f56cb0
push esi
push str.softwareTECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x248], ebx
call fcn.12f56e20
test eax, eax
je 0x12d9c582
push 4
push str.RunAs
lea ecx, [esp + 0x14]
call fcn.12f592e0
push 0xffffffffffffffff
push str.RunAs
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.12f56fc0
and eax, 0xff
jne 0x12d9c54f
mov dword [0x13197cb0], ebx
jmp 0x12d9c571
cmp eax, 2
jne 0x12d9c55b
mov dword [0x13197cb0], eax
jmp 0x12d9c571
cmp eax, 3
jne 0x12d9c567
mov dword [0x13197cb0], eax
jmp 0x12d9c571
cmp eax, 4
jne 0x12d9c571
mov dword [0x13197cb0], eax
lea ecx, [esp + 0xc]
call fcn.12f56e70
cmp esi, ebx
jne 0x12d9c676
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x134]
push 0x104
push eax
call fcn.12f7a820
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
mov dword [esp + 0x20], 0x130c98e8
mov dword [esp + 0x24], 0x130c98e0
mov dword [esp + 0x28], 0x130c98d4
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 4
xor edi, edi
lea esi, [esp + 0x20]
mov ecx, dword [esi]
lea edx, [esp + 0x130]
push ecx
push edx
push 0x130c4bec
lea eax, [esp + 0x38]
push 0x103
push eax
call fcn.12f5d86f
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x12d9c661
call fcn.12d9c6b0
lea edx, [esp + 0x130]
push eax
push edx
push 0x130c4bec
lea eax, [esp + 0x38]
push 0x103
push eax
call fcn.12f5d86f
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x12d9c66c
inc edi
add esi, 4
cmp edi, 3
jb 0x12d9c602
jmp 0x12d9c676
mov edx, dword [esp + edi*4 + 0x14]
mov dword [0x13197cb0], edx
mov esi, dword [0x13197cb0]
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], 0xffffffff
call fcn.12f56da0
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret
Function at 0x12d9dbd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x218]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov esi, ecx
je 0x12d9dd60
cmp ebx, 0xffffffff
je 0x12d9dd60
lea eax, [esi + 0x440]
push eax
call fcn.12f5c44d
add esp, 4
test eax, eax
je 0x12d9dd60
cmp dword [esi + 0x43c], ebx
je 0x12d9dd60
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x24], eax
jne 0x12d9dd60
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push ecx
push edx
lea eax, [esp + 0x20]
push 0x104
push eax
push ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 1
call fcn.12e394d0
mov ecx, eax
call fcn.12e399e0
test eax, eax
je 0x12d9dd60
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.12d9e120
test eax, eax
jne 0x12d9dd60
mov eax, dword [0x13198f68]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
je 0x12d9dcb4
lea edx, [esp + 0x18]
push edx
call ebx
push eax
mov eax, dword [esi + 0x28]
push eax
push str.CDeCompressOpCommon::DealWriteFile___08x___08x___s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
call ebx
mov ecx, dword [esi + 0x28]
add ecx, 0x7d0
cmp ecx, eax
jae 0x12d9dcdf
cmp dword [0x13198f68], ebp
je 0x12d9dcdf
push str.CDeCompressOpCommon::DealWriteFile_timeout
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
lea ebp, [esi + 0x648]
push ebp
call fcn.12f5c44d
add esp, 4
test eax, eax
je 0x12d9dd04
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12d9dd60
call ebx
cmp dword [esi + 0x28], eax
ja 0x12d9dd1a
call ebx
mov ecx, dword [esi + 0x28]
add ecx, 0x7d0
cmp ecx, eax
jae 0x12d9dd40
lea edx, [esp + 0x18]
lea edi, [esi + 0x234]
push edx
push edi
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12d9dd60
call ebx
mov dword [esi + 0x28], eax
mov ecx, 0x82
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push 0x103
push eax
push ebp
call fcn.12f5c4ab
mov ecx, dword [esp + 0x230]
add esp, 0xc
mov dword [esi + 0x43c], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x12d9df80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13056d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa14
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0xa34]
lea ecx, [esp + 0x14]
xor ebp, ebp
push eax
push ecx
push ebp
push ebp
lea edx, [esp + 0x28]
lea esi, [edi + 0x20c]
push ebp
push edx
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.12e30390
mov ebx, eax
add esp, 0x1c
cmp ebx, ebp
je 0x12d9e04e
lea ecx, [esp + 0x1c]
call fcn.12e02000
lea eax, [edi + 4]
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0xa30], ebp
call fcn.12e02970
push esi
lea ecx, [esp + 0x20]
call fcn.12e02a90
push 1
lea ecx, [esp + 0x20]
call fcn.12e02370
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.12e02450
push 0x17
lea ecx, [esp + 0x20]
call fcn.12e02310
push ebp
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.12e72cf0
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa2c], 0xffffffff
call fcn.12e021f0
cmp dword [0x13198f68], ebp
je 0x12d9e070
add edi, 4
push esi
push edi
push ebx
push str.CDeCompressOpCommon::AddLog___d___s___s_
push str.CompressLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov ecx, dword [esp + 0xa24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa20
ret 4
Function at 0x12da0440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov ecx, dword [0x131986d4]
sub esp, 0x14
xor eax, eax
push ebx
push ebp
push esi
cmp ecx, eax
push edi
jbe 0x12da0514
mov word [esp + 0x14], ax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1e], eax
lea edx, [esp + 0x14]
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov edi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
cmp eax, 0xffffffff
je 0x12da04c0
mov ecx, dword [esp + 0x18]
push ecx
call ebx
mov edx, dword [esp + 0x16]
mov esi, eax
push edx
call ebp
push edi
push esi
push eax
mov ecx, 0x131986c8
call fcn.12da03b0
test eax, eax
jne 0x12da0503
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x12da0512
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x16]
mov esi, eax
push ecx
call ebp
push edi
push esi
push eax
mov ecx, 0x131986c8
call fcn.12da03b0
test eax, eax
je 0x12da0512
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8