joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e8c580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13062398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 4]
lea ecx, [esp + 0x14]
push eax
call fcn.12f56170
mov edi, dword [esp + 0x2c]
mov ebp, dword [esi + 0x28]
mov eax, edi
xor edx, edx
shr eax, 4
div ebp
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x24], 0
test ecx, ecx
mov ebx, edx
je 0x12e8c5ee
mov eax, dword [ecx + ebx*4]
test eax, eax
je 0x12e8c5ea
cmp dword [eax + 8], edi
je 0x12e8c5e2
mov eax, dword [eax]
test eax, eax
jne 0x12e8c5d5
jmp 0x12e8c5ea
test eax, eax
jne 0x12e8c68f
test ecx, ecx
jne 0x12e8c61e
lea edi, [ebp*4]
push edi
call fcn.12f5c05b
mov edx, eax
mov ecx, edi
mov dword [esi + 0x24], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x2c]
mov dword [esi + 0x28], ebp
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x12e8c654
mov eax, dword [esi + 0x38]
push 0x20
lea ecx, [esi + 0x34]
push eax
push ecx
call fcn.12f54aa0
mov ecx, dword [esi + 0x38]
mov edx, ecx
shl edx, 5
dec ecx
test ecx, ecx
lea eax, [edx + eax - 0x18]
jl 0x12e8c654
inc ecx
mov edx, dword [esi + 0x30]
mov dword [eax], edx
mov dword [esi + 0x30], eax
sub eax, 0x20
dec ecx
jne 0x12e8c646
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x2c]
inc ecx
xor edx, edx
mov dword [esi + 0x2c], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + ebx*4]
mov dword [eax], edx
mov ecx, dword [esi + 0x24]
mov dword [ecx + ebx*4], eax
mov esi, dword [esp + 0x30]
lea edi, [eax + 0xc]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x12e8c880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
xor eax, eax
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0xe], eax
push esi
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x1a], eax
lea edx, [esp + 0x14]
push ecx
xor edi, edi
mov dword [esp + 0x22], eax
push edx
push ebp
mov word [esp + 0x20], di
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e8c8e4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebx
call fcn.12e8c9d0
mov edi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e8c920
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov cx, word [edx]
xor edx, edx
push ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
cmp esi, 0xffffffff
setne dl
push ecx
push edx
push eax
push str.CSOCKETTRACK_MSGTable::GetSocketInfo_1_nAddrLen__lu_dwRet__lu_dwLocalIP__lu_wLocalPort__lu_
push str.PortRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x12e8c949
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.12e8c9d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x1c
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov ebp, dword [esp + 0x38]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e8c986
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push ebp
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebx
call fcn.12e8c9d0
mov edi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e8c9bf
mov edx, dword [esp + 0x34]
xor ecx, ecx
mov cx, word [ebp]
mov eax, dword [edx]
mov edx, dword [esp + 0x10]
push ecx
xor ecx, ecx
cmp esi, 0xffffffff
push eax
setne cl
push ecx
push edx
push str.CSOCKETTRACK_MSGTable::GetSocketInfo_2_nAddrLen__lu_dwRet__lu_dwRemoteIP__lu_wRemotePort__lu_
push str.PortRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x1c
Function at 0x12e8db60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x130624d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x1c]
lea ecx, [esp + 0x14]
push eax
call fcn.12f56170
mov edi, dword [esp + 0x2c]
mov ebx, dword [esi + 8]
mov eax, edi
xor edx, edx
shr eax, 4
div ebx
mov ecx, dword [esi + 4]
mov dword [esp + 0x24], 0
test ecx, ecx
mov ebp, edx
je 0x12e8dbce
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x12e8dbca
cmp dword [eax + 8], edi
je 0x12e8dbc2
mov eax, dword [eax]
test eax, eax
jne 0x12e8dbb5
jmp 0x12e8dbca
test eax, eax
jne 0x12e8dc72
test ecx, ecx
jne 0x12e8dbfa
lea edi, [ebx*4]
push edi
call fcn.12f5c05b
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x12e8dc31
mov eax, dword [esi + 0x18]
push 0x50
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.12f54aa0
mov ecx, dword [esi + 0x18]
lea edx, [ecx + ecx*4]
shl edx, 4
dec ecx
test ecx, ecx
lea eax, [edx + eax - 0x48]
jl 0x12e8dc31
inc ecx
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x50
dec ecx
jne 0x12e8dc23
mov edi, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
inc ecx
push 1
mov eax, dword [edi]
lea ebx, [edi + 8]
push ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ecx
call fcn.12e8f590
lea ecx, [edi + 0xc]
push 1
push ecx
call fcn.12e8f5a0
mov edx, dword [esp + 0x3c]
mov dword [edi + 4], ebp
mov dword [ebx], edx
mov ecx, dword [esi + 4]
add esp, 0x10
mov eax, edi
mov edx, dword [ecx + ebp*4]
mov dword [edi], edx
mov ecx, dword [esi + 4]
mov dword [ecx + ebp*4], edi
mov ecx, dword [esp + 0x30]
lea esi, [eax + 0x14]
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x10], edx
mov dx, word [ecx + 0x18]
mov word [eax + 0x24], dx
mov dx, word [ecx + 0x1a]
mov word [eax + 0x26], dx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x28], edx
lea edx, [ecx + 8]
mov edi, dword [ecx + 8]
mov dword [esi], edi
mov edi, dword [edx + 4]
mov dword [esi + 4], edi
mov edi, dword [edx + 8]
mov dword [esi + 8], edi
mov edx, dword [edx + 0xc]
mov dword [esi + 0xc], edx
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x2c], edx
mov dx, word [ecx + 0x34]
mov word [eax + 0x40], dx
mov dx, word [ecx + 0x36]
mov word [eax + 0x42], dx
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x44], edx
lea edx, [ecx + 0x24]
lea esi, [eax + 0x30]
mov edi, dword [edx]
mov dword [esi], edi
mov edi, dword [edx + 4]
mov dword [esi + 4], edi
mov edi, dword [edx + 8]
mov dword [esi + 8], edi
mov edx, dword [edx + 0xc]
mov dword [esi + 0xc], edx
mov dx, word [ecx + 0x3c]
mov word [eax + 0x48], dx
mov dx, word [ecx + 0x3e]
mov word [eax + 0x4a], dx
mov ecx, dword [ecx + 0x40]
mov dword [eax + 0x4c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x12e8e810
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
mov dword [esp + 0x10], 0x1c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, dword [esp + 0x38]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x12e8e86d
mov eax, dword [esp + 0x10]
lea edx, [esi + 4]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.12e4eec0
add esp, 0xc
mov ebp, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e8e8a4
mov eax, dword [esi + 4]
xor edx, edx
mov dx, word [esi + 0x18]
xor ecx, ecx
cmp ebx, 0xffffffff
push edx
mov edx, dword [esp + 0x14]
push eax
setne cl
push ecx
push edx
push edi
push str.CSocketTrackTable::GetSocketInfo_1__socket:_08x_nAddrLen__lu_dwRet__lu_dwLocalIP__08x_wLocalPort__lu_
push str.PortRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x12e8e8c8
mov ecx, dword [esp + 0x40]
add esi, 0x20
push esi
push ecx
push eax
call fcn.12e4eec0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
mov dword [esp + 0x1c], 0x1c
call dword [sym.imp.WS2_32.dll_getpeername]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x12e8e900
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.12e4eec0
add esp, 0xc
mov ebp, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e8e937
mov edx, dword [esi + 0x20]
xor ecx, ecx
mov cx, word [esi + 0x34]
xor eax, eax
cmp ebx, 0xffffffff
push ecx
mov ecx, dword [esp + 0x14]
push edx
setne al
push eax
push ecx
push edi
push str.CSocketTrackTable::GetSocketInfo_2__socket:_08x_nAddrLen__lu_dwRet__lu_dwRemoteIP__08x_wRemotePort__lu_
push str.PortRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10

Function at 0x12e8eb80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x20
push esi
push edi
xor esi, esi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], si
mov edx, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x14], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x12e8ebdc
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 8]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.12e4eec0
add esp, 0xc
pop edi
pop esi
add esp, 0x20
ret 8
mov eax, esi
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x12e8f5e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131bd0f0
jmp 0x12e8f610
push 0xffffffffffffffff
push 0x13062717
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.12f55c40
xor ebp, ebp
lea ecx, [esi + 0x230]
mov dword [esp + 0x28], ebp
call fcn.12f55c40
lea ecx, [esi + 0x660]
mov byte [esp + 0x28], 1
call fcn.12f55c40
lea ebx, [esi + 0x680]
mov byte [esp + 0x28], 2
mov dword [ebx], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 4], ebp
lea ecx, [esi + 0x694]
mov byte [esp + 0x28], 3
call fcn.12f55c40
mov byte [esp + 0x28], 4
mov dword [esi + 0x6b4], ebp
mov dword [esi + 0x6c0], ebp
mov dword [esi + 0x6bc], ebp
mov dword [esi + 0x6b8], ebp
lea ecx, [esi + 0x6ec]
mov byte [esp + 0x28], 5
call fcn.12f55c40
lea ecx, [esi + 0x70c]
mov byte [esp + 0x28], 6
call fcn.12f4cc70
lea ecx, [esi + 0x720]
mov byte [esp + 0x28], 7
call fcn.12f4cc70
lea ecx, [esi + 0x730]
mov byte [esp + 0x28], 8
call fcn.12f4cc70
mov eax, dword [0x1307d24c]
mov byte [esp + 0x28], 9
mov dword [esi + 0x75c], eax
mov byte [esp + 0x28], 0xa
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x24]
mov dword [esi], 0x1307a750
mov dword [esi + 0x22c], ebp
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x458]
rep stosd dword es:[edi], eax
or edi, 0xffffffff
mov ecx, ebx
push edi
push ebp
call fcn.12e96120
lea eax, [esi + 0x694]
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esi + 0x690], ebp
call fcn.12f56170
mov byte [esp + 0x28], 0xb
push edi
push ebp
lea ecx, [esi + 0x6b4]
call fcn.12e962a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0xa
call fcn.12f561d0
lea eax, [esi + 0x6ec]
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esi + 0x6c8], ebp
mov dword [esi + 0x6c4], ebp
mov dword [esi + 0x6cc], ebp
mov dword [esi + 0x6d0], ebp
mov dword [esi + 0x6d4], edi
mov dword [esi + 0x6d8], ebp
mov dword [esi + 0x6e0], ebp
mov dword [esi + 0x6e4], ebp
call fcn.12f56170
push edi
push ebp
lea ecx, [esi + 0x70c]
mov byte [esp + 0x30], 0xc
call fcn.12f4cce0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0xa
call fcn.12f561d0
push edi
push ebp
lea ecx, [esi + 0x720]
mov dword [esi + 0x71c], ebp
call fcn.12f4cce0
push edi
push ebp
lea ecx, [esi + 0x730]
mov dword [esi + 0x764], ebp
call fcn.12f4cce0
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x740], ebp
mov dword [esi + 0x6e8], ebp
mov dword [esi + 0x770], ebp
mov dword [esi + 0x774], ebp
mov dword [esi + 0x768], ebp
mov dword [esi + 0x76c], ebp
mov dword [esp + 0x28], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x12e98860
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x12e9892e
push ebx
call fcn.12f5c51d
push str.command:
push ebx
mov edi, eax
call fcn.12f5c53a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x12e988cb
push str.command:
call fcn.12f5c51d
push str.update
lea esi, [esi + eax*2]
call fcn.12f5c51d
push eax
push str.update
push esi
call fcn.12f5e383
add esp, 0x14
test eax, eax
jne 0x12e988cb
mov dword [ebp + 0x42c], 1
push str.path:_
push ebx
call fcn.12f5c53a
mov esi, eax
add esp, 8
test esi, esi
je 0x12e9892e
push str.path:_
call fcn.12f5c51d
lea esi, [esi + eax*2]
push 0x22
push esi
call fcn.12f5d099
mov edx, eax
add esp, 0xc
test edx, edx
je 0x12e9892e
cmp edi, 0x104
jae 0x12e9892e
sub edx, esi
add ebp, 0x218
push 0x103
mov ecx, 0x41
sar edx, 1
xor eax, eax
mov edi, ebp
push ebp
push edx
rep stosd dword es:[edi], eax
push esi
call fcn.12e2f870
mov ebp, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [0x13199068]
test eax, eax
je 0x12e9895e
mov ecx, dword [ebp + 0x42c]
mov edx, dword [ebp + 4]
lea eax, [ebp + 0x218]
push eax
push ecx
push edx
push ebx
push str.CSvnUpDownLog::AnalysisCmd___lpszCmdLine_:__s___m_dwType_:__d___m_bUpdateCmd_:__d____S_
push str.svnupdown
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x12e9a4e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131be198]
test eax, eax
jne 0x12e9a4f8
mov dword [0x131be198], 1
jmp 0x12e9a500
ret
sub esp, 0x208
mov ecx, 0x82
xor eax, eax
push edi
mov edi, 0x131be1a0
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, 0x131be3ac
rep stosd dword es:[edi], eax
call fcn.12f9c5b0
test eax, eax
je 0x12e9a553
push 0x104
push 0x131be1a0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0x104
push 0x131be3ac
call fcn.12f7a5b0
add esp, 0xc
jmp 0x12e9a5fe
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.12f7a4b0
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x103
not ecx
dec ecx
push 0x131be1a0
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push eax
call esi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x131be3ac
lea eax, [esp + 0x114]
push ecx
push eax
push 0
push 0
call esi
pop esi
push 0x131be1a0
call fcn.12f615c4
push 0x131be3ac
call fcn.12f615c4
push 0x131be1a0
call fcn.12f5c51d
push 0x131be3ac
mov dword [0x131be19c], eax
call fcn.12f5c51d
add esp, 0x10
mov dword [0x131be3a8], eax
pop edi
add esp, 0x208
ret
Function at 0x12e9bc60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306304b
push eax
mov eax, dword [0x131be5f4]
mov dword fs:[0], esp
sub esp, 0x910
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x12e9bea6
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.OAgent.ini
mov dword [0x131be5f4], 1
mov dword [esp + 0xc], ebx
stosb byte es:[edi], al
call fcn.12d8c1c0
push eax
lea eax, [esp + 0x1c]
push 0x130c4bec
push eax
call fcn.12f5cf6d
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push 0x400
push edx
push 0x13198dc0
push 0x1307a7c4
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jbe 0x12e9bd56
cmp byte [esp + 0x517], bl
jne 0x12e9bd56
lea eax, [esp + 0x518]
push 0x400
lea ecx, [esp + 0x11c]
push eax
push ecx
call fcn.12ffe6d0
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x12e9bd5a
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x12e9be64
lea ecx, [esp + 0xc]
call fcn.12f56d80
push 0x20019
push 0x1307a7c8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x92c], ebx
call fcn.12f56ef0
test eax, eax
je 0x12e9bdd9
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0x1307a810
call fcn.12f57310
cmp eax, ebx
je 0x12e9bdd9
mov ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x12e9bdcc
mov edx, ecx
push esi
mov esi, eax
lea edi, [esp + 0x51c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12e9bdd0
mov dword [esp + 8], ebx
push eax
call fcn.12f5c050
add esp, 4
lea ecx, [esp + 0xc]
call fcn.12f56f40
lea ecx, [esp + 0xc]
mov dword [esp + 0x920], 0xffffffff
call fcn.12f56e70
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x12e9be64
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x11c]
push eax
push 0x13198dc0
push 0x1307a810
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
jbe 0x12e9be5c
cmp byte [esp + 0x517], bl
jne 0x12e9be5c
lea ecx, [esp + 0x518]
push 0x400
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.12ffe6d0
add esp, 0xc
jmp 0x12e9be60
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x12e9bea6
cmp eax, 4
jbe 0x12e9bea6
lea ecx, [esp + 0x518]
test ecx, ecx
je 0x12e9bea6
cmp dword [esp + 0x518], 1
je 0x12e9bea6
mov edx, dword [esp + 0x534]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x12e9bea6
add eax, 0xfffffffc
cmp ecx, eax
ja 0x12e9bea6
mov eax, dword [esp + 0x520]
mov dword [0x131be5f0], eax
mov ecx, dword [esp + 0x918]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x91c
ret
Function at 0x12e9cf50
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push ebx
push 4
xor ebp, ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x12e9cfb7
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
pop edi
je 0x12e9cfb0
cmp dword [esp + 0x18], ebx
je 0x12e9cfac
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x12e9cfb0
cmp dword [esp + 0x18], ebx
jne 0x12e9cf97
mov ebp, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x12e9d6c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x131be5f8
jmp 0x12e9d6f0
push 0xffffffffffffffff
push 0x1306340e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebp, [esi + 8]
mov ecx, ebp
call fcn.12f55c40
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
push 1
mov byte [esp + 0x28], 1
push ebp
lea ecx, [esp + 0x18]
mov dword [esi], 0x1307a890
mov dword [esi + 4], edi
call fcn.12f56170
mov eax, dword [esi + 0x28]
mov byte [esp + 0x24], 2
cmp eax, edi
je 0x12e9d75f
push eax
call fcn.12f5c050
add esp, 4
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
mov dword [esp + 0x20], 0xffffffff
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x12ea29a0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131be6a8
jmp 0x12ea3ee0
push 0xffffffffffffffff
push 0x13063b63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], edi
call fcn.12f55c40
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret