joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12f10f30
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1306aa40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x12f11125
cmp dword [ebp + 0xc], ebx
je 0x12f11125
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x12f10fa4
mov dword [ebp - 4], 0xffffffff
cmp esi, 0xffffffff
je 0x12f11111
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x44], eax
mov edi, 0x100000
cmp dword [ebp - 0x2c], ebx
jne 0x12f10fdd
cmp eax, edi
ja 0x12f10fdd
mov edi, eax
cmp eax, ebx
je 0x12f1110a
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x40]
call fcn.12f55360
mov dword [ebp - 4], 2
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x40]
call fcn.12f55380
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push edi
mov edx, dword [ebp - 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12f110fb
push ebx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f55580
xor edi, edi
mov cl, byte [ebp + edi - 0x2c]
mov byte [ebp - 0x68], cl
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f55580
inc edi
cmp edi, 4
jb 0x12f11022
xor edi, edi
mov cl, byte [ebp + edi - 0x44]
mov byte [ebp - 0x70], cl
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
call fcn.12f55580
inc edi
cmp edi, 4
jb 0x12f11041
lea ecx, [ebp - 0x5c]
call fcn.12f55360
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.12f87710
add esp, 8
mov eax, dword [ebp - 0x58]
mov ebx, eax
lea ecx, [eax + eax]
cmp ecx, dword [ebp + 0x10]
jge 0x12f110ef
mov edi, dword [ebp + 0xc]
xor esi, esi
test eax, eax
jle 0x12f110af
xor edx, edx
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax + esi]
push edx
push 0x131678d4
push edi
call fcn.12f5cfbf
add esp, 0xc
add edi, 4
inc esi
cmp esi, ebx
jl 0x12f11090
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.12f55370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.12f55370
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.12f55370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.12f55370
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x12f14360
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131c4778
jmp 0x12f14390
push 0xffffffffffffffff
push 0x1306adab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x10]
call fcn.12f55c40
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], 0x1307c9a8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f177d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1306b278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
lea eax, [esi + 0x78]
push eax
call fcn.12f56170
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [edx + 4]
mov edx, dword [esi + 0x9c]
cmp eax, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], edx
jle 0x12f178c9
push ebx
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jmp 0x12f17832
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
jle 0x12f1786d
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
add edx, eax
mov eax, dword [esi + 0x98]
mov ecx, 4
mov edi, eax
mov esi, edx
xor ebp, ebp
repe cmpsd dword [esi], dword es:[edi]
je 0x12f178a9
mov ecx, dword [esp + 0x14]
inc ebx
add eax, 0x2c
cmp ebx, ecx
jl 0x12f1784e
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edi, dword [ebp + 4]
push 0xffffffffffffffff
mov esi, dword [ecx]
mov ecx, dword [esp + 0x14]
lea edx, [edi + 1]
add esi, ecx
push edx
mov ecx, ebp
call fcn.12ee5f00
mov eax, dword [ebp]
shl edi, 4
add edi, eax
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
jmp 0x12f178ad
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 0x10
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x12f1782e
pop edi
pop ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f561d0
mov eax, dword [0x13199068]
test eax, eax
je 0x12f178fb
mov ecx, dword [ebp + 4]
push ecx
push str.CWaterMarkHelper::GetLibGuidUnExist____d_
push str.watermark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x12f187b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x131c48f8
jmp 0x12f187e0
push 0xffffffffffffffff
push 0x1306b33f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
call fcn.12f55c40
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.12f55c40
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.12f54670
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 2
call fcn.12f55c40
push 0xffffffffffffffff
mov byte [esp + 0x1c], 3
push ebx
mov ecx, edi
mov dword [esi], 0x1307cab0
call fcn.12f54690
mov ecx, 0x19
xor eax, eax
lea edi, [esi + 0x70]
mov dword [esi + 0x6c], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
mov ecx, 0x42
lea edi, [esi + 0x304]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x2fc], ebx
mov dword [esi + 0x300], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x40c], ebx
mov eax, esi
pop edi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12f188e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1306b37f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x1307cab0
mov dword [esp + 0x18], 3
call fcn.12f19350
mov ecx, esi
call fcn.12f193c0
lea ebp, [esi + 0x5c]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.12f54690
mov ecx, 0x19
xor eax, eax
lea edi, [esi + 0x70]
mov dword [esi + 0x6c], 0
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
mov dword [esi + 0x2fc], eax
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 2
call fcn.12f55c90
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.12f54680
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0
call fcn.12f55c90
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.12f55c90
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12f193c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1306b438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x30]
lea ecx, [esp + 0xc]
push eax
call fcn.12f56170
mov eax, dword [esi + 0x58]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], edi
je 0x12f19404
push eax
call fcn.12f5c050
add esp, 4
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x12f1a320
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x131c4d08
jmp 0x12f1a350
push 0xffffffffffffffff
push 0x1306b5c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x58], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
lea ecx, [esi + 0x90]
mov dword [esp + 0x14], edi
call fcn.12f55c40
mov byte [esp + 0x14], 1
mov dword [esi + 0xb0], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xb4], edi
mov eax, 2
mov byte [esp + 0x14], al
mov dword [esi + 0xc0], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xc4], edi
mov byte [esp + 0x14], 3
mov dword [esi + 0xd0], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xd4], edi
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 4
mov dword [esi], 0x1307cc04
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], 0x7530
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f1aeb0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x414
push ebp
mov ebp, ecx
push esi
mov eax, dword [ebp + 0xe4]
test eax, eax
jne 0x12f1afaf
call fcn.12f1ad50
test eax, eax
je 0x12f1afaf
mov esi, dword [esp + 0x420]
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 8], eax
jne 0x12f1afaf
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea edx, [esp + 0x218]
push 0x103
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x13199068]
pop edi
test eax, eax
je 0x12f1af84
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push str.CWaterMarkScreenDNT::FilterDestroyWindow____08x____s____s_
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
push str.MsoSplash
call fcn.12f5c51d
push eax
lea edx, [esp + 0x14]
push str.MsoSplash
push edx
call fcn.12f5e383
add esp, 0x10
test eax, eax
jne 0x12f1afaf
mov dword [ebp + 0xe4], 1
pop esi
pop ebp
add esp, 0x414
ret 4
Function at 0x12f1df50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306b898
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push 0x3ec
mov ecx, 0x131bcb48
call fcn.12e87050
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, edi
je 0x12f1df9f
push esi
push str.CWaterMarkScreenDNT::GetWaterMarkMemPtr_1___d_
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
push 2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call fcn.12e823d0
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x5c
push esi
push 0x3ec
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
call fcn.12e829e0
cmp dword [0x13199068], edi
je 0x12f1dff8
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
push str.CWaterMarkScreenDNT::GetWaterMarkMemPtr_2___d____p____d_
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, ebx
call fcn.12f1b030
test eax, eax
jne 0x12f1e03e
cmp dword [0x13199068], edi
je 0x12f1e029
push str.CWaterMarkScreenDNT::GetWaterMarkMemPtr_3__ERROR_
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov ecx, dword [esp + 0xc]
push ecx
call fcn.12f5c050
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov dword [edx], eax
mov dword [esp + 0x28], 0xffffffff
call fcn.12e82410
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x12f1f120
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x1306b91b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x22c]
push ebp
push esi
push edi
xor edi, edi
cmp ebx, 5
mov ebp, ecx
mov dword [esp + 0x10], edi
ja 0x12f1f272
mov esi, dword [esp + 0x230]
cmp ebx, edi
je 0x12f1f225
mov word [esp + 0x18], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0x131912a8
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
call fcn.12f46b50
lea eax, [esp + 0x18]
push 0x103
push eax
push esi
mov dword [esp + 0x234], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, ebp
call fcn.12f1ec20
test eax, eax
je 0x12f1f207
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12f1f207
mov edx, dword [esp + 0x23c]
mov dword [esp + 0x10], 1
mov dword [edx], esi
mov eax, dword [0x13199068]
test eax, eax
je 0x12f1f207
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push str.CWaterMarkScreenDNT::WPS_EnumFileWnd___Level:__d___FileWnd:__08x___WindowText:__s_
push str.WaterMark
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
lea ecx, [esp + 0x14]
mov dword [esp + 0x228], 0xffffffff
call fcn.12f472f0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x12f1f28f
mov edi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x12f1f272
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp + 0x234]
inc ebx
push ecx
push ebx
push edx
push esi
mov ecx, ebp
call fcn.12f1f120
mov edi, eax
dec ebx
test edi, edi
jne 0x12f1f272
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x12f1f23b
mov eax, edi
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret 0x10
mov eax, dword [esp + 0x10]
jmp 0x12f1f274
Function at 0x12f26810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1306c100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
mov ebx, 1
push esi
push ebx
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_ieat_proc_external
mov dword [0x131c7d48], 0
call fcn.12f46b50
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.12e9bfb0
mov esi, dword [0x13196dcc]
mov dword [esp + 0x5c], ebx
test esi, esi
je 0x12f2689f
lea ecx, [esp + 0x30]
call fcn.12e9c180
test eax, eax
je 0x12f2689f
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push esi
call fcn.12f46b50
lea ecx, [esp + 0x34]
mov byte [esp + 0x60], bl
call fcn.12e9c5f0
test eax, eax
je 0x12f2689f
mov dword [0x131c7d48], ebx
jmp 0x12f268a8
mov eax, dword [0x131c7d48]
test eax, eax
je 0x12f268ca
push ebx
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_ieat_wapi_external
call fcn.12f46b50
mov ecx, 0x131c7d20
mov byte [esp + 0x68], bl
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9bf00
push ebx
push 0
push ecx
mov byte [esp + 0x68], 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_dis_cloudbox_com_ieta
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 4
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9c180
test eax, eax
je 0x12f2692b
lea ecx, [esp + 0xc]
call fcn.12e9c670
cmp eax, ebx
jne 0x12f2691c
mov dword [0x131c7d4c], ebx
jmp 0x12f2692b
cmp eax, 2
jne 0x12f2692b
mov dword [0x131c7d4c], 0
call fcn.12f26ce0
mov eax, dword [0x13199068]
test eax, eax
je 0x12f26953
mov eax, dword [0x131c7d4c]
push eax
push str._CXDtFrame::Init__s_bDisCloudBoxIeta_:__d_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], bl
call fcn.12e9c070
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x54]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x58
ret
Function at 0x12f27c50
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x131c7d9c]
push esi
test eax, eax
jne 0x12f27d47
mov ecx, dword [0x131c7d98]
cmp ecx, 3
ja 0x12f27d47
mov edx, ecx
inc edx
mov dword [0x131c7d98], edx
call fcn.12f9c5b0
test eax, eax
je 0x12f27c8c
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x12f27c97
push 0x130d3a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x12f27c9f
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetSpecialFolderLocation
push esi
call edi
push str.SHGetSpecialFolderPathW
push esi
mov dword [0x131c7d68], eax
call edi
push str.SHGetKnownFolderPath
push esi
mov dword [0x131c7d6c], eax
call edi
push str.SHGetFolderLocation
push esi
mov dword [0x131c7d70], eax
call edi
push str.SHFormatDrive
push esi
mov dword [0x131c7d74], eax
call edi
push 2
push esi
mov dword [0x131c7d78], eax
call edi
push 4
push esi
mov dword [0x131c7d7c], eax
call edi
push str.SHCreateDirectoryExW
push esi
mov dword [0x131c7d80], eax
call edi
push str.PathRemoveFileSpecW
push esi
mov dword [0x131c7d84], eax
call edi
push str.SHFileOperationA
push esi
mov dword [0x131c7d88], eax
call edi
push str.SHFileOperationW
push esi
mov dword [0x131c7d8c], eax
call edi
push str.PathResolve
push esi
mov dword [0x131c7d90], eax
call edi
mov dword [0x131c7d94], eax
mov eax, 1
mov dword [0x131c7d9c], eax
pop edi
pop esi
ret

Function at 0x12f30390
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131c7ff0
jmp 0x12f303c0
push 0xffffffffffffffff
push 0x1306cde1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.12f55c40
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.12f55c40
mov ecx, dword [0x1307d24c]
mov eax, 1
mov byte [esp + 0x14], al
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 2
mov dword [esi], 0x1307ce70
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12f36c50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1306d580
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov esi, ecx
call fcn.12f36c20
test eax, eax
jne 0x12f36c89
mov dword [esi + 0x7c], eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x34
ret
lea ecx, [esp + 0xc]
xor edi, edi
call fcn.12e9bf00
push 1
push edi
push ecx
mov dword [esp + 0x44], edi
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_landing_enable
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9c180
test eax, eax
je 0x12f36ce5
lea ecx, [esp + 0xc]
call fcn.12e9c670
mov edi, eax
cmp edi, 1
je 0x12f36ce5
cmp edi, 2
jne 0x12f36ce5
mov dword [esi + 0x7c], 0
jmp 0x12f36cec
mov dword [esi + 0x7c], 1
mov eax, dword [0x13199068]
test eax, eax
je 0x12f36d0e
mov eax, dword [esi + 0x7c]
push eax
push edi
push str.CDocWaterMarkMgr::CheckLandingEnable___Num:_d__Enable:_d_
push str.DWMRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x30]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret