joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e768a0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
test ebx, ebx
push edi
jne 0x12e768bb
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov ebp, eax
call esi
push 0
push 0
mov esi, eax
push 0
push 0x130dbc54
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
xor eax, eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
push ecx
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e76939
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push esi
push ebp
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push str.SavePrintScreenPhoto___d___d___d___d____d___d_
push str.Screenshot
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x24
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
mov eax, dword [esp + 0x28]
push eax
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
mov ecx, dword [esp + 0x30]
push 0
push edi
push ecx
push ebp
push 0
push 0
push esi
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
mov ebp, eax
call edi
push esi
call edi
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
sub esp, 0x10
mov eax, esp
push ebp
mov dword [eax], ecx
mov ecx, dword [ebx + 8]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.12e76630
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x12e796e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
xor eax, eax
mov ecx, dword [esi + 0x14]
mov edi, ebp
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x14]
mov edx, ecx
sub edx, edi
sub edx, eax
test edx, edx
jle 0x12e797e5
push ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor edx, edx
mov dl, byte [ebx + edi]
mov edi, dword [esi + 0xc]
xor ebx, ebx
mov bl, byte [ebp]
xor edx, ebx
mov dl, byte [edx + edi]
mov byte [esp + 0x1c], dl
mov ebx, dword [esp + 0x1c]
and ebx, 0xff
cmp ebx, ecx
je 0x12e79781
mov edi, 1
cmp eax, edi
jle 0x12e79781
mov ecx, dword [esi + 0x10]
xor edx, edx
sub ecx, edi
mov dl, byte [ecx + eax]
add edx, ebx
push edx
push esi
call fcn.12e79360
mov ecx, dword [esi + 8]
add esp, 8
mov dl, byte [eax + ecx]
mov al, byte [edi + ebp]
xor al, dl
mov byte [edi + ebp], al
mov eax, dword [esi + 0x14]
inc edi
cmp edi, eax
jl 0x12e79755
mov eax, dword [esi + 0x14]
lea ecx, [ebp + 1]
dec eax
push eax
push ecx
push ebp
call fcn.12f5c5c0
mov eax, dword [esi + 4]
add esp, 0xc
cmp ebx, eax
je 0x12e797bc
mov edx, dword [esi + 0x10]
xor eax, eax
mov al, byte [edx]
add eax, ebx
push eax
push esi
call fcn.12e79360
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
add esp, 8
mov al, byte [eax + ecx]
mov byte [edx + ebp - 1], al
jmp 0x12e797c4
mov ecx, dword [esi + 0x14]
mov byte [ecx + ebp - 1], 0
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x14]
mov edi, ecx
inc edx
sub edi, ebx
mov dword [esp + 0x14], edx
sub edi, eax
cmp edx, edi
jl 0x12e79720
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x12e7d100
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x12e7d10e
or eax, 0xffffffff
pop esi
ret
push 0
push esi
call fcn.12e7bf90
add esp, 8
test eax, eax
je 0x12e7d122
or eax, 0xffffffff
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
ret
Function at 0x12e7d510
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x13061271
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x238]
push edi
push 0x131912a8
lea ecx, [esp + 0x14]
call fcn.12f46b50
xor ebx, ebx
push 0x130e1f5c
mov dword [esp + 0x238], ebx
call fcn.12f5c51d
push eax
push 0x130e1f5c
push esi
call fcn.12f5e383
add esp, 0x10
test eax, eax
je 0x12e7d5e9
push 0x130e1f3c
call fcn.12f5c51d
push eax
push 0x130e1f3c
push esi
call fcn.12f5e383
add esp, 0x10
test eax, eax
je 0x12e7d5e9
push 0x130e1f1c
call fcn.12f5c51d
push eax
push 0x130e1f1c
push esi
call fcn.12f5e383
add esp, 0x10
test eax, eax
je 0x12e7d5e9
push 4
push 0x131093d0
push esi
call fcn.12f5d731
add esp, 0xc
test eax, eax
je 0x12e7d5e4
push 4
push 0x130b9230
push esi
call fcn.12f5d731
add esp, 0xc
test eax, eax
je 0x12e7d5e4
push 4
push 0x131093c4
push esi
call fcn.12f5d731
add esp, 0xc
test eax, eax
jne 0x12e7d668
add esi, 8
jmp 0x12e7d668
push esi
lea ecx, [esp + 0x14]
call fcn.12f47570
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
mov eax, dword [eax - 8]
add eax, 0xfffffffc
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.12f49830
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x238], 1
call fcn.12f47480
lea ecx, [esp + 0x14]
mov byte [esp + 0x234], bl
call fcn.12f472f0
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0x131093c4
push eax
call fcn.12f47c40
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x238], 2
call fcn.12f47480
lea ecx, [esp + 0x14]
mov byte [esp + 0x234], bl
call fcn.12f472f0
mov esi, dword [esp + 0x10]
push esi
call fcn.12f5c51d
add esp, 4
cmp eax, 4
jb 0x12e7d74b
cmp word [esi + 2], 0x3a
jne 0x12e7d74b
cmp word [esi + 4], 0x5c
lea ebp, [esi + 4]
jne 0x12e7d74b
mov ecx, dword [0x130e0f10]
mov dx, word [0x130e0f14]
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov cx, word [esi]
xor eax, eax
mov dword [esp + 0x1e], eax
push ecx
mov word [esp + 0x20], dx
mov word [esp + 0x26], ax
call fcn.12f5cd26
add esp, 4
cmp ax, 0x61
mov word [esp + 0x18], ax
jb 0x12e7d6d3
cmp ax, 0x7a
jbe 0x12e7d6df
cmp ax, 0x41
jb 0x12e7d74b
cmp ax, 0x5a
ja 0x12e7d74b
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x12e7d74b
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], 0x104
call sub.MPR.dll_WNetGetConnectionW
cmp eax, ebx
jne 0x12e7d74b
mov edi, dword [esp + 0x244]
mov esi, dword [esp + 0x240]
lea eax, [esp + 0x24]
push ebp
push eax
lea ecx, [edi - 1]
push 0x130c8b08
push ecx
push esi
call fcn.12f5d990
add esp, 0x14
jmp 0x12e7d767
mov edi, dword [esp + 0x244]
lea edx, [edi - 1]
push edx
push esi
mov esi, dword [esp + 0x248]
push esi
call fcn.12f5c57b
add esp, 0xc
mov word [esi + edi*2 - 2], bx
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], 0xffffffff
call fcn.12f472f0
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x228
ret
Function at 0x12e80460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13061730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.12e9bf00
xor edi, edi
push 1
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [esp + 0x44], 0
push str.single_network_enable
mov dword [esi + 0x10], 0
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.12e9c110
cmp dword [esp + 0x2c], 0xf0000001
jne 0x12e804de
lea ecx, [esp + 0xc]
call fcn.12e9c670
cmp eax, 1
je 0x12e804d5
cmp eax, 2
jne 0x12e804de
mov dword [esi + 0x10], 1
mov edi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e804ff
mov eax, dword [esi + 0x10]
push eax
push str.CSetInfoToMem::InitConfig__OneNetworkCardFunc_:__d_
push str.onenetworkcard
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret

Function at 0x12e809c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 8], ebp
je 0x12e809d4
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
cmp dword [edi + 0x18], ebp
je 0x12e809e4
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp eax, ebp
mov dword [edi + 0x14], esi
jne 0x12e80a02
cmp esi, ebp
jne 0x12e80a02
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
push ebx
xor ebx, ebx
cmp esi, ebp
mov dword [edi + 0x18], ebp
je 0x12e80a48
lea eax, [edi + 0x20]
push eax
push 0x65c
push ebp
push 4
call fcn.13005df0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebp
mov dword [edi + 0x1c], eax
je 0x12e80aa5
push ebp
push ebp
push ebp
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, ebp
je 0x12e80aa5
mov dword [edi + 0x18], 1
jmp 0x12e80aa5
cmp ebp, 1
mov esi, 6
jne 0x12e80a57
mov esi, 4
lea eax, [edi + 0x20]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [edi + 0x1c], eax
je 0x12e80a7f
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x12e80a87
inc ebp
cmp ebp, 2
jl 0x12e80a48
jmp 0x12e80a96
cmp esi, 4
jne 0x12e80a96
mov dword [edi + 0x124], 1
test ebx, ebx
je 0x12e80aa1
mov dword [edi + 0x18], 1
mov esi, dword [esp + 0x14]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x12e80ab1
mov dword [edi + 0xc], ebx
jmp 0x12e80ac6
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x12e80ac6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x1c], 0
mov ecx, dword [edi + 0x18]
push ecx
push esi
mov ecx, 0x131bb560
call fcn.12e82220
mov eax, dword [edi + 0x18]
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x12e86b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13061d96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.12e5a8f0
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x14], edi
call fcn.12e86b30
mov eax, dword [0x1307d248]
mov byte [esp + 0x14], 1
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 3
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12e87840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x13061f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x4c]
call fcn.12e9bf00
xor edi, edi
push 1
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.hookapi_pipe_srvsvc_dis
mov dword [esp + 0x88], edi
call fcn.12f46b50
lea ecx, [esp + 0x58]
mov byte [esp + 0x84], 0
call fcn.12e9c110
lea ecx, [esp + 0x4c]
call fcn.12e9c180
test eax, eax
je 0x12e87810
lea ecx, [esp + 0x2c]
call fcn.12f4cc70
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x7c], 2
call fcn.12e9c5e0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edi
cmp eax, edi
jle 0x12e87802
mov bl, 6
lea ecx, [esp + 0x3c]
call fcn.12f4cc70
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 3
call fcn.12f4cc70
lea ecx, [esp + 0x18]
push edi
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 4
call fcn.12d9ae00
mov eax, dword [eax]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x3c]
push edx
push ecx
push eax
mov ecx, ebp
mov byte [esp + 0x84], 5
call fcn.12e87430
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 4
call fcn.12f472f0
mov edx, dword [0x13196dcc]
lea eax, [esp + 0x3c]
push edx
push eax
mov ecx, ebp
call fcn.12e875c0
test eax, eax
je 0x12e877d5
mov eax, dword [esp + 0x20]
xor esi, esi
test eax, eax
jle 0x12e877d5
lea edi, [ebp + 4]
lea ecx, [esp + 0x10]
push esi
push ecx
lea ecx, [esp + 0x24]
call fcn.12d9ae00
push 0x130c4ed0
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], bl
call fcn.12f4ab60
push str.pipe_srvsvc
lea ecx, [esp + 0x14]
call fcn.12f47f40
mov eax, dword [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, edi
call fcn.12f4d280
mov eax, dword [0x13199068]
test eax, eax
je 0x12e877ba
mov eax, dword [esp + 0x10]
push eax
push esi
push str.CSimpleCfgMgr::Init__j_:__d___Path_:__s_
push 0x130d407c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], 4
call fcn.12f472f0
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
jl 0x12e87758
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 3
call fcn.12f4cc80
lea ecx, [esp + 0x3c]
mov byte [esp + 0x78], 2
call fcn.12f4cc80
mov eax, dword [esp + 0x30]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x12e876d4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 0
call fcn.12f4cc80
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x6c
ret
jmp 0x12e87640
Function at 0x12e87a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13061f70
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x131bcc00]
xor ebx, ebx
cmp ecx, ebx
je 0x12e87a44
cmp eax, ecx
jbe 0x12e87b1e
add ecx, 0x493e0
cmp ecx, eax
ja 0x12e87b1e
lea ecx, [esp + 0xc]
call fcn.12e9bf00
push 1
push ebx
push ecx
mov dword [esp + 0x44], ebx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.screenshot_log
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9c180
test eax, eax
je 0x12e87aaf
lea ecx, [esp + 0xc]
call fcn.12e9c670
cmp eax, 1
jne 0x12e87a94
mov dword [0x131bcbe4], eax
jmp 0x12e87ab5
cmp eax, 2
jne 0x12e87aaf
mov dword [0x131bcbe4], 1
mov dword [0x131bcbe8], 1
jmp 0x12e87abb
mov dword [0x131bcbe4], ebx
mov dword [0x131bcbe8], ebx
call fcn.12e87900
mov ecx, dword [0x131bcbe4]
cmp ecx, ebx
je 0x12e87ae2
cmp dword [0x131bcbf4], ebx
je 0x12e87ada
cmp dword [0x131bcbf8], ebx
je 0x12e87ae2
xor ecx, ecx
mov dword [0x131bcbe4], ecx
mov eax, dword [0x13199068]
cmp eax, ebx
je 0x12e87b06
mov eax, dword [0x131bcbe8]
push eax
push ecx
push str.CSnapShotLogMgr::CheckInit__Log:_d__Backup:_d_
push str.ImageCtrl
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
call edi
mov dword [0x131bcc00], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x30]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret

Function at 0x12e87bf0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
jne 0x12e87c51
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push str.TEC_OCULAR__AGENT_V3_MUTEX_OAGENTSOCKETMAIL
call fcn.12e30150
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov dword [esi + 0x44], eax
pop edi
jne 0x12e87c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x12e87c5f
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x12e87dc0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
je 0x12e87dd1
mov eax, 1
pop esi
ret
push 0x13123110
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x40], eax
je 0x12e87ec5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartMonitor
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x40]
push str.StopMonitor
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.SetUserName
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x40]
push str.SetLogFlag
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
push str.GetSmbLog
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.SetLocalIPs
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x40]
push str.SetSyncTime
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x40]
push str.SetLogMode
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.SetSmbLogFlag
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 0x40]
push str.DealEmailData
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x40]
push str.CheckLeaveEmailData
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.MoveEMailRecordTempLocation
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi + 0x40]
push str.ToCheckMailHistoryPath
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x40]
push str.ToCheckMailHistoryFile
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.ToStartMailDataRegMonitor
push ecx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], 1
pop edi
mov eax, dword [esi + 0x48]
pop esi
ret
Function at 0x12e89e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
push ebx
push ebp
xor ebp, ebp
mov eax, str.baidubrowser.exe
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0x130c6408
mov dword [esp + 0x18], str.360se.exe
mov dword [esp + 0x1c], 0x130c6470
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], str.iexplore.exe
mov dword [esp + 0x28], str.opera.exe
mov dword [esp + 0x2c], str.safari.exe
mov dword [esp + 0x30], str.qqbrowser.exe
mov dword [esp + 0x34], str.liebao.exe
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], str.360chrome.exe
mov dword [esp + 0x40], str.MircosoftEdge.exe
mov dword [esp + 0x44], str.baidunetdisk.exe
mov dword [esp + 0x48], str.wydrive.exe
mov dword [esp + 0x4c], str.baiduyunguanjia.exe
mov dword [esp + 0x50], str.sogouexplorer.exe
mov dword [esp + 0x54], str.115chrome.exe
mov dword [esp + 0x58], str.2345explorer.exe
mov dword [esp + 0x5c], str.theworld.exe
mov dword [esp + 0x60], str.plugin_container.exe
mov dword [esp + 0x64], str.qq.exe
mov dword [esp + 0x68], 0x130c5a04
mov dword [esp + 0x6c], str.skype.exe
mov dword [esp + 0x70], str.tim.exe
mov dword [esp + 0x74], str.fetion.exe
mov dword [esp + 0x78], str.rtx.exe
mov dword [esp + 0x7c], str.wxwork.exe
mov dword [esp + 0x80], str.alitalk.exe
mov dword [esp + 0x84], 0x130e1af0
mov dword [esp + 0x88], str.googletalk.exe
lea ebx, [esp + 0x14]
mov edi, dword [0x13196dcc]
test edi, edi
je 0x12e89f28
mov esi, dword [ebx]
push esi
call fcn.12f5c51d
push eax
push esi
push edi
call fcn.12f5e383
add esp, 0x10
test eax, eax
je 0x12e89f33
inc ebp
add ebx, 4
cmp ebp, 0x1e
jl 0x12e89f07
jmp 0x12e89f3b
mov dword [esp + 0x10], 1
mov eax, dword [0x13199068]
test eax, eax
je 0x12e89f67
mov esi, dword [esp + 0x10]
push esi
push str.FilterSpecialProcess_bRet__d_
push str.SocketLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
Function at 0x12e8a280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x130621f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], esi
xor edi, edi
call fcn.12f4cc70
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0x130c6c74
push ecx
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x48]
mov dword [esp + 0x1c], esi
call fcn.12f4baf0
mov edx, dword [esp + 0xc]
mov byte [esp + 0x30], 2
cmp dword [edx - 8], esi
je 0x12e8a32c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.12f4d280
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0x130c6c74
push eax
lea ecx, [esp + 0x48]
call fcn.12f4baf0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.12f47480
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.12f472f0
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 8], esi
jne 0x12e8a2db
mov eax, dword [0x13199068]
cmp eax, esi
je 0x12e8a34e
mov edx, dword [esp + 0x1c]
push edx
push str.IsMatchStrW__wstrarr.size:_d_
push str.SocketLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp dword [esp + 0x1c], esi
jle 0x12e8a3a2
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push 0
mov eax, dword [eax + esi*4]
push eax
push ebp
call fcn.12e31a10
mov edi, eax
mov eax, dword [0x13199068]
add esp, 0xc
test eax, eax
je 0x12e8a395
mov ecx, dword [esp + 0x18]
push edi
mov edx, dword [ecx + esi*4]
push edx
push esi
push ebp
push str.IsMatchStrW__lpsz:_s__wstrarr__d_:_s__bRet:_d_
push str.SocketLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
test edi, edi
jne 0x12e8a3a2
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x12e8a358
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.12f472f0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.12f4cc80
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f472f0
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x12e8a400
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131bcfb0
jmp 0x12e8a430
push 0xffffffffffffffff
push 0x13062216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.12f92ea0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.12f55c40
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 1
mov dword [esi], 0x1307a5f8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret