joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12f89490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1306fb9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov ecx, dword [0x1307d24c]
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ecx, 9
lea edi, [esp + 0x16]
mov ebx, dword [esp + 0x50]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, ebx
lea edx, [esp + 0x14]
push 0xa
push edx
shr eax, 0x18
push eax
mov dword [esp + 0x50], 1
call fcn.12f5e9c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.12f47f40
push 0x130b7b04
lea ecx, [esp + 0x10]
call fcn.12f47f40
xor edx, edx
lea ecx, [esp + 0x14]
mov dl, byte [esp + 0x52]
push 0xa
push ecx
push edx
call fcn.12f5e9c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.12f47f40
push 0x130b7b04
lea ecx, [esp + 0x10]
call fcn.12f47f40
xor ecx, ecx
lea eax, [esp + 0x14]
push 0xa
mov cl, bh
push eax
push ecx
call fcn.12f5e9c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.12f47f40
push 0x130b7b04
lea ecx, [esp + 0x10]
call fcn.12f47f40
lea edx, [esp + 0x14]
push 0xa
and ebx, 0xff
push edx
push ebx
call fcn.12f5e9c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.12f47f40
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.12f468f0
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.12f472f0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x12f93b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x130705bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x38]
push esi
mov dword [esp + 4], 0
cmp word [eax], 0x4d4f
je 0x12f93b7d
mov esi, dword [esp + 0x38]
push 0
push 0
mov ecx, esi
call fcn.12f92490
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push ebp
push edi
mov ebp, dword [esp + 0x48]
mov ecx, 8
mov esi, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
xor esi, esi
xor edi, edi
test ecx, ecx
jbe 0x12f93bb1
and word [esp + 0x12], 0xefff
test byte [eax + 3], 0x10
je 0x12f93bad
or byte [esp + 0x13], 0x20
mov esi, ebp
mov edi, ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], edi
call fcn.12f92480
lea eax, [esp + 0x10]
push 0x20
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x40], 1
call fcn.12f929e0
push edi
push esi
lea ecx, [esp + 0x4c]
call fcn.12f929e0
test esi, esi
je 0x12f93bf2
cmp esi, ebp
je 0x12f93bf2
push esi
call fcn.12f5c050
add esp, 4
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x44]
push ecx
mov ecx, esi
call fcn.12f925a0
lea ecx, [esp + 0x44]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 0
call fcn.12f925e0
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop ebp
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x12f95f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x12f960ab
cmp dword [esi + 8], ebx
je 0x12f960ab
cmp dword [esi + 0x10], ebx
je 0x12f95fb2
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x12f95f97
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x12f95f86
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x12f960ab
mov eax, dword [esi + 8]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp edi, ebx
je 0x12f9601c
cmp dword [esp + 0x10], ebx
je 0x12f9601c
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x12f96038
cmp eax, ebx
je 0x12f96038
cmp eax, 0x3e5
je 0x12f96038
cmp eax, 0x217
jne 0x12f960ab
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x12f96070
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x12f960ab
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 8]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x12f960c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x12f9624b
cmp dword [esi + 0xc], ebx
je 0x12f9624b
cmp dword [esi + 0x10], ebx
je 0x12f96152
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x12f96137
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x12f96126
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x12f9624b
mov eax, dword [esi + 0xc]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
je 0x12f961bc
cmp dword [esp + 0x10], ebx
jbe 0x12f961bc
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x12f961d8
cmp eax, ebx
je 0x12f961d8
cmp eax, 0x3e5
je 0x12f961d8
cmp eax, 0x217
jne 0x12f9624b
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x12f96210
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x12f9624b
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 0xc]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x12f97400
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13070858
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
cmp ebp, 0x640
push edi
mov esi, ecx
ja 0x12f974e9
xor edi, edi
cmp ebp, edi
jbe 0x12f974e9
lea eax, [esi + 0x54]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.12f56170
mov ebx, dword [esp + 0x34]
mov ecx, dword [esi + 0x44]
mov dword [esp + 0x2c], edi
lea ebx, [ebx + ebx*2]
shl ebx, 4
add ebx, ecx
cmp dword [ebx + 0x28], edi
jne 0x12f97500
mov esi, dword [esp + 0x38]
mov edi, dword [ebx + 0x1c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x24]
mov edx, dword [ebx + 0x1c]
lea ecx, [esp + 0x38]
push eax
mov eax, dword [ebx]
push ecx
push ebp
xor esi, esi
push edx
push eax
mov dword [ebx + 0x28], 1
mov dword [esp + 0x4c], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
je 0x12f974c7
cmp dword [esp + 0x38], ebp
jne 0x12f9758e
lea ecx, [esp + 0x18]
mov dword [ebx + 0x28], esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f561d0
mov eax, 1
jmp 0x12f974eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x12f9758e
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f561d0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
push ebp
mov dword [esp + 0x18], edi
call fcn.12f5c05b
mov edx, eax
add esp, 4
cmp edx, edi
mov dword [esp + 0x3c], edx
je 0x12f974d8
mov esi, dword [esp + 0x38]
mov ecx, ebp
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 4]
test eax, eax
jne 0x12f9754e
push 0x10
call fcn.12f5c05b
add esp, 4
test eax, eax
jne 0x12f9755c
mov edx, dword [esp + 0x3c]
jmp 0x12f97578
mov ecx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 0x10]
dec ecx
mov dword [ebx + 0x10], ecx
jmp 0x12f97560
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], esi
mov dword [eax], 0
mov ecx, dword [ebx + 0xc]
inc ecx
mov dword [ebx + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edx
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x12f97589
mov dword [ecx], eax
jmp 0x12f9758b
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f561d0
mov eax, 1
jmp 0x12f974eb
Function at 0x12f975b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x13070878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x54]
lea ecx, [esp + 0x10]
push eax
call fcn.12f56170
mov eax, dword [esp + 0x28]
xor edi, edi
lea ecx, [eax + eax*2]
mov eax, dword [esi + 0x44]
shl ecx, 4
add eax, ecx
mov edx, dword [eax + 0x20]
mov dword [edx], edi
mov ecx, dword [eax + 0x20]
mov dword [ecx + 4], edi
mov edx, dword [eax + 0x20]
mov dword [edx + 8], edi
mov ecx, dword [eax + 0x20]
mov dword [ecx + 0xc], edi
mov dword [esp + 8], edi
mov edx, dword [eax + 0x20]
lea ecx, [esp + 8]
push edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax]
push ecx
push 0x640
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
pop edi
pop esi
jne 0x12f97662
cmp eax, 0x3e5
je 0x12f97662
cmp eax, 0x218
je 0x12f97662
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.12f561d0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x10]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x12f97690
Capabilities:
Access peb ldr_data
Connect pipe
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x13070898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 0x54]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.12f56170
mov eax, dword [esp + 0x38]
mov esi, dword [ebx + 0x44]
xor edi, edi
lea ecx, [eax + eax*2]
mov dword [esp + 0x30], edi
shl ecx, 4
add esi, ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 8], edi
mov eax, dword [esi + 0x20]
mov dword [eax + 0xc], edi
mov ecx, dword [esi + 0x20]
mov dword [ecx], edi
mov edx, dword [esi + 0x20]
mov dword [edx + 4], edi
mov eax, dword [esi + 0x24]
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x24]
mov dword [ecx + 0xc], edi
mov edx, dword [esi + 0x24]
mov dword [edx], edi
mov eax, dword [esi + 0x24]
mov dword [eax + 4], edi
mov ecx, dword [esi + 0x20]
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x12f97773
mov ecx, dword [esi + 0x20]
xor eax, eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi]
mov dword [esp + 0x28], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x217
call fcn.12f96c80
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f561d0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
cmp eax, edi
je 0x12f9777e
cmp eax, 0x3e5
jne 0x12f97783
mov edi, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x12f982d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x13070938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.12f9bcf0
xor ebx, ebx
lea ecx, [esi + 0x60]
mov dword [esp + 0x18], ebx
call fcn.12f92ea0
mov eax, dword [0x1307d248]
or edx, 0xffffffff
mov dword [esi + 0x7c], eax
mov ecx, 8
xor eax, eax
lea edi, [esi + 0x88]
mov dword [esi + 0x50], 0x1307e6e4
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xac], edx
rep stosd dword es:[edi], eax
mov dword [esi + 0xa8], ebx
mov ecx, 8
lea edi, [esi + 0x10]
mov dword [esi], 0x1307e688
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov word [esi + 0x44], bx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f98e70
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x13070ae5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x49c
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4b8]
mov dword [esp + 0xc], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x131c8d98]
test esi, esi
je 0x12f98f5b
test eax, eax
jne 0x12f98f1a
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x131c8d98], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x12f98f0e
cmp dword [esp + 0x14], 5
jb 0x12f98f0e
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x131c8d9c], ecx
jmp 0x12f98f1a
mov edx, dword [0x13181c0c]
mov dword [0x131c8d9c], edx
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x13181c0c]
jne 0x12f98f2f
mov eax, dword [0x131c8d9c]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0xb4]
push str._s__s__08x__08x
push eax
call fcn.12f5cf6d
add esp, 0x18
jmp 0x12f98fea
test eax, eax
jne 0x12f98faf
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x131c8d98], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x12f98fa5
cmp dword [esp + 0x14], 5
jb 0x12f98fa5
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x131c8d9c], edx
jmp 0x12f98faf
mov eax, dword [0x13181c0c]
mov dword [0x131c8d9c], eax
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x13181c0c]
jne 0x12f98fc4
mov eax, dword [0x131c8d9c]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push eax
lea eax, [esp + 0xb0]
push str._s___08x__08x
push eax
call fcn.12f5cf6d
add esp, 0x14
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0xc]
call fcn.12f41640
mov esi, dword [esp + 0x4b4]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x4b0], 1
call fcn.12f41540
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x4ac], 0
call fcn.12f41f70
mov ecx, dword [esp + 0x4a4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x4a8
ret
Function at 0x12f9b790
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x12f9b818
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x12f9b7f2
mov ecx, dword [esi + 0x18]
xor eax, eax
mov dword [esp + 9], eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x11], ax
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x17], al
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
lea edx, [esp + 0xc]
push 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push edx
push 0xd
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
pop edi
jge 0x12f9b7f2
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0xc]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x12f9bee0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x131c8f40]
sub esp, 0x114
test eax, eax
jne 0x12f9c02d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x131c8dd8
mov dword [0x131c8f40], 1
mov dword [0x131c8dd8], 0x94
call esi
mov edx, dword [0x131c8de8]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x13181c68], eax
je 0x12f9c008
push ebx
push 0x131c8e70
mov dword [0x131c8e70], 0x9c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x131c8f34], eax
call edi
mov dword [0x131c8f38], eax
mov eax, dword [0x131c8f34]
test eax, eax
push 0x131c8f10
je 0x12f9bf84
call eax
jmp 0x12f9bf8a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x131c8e74]
cmp eax, 6
jae 0x12f9bfa2
cmp eax, 5
jne 0x12f9bfb6
cmp dword [0x131c8e78], 2
jb 0x12f9bfb6
cmp word [0x131c8f10], 9
jne 0x12f9bfb6
mov dword [0x131c8dcc], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x12f9bfd4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x131c8f3c], edx
jmp 0x12f9bfda
mov edx, dword [0x131c8f3c]
test edx, edx
je 0x12f9c008
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x12f9c008
mov ecx, dword [esp + 0x14]
mov dword [0x131c8de4], ecx
push 0x131c8de0
push 0x131c8ddc
call fcn.12f9c3d0
add esp, 8
call fcn.12f9c040
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x12f9db00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x13071068
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
lea ecx, [esp + 0x18]
call fcn.12f4cc70
mov eax, dword [esp + 0x38]
lea ecx, [esp]
push eax
mov dword [esp + 0x34], 0
call fcn.12f46b50
mov ecx, dword [esp]
mov byte [esp + 0x30], 1
mov eax, dword [ecx - 8]
test eax, eax
je 0x12f9dc48
lea edx, [esp + 4]
lea eax, [esp + 0x38]
push edx
push 0x130c9048
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.12f4baf0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 2
call fcn.12f4ad60
lea ecx, [esp + 0x38]
call fcn.12f4b080
mov ecx, dword [esp + 0x38]
push 0x131912a8
push ecx
call fcn.12f5d02e
add esp, 8
test eax, eax
je 0x12f9dc3a
push esi
mov eax, dword [esp + 0x20]
xor esi, esi
test eax, eax
jle 0x12f9dbc9
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + esi*4]
push eax
mov eax, dword [esp + 0x40]
push eax
call fcn.12f607c9
add esp, 8
test eax, eax
je 0x12f9dbd8
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
jl 0x12f9dba7
lea ecx, [esp + 0x3c]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.12f4d280
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push 0x130c9048
push eax
lea ecx, [esp + 0x10]
call fcn.12f4baf0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 3
call fcn.12f47480
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.12f472f0
lea ecx, [esp + 0x3c]
call fcn.12f4ad60
lea ecx, [esp + 0x3c]
call fcn.12f4b080
mov ecx, dword [esp + 0x3c]
push 0x131912a8
push ecx
call fcn.12f5d02e
add esp, 8
test eax, eax
jne 0x12f9db9d
pop esi
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call fcn.12f472f0
push 1
push 0x131c8f70
lea ecx, [esp + 0x14]
call fcn.12f56170
push 0xffffffffffffffff
push 0
mov ecx, 0x131c8f58
mov byte [esp + 0x38], 4
call fcn.12f4cce0
lea edx, [esp + 0x18]
mov ecx, 0x131c8f58
push edx
call fcn.12f4d000
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.12f561d0
lea ecx, [esp]
mov byte [esp + 0x30], 0
call fcn.12f472f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f4cc80
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x12fa14e0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword [0x131c9044]
push ebx
mov ebx, dword [esp + 0x10]
push esi
test eax, eax
push edi
jne 0x12fa1502
mov eax, dword [0x131c97cc]
test eax, eax
jne 0x12fa1502
mov eax, dword [0x131c9ddc]
test eax, eax
je 0x12fa1506
test ebx, ebx
je 0x12fa1540
mov eax, dword [0x13182888]
or esi, 0xffffffff
cmp eax, esi
jne 0x12fa1540
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, esi
mov dword [0x13182888], eax
je 0x12fa1540
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x12fa1540
mov eax, dword [0x13182888]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x13182888], esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push ebx
push esi
push edi
call fcn.12fb3330
add esp, 0xc
test eax, eax
je 0x12fa1583
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push esi
push edi
call fcn.12fcfbd0
add esp, 0x10
test eax, eax
je 0x12fa1583
push ebx
push esi
push edi
call fcn.12fdef00
add esp, 0xc
test eax, eax
je 0x12fa1583
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret