joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e8e800
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
mov dword [esp + 0x10], 0x1c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov esi, dword [esp + 0x38]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x12e8e85d
mov eax, dword [esp + 0x10]
lea edx, [esi + 4]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.12e4eec0
add esp, 0xc
mov ebp, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e8e894
mov eax, dword [esi + 4]
xor edx, edx
mov dx, word [esi + 0x18]
xor ecx, ecx
cmp ebx, 0xffffffff
push edx
mov edx, dword [esp + 0x14]
push eax
setne cl
push ecx
push edx
push edi
push 0x13126790
push 0x131247dc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x12e8e8b8
mov ecx, dword [esp + 0x40]
add esi, 0x20
push esi
push ecx
push eax
call fcn.12e4eec0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
mov dword [esp + 0x1c], 0x1c
call dword [sym.imp.WS2_32.dll_getpeername]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x12e8e8f0
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.12e4eec0
add esp, 0xc
mov ebp, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e8e927
mov edx, dword [esi + 0x20]
xor ecx, ecx
mov cx, word [esi + 0x34]
xor eax, eax
cmp ebx, 0xffffffff
push ecx
mov ecx, dword [esp + 0x14]
push edx
setne al
push eax
push ecx
push edi
push 0x131266c0
push 0x131247dc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10

Function at 0x12e8eb70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x20
push esi
push edi
xor esi, esi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], si
mov edx, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x14], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x12e8ebcc
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 8]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.12e4eec0
add esp, 0xc
pop edi
pop esi
add esp, 0x20
ret 8
mov eax, esi
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x12e8f61a
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131bcff0
jmp 0x12e8f600
push 0xffffffffffffffff
push 0x13062647
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.12f55b70
xor ebp, ebp
lea ecx, [esi + 0x230]
mov dword [esp + 0x28], ebp
call fcn.12f55b70
lea ecx, [esi + 0x660]
mov byte [esp + 0x28], 1
call fcn.12f55b70
lea ebx, [esi + 0x680]
mov byte [esp + 0x28], 2
mov dword [ebx], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 4], ebp
lea ecx, [esi + 0x694]
mov byte [esp + 0x28], 3
call fcn.12f55b70
mov byte [esp + 0x28], 4
mov dword [esi + 0x6b4], ebp
mov dword [esi + 0x6c0], ebp
mov dword [esi + 0x6bc], ebp
mov dword [esi + 0x6b8], ebp
lea ecx, [esi + 0x6ec]
mov byte [esp + 0x28], 5
call fcn.12f55b70
lea ecx, [esi + 0x70c]
mov byte [esp + 0x28], 6
call fcn.12f4cba0
lea ecx, [esi + 0x720]
mov byte [esp + 0x28], 7
call fcn.12f4cba0
lea ecx, [esi + 0x730]
mov byte [esp + 0x28], 8
call fcn.12f4cba0
mov eax, dword [0x1307d25c]
mov byte [esp + 0x28], 9
mov dword [esi + 0x75c], eax
mov byte [esp + 0x28], 0xa
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x24]
mov dword [esi], 0x1307a750
mov dword [esi + 0x22c], ebp
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x458]
rep stosd dword es:[edi], eax
or edi, 0xffffffff
mov ecx, ebx
push edi
push ebp
call fcn.12e96110
lea eax, [esi + 0x694]
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esi + 0x690], ebp
call fcn.12f560a0
mov byte [esp + 0x28], 0xb
push edi
push ebp
lea ecx, [esi + 0x6b4]
call fcn.12e96290
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0xa
call fcn.12f56100
lea eax, [esi + 0x6ec]
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esi + 0x6c8], ebp
mov dword [esi + 0x6c4], ebp
mov dword [esi + 0x6cc], ebp
mov dword [esi + 0x6d0], ebp
mov dword [esi + 0x6d4], edi
mov dword [esi + 0x6d8], ebp
mov dword [esi + 0x6e0], ebp
mov dword [esi + 0x6e4], ebp
call fcn.12f560a0
push edi
push ebp
lea ecx, [esi + 0x70c]
mov byte [esp + 0x30], 0xc
call fcn.12f4cc10
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0xa
call fcn.12f56100
push edi
push ebp
lea ecx, [esi + 0x720]
mov dword [esi + 0x71c], ebp
call fcn.12f4cc10
push edi
push ebp
lea ecx, [esi + 0x730]
mov dword [esi + 0x764], ebp
call fcn.12f4cc10
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x740], ebp
mov dword [esi + 0x6e8], ebp
mov dword [esi + 0x770], ebp
mov dword [esi + 0x774], ebp
mov dword [esi + 0x768], ebp
mov dword [esi + 0x76c], ebp
mov dword [esp + 0x28], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x12e910a0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x130628eb
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x690]
xor edi, edi
cmp eax, edi
jne 0x12e910d9
cmp dword [ebx + 0x6d8], 1
jne 0x12e912f1
mov esi, dword [esp + 0x244]
cmp esi, edi
je 0x12e912f1
cmp esi, 0xffffffff
je 0x12e912f1
cmp dword [esp + 0x248], edi
je 0x12e912f1
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
lea eax, [ebx + 0x694]
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.12f560a0
mov eax, dword [0x13198f68]
mov dword [esp + 0x240], edi
mov dword [esp + 0x10], edi
mov edi, dword [ebx + 0x6b8]
test eax, eax
je 0x12e91148
push edi
push 0x13128288
push 0x1311eac8
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov eax, dword [ebx + 0x6dc]
test eax, eax
je 0x12e91163
cmp ebp, eax
jb 0x12e91163
add eax, 0xbb8
cmp eax, ebp
jae 0x12e91229
cmp edi, 1
jb 0x12e91217
dec edi
test edi, edi
jl 0x12e91217
mov ecx, edi
shl ecx, 5
add ecx, edi
lea esi, [edi + ecx*2]
shl esi, 3
mov eax, dword [ebx + 0x6b4]
mov edx, dword [esp + 0x24c]
push edx
lea ecx, [esi + eax + 0x10]
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12e911f5
mov edx, dword [ebx + 0x6b4]
mov eax, dword [esi + edx]
add eax, 0x1388
cmp eax, ebp
jae 0x12e911e8
mov eax, dword [ebx + 0x6b8]
sub eax, edi
dec eax
je 0x12e911e2
mov ecx, edx
mov edx, eax
shl edx, 5
add edx, eax
lea eax, [eax + edx*2]
lea edx, [esi + ecx + 0x218]
shl eax, 3
push eax
lea eax, [esi + ecx]
push edx
push eax
call fcn.12f5c4f0
add esp, 0xc
dec dword [ebx + 0x6b8]
dec edi
sub esi, 0x218
test edi, edi
jge 0x12e91182
jmp 0x12e91210
mov eax, dword [ebx + 0x6b4]
mov ecx, edi
shl ecx, 5
add ecx, edi
mov dword [esp + 0x10], 1
lea edx, [edi + ecx*2]
mov dword [eax + edx*8], ebp
mov esi, dword [esp + 0x248]
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x6dc], ebp
test eax, eax
jne 0x12e912ac
cmp dword [ebx + 0x6b8], 0x400
jge 0x12e912ac
mov ecx, 0x85
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x24c]
mov dword [esp + 0x24], eax
push 0x103
lea eax, [esp + 0x34]
push edx
push eax
call fcn.12f5c4ab
lea edi, [ebx + 0x6b4]
mov dword [esp + 0x38], esi
add esp, 0xc
mov dword [esp + 0x20], ebp
mov esi, dword [edi + 4]
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
mov ecx, edi
call fcn.12e96290
mov ecx, dword [edi]
mov edx, esi
shl edx, 5
add edx, esi
lea eax, [esi + edx*2]
lea esi, [esp + 0x20]
lea edi, [ecx + eax*8]
mov ecx, 0x86
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x13198f68]
pop ebp
test eax, eax
je 0x12e912d6
mov edx, dword [esp + 0xc]
mov ebx, dword [ebx + 0x6b8]
push edx
push ebx
push 0x131281f8
push 0x1311eac8
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x10]
mov dword [esp + 0x23c], 0xffffffff
call fcn.12f56100
mov eax, 1
jmp 0x12e912f3
xor eax, eax
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret 8
Function at 0x12e98850
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x12e9891e
push ebx
call fcn.12f5c44d
push 0x1312bc40
push ebx
mov edi, eax
call fcn.12f5c46a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x12e988bb
push 0x1312bc40
call fcn.12f5c44d
push str.update
lea esi, [esi + eax*2]
call fcn.12f5c44d
push eax
push str.update
push esi
call fcn.12f5e2b3
add esp, 0x14
test eax, eax
jne 0x12e988bb
mov dword [ebp + 0x42c], 1
push 0x1312bc30
push ebx
call fcn.12f5c46a
mov esi, eax
add esp, 8
test esi, esi
je 0x12e9891e
push 0x1312bc30
call fcn.12f5c44d
lea esi, [esi + eax*2]
push 0x22
push esi
call fcn.12f5cfc9
mov edx, eax
add esp, 0xc
test edx, edx
je 0x12e9891e
cmp edi, 0x104
jae 0x12e9891e
sub edx, esi
add ebp, 0x218
push 0x103
mov ecx, 0x41
sar edx, 1
xor eax, eax
mov edi, ebp
push ebp
push edx
rep stosd dword es:[edi], eax
push esi
call fcn.12e2f870
mov ebp, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [0x13198f68]
test eax, eax
je 0x12e9894e
mov ecx, dword [ebp + 0x42c]
mov edx, dword [ebp + 4]
lea eax, [ebp + 0x218]
push eax
push ecx
push edx
push ebx
push 0x1312bb80
push 0x1312b6e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x12e9a4d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131be098]
test eax, eax
jne 0x12e9a4e8
mov dword [0x131be098], 1
jmp 0x12e9a4f0
ret
sub esp, 0x208
mov ecx, 0x82
xor eax, eax
push edi
mov edi, 0x131be0a0
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, 0x131be2ac
rep stosd dword es:[edi], eax
call fcn.12f9c4e0
test eax, eax
je 0x12e9a543
push 0x104
push 0x131be0a0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0x104
push 0x131be2ac
call fcn.12f7a4e0
add esp, 0xc
jmp 0x12e9a5ee
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.12f7a3e0
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x103
not ecx
dec ecx
push 0x131be0a0
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push eax
call esi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x131be2ac
lea eax, [esp + 0x114]
push ecx
push eax
push 0
push 0
call esi
pop esi
push 0x131be0a0
call fcn.12f614f4
push 0x131be2ac
call fcn.12f614f4
push 0x131be0a0
call fcn.12f5c44d
push 0x131be2ac
mov dword [0x131be09c], eax
call fcn.12f5c44d
add esp, 0x10
mov dword [0x131be2a8], eax
pop edi
add esp, 0x208
ret
Function at 0x12e9bc50
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13062f7b
push eax
mov eax, dword [0x131be4f4]
mov dword fs:[0], esp
sub esp, 0x910
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x12e9be96
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.OAgent.ini
mov dword [0x131be4f4], 1
mov dword [esp + 0xc], ebx
stosb byte es:[edi], al
call fcn.12d8c1c0
push eax
lea eax, [esp + 0x1c]
push 0x130c4bec
push eax
call fcn.12f5ce9d
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push 0x400
push edx
push 0x13198cc0
push 0x1307a7c4
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jbe 0x12e9bd46
cmp byte [esp + 0x517], bl
jne 0x12e9bd46
lea eax, [esp + 0x518]
push 0x400
lea ecx, [esp + 0x11c]
push eax
push ecx
call fcn.12ffe600
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x12e9bd4a
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x12e9be54
lea ecx, [esp + 0xc]
call fcn.12f56cb0
push 0x20019
push 0x1307a7c8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x92c], ebx
call fcn.12f56e20
test eax, eax
je 0x12e9bdc9
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0x1307a810
call fcn.12f57240
cmp eax, ebx
je 0x12e9bdc9
mov ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x12e9bdbc
mov edx, ecx
push esi
mov esi, eax
lea edi, [esp + 0x51c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12e9bdc0
mov dword [esp + 8], ebx
push eax
call fcn.12f5bf80
add esp, 4
lea ecx, [esp + 0xc]
call fcn.12f56e70
lea ecx, [esp + 0xc]
mov dword [esp + 0x920], 0xffffffff
call fcn.12f56da0
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x12e9be54
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x11c]
push eax
push 0x13198cc0
push 0x1307a810
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
jbe 0x12e9be4c
cmp byte [esp + 0x517], bl
jne 0x12e9be4c
lea ecx, [esp + 0x518]
push 0x400
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.12ffe600
add esp, 0xc
jmp 0x12e9be50
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x12e9be96
cmp eax, 4
jbe 0x12e9be96
lea ecx, [esp + 0x518]
test ecx, ecx
je 0x12e9be96
cmp dword [esp + 0x518], 1
je 0x12e9be96
mov edx, dword [esp + 0x534]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x12e9be96
add eax, 0xfffffffc
cmp ecx, eax
ja 0x12e9be96
mov eax, dword [esp + 0x520]
mov dword [0x131be4f0], eax
mov ecx, dword [esp + 0x918]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x91c
ret
Function at 0x12e9cf40
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push ebx
push 4
xor ebp, ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x12e9cfa7
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
pop edi
je 0x12e9cfa0
cmp dword [esp + 0x18], ebx
je 0x12e9cf9c
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x12e9cfa0
cmp dword [esp + 0x18], ebx
jne 0x12e9cf87
mov ebp, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x12ea3400
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x13063a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea eax, [ebx + 0x10]
xor esi, esi
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
call fcn.12f560a0
mov edi, dword [ebx + 4]
mov dword [esp + 0x28], esi
dec edi
cmp edi, esi
jl 0x12ea3515
mov esi, edi
shl esi, 5
add esi, edi
shl esi, 3
sub esi, edi
shl esi, 2
mov ecx, dword [esp + 0x30]
mov edx, dword [ebx]
lea eax, [ecx + 4]
push eax
lea eax, [esi + edx + 4]
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
je 0x12ea34c2
mov ebp, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + ebp + 0x414]
lea ecx, [esi + ebp]
add edx, 0x1388
cmp edx, eax
jae 0x12ea34b5
mov eax, dword [ebx + 4]
sub eax, edi
dec eax
je 0x12ea34b2
mov edx, eax
shl edx, 5
add edx, eax
shl edx, 3
sub edx, eax
lea eax, [esi + ebp + 0x41c]
shl edx, 2
push edx
push eax
push ecx
call fcn.12f5c4f0
add esp, 0xc
dec dword [ebx + 4]
dec edi
sub esi, 0x41c
test edi, edi
jge 0x12ea3452
jmp 0x12ea3515
mov esi, edi
mov ecx, dword [ebx]
shl esi, 5
add esi, edi
shl esi, 3
sub esi, edi
shl esi, 2
lea ebp, [esi + ecx + 0x414]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp]
add edx, 0xbb8
cmp edx, eax
jae 0x12ea350e
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x414]
mov dword [ebp], ecx
mov edx, dword [ebx]
mov eax, dword [eax]
mov dword [esi + edx], eax
mov ecx, dword [ebx]
mov dword [esi + ecx + 0x418], 0
cmp edi, 0xffffffff
mov eax, edi
jne 0x12ea354e
mov esi, dword [ebx + 4]
push 0xffffffffffffffff
mov ecx, ebx
lea edx, [esi + 1]
push edx
call fcn.12ea61c0
mov eax, esi
mov ecx, dword [ebx]
shl eax, 5
add eax, esi
shl eax, 3
sub eax, esi
mov esi, dword [esp + 0x30]
lea edi, [ecx + eax*4]
mov ecx, 0x107
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 4]
dec eax
cmp eax, 0xffffffff
je 0x12ea35d9
mov esi, eax
mov edx, dword [ebx]
shl esi, 5
add esi, eax
shl esi, 3
sub esi, eax
shl esi, 2
lea ecx, [esi + edx]
mov edx, dword [esi + edx]
cmp edx, 0xffffffff
je 0x12ea35d9
mov edi, dword [0x13198f68]
test edi, edi
je 0x12ea358e
add ecx, 4
push ecx
push edx
push eax
push 0x131325e8
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov eax, dword [ebx]
add esi, eax
mov eax, dword [esi]
test eax, eax
jne 0x12ea35a5
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 0
jne 0x12ea35ae
test eax, eax
je 0x12ea35d9
mov edx, dword [esp + 0x30]
cmp dword [edx], 0
jne 0x12ea35d9
mov dword [esi], 0xffffffff
mov eax, dword [0x13198f68]
test eax, eax
mov dword [esp + 0x10], 1
je 0x12ea35d9
push 0x131325c8
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.12f56100
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x12ea4ff0
Capabilities:
Get file size

Disassembly:
sub esp, 0x21c
push esi
mov esi, dword [esp + 0x224]
test esi, esi
push edi
je 0x12ea523b
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ea502a
push 0x131be808
push esi
push 0x13132d28
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
push esi
call fcn.12e310a0
mov edi, eax
push edi
call fcn.12f5c44d
add esp, 8
cmp eax, 4
jne 0x12ea507b
push eax
push 0x13132d1c
push edi
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12ea507b
mov ecx, 0x82
mov edi, 0x131be808
push 0x103
push esi
rep stosd dword es:[edi], eax
push 0x131be808
call fcn.12f5c4ab
add esp, 0xc
pop edi
pop esi
add esp, 0x21c
ret
push edi
call fcn.12f5c44d
add esp, 4
cmp eax, 4
jne 0x12ea523b
push eax
push str..doc
push edi
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
je 0x12ea50b8
push 4
push str..xls
push edi
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12ea523b
push 0x131be808
call fcn.12f5c44d
push esi
mov edi, eax
call fcn.12f5c44d
add esp, 8
cmp eax, edi
jne 0x12ea523b
push esi
call fcn.12f5c44d
sub eax, 4
push eax
push 0x131be808
push esi
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
jne 0x12ea523b
mov ecx, 0x81
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], ax
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.12e7d1a0
mov eax, dword [0x13198f68]
add esp, 0xc
test eax, eax
je 0x12ea513c
lea ecx, [esp + 0x1c]
push ecx
push 0x13132cfc
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp word [esp + 0x1c], 0
je 0x12ea523b
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
push edx
push 0x80
push 3
push edx
push 3
push SysReAllocStringLen
push eax
xor edi, edi
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ea5197
push esi
push 0x13132cdc
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp esi, 0xffffffff
je 0x12ea51ed
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x12ea51b9
mov dword [esp + 8], 0
xor edi, edi
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
push eax
push edx
push edx
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
jne 0x12ea51e6
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x13198f68]
test eax, eax
je 0x12ea521a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
push edi
push 0x13132cac
push 0x1312e7e0
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
lea edx, [esp + 0x28]
push 0x1311e28c
push edx
push 1
push 0
call fcn.12e74920
add esp, 0x1c
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x12eaaf70
Capabilities:
Create service

Disassembly:
sub esp, 8
push ebp
push esi
push edi
call fcn.12f9c4e0
test eax, eax
je 0x12eab099
mov edi, dword [esp + 0x20]
xor esi, esi
cmp edi, esi
je 0x12eab08f
mov ebp, dword [esp + 0x2c]
cmp ebp, esi
je 0x12eab08f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12eab08f
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12eab08f
push ebx
push 0xa
push esi
push esi
mov dword [esp + 0x3c], esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x12eab047
push ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x10], eax
je 0x12eab043
mov edx, dword [esp + 0x34]
mov dword [esp + 0x14], edi
test edx, edx
je 0x12eab001
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x12eab001
lea esi, [esp + 0x14]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x34]
push esi
push edx
mov edx, dword [esp + 0x30]
push ebp
push 1
push ecx
mov ecx, dword [esp + 0x44]
push edx
push 0xf01ff
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x12eab043
mov dword [esp + 0x30], 1
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [0x131bef60], 0
test eax, eax
jne 0x12eab064
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x131bef60], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x12eab071
push esi
call ebp
test edi, edi
je 0x12eab07c
push edi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test ebx, ebx
je 0x12eab083
push ebx
call ebp
mov eax, dword [esp + 0x30]
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [0x131bef60], 0x57
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret

Function at 0x12eab726
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
call fcn.12f9c530
test eax, eax
je 0x12eab78f
mov edx, dword [esp + 0x210]
test edx, edx
je 0x12eab78f
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
pop edi
jbe 0x12eab78f
cmp eax, 0x104
jae 0x12eab78f
mov ecx, dword [esp + 0x214]
lea edx, [esp + 4]
push ecx
push edx
mov ecx, esi
call fcn.12eab600
pop esi
add esp, 0x208
ret 8
xor eax, eax
pop esi
add esp, 0x208
ret 8