joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e80450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13061660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.12e9bef0
xor edi, edi
push 1
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [esp + 0x44], 0
push str.single_network_enable
mov dword [esi + 0x10], 0
call fcn.12f46a80
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.12e9c100
cmp dword [esp + 0x2c], 0xf0000001
jne 0x12e804ce
lea ecx, [esp + 0xc]
call fcn.12e9c660
cmp eax, 1
je 0x12e804c5
cmp eax, 2
jne 0x12e804ce
mov dword [esi + 0x10], 1
mov edi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e804ef
mov eax, dword [esi + 0x10]
push eax
push 0x13121e90
push 0x13121df8
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c060
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret

Function at 0x12e809b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 8], ebp
je 0x12e809c4
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
cmp dword [edi + 0x18], ebp
je 0x12e809d4
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp eax, ebp
mov dword [edi + 0x14], esi
jne 0x12e809f2
cmp esi, ebp
jne 0x12e809f2
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
push ebx
xor ebx, ebx
cmp esi, ebp
mov dword [edi + 0x18], ebp
je 0x12e80a38
lea eax, [edi + 0x20]
push eax
push 0x65c
push ebp
push 4
call fcn.13005d20
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebp
mov dword [edi + 0x1c], eax
je 0x12e80a95
push ebp
push ebp
push ebp
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, ebp
je 0x12e80a95
mov dword [edi + 0x18], 1
jmp 0x12e80a95
cmp ebp, 1
mov esi, 6
jne 0x12e80a47
mov esi, 4
lea eax, [edi + 0x20]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [edi + 0x1c], eax
je 0x12e80a6f
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x12e80a77
inc ebp
cmp ebp, 2
jl 0x12e80a38
jmp 0x12e80a86
cmp esi, 4
jne 0x12e80a86
mov dword [edi + 0x124], 1
test ebx, ebx
je 0x12e80a91
mov dword [edi + 0x18], 1
mov esi, dword [esp + 0x14]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x12e80aa1
mov dword [edi + 0xc], ebx
jmp 0x12e80ab6
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x12e80ab6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x1c], 0
mov ecx, dword [edi + 0x18]
push ecx
push esi
mov ecx, 0x131bb460
call fcn.12e82210
mov eax, dword [edi + 0x18]
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x12e86b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13061cc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.12e5a8f0
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x14], edi
call fcn.12e86b20
mov eax, dword [0x1307d258]
mov byte [esp + 0x14], 1
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 3
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12e87830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x13061e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x4c]
call fcn.12e9bef0
xor edi, edi
push 1
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.hookapi_pipe_srvsvc_dis
mov dword [esp + 0x88], edi
call fcn.12f46a80
lea ecx, [esp + 0x58]
mov byte [esp + 0x84], 0
call fcn.12e9c100
lea ecx, [esp + 0x4c]
call fcn.12e9c170
test eax, eax
je 0x12e87800
lea ecx, [esp + 0x2c]
call fcn.12f4cba0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x7c], 2
call fcn.12e9c5d0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edi
cmp eax, edi
jle 0x12e877f2
mov bl, 6
lea ecx, [esp + 0x3c]
call fcn.12f4cba0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 3
call fcn.12f4cba0
lea ecx, [esp + 0x18]
push edi
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 4
call fcn.12d9ae00
mov eax, dword [eax]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x3c]
push edx
push ecx
push eax
mov ecx, ebp
mov byte [esp + 0x84], 5
call fcn.12e87420
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 4
call fcn.12f47220
mov edx, dword [0x13196ccc]
lea eax, [esp + 0x3c]
push edx
push eax
mov ecx, ebp
call fcn.12e875b0
test eax, eax
je 0x12e877c5
mov eax, dword [esp + 0x20]
xor esi, esi
test eax, eax
jle 0x12e877c5
lea edi, [ebp + 4]
lea ecx, [esp + 0x10]
push esi
push ecx
lea ecx, [esp + 0x24]
call fcn.12d9ae00
push 0x130c4ed0
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], bl
call fcn.12f4aa90
push 0x13122dc8
lea ecx, [esp + 0x14]
call fcn.12f47e70
mov eax, dword [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, edi
call fcn.12f4d1b0
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e877aa
mov eax, dword [esp + 0x10]
push eax
push esi
push 0x13122d74
push 0x130d407c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], 4
call fcn.12f47220
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
jl 0x12e87748
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 3
call fcn.12f4cbb0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x78], 2
call fcn.12f4cbb0
mov eax, dword [esp + 0x30]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x12e876c4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 0
call fcn.12f4cbb0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.12e9c060
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x6c
ret
jmp 0x12e87630
Function at 0x12e879f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13061ea0
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x131bcb00]
xor ebx, ebx
cmp ecx, ebx
je 0x12e87a34
cmp eax, ecx
jbe 0x12e87b0e
add ecx, 0x493e0
cmp ecx, eax
ja 0x12e87b0e
lea ecx, [esp + 0xc]
call fcn.12e9bef0
push 1
push ebx
push ecx
mov dword [esp + 0x44], ebx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.screenshot_log
call fcn.12f46a80
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call fcn.12e9c100
lea ecx, [esp + 0xc]
call fcn.12e9c170
test eax, eax
je 0x12e87a9f
lea ecx, [esp + 0xc]
call fcn.12e9c660
cmp eax, 1
jne 0x12e87a84
mov dword [0x131bcae4], eax
jmp 0x12e87aa5
cmp eax, 2
jne 0x12e87a9f
mov dword [0x131bcae4], 1
mov dword [0x131bcae8], 1
jmp 0x12e87aab
mov dword [0x131bcae4], ebx
mov dword [0x131bcae8], ebx
call fcn.12e878f0
mov ecx, dword [0x131bcae4]
cmp ecx, ebx
je 0x12e87ad2
cmp dword [0x131bcaf4], ebx
je 0x12e87aca
cmp dword [0x131bcaf8], ebx
je 0x12e87ad2
xor ecx, ecx
mov dword [0x131bcae4], ecx
mov eax, dword [0x13198f68]
cmp eax, ebx
je 0x12e87af6
mov eax, dword [0x131bcae8]
push eax
push ecx
push 0x13122f30
push 0x13122e54
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
call edi
mov dword [0x131bcb00], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c060
mov ecx, dword [esp + 0x30]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret

Function at 0x12e87be0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
jne 0x12e87c41
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x13122f94
call fcn.12e30150
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov dword [esi + 0x44], eax
pop edi
jne 0x12e87c41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x12e87c4f
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x12e87db0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
je 0x12e87dc1
mov eax, 1
pop esi
ret
push 0x131230c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x40], eax
je 0x12e87eb5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x131230b0
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x40]
push 0x131230a4
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x13123098
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x40]
push 0x1312308c
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
push 0x13123080
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x13123074
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x40]
push 0x13123068
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x40]
push 0x1312305c
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x1312304c
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 0x40]
push 0x1312303c
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x40]
push 0x13123028
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x1312300c
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi + 0x40]
push 0x13122ff4
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x40]
push 0x13122fdc
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x13122fc0
push ecx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], 1
pop edi
mov eax, dword [esi + 0x48]
pop esi
ret
Function at 0x12e89df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
push ebx
push ebp
xor ebp, ebp
mov eax, 0x13123840
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0x130c6408
mov dword [esp + 0x18], str.360se.exe
mov dword [esp + 0x1c], 0x130c6470
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], str.iexplore.exe
mov dword [esp + 0x28], str.opera.exe
mov dword [esp + 0x2c], 0x13123828
mov dword [esp + 0x30], str.qqbrowser.exe
mov dword [esp + 0x34], str.liebao.exe
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], str.360chrome.exe
mov dword [esp + 0x40], 0x13123804
mov dword [esp + 0x44], str.baidunetdisk.exe
mov dword [esp + 0x48], str.wydrive.exe
mov dword [esp + 0x4c], str.baiduyunguanjia.exe
mov dword [esp + 0x50], str.sogouexplorer.exe
mov dword [esp + 0x54], str.115chrome.exe
mov dword [esp + 0x58], str.2345explorer.exe
mov dword [esp + 0x5c], str.theworld.exe
mov dword [esp + 0x60], 0x131237d8
mov dword [esp + 0x64], str.qq.exe
mov dword [esp + 0x68], 0x130c5a04
mov dword [esp + 0x6c], 0x13121a5c
mov dword [esp + 0x70], str.tim.exe
mov dword [esp + 0x74], 0x131237c0
mov dword [esp + 0x78], 0x131237b0
mov dword [esp + 0x7c], str.wxwork.exe
mov dword [esp + 0x80], 0x13123798
mov dword [esp + 0x84], 0x130e1af0
mov dword [esp + 0x88], 0x13123778
lea ebx, [esp + 0x14]
mov edi, dword [0x13196ccc]
test edi, edi
je 0x12e89f18
mov esi, dword [ebx]
push esi
call fcn.12f5c44d
push eax
push esi
push edi
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
je 0x12e89f23
inc ebp
add ebx, 4
cmp ebp, 0x1e
jl 0x12e89ef7
jmp 0x12e89f2b
mov dword [esp + 0x10], 1
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e89f57
mov esi, dword [esp + 0x10]
push esi
push 0x1312373c
push 0x1312351c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
Function at 0x12e8a270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13062120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], esi
xor edi, edi
call fcn.12f4cba0
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0x130c6c74
push ecx
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x48]
mov dword [esp + 0x1c], esi
call fcn.12f4ba20
mov edx, dword [esp + 0xc]
mov byte [esp + 0x30], 2
cmp dword [edx - 8], esi
je 0x12e8a31c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.12f4d1b0
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0x130c6c74
push eax
lea ecx, [esp + 0x48]
call fcn.12f4ba20
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.12f473b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.12f47220
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 8], esi
jne 0x12e8a2cb
mov eax, dword [0x13198f68]
cmp eax, esi
je 0x12e8a33e
mov edx, dword [esp + 0x1c]
push edx
push 0x131239c4
push 0x1312351c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp dword [esp + 0x1c], esi
jle 0x12e8a392
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push 0
mov eax, dword [eax + esi*4]
push eax
push ebp
call fcn.12e31a10
mov edi, eax
mov eax, dword [0x13198f68]
add esp, 0xc
test eax, eax
je 0x12e8a385
mov ecx, dword [esp + 0x18]
push edi
mov edx, dword [ecx + esi*4]
push edx
push esi
push ebp
push 0x13123964
push 0x1312351c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
test edi, edi
jne 0x12e8a392
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x12e8a348
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.12f47220
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.12f4cbb0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f47220
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x12e8a436
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131bceb0
jmp 0x12e8a420
push 0xffffffffffffffff
push 0x13062146
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.12f92dd0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.12f55b70
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 1
mov dword [esi], 0x1307a5f8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12e8c570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x130622c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 4]
lea ecx, [esp + 0x14]
push eax
call fcn.12f560a0
mov edi, dword [esp + 0x2c]
mov ebp, dword [esi + 0x28]
mov eax, edi
xor edx, edx
shr eax, 4
div ebp
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x24], 0
test ecx, ecx
mov ebx, edx
je 0x12e8c5de
mov eax, dword [ecx + ebx*4]
test eax, eax
je 0x12e8c5da
cmp dword [eax + 8], edi
je 0x12e8c5d2
mov eax, dword [eax]
test eax, eax
jne 0x12e8c5c5
jmp 0x12e8c5da
test eax, eax
jne 0x12e8c67f
test ecx, ecx
jne 0x12e8c60e
lea edi, [ebp*4]
push edi
call fcn.12f5bf8b
mov edx, eax
mov ecx, edi
mov dword [esi + 0x24], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x2c]
mov dword [esi + 0x28], ebp
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x12e8c644
mov eax, dword [esi + 0x38]
push 0x20
lea ecx, [esi + 0x34]
push eax
push ecx
call fcn.12f549d0
mov ecx, dword [esi + 0x38]
mov edx, ecx
shl edx, 5
dec ecx
test ecx, ecx
lea eax, [edx + eax - 0x18]
jl 0x12e8c644
inc ecx
mov edx, dword [esi + 0x30]
mov dword [eax], edx
mov dword [esi + 0x30], eax
sub eax, 0x20
dec ecx
jne 0x12e8c636
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x2c]
inc ecx
xor edx, edx
mov dword [esi + 0x2c], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + ebx*4]
mov dword [eax], edx
mov ecx, dword [esi + 0x24]
mov dword [ecx + ebx*4], eax
mov esi, dword [esp + 0x30]
lea edi, [eax + 0xc]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f56100
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x12e8c870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
xor eax, eax
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0xe], eax
push esi
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x1a], eax
lea edx, [esp + 0x14]
push ecx
xor edi, edi
mov dword [esp + 0x22], eax
push edx
push ebp
mov word [esp + 0x20], di
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e8c8d4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebx
call fcn.12e8c9c0
mov edi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e8c910
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov cx, word [edx]
xor edx, edx
push ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
cmp esi, 0xffffffff
setne dl
push ecx
push edx
push eax
push 0x1312566c
push 0x131247dc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x12e8c939
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.12e8c9c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x1c
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov ebp, dword [esp + 0x38]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e8c976
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push ebp
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebx
call fcn.12e8c9c0
mov edi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e8c9af
mov edx, dword [esp + 0x34]
xor ecx, ecx
mov cx, word [ebp]
mov eax, dword [edx]
mov edx, dword [esp + 0x10]
push ecx
xor ecx, ecx
cmp esi, 0xffffffff
push eax
setne cl
push ecx
push edx
push 0x131255b0
push 0x131247dc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x1c
Function at 0x12e8db50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13062408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x1c]
lea ecx, [esp + 0x14]
push eax
call fcn.12f560a0
mov edi, dword [esp + 0x2c]
mov ebx, dword [esi + 8]
mov eax, edi
xor edx, edx
shr eax, 4
div ebx
mov ecx, dword [esi + 4]
mov dword [esp + 0x24], 0
test ecx, ecx
mov ebp, edx
je 0x12e8dbbe
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x12e8dbba
cmp dword [eax + 8], edi
je 0x12e8dbb2
mov eax, dword [eax]
test eax, eax
jne 0x12e8dba5
jmp 0x12e8dbba
test eax, eax
jne 0x12e8dc62
test ecx, ecx
jne 0x12e8dbea
lea edi, [ebx*4]
push edi
call fcn.12f5bf8b
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x12e8dc21
mov eax, dword [esi + 0x18]
push 0x50
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.12f549d0
mov ecx, dword [esi + 0x18]
lea edx, [ecx + ecx*4]
shl edx, 4
dec ecx
test ecx, ecx
lea eax, [edx + eax - 0x48]
jl 0x12e8dc21
inc ecx
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x50
dec ecx
jne 0x12e8dc13
mov edi, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
inc ecx
push 1
mov eax, dword [edi]
lea ebx, [edi + 8]
push ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ecx
call fcn.12e8f580
lea ecx, [edi + 0xc]
push 1
push ecx
call fcn.12e8f590
mov edx, dword [esp + 0x3c]
mov dword [edi + 4], ebp
mov dword [ebx], edx
mov ecx, dword [esi + 4]
add esp, 0x10
mov eax, edi
mov edx, dword [ecx + ebp*4]
mov dword [edi], edx
mov ecx, dword [esi + 4]
mov dword [ecx + ebp*4], edi
mov ecx, dword [esp + 0x30]
lea esi, [eax + 0x14]
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x10], edx
mov dx, word [ecx + 0x18]
mov word [eax + 0x24], dx
mov dx, word [ecx + 0x1a]
mov word [eax + 0x26], dx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x28], edx
lea edx, [ecx + 8]
mov edi, dword [ecx + 8]
mov dword [esi], edi
mov edi, dword [edx + 4]
mov dword [esi + 4], edi
mov edi, dword [edx + 8]
mov dword [esi + 8], edi
mov edx, dword [edx + 0xc]
mov dword [esi + 0xc], edx
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x2c], edx
mov dx, word [ecx + 0x34]
mov word [eax + 0x40], dx
mov dx, word [ecx + 0x36]
mov word [eax + 0x42], dx
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x44], edx
lea edx, [ecx + 0x24]
lea esi, [eax + 0x30]
mov edi, dword [edx]
mov dword [esi], edi
mov edi, dword [edx + 4]
mov dword [esi + 4], edi
mov edi, dword [edx + 8]
mov dword [esi + 8], edi
mov edx, dword [edx + 0xc]
mov dword [esi + 0xc], edx
mov dx, word [ecx + 0x3c]
mov word [eax + 0x48], dx
mov dx, word [ecx + 0x3e]
mov word [eax + 0x4a], dx
mov ecx, dword [ecx + 0x40]
mov dword [eax + 0x4c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f56100
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8