joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e31550
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push ebp
mov dword [esp + 0xc], eax
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x12e3157e
push ebx
call fcn.12f5c51d
add esp, 4
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x12e31593
push ebp
call fcn.12f5c51d
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add edx, ecx
lea edi, [edx + edx + 0x10]
push edi
call fcn.12f5c05b
mov esi, eax
add esp, 4
test esi, esi
jne 0x12e315b8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x12e315fa
mov edx, dword [esi]
lea eax, [esi + 0xc]
push edx
push ebx
push eax
call fcn.12f5c57b
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x12e31616
mov edx, dword [esi]
mov ecx, dword [esi + 4]
push ecx
push ebp
lea eax, [esi + edx*2 + 0xe]
push eax
call fcn.12f5c57b
add esp, 0xc
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
push 0
push esi
push 0x12e31650
push 0
mov dword [esi + 8], ecx
push 0
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x12e32190
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.12f5c51d
mov ebx, dword [esp + 0x24]
add esp, 4
mov ebp, eax
mov eax, 0x1f3
sub eax, ebp
push ebx
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x12e321d5
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
push edi
mov edi, 1
test byte [ebx], 0x10
je 0x12e322f2
add ebx, 0x2c
cmp word [ebx], 0x2e
jne 0x12e3220f
mov ecx, dword [esp + 0x24]
mov ax, word [ecx + 0x2e]
cmp ax, 0x2e
jne 0x12e32206
cmp word [ecx + 0x30], 0
je 0x12e322c1
test ax, ax
je 0x12e322c1
push ebx
call fcn.12f5c51d
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0x18], eax
inc eax
cmp ecx, eax
jb 0x12e322c1
mov eax, dword [esp + 0x2c]
lea ebp, [esi + ebp*2 - 2]
push eax
push 0x10002
push ebx
push esi
mov word [ebp], 0
call dword [esp + 0x38]
mov edi, eax
test edi, edi
je 0x12e322dd
push ebx
push esi
call fcn.12f5c935
push 0x13109518
push esi
call fcn.12f5c935
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
push esi
call fcn.12e32190
mov edi, eax
add esp, 0x20
test edi, edi
je 0x12e322dd
mov ecx, 0x82
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push ecx
push ebp
push ebx
call fcn.12f5c57b
mov edx, dword [esp + 0x38]
add esp, 0xc
mov word [ebp], 0
push edx
push 0x20002
push ebx
push esi
call dword [esp + 0x38]
mov edi, eax
mov eax, dword [esp + 0x20]
mov word [ebp], 0x2a
mov ebp, eax
mov word [esi + eax*2], 0
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x12e322dd
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x12e321db
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x2c]
lea edx, [ebx + 0x2c]
push ecx
push 1
push edx
push esi
mov word [esi + ebp*2 - 2], 0
call dword [esp + 0x38]
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
jmp 0x12e322c5
Function at 0x12e32b10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
xor edx, edx
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
je 0x12e32cbe
cmp dword [esp + 0x38], 0x200
jne 0x12e32cbe
push esi
push edi
mov ecx, 7
lea edi, [esp + 0x16]
mov word [esp + 0x14], dx
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], edx
rep stosd dword es:[edi], eax
mov eax, dword [0x130d5510]
mov ecx, dword [0x130d5514]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
add eax, 0x41
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], ax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
push ecx
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], edx
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x12e32c84
lea edx, [esp + 0x14]
push edx
call fcn.12f5c51d
lea esi, [ebx + 0x36]
push 5
push str.FAT16
push esi
mov edi, eax
call fcn.12f69be0
add esp, 0x10
test eax, eax
jne 0x12e32be4
cmp edi, 5
jne 0x12e32c1d
push edi
lea eax, [esp + 0x18]
push 0x131096bc
push eax
call fcn.12f5e383
add esp, 0xc
test eax, eax
je 0x12e32c39
push 5
push str.FAT12
push esi
call fcn.12f69be0
add esp, 0xc
test eax, eax
jne 0x12e32c45
cmp edi, 3
jne 0x12e32c45
push edi
lea edx, [esp + 0x18]
push 0x131096ac
push edx
call fcn.12f5e383
add esp, 0xc
test eax, eax
jne 0x12e32c45
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edi, 3
jne 0x12e32be4
push edi
lea ecx, [esp + 0x18]
push 0x131096ac
push ecx
call fcn.12f5e383
add esp, 0xc
test eax, eax
jne 0x12e32be4
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x28
ret
push 5
lea eax, [ebx + 0x52]
push str.FAT32
push eax
call fcn.12f69be0
add esp, 0xc
test eax, eax
jne 0x12e32c84
cmp edi, 5
jne 0x12e32c84
push edi
lea ecx, [esp + 0x18]
push 0x13109698
push ecx
call fcn.12f5e383
add esp, 0xc
test eax, eax
jne 0x12e32c84
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x28
ret
lea esi, [ebx + 3]
push 5
push str.EXFAT
push esi
call fcn.12f69be0
add esp, 0xc
test eax, eax
jne 0x12e32ca7
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x28
ret
push 4
push str.NTFS
push esi
call fcn.12f69be0
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x12e32cd0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov ebx, dword [esp + 0x118]
rep stosd dword es:[edi], eax
mov cl, byte [0x131096e2]
xor esi, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x131096e0]
mov byte [esp + 0xe], cl
test ebx, ebx
mov word [esp + 0xc], ax
je 0x12e32d15
cmp ebx, 1
jne 0x12e32d2d
call fcn.12f9c5b0
test eax, eax
jne 0x12e32d2d
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x108
ret
lea edx, [esp + 0x10]
push 0x104
lea eax, [esp + 0x10]
add bl, 0x41
push edx
push eax
mov byte [esp + 0x18], bl
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jbe 0x12e32d9e
cmp eax, 0x104
jae 0x12e32d9e
lea ecx, [esp + 0x10]
push ecx
call fcn.12f5e908
lea edx, [esp + 0x14]
push str.cdrom
push edx
call fcn.12f5df34
add esp, 0xc
test eax, eax
je 0x12e32d79
mov esi, 5
lea eax, [esp + 0x10]
push str.floppy
push eax
call fcn.12f5df34
add esp, 8
test eax, eax
je 0x12e32daa
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x108
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x12e331a0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x64
xor eax, eax
push ebx
mov ebx, dword [esp + 0x70]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x70]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.12f9c5b0
test eax, eax
je 0x12e33264
push 0x41
push 0
push 1
push 0x131096fc
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov esi, eax
test esi, esi
jne 0x12e331ef
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x12e33300
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x12e33236
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x84], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x12e332e2
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x12e332b4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x12e332f4
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x12e333a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
xor ecx, ecx
xor edi, edi
xor eax, eax
mov esi, 0x200
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x12e333ca
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 1
jne 0x12e333d6
mov esi, 0x400
jmp 0x12e33424
cmp eax, 2
jne 0x12e33424
xor eax, eax
lea edx, [esp + 0x38]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x2c], eax
push 0x18
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 0x70000
push ebp
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x12e33484
mov esi, dword [esp + 0x2c]
cmp esi, 0x200
jb 0x12e33484
push esi
call fcn.12f5c05b
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
jne 0x12e3347a
mov edx, dword [ebx]
push edx
call fcn.12f5c050
mov eax, dword [esp + 0x14]
add esp, 4
inc eax
mov dword [ebx], edi
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x12e333c4
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x12e34660
Capabilities:
Get disk information

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
cmp esi, edi
je 0x12e346c4
push esi
call fcn.12f5c51d
add esp, 4
cmp eax, 2
jb 0x12e346c4
mov ax, word [esi]
cmp ax, 0x5c
jne 0x12e3468c
cmp word [esi + 2], ax
je 0x12e346b9
mov word [esp + 8], ax
mov ax, word [esi + 2]
lea ecx, [esp + 8]
mov word [esp + 0xa], ax
push ecx
mov word [esp + 0x10], di
mov word [esp + 0x12], di
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x12e346b9
cmp eax, 1
jne 0x12e346c4
pop edi
mov eax, 1
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x12e380e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1305d4f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.12e38270
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
push 0x131912a8
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 1
call fcn.12f46b50
mov eax, dword [0x1307d24c]
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 2
mov dword [ecx], eax
push 0x131912a8
mov byte [esp + 0x18], 3
call fcn.12f47570
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12e39520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1305d807
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
push 0x131912a8
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0
call fcn.12f46b50
push 0x131912a8
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call fcn.12f46b50
mov ebp, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ebp
mov byte [esp + 0x2c], 2
call fcn.12f468f0
mov esi, dword [edi + 4]
mov edi, dword [edi + 0x10]
test edi, edi
mov byte [esp + 0x28], 3
mov dword [esp + 0x34], 0
jle 0x12e3960e
mov eax, esi
mov esi, dword [esi]
add eax, 0x14
lea ecx, [esp + 0xc]
push eax
call fcn.12f47570
push 0x5c
lea ecx, [esp + 0x10]
call fcn.12f484a0
inc eax
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.12f495e0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call fcn.12f47480
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 3
call fcn.12f472f0
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.12f5d02e
add esp, 8
test eax, eax
je 0x12e39600
mov eax, dword [esp + 0x34]
inc eax
cmp eax, edi
mov dword [esp + 0x34], eax
jl 0x12e39593
jmp 0x12e3960e
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
call fcn.12f47480
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.12f468f0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.12f472f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.12f472f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.12f472f0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x12e39d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305d8eb
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
push ebp
mov ebp, dword [esp + 0x240]
push edi
cmp ebp, 0xffffffff
mov ebx, ecx
je 0x12e39eb0
mov eax, dword [esp + 0x248]
xor edi, edi
cmp eax, edi
je 0x12e39eb0
push esi
lea eax, [ebx + 0x1c]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.12f56170
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], edi
push ecx
push ebp
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
call fcn.12e39c20
mov esi, eax
cmp esi, edi
je 0x12e39de9
mov dword [esp + 0x10], edi
mov ecx, 0x85
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x24c]
mov dword [esi + 4], eax
push 0x103
lea eax, [esi + 0xc]
push edx
push eax
call fcn.12f5c57b
mov ecx, dword [esp + 0x25c]
add esp, 0xc
mov dword [esi + 8], ecx
jmp 0x12e39e95
mov ecx, 0x84
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x24c]
mov dword [esp + 0x28], eax
push 0x103
lea eax, [esp + 0x34]
push edx
push eax
call fcn.12f5c57b
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x25c]
mov esi, dword [ebx + 4]
add esp, 0xc
test edx, edx
mov dword [esp + 0x2c], ecx
jne 0x12e39e48
push 0x21c
call fcn.12f5c05b
mov edx, eax
add esp, 4
test edx, edx
je 0x12e39e95
jmp 0x12e39e54
mov eax, dword [edx]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x14]
dec eax
mov dword [ebx + 0x14], eax
mov dword [edx + 4], 0
mov dword [edx], esi
mov ecx, dword [ebx + 0x10]
lea ebp, [edx + 8]
inc ecx
xor eax, eax
mov dword [ebx + 0x10], ecx
mov ecx, 0x85
mov edi, ebp
test edx, edx
rep stosd dword es:[edi], eax
je 0x12e39e95
mov ecx, 0x85
lea esi, [esp + 0x24]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x12e39e8f
mov dword [eax + 4], edx
jmp 0x12e39e92
mov dword [ebx + 8], edx
mov dword [ebx + 4], edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x240], 0xffffffff
call fcn.12f561d0
mov eax, dword [esp + 0x10]
pop esi
jmp 0x12e39eb5
mov eax, 1
mov ecx, dword [esp + 0x234]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret 0xc
Function at 0x12e3a370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1305d9c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push 1
push esi
lea ecx, [esp + 0x18]
call fcn.12f56170
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x2c], ebx
push edx
mov ecx, esi
mov dword [esp + 0x18], ebx
call fcn.12e3a730
mov edi, eax
cmp edi, ebx
je 0x12e3a48f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 8]
cmp eax, ecx
jb 0x12e3a3ed
add ecx, 0x7530
cmp eax, ecx
ja 0x12e3a3ed
mov ecx, dword [esp + 0x34]
mov eax, dword [edi + 0xc]
mov ebx, 1
mov dword [ecx], eax
jmp 0x12e3a48f
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jne 0x12e3a3ff
mov edx, dword [eax]
mov dword [esi + 0x20], edx
jmp 0x12e3a406
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ecx], edx
cmp eax, dword [esi + 0x24]
jne 0x12e3a413
mov ecx, dword [eax + 4]
mov dword [esi + 0x24], ecx
jmp 0x12e3a41b
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp edx, ecx
jge 0x12e3a432
mov ecx, dword [esi + 0x28]
mov dword [eax], ecx
mov dword [esi + 0x28], eax
inc dword [esi + 0x30]
jmp 0x12e3a43b
push eax
call fcn.12f5c050
add esp, 4
mov eax, dword [esi + 0x2c]
dec eax
mov dword [esi + 0x2c], eax
jne 0x12e3a48f
mov eax, dword [esi + 0x20]
mov ecx, eax
cmp ecx, ebx
je 0x12e3a453
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x12e3a44d
cmp eax, ebx
je 0x12e3a468
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12e3a457
mov eax, dword [esi + 0x28]
mov dword [esi + 0x2c], ebx
cmp eax, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
je 0x12e3a489
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12e3a478
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x12e3a4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1305d9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.12f56170
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x18], eax
xor edx, edx
test ecx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
setne dl
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
mov ecx, esi
call fcn.12e3a780
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x12e3cb80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1305ddcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x13078510
lea esi, [edi + 0x4c]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 8
call fcn.12f472f0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 7
call fcn.12f472f0
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 6
call fcn.12f472f0
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 5
call fcn.12f472f0
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 4
call fcn.12f472f0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 3
call fcn.12f472f0
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call fcn.12f472f0
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 0
call fcn.12f472f0
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.12f8b5e0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x12e3db30
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x12e3db3b
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.12f513e0
add esp, 8
ret 4
Function at 0x12e3dc50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x12e3dd8b
push 4
push esi
call fcn.12e34360
add esp, 8
test eax, eax
jne 0x12e3dd8b
mov eax, dword [esp + 0xc]
lea esi, [esi + eax*4]
test esi, esi
je 0x12e3dd8b
mov eax, dword [0x13199068]
push ebx
mov ebx, dword [esi]
push ebp
test eax, eax
je 0x12e3dca7
mov ecx, dword [esp + 0x18]
push ecx
push ebx
push esi
push str.SetHookVTable_1_vtable_0x_08x__OldFunc_0x_08x__NewFunc_0x_08x_
push str.HookCOM
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
test ebx, ebx
je 0x12e3dd66
cmp ebx, dword [esp + 0x18]
je 0x12e3dd66
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x10]
push edi
push edx
push 0x40
push 4
push esi
mov dword [esp + 0x24], 0
call ebp
mov edi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e3dd00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x18]
push eax
push edi
push str.SetHookVTable_2_VirtualProtect______ret__d__old__d__err__08x_
push str.HookCOM
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
test edi, edi
pop edi
je 0x12e3dd54
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
mov dword [esi], ecx
push edx
push eax
push 4
push esi
mov dword [esp + 0x28], 0
call ebp
mov esi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e3dd85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
push str.SetHookVTable_3_VirtualProtect__ret__d__old__d__err__08x_
push str.HookCOM
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov eax, ebx
pop ebp
pop ebx
pop esi
ret
mov eax, dword [0x13199068]
xor ebx, ebx
test eax, eax
je 0x12e3dd85
push str.SetHookVTable_4
jmp 0x12e3dd76
mov eax, dword [0x13199068]
xor ebx, ebx
test eax, eax
je 0x12e3dd85
push str.SetHookVTable_5
push str.HookCOM
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, ebx
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret