joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12f08c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306a038
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, ecx
je 0x12f08dbb
cmp dword [esp + 0x38], ebp
je 0x12f08dbb
cmp dword [esp + 0x3c], ebp
je 0x12f08dbb
push 0x5c
push esi
call fcn.12f5c8b4
add esp, 8
cmp eax, ebp
je 0x12f08dbb
sub eax, esi
push ebx
sar eax, 1
mov dword [esp + 0x18], eax
lea eax, [edi + 0x348]
push 1
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebp
call fcn.12f560a0
mov eax, dword [edi + 0x33c]
mov dword [esp + 0x30], ebp
lea ebx, [eax - 1]
cmp ebx, ebp
mov dword [esp + 0x10], ebx
jl 0x12f08d91
mov ecx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
shl ecx, 6
add ecx, ebx
lea esi, [ebx + ecx*4]
shl esi, 2
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x12f08d91
mov edx, dword [edi + 0x338]
lea eax, [edx + esi + 4]
push eax
call fcn.12f5c44d
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp ecx, eax
jne 0x12f08d7e
mov edx, dword [edi + 0x338]
push ecx
mov ecx, dword [esp + 0x3c]
lea eax, [edx + esi + 4]
push ecx
push eax
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12f08d7e
mov eax, dword [esp + 0x44]
test eax, eax
je 0x12f08d40
mov ebx, dword [edi + 0x338]
add ebx, esi
call ebp
cmp eax, dword [ebx]
jb 0x12f08d25
mov ebx, dword [edi + 0x338]
add ebx, esi
call ebp
mov ecx, dword [ebx]
add ecx, 0x1d4c0
cmp eax, ecx
jb 0x12f08d3c
mov ebx, dword [edi + 0x338]
add ebx, esi
call ebp
cmp eax, dword [ebx]
jae 0x12f08d7a
call ebp
cmp eax, 0x1d4c0
jae 0x12f08d7a
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x40]
mov eax, dword [edi + 0x338]
dec edx
push edx
mov edx, dword [esp + 0x40]
lea ecx, [eax + esi + 0x20c]
push ecx
push edx
call fcn.12f5c4ab
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
add esp, 0xc
mov dword [esp + 0x14], 1
mov word [eax + ecx*2 - 2], 0
jmp 0x12f08d7e
mov ebx, dword [esp + 0x10]
dec ebx
sub esi, 0x414
test ebx, ebx
mov dword [esp + 0x10], ebx
jge 0x12f08cad
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.12f56100
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x12f090a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1306a0a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esi], edi
call fcn.12f55b70
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov byte [esp + 0x14], 1
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], 0x1e
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 2
call fcn.12f55b70
push edi
mov byte [esp + 0x18], 3
push edi
lea ecx, [esi + 0x70]
mov dword [esi + 0x6c], edi
call fcn.12f87d60
mov byte [esp + 0x14], 4
or edx, 0xffffffff
mov dword [esi + 0xa4], edi
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0xa8]
mov dword [esi + 0xa0], edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f09c70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x830
mov eax, dword [ecx]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
je 0x12f09eb0
mov ebp, dword [esp + 0x844]
cmp ebp, ebx
je 0x12f09eb0
mov esi, dword [esp + 0x848]
cmp esi, ebx
je 0x12f09eb0
cmp dword [0x13198f68], ebx
je 0x12f09cca
push esi
push ebp
push 0x13165238
push 0x13164bd8
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
push esi
call fcn.12f5c44d
add esp, 4
cmp eax, 8
jb 0x12f09eb0
push 8
push 0x13164534
push esi
call fcn.12f5c44d
add esp, 4
lea eax, [esi + eax*2 - 0x10]
push eax
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12f09d0a
mov dword [esp + 0x10], 2
jmp 0x12f09d92
push 0x13165228
push ebp
call fcn.12f5c46a
add esp, 8
test eax, eax
je 0x12f09d96
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x220]
push 0x104
lea eax, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [esp + 0x220]
push eax
push ecx
push ebp
call fcn.12f5e2b3
add esp, 0xc
test eax, eax
jne 0x12f09d96
mov dword [esp + 0x10], 3
mov ebx, dword [esp + 0x10]
mov eax, dword [0x13198f68]
test eax, eax
je 0x12f09db4
push ebx
push 0x131651f8
push 0x13164bd8
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp ebx, 2
jne 0x12f09eb0
push 0x448
call fcn.12f5bf8b
mov ecx, dword [esp + 0x18]
add esp, 4
mov ebx, eax
push esi
push ebx
push 0
push ebp
push 0xffffffffffffffff
call fcn.12f0a480
test eax, eax
je 0x12f09e92
test ebx, ebx
je 0x12f09e9f
mov edi, dword [esp + 0x84c]
test edi, edi
je 0x12f09e00
mov ecx, 0x112
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
push 0
lea esi, [ebx + 0x34]
lea ebp, [ebx + 0x23c]
call fcn.12f0a060
test eax, eax
je 0x12f09e92
test ebp, ebp
je 0x12f09e92
test esi, esi
je 0x12f09e92
mov dword [esp + 0x428], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x42c], eax
xor eax, eax
mov ecx, 0x103
lea edi, [esp + 0x434]
push 0x103
lea edx, [esp + 0x63c]
mov word [esp + 0x434], ax
mov word [esp + 0x436], ax
push esi
push edx
rep stosd dword es:[edi], eax
call fcn.12f5c4ab
push 0x103
lea eax, [esp + 0x440]
push ebp
push eax
call fcn.12f5c4ab
add esp, 0x18
lea ecx, [esp + 0x428]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.12f0a320
test ebx, ebx
je 0x12f09e9f
push ebx
call fcn.12f5bf80
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x830
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x830
ret 0xc
Function at 0x12f0ba10
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306a34b
push eax
mov eax, dword [0x131c40ac]
mov dword fs:[0], esp
sub esp, 0x218
test eax, eax
push esi
je 0x12f0bb66
mov eax, dword [0x131c40b8]
test eax, eax
je 0x12f0bb66
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x12f0bb66
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
call fcn.12f8ca00
mov eax, dword [esp + 0xc]
push 0x13165dc4
push eax
mov dword [esp + 0x234], 0
call fcn.12f5df5c
add esp, 0x10
test eax, eax
je 0x12f0bab4
mov ecx, dword [esp + 4]
push 0x13165db4
push ecx
call fcn.12f5df5c
add esp, 8
test eax, eax
jne 0x12f0bb52
push edi
push esi
call fcn.12e32f20
mov esi, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], 0
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x18]
push 0x103
push edx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x18]
push 0x13165e38
push eax
call fcn.12f5e1d4
add esp, 8
test eax, eax
pop edi
je 0x12f0bb14
lea ecx, [esp + 0x14]
push 0x13165e10
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12f0bb52
mov eax, dword [0x13198f68]
test eax, eax
je 0x12f0bb36
lea edx, [esp + 0x14]
push edx
push 0x13165dd0
push str.UpDlFileFrame
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0xc]
lea eax, [esp + 0x14]
push ecx
push 0x12f0b810
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [esp + 4]
mov dword [esp + 0x224], 0xffffffff
call fcn.12f41ea0
mov ecx, dword [esp + 0x21c]
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret

Function at 0x12f0c319
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
mov ecx, 0x131c42f8
jmp 0x12f0c300
push 0xffffffffffffffff
push 0x1306a3b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.12f4cba0
xor edi, edi
lea ecx, [esi + 0x18]
mov dword [esp + 0x24], edi
call fcn.12f4cba0
mov byte [esp + 0x24], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov byte [esp + 0x24], 2
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x24], 3
call fcn.12f4cba0
lea ecx, [esi + 0x58]
mov byte [esp + 0x24], 4
call fcn.12f4cba0
lea ebp, [esi + 0x70]
mov byte [esp + 0x24], 5
mov ecx, ebp
call fcn.12f55b70
push 1
push ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 6
call fcn.12f560a0
mov byte [esp + 0x24], 7
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi], edi
mov dword [esi + 4], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.12f56100
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
mov dword [esp + 0x20], 0xffffffff
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x12f10e60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1306a950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x12f11055
cmp dword [ebp + 0xc], ebx
je 0x12f11055
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x12f10ed4
mov dword [ebp - 4], 0xffffffff
cmp esi, 0xffffffff
je 0x12f11041
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x44], eax
mov edi, 0x100000
cmp dword [ebp - 0x2c], ebx
jne 0x12f10f0d
cmp eax, edi
ja 0x12f10f0d
mov edi, eax
cmp eax, ebx
je 0x12f1103a
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x40]
call fcn.12f55290
mov dword [ebp - 4], 2
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x40]
call fcn.12f552b0
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push edi
mov edx, dword [ebp - 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12f1102b
push ebx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f554b0
xor edi, edi
mov cl, byte [ebp + edi - 0x2c]
mov byte [ebp - 0x68], cl
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f554b0
inc edi
cmp edi, 4
jb 0x12f10f52
xor edi, edi
mov cl, byte [ebp + edi - 0x44]
mov byte [ebp - 0x70], cl
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f554b0
inc edi
cmp edi, 4
jb 0x12f10f71
lea ecx, [ebp - 0x5c]
call fcn.12f55290
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.12f87640
add esp, 8
mov eax, dword [ebp - 0x58]
mov ebx, eax
lea ecx, [eax + eax]
cmp ecx, dword [ebp + 0x10]
jge 0x12f1101f
mov edi, dword [ebp + 0xc]
xor esi, esi
test eax, eax
jle 0x12f10fdf
xor edx, edx
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax + esi]
push edx
push 0x131677cc
push edi
call fcn.12f5ceef
add esp, 0xc
add edi, 4
inc esi
cmp esi, ebx
jl 0x12f10fc0
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.12f552a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.12f552a0
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.12f552a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.12f552a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x12f142d6
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131c4678
jmp 0x12f142c0
push 0xffffffffffffffff
push 0x1306acbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x10]
call fcn.12f55b70
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], 0x1307c9a8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f17700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1306b188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
lea eax, [esi + 0x78]
push eax
call fcn.12f560a0
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [edx + 4]
mov edx, dword [esi + 0x9c]
cmp eax, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], edx
jle 0x12f177f9
push ebx
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jmp 0x12f17762
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
jle 0x12f1779d
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
add edx, eax
mov eax, dword [esi + 0x98]
mov ecx, 4
mov edi, eax
mov esi, edx
xor ebp, ebp
repe cmpsd dword [esi], dword es:[edi]
je 0x12f177d9
mov ecx, dword [esp + 0x14]
inc ebx
add eax, 0x2c
cmp ebx, ecx
jl 0x12f1777e
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edi, dword [ebp + 4]
push 0xffffffffffffffff
mov esi, dword [ecx]
mov ecx, dword [esp + 0x14]
lea edx, [edi + 1]
add esi, ecx
push edx
mov ecx, ebp
call fcn.12ee5ef0
mov eax, dword [ebp]
shl edi, 4
add edi, eax
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
jmp 0x12f177dd
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 0x10
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x12f1775e
pop edi
pop ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f56100
mov eax, dword [0x13198f68]
test eax, eax
je 0x12f1782b
mov ecx, dword [ebp + 4]
push ecx
push 0x1316af70
push str.watermark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x12f18727
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x131c47f8
jmp 0x12f18710
push 0xffffffffffffffff
push 0x1306b24f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
call fcn.12f55b70
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.12f55b70
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.12f545a0
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 2
call fcn.12f55b70
push 0xffffffffffffffff
mov byte [esp + 0x1c], 3
push ebx
mov ecx, edi
mov dword [esi], 0x1307cab0
call fcn.12f545c0
mov ecx, 0x19
xor eax, eax
lea edi, [esi + 0x70]
mov dword [esi + 0x6c], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
mov ecx, 0x42
lea edi, [esi + 0x304]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x2fc], ebx
mov dword [esi + 0x300], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x40c], ebx
mov eax, esi
pop edi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12f18810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1306b28f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x1307cab0
mov dword [esp + 0x18], 3
call fcn.12f19280
mov ecx, esi
call fcn.12f192f0
lea ebp, [esi + 0x5c]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.12f545c0
mov ecx, 0x19
xor eax, eax
lea edi, [esi + 0x70]
mov dword [esi + 0x6c], 0
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
mov dword [esi + 0x2fc], eax
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 2
call fcn.12f55bc0
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.12f545b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0
call fcn.12f55bc0
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.12f55bc0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12f192f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1306b348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x30]
lea ecx, [esp + 0xc]
push eax
call fcn.12f560a0
mov eax, dword [esi + 0x58]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], edi
je 0x12f19334
push eax
call fcn.12f5bf80
add esp, 4
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.12f56100
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x12f1ade0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x414
push ebp
mov ebp, ecx
push esi
mov eax, dword [ebp + 0xe4]
test eax, eax
jne 0x12f1aedf
call fcn.12f1ac80
test eax, eax
je 0x12f1aedf
mov esi, dword [esp + 0x420]
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 8], eax
jne 0x12f1aedf
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea edx, [esp + 0x218]
push 0x103
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x13198f68]
pop edi
test eax, eax
je 0x12f1aeb4
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push 0x1316daf8
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
push 0x1316dae4
call fcn.12f5c44d
push eax
lea edx, [esp + 0x14]
push 0x1316dae4
push edx
call fcn.12f5e2b3
add esp, 0x10
test eax, eax
jne 0x12f1aedf
mov dword [ebp + 0xe4], 1
pop esi
pop ebp
add esp, 0x414
ret 4
Function at 0x12f1de80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306b7a8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push 0x3ec
mov ecx, 0x131bca48
call fcn.12e87040
mov esi, eax
mov eax, dword [0x13198f68]
cmp eax, edi
je 0x12f1decf
push esi
push 0x1316ffb0
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
push 2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call fcn.12e823c0
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x5c
push esi
push 0x3ec
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
call fcn.12e829d0
cmp dword [0x13198f68], edi
je 0x12f1df28
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
push 0x1316ff3c
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, ebx
call fcn.12f1af60
test eax, eax
jne 0x12f1df6e
cmp dword [0x13198f68], edi
je 0x12f1df59
push 0x1316fed4
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [esp + 0xc]
push ecx
call fcn.12f5bf80
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov dword [edx], eax
mov dword [esp + 0x28], 0xffffffff
call fcn.12e82400
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x12f1f050
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x1306b82b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x22c]
push ebp
push esi
push edi
xor edi, edi
cmp ebx, 5
mov ebp, ecx
mov dword [esp + 0x10], edi
ja 0x12f1f1a2
mov esi, dword [esp + 0x230]
cmp ebx, edi
je 0x12f1f155
mov word [esp + 0x18], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0x131911a8
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
call fcn.12f46a80
lea eax, [esp + 0x18]
push 0x103
push eax
push esi
mov dword [esp + 0x234], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, ebp
call fcn.12f1eb50
test eax, eax
je 0x12f1f137
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.12f5e1d4
add esp, 8
test eax, eax
jne 0x12f1f137
mov edx, dword [esp + 0x23c]
mov dword [esp + 0x10], 1
mov dword [edx], esi
mov eax, dword [0x13198f68]
test eax, eax
je 0x12f1f137
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push 0x13170454
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x228], 0xffffffff
call fcn.12f47220
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12f1f1bf
mov edi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x12f1f1a2
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x234]
inc ebx
push ecx
push ebx
push edx
push esi
mov ecx, ebp
call fcn.12f1f050
mov edi, eax
dec ebx
test edi, edi
jne 0x12f1f1a2
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x12f1f16b
mov eax, edi
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret 0x10
mov eax, dword [esp + 0x10]
jmp 0x12f1f1a4