joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ea3410
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x13063b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea eax, [ebx + 0x10]
xor esi, esi
push 1
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
call fcn.12f56170
mov edi, dword [ebx + 4]
mov dword [esp + 0x28], esi
dec edi
cmp edi, esi
jl 0x12ea3525
mov esi, edi
shl esi, 5
add esi, edi
shl esi, 3
sub esi, edi
shl esi, 2
mov ecx, dword [esp + 0x30]
mov edx, dword [ebx]
lea eax, [ecx + 4]
push eax
lea eax, [esi + edx + 4]
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12ea34d2
mov ebp, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + ebp + 0x414]
lea ecx, [esi + ebp]
add edx, 0x1388
cmp edx, eax
jae 0x12ea34c5
mov eax, dword [ebx + 4]
sub eax, edi
dec eax
je 0x12ea34c2
mov edx, eax
shl edx, 5
add edx, eax
shl edx, 3
sub edx, eax
lea eax, [esi + ebp + 0x41c]
shl edx, 2
push edx
push eax
push ecx
call fcn.12f5c5c0
add esp, 0xc
dec dword [ebx + 4]
dec edi
sub esi, 0x41c
test edi, edi
jge 0x12ea3462
jmp 0x12ea3525
mov esi, edi
mov ecx, dword [ebx]
shl esi, 5
add esi, edi
shl esi, 3
sub esi, edi
shl esi, 2
lea ebp, [esi + ecx + 0x414]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp]
add edx, 0xbb8
cmp edx, eax
jae 0x12ea351e
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x414]
mov dword [ebp], ecx
mov edx, dword [ebx]
mov eax, dword [eax]
mov dword [esi + edx], eax
mov ecx, dword [ebx]
mov dword [esi + ecx + 0x418], 0
cmp edi, 0xffffffff
mov eax, edi
jne 0x12ea355e
mov esi, dword [ebx + 4]
push 0xffffffffffffffff
mov ecx, ebx
lea edx, [esi + 1]
push edx
call fcn.12ea61d0
mov eax, esi
mov ecx, dword [ebx]
shl eax, 5
add eax, esi
shl eax, 3
sub eax, esi
mov esi, dword [esp + 0x30]
lea edi, [ecx + eax*4]
mov ecx, 0x107
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 4]
dec eax
cmp eax, 0xffffffff
je 0x12ea35e9
mov esi, eax
mov edx, dword [ebx]
shl esi, 5
add esi, eax
shl esi, 3
sub esi, eax
shl esi, 2
lea ecx, [esi + edx]
mov edx, dword [esi + edx]
cmp edx, 0xffffffff
je 0x12ea35e9
mov edi, dword [0x13199068]
test edi, edi
je 0x12ea359e
add ecx, 4
push ecx
push edx
push eax
push str.IsNeedLog__d__d__s
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
mov eax, dword [ebx]
add esi, eax
mov eax, dword [esi]
test eax, eax
jne 0x12ea35b5
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 0
jne 0x12ea35be
test eax, eax
je 0x12ea35e9
mov edx, dword [esp + 0x30]
cmp dword [edx], 0
jne 0x12ea35e9
mov dword [esi], 0xffffffff
mov eax, dword [0x13199068]
test eax, eax
mov dword [esp + 0x10], 1
je 0x12ea35e9
push str.IsNeedLog_____
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x12ea5000
Capabilities:
Get file size

Disassembly:
sub esp, 0x21c
push esi
mov esi, dword [esp + 0x224]
test esi, esi
push edi
je 0x12ea524b
mov eax, dword [0x13199068]
test eax, eax
je 0x12ea503a
push 0x131be908
push esi
push str.DealOAIE_1__s__s
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
push esi
call fcn.12e310a0
mov edi, eax
push edi
call fcn.12f5c51d
add esp, 8
cmp eax, 4
jne 0x12ea508b
push eax
push str..bak
push edi
call fcn.12f5e383
add esp, 0xc
test eax, eax
jne 0x12ea508b
mov ecx, 0x82
mov edi, 0x131be908
push 0x103
push esi
rep stosd dword es:[edi], eax
push 0x131be908
call fcn.12f5c57b
add esp, 0xc
pop edi
pop esi
add esp, 0x21c
ret
push edi
call fcn.12f5c51d
add esp, 4
cmp eax, 4
jne 0x12ea524b
push eax
push str..doc
push edi
call fcn.12f5e383
add esp, 0xc
test eax, eax
je 0x12ea50c8
push 4
push str..xls
push edi
call fcn.12f5e383
add esp, 0xc
test eax, eax
jne 0x12ea524b
push 0x131be908
call fcn.12f5c51d
push esi
mov edi, eax
call fcn.12f5c51d
add esp, 8
cmp eax, edi
jne 0x12ea524b
push esi
call fcn.12f5c51d
sub eax, 4
push eax
push 0x131be908
push esi
call fcn.12f5e383
add esp, 0x10
test eax, eax
jne 0x12ea524b
mov ecx, 0x81
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], ax
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.12e7d1b0
mov eax, dword [0x13199068]
add esp, 0xc
test eax, eax
je 0x12ea514c
lea ecx, [esp + 0x1c]
push ecx
push str.DealOAIE_2__s
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp word [esp + 0x1c], 0
je 0x12ea524b
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
push edx
push 0x80
push 3
push edx
push 3
push SysReAllocStringLen
push eax
xor edi, edi
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12ea51a7
push esi
push str.DealOAIE_3__x
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp esi, 0xffffffff
je 0x12ea51fd
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x12ea51c9
mov dword [esp + 8], 0
xor edi, edi
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
push eax
push edx
push edx
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
jne 0x12ea51f6
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x13199068]
test eax, eax
je 0x12ea522a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
push edi
push str.DealOAIE_4__d__d__d__d
push str.DocOpLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
lea edx, [esp + 0x28]
push str.OA_UPLOAD
push edx
push 1
push 0
call fcn.12e74930
add esp, 0x1c
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x12ea6380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, 0x131bed28
jmp 0x12ea63b0
push 0xffffffffffffffff
push 0x13063cd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x10]
call fcn.12f55c40
xor ebp, ebp
lea ecx, [esi + 0x24c]
mov dword [esp + 0x28], ebp
call fcn.12f4cc70
lea ecx, [esi + 0x260]
mov byte [esp + 0x28], 1
call fcn.12f54670
lea ecx, [esi + 0x270]
mov byte [esp + 0x28], 2
call fcn.12f54670
lea ecx, [esi + 0x284]
mov byte [esp + 0x28], 3
call fcn.12f4cc70
mov eax, dword [0x1307d24c]
lea edi, [esi + 0x294]
mov byte [esp + 0x28], 4
mov dword [edi], eax
lea ecx, [esi + 0x298]
mov byte [esp + 0x28], 5
call fcn.12f55c40
mov byte [esp + 0x28], 6
mov dword [esi + 0x2b8], ebp
mov dword [esi + 0x2c4], ebp
mov dword [esi + 0x2c0], ebp
mov dword [esi + 0x2bc], ebp
mov ecx, dword [0x1307d24c]
mov byte [esp + 0x28], 7
mov dword [esi + 0x2c8], ecx
mov byte [esp + 0x28], 8
push 0x131912a8
mov ecx, edi
mov dword [esi], 0x1307af2c
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x240], ebp
mov dword [esi + 0x244], ebp
mov dword [esi + 0x248], ebp
mov dword [esi + 0x280], ebp
call fcn.12f47570
lea ebx, [esi + 0x34]
mov ecx, 0x82
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x103
call fcn.12d8c6e0
push eax
push ebx
call fcn.12f5c57b
push ebx
call fcn.12f5c51d
add esp, 0x10
lea ecx, [esi + 0x24c]
mov dword [esi + 0x23c], eax
push 0xffffffffffffffff
push ebp
call fcn.12f4cce0
push 0xffffffffffffffff
push ebp
lea ecx, [esi + 0x284]
call fcn.12f4cce0
push 1
lea eax, [esi + 0x298]
lea ecx, [esp + 0x18]
push eax
call fcn.12f56170
mov eax, dword [esi + 0x2b8]
mov byte [esp + 0x28], 9
cmp eax, ebp
je 0x12ea6520
push eax
call fcn.12f5c050
add esp, 4
mov dword [esi + 0x2b8], ebp
mov dword [esi + 0x2c0], ebp
mov dword [esi + 0x2bc], ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 8
call fcn.12f561d0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x20], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x12eab736
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
call fcn.12f9c600
test eax, eax
je 0x12eab79f
mov edx, dword [esp + 0x210]
test edx, edx
je 0x12eab79f
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
pop edi
jbe 0x12eab79f
cmp eax, 0x104
jae 0x12eab79f
mov ecx, dword [esp + 0x214]
lea edx, [esp + 4]
push ecx
push edx
mov ecx, esi
call fcn.12eab610
pop esi
add esp, 0x208
ret 8
xor eax, eax
pop esi
add esp, 0x208
ret 8

Function at 0x12eab8e6
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
call fcn.12f9c600
test eax, eax
je 0x12eab94f
mov edx, dword [esp + 0x210]
test edx, edx
je 0x12eab94f
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
pop edi
jbe 0x12eab94f
cmp eax, 0x104
jae 0x12eab94f
mov ecx, dword [esp + 0x214]
lea edx, [esp + 4]
push ecx
push edx
mov ecx, esi
call fcn.12eab7b0
pop esi
add esp, 0x208
ret 8
xor eax, eax
pop esi
add esp, 0x208
ret 8

Function at 0x12eabaa6
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
call fcn.12f9c600
test eax, eax
je 0x12eabb17
mov edx, dword [esp + 0x210]
test edx, edx
je 0x12eabb17
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
pop edi
jbe 0x12eabb17
cmp eax, 0x104
jae 0x12eabb17
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x214]
push ecx
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
call fcn.12eab960
pop esi
add esp, 0x208
ret 0xc
xor eax, eax
pop esi
add esp, 0x208
ret 0xc
Function at 0x12eb0630
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x12eb0647
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x12eb069b
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x12eb069b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x12eb069b
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x18], 0
not ecx
dec ecx
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x12eb06ce
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
push ecx
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
pop esi
pop ebx
ret 4

Function at 0x12eb06e0
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 8]
test eax, eax
je 0x12eb06f6
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x12eb0749
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x12eb0749
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x12eb0749
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
mov dword [esp + 0x18], 0
call fcn.12f5c51d
mov edx, dword [esi + 0x18]
add esp, 4
shl eax, 1
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x12eb077b
lea eax, [esp + 0xc]
push 0
push eax
push edi
mov dword [esp + 0x18], 0
call fcn.12f5c51d
add esp, 4
shl eax, 1
push eax
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
pop esi
ret 4
Function at 0x12eb13f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x130646b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x10]
call fcn.12f55c40
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.12f4cc70
mov eax, dword [0x1307d24c]
mov byte [esp + 0x14], 1
mov dword [esi + 0x40], eax
push edi
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 2
call fcn.12eb0bd0
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.12eb0e80
lea ecx, [esi + 0x74]
mov byte [esp + 0x14], 4
call fcn.12eb0f40
push edi
lea ecx, [esi + 0x84]
mov byte [esp + 0x18], 5
call fcn.12eb1070
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov byte [esp + 0x14], 6
mov dword [esi], 0x1307afb0
mov dword [esi + 4], edi
mov dword [esi + 8], 2
mov dword [esi + 0xc], eax
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esp + 0x14], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12eb1670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1306478b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebp
mov ebp, ecx
push esi
push 1
lea eax, [ebp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.12f56170
xor esi, esi
add ebp, 0x30
push 0xffffffffffffffff
push esi
mov ecx, ebp
mov dword [esp + 0x22c], esi
call fcn.12f4cce0
mov edx, dword [esp + 0x22c]
cmp edx, esi
jne 0x12eb16d8
lea ecx, [esp + 8]
mov dword [esp + 0x224], 0xffffffff
call fcn.12f561d0
jmp 0x12eb1773
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3b
push edx
mov edi, edx
call fcn.12f5d099
mov ebx, eax
add esp, 8
cmp ebx, esi
je 0x12eb174b
mov esi, ebx
sub esi, edi
sar esi, 1
je 0x12eb1737
cmp esi, 0x103
jae 0x12eb1737
push esi
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.12f5c57b
mov eax, dword [ebp + 4]
add esp, 0xc
lea edx, [esp + 0x1c]
mov ecx, ebp
push edx
push eax
mov word [esp + esi*2 + 0x24], 0
call fcn.12f4d190
lea edi, [ebx + 2]
push 0x3b
push edi
call fcn.12f5d099
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x12eb1701
cmp word [edi], 0
je 0x12eb175d
mov eax, dword [ebp + 4]
push edi
push eax
mov ecx, ebp
call fcn.12f4d190
lea ecx, [esp + 0x10]
mov dword [esp + 0x22c], 0xffffffff
call fcn.12f561d0
pop edi
pop ebx
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x220
ret 4
Function at 0x12eb46a0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x13064c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
je 0x12eb4776
push ebx
push esi
mov esi, dword [esp + 0x24]
mov ebx, 2
mov ecx, esi
call fcn.12f4b080
mov ecx, esi
call fcn.12f4ad60
push 0x13113e90
mov ecx, esi
call fcn.12f4ae50
push 0x13113e90
mov ecx, esi
call fcn.12f4ab60
dec ebx
jne 0x12eb46cf
push 0x13113e90
mov ecx, esi
call fcn.12f47f40
push 0x13198dc0
lea ecx, [esp + 0x24]
call fcn.12f41640
mov esi, dword [esi]
xor ebx, ebx
push 0xfde9
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x20], ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.12eb45f0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.12f420f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call fcn.12f41f70
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xc]
push ebx
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.12f41f70
pop esi
pop ebx
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12eb51d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13064dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push 1
push esi
lea ecx, [esp + 0x18]
call fcn.12f56170
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x30], ebx
push eax
mov ecx, esi
mov dword [esp + 0x1c], ebx
call fcn.12eb5670
mov edi, eax
cmp edi, ebx
je 0x12eb5300
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
je 0x12eb52ef
cmp eax, ecx
jb 0x12eb524b
add ecx, 0x493e0
cmp eax, ecx
jbe 0x12eb52ef
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jne 0x12eb525d
mov ecx, dword [eax]
mov dword [esi + 0x20], ecx
jmp 0x12eb5264
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
cmp eax, dword [esi + 0x24]
jne 0x12eb5271
mov edx, dword [eax + 4]
mov dword [esi + 0x24], edx
jmp 0x12eb5279
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
cmp ecx, edx
jge 0x12eb5290
mov edx, dword [esi + 0x28]
mov dword [eax], edx
mov dword [esi + 0x28], eax
inc dword [esi + 0x30]
jmp 0x12eb5299
push eax
call fcn.12f5c050
add esp, 4
mov eax, dword [esi + 0x2c]
dec eax
mov dword [esi + 0x2c], eax
jne 0x12eb5300
mov eax, dword [esi + 0x20]
mov ecx, eax
cmp ecx, ebx
je 0x12eb52b1
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x12eb52ab
cmp eax, ebx
je 0x12eb52c6
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12eb52b5
mov eax, dword [esi + 0x28]
mov dword [esi + 0x2c], ebx
cmp eax, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
je 0x12eb52e7
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12eb52d6
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
jmp 0x12eb5300
mov edx, dword [esp + 0x38]
mov ecx, dword [edi + 0xc]
mov ebx, 1
mov dword [edx], ecx
mov dword [edi + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x12eb5510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x13064e38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.12f56170
mov eax, dword [esi + 0x20]
xor ebx, ebx
mov ecx, eax
mov dword [esp + 0x20], ebx
cmp ecx, ebx
je 0x12eb554e
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x12eb5548
cmp eax, ebx
je 0x12eb5563
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12eb5552
mov eax, dword [esi + 0x28]
mov dword [esi + 0x2c], ebx
cmp eax, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
je 0x12eb5584
mov edi, dword [eax]
push eax
call fcn.12f5c050
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x12eb5573
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.12f561d0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x12eb7940
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131bfe20
jmp 0x12eb7970
push 0xffffffffffffffff
push 0x1306511b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x10]
call fcn.12f55c40
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], 0x1307b140
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x240], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12eb8600
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131c0068
jmp 0x12eb8630
push 0xffffffffffffffff
push 0x130651bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x10]
call fcn.12f55c40
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], 0x1307b144
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x240], eax
mov dword [esi + 0x244], eax
mov dword [esi + 0x248], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12ebef00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1305dd4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.12f8b450
mov ecx, dword [0x1307d24c]
xor edi, edi
lea eax, [esi + 0x4c]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov dword [eax + 0x14], ecx
mov edx, dword [0x1307d24c]
mov byte [esp + 0x18], 1
mov dword [eax + 0x18], edx
mov ecx, dword [0x1307d24c]
mov byte [esp + 0x18], 2
mov dword [eax + 0x1c], ecx
mov edx, dword [0x1307d24c]
mov byte [esp + 0x18], 3
mov dword [eax + 0x20], edx
mov ecx, dword [0x1307d24c]
mov byte [esp + 0x18], 4
mov dword [eax + 0x24], ecx
mov edx, dword [0x1307d24c]
mov byte [esp + 0x18], 5
mov dword [eax + 0x28], edx
mov ecx, dword [0x1307d24c]
mov byte [esp + 0x18], 6
mov dword [eax + 0x2c], ecx
mov edx, dword [0x1307d24c]
mov byte [esp + 0x18], 7
mov dword [eax + 0x30], edx
mov byte [esp + 0x18], 8
mov word [eax], di
mov word [eax + 2], di
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov byte [esp + 0x18], 9
mov dword [esi], 0x13078510
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x24]
xor eax, eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x20], edi
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x38]
mov dword [esi + 0x34], edi
mov ecx, dword [esp + 0x10]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
or eax, 0xffffffff
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esp + 0x18], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, 0x131c0860
jmp 0x12e3ca30