joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ff1500
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x131ca3a4]
sub esp, 0x218
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x12ff16a5
mov ebp, dword [esp + 0x22c]
cmp ebp, ebx
je 0x12ff16a5
push 0x131ca3a8
call fcn.12f5c44d
add esp, 4
test eax, eax
je 0x12ff16a5
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x16], eax
push ecx
mov dword [esp + 0x1e], eax
mov word [esp + 0x18], bx
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], bx
mov edx, dword [0x131ca3a0]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1e]
push edx
mov edx, dword [esp + 0x20]
and ecx, 0xffff
stosw word es:[edi], ax
mov eax, dword [esp + 0x24]
and edx, 0xffff
and eax, 0xffff
push eax
mov eax, dword [esp + 0x22]
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x24]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x44]
push 0x13183278
push eax
call fcn.12f5ceef
add esp, 0x24
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x10000000
push 0x131ca3a8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x12ff16a5
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jne 0x12ff1623
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x2c]
push 2
push edx
push esi
mov dword [esp + 0x38], 0xfeff
call edi
lea eax, [esp + 0x10]
push ebx
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.12f5c44d
add esp, 4
lea edx, [esp + 0x30]
shl eax, 1
push eax
push edx
push esi
call edi
push ebp
call fcn.12f5c44d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x12ff168e
lea eax, [esp + 0x10]
push 0
push eax
push ebp
call fcn.12f5c44d
add esp, 4
shl eax, 1
push eax
push ebp
push esi
call edi
cmp word [ebp + ebx*2 - 2], 0xa
je 0x12ff168e
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x13113e90
call fcn.12f5c44d
add esp, 4
shl eax, 1
push eax
push 0x13113e90
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x218
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218
ret
Function at 0x12ff4170
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x13072618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1307f4a0
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x12ff41b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.12f4bed0
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.12f4bed0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.12f41ea0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.12f41ea0
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.12f41ea0
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.12f41ea0
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.12f41ea0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.12f41ea0
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.12f41ea0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12ff5970
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.12f9c460
test eax, eax
je 0x12ff598e
mov dword [0x131ca5b8], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x12ff59a9
mov dword [0x131ca5b8], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push 2
push edi
push edi
mov dword [0x131ca5b8], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x12ff59d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
je 0x12ff59fa
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x12ff5a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x12ff5a6f
jne 0x12ff5a38
test esi, esi
jne 0x12ff5a1e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x12ff5a1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x12ff5a38
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x12ff5a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, eax
test ebp, ebp
jne 0x12ff5a8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x131ca5b8], eax
jne 0x12ff5a78
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x12ff5a8f
mov eax, dword [0x131ca5b8]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x12ff5a8f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x12ff5a8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x131ca5b8], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x12ff5a9c
push edi
call ebx
test esi, esi
je 0x12ff5aa3
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x12ff5cb0
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.12f9c460
test eax, eax
je 0x12ff5ccc
mov dword [0x131ca5b8], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x131ca5b8], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x12ff5d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x12ff5d29
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x12ff5d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x12ff5d7f
jne 0x12ff5d63
test esi, esi
jne 0x12ff5d4d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x12ff5d4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x12ff5d63
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x12ff5d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x12ff5d9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x12ff5d83
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x12ff5d8f
mov dword [0x131ca5b8], ebx
jmp 0x12ff5da6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x131ca5b8], eax
jmp 0x12ff5da6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x12ff5db3
push edi
call ebx
test esi, esi
je 0x12ff5dba
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x12ff6680
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x1307276b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x620
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.12f4bec0
mov eax, dword [esp + 0x658]
mov dword [esp + 0x630], esi
test eax, eax
je 0x12ff66c4
push eax
lea ecx, [esp + 0x14]
call fcn.12f4c110
mov eax, dword [esp + 0x65c]
test eax, eax
je 0x12ff66d9
push eax
lea ecx, [esp + 0x14]
call fcn.12f4c110
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x229]
mov byte [esp + 0x228], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x12ff6758
lea eax, [esp + 8]
lea ecx, [esp + 0x228]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.12f53a30
add esp, 0x10
test eax, eax
jne 0x12ff6751
lea ecx, [esp + 0x10]
mov dword [esp + 0x630], 0xffffffff
call fcn.12f4bed0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x620]
mov dword fs:[0], ecx
add esp, 0x62c
ret
lea esi, [esp + 0x228]
mov eax, dword [esp + 0x648]
mov ecx, dword [esp + 0x664]
mov edx, dword [esp + 0x660]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x660]
push ecx
mov ecx, dword [esp + 0x660]
push edx
mov edx, dword [esp + 0x658]
push esi
mov esi, dword [esp + 0x650]
push 0
push eax
mov eax, dword [esp + 0x660]
push ecx
mov ecx, dword [esp + 0x660]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x12ff6811
mov ebx, dword [esp + 0x654]
test ebx, ebx
je 0x12ff6811
test esi, esi
je 0x12ff6811
call fcn.13002620
mov eax, dword [0x131caa80]
test eax, eax
je 0x12ff6811
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.12f51030
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x131caa80]
lea ecx, [esp + 0x18]
mov dword [esp + 0x638], 0xffffffff
call fcn.12f4bed0
mov ecx, dword [esp + 0x630]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x62c
ret
Function at 0x12ff7060
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x12ff707d
cmp edi, 4
jbe 0x12ff707d
mov dword [0x131ca5bc], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x12ff709c
push eax
mov eax, dword [0x1318339c]
push eax
mov ecx, esi
call fcn.12f57f50
cmp edi, 0xffffffff
je 0x12ff70b0
mov ecx, dword [0x131833a0]
push edi
push ecx
mov ecx, esi
call fcn.12f57f50
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x12ff70c8
mov edx, dword [0x131833a4]
push eax
push edx
mov ecx, esi
call fcn.12f57f50
mov eax, dword [esp + 0x20]
test eax, eax
je 0x12ff70de
push eax
mov eax, dword [0x131833b0]
push eax
mov ecx, esi
call fcn.12f58100
mov eax, dword [esp + 0x24]
test eax, eax
je 0x12ff70f5
mov ecx, dword [0x131833b4]
push eax
push ecx
mov ecx, esi
call fcn.12f58100
mov edx, dword [esp + 0x28]
test edx, edx
je 0x12ff711b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [0x131833ac]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x12ff7131
push eax
mov eax, dword [0x131833a8]
push eax
mov ecx, esi
call fcn.12f58100
mov eax, dword [esp + 0x30]
test eax, eax
je 0x12ff7148
mov ecx, dword [0x131833b8]
push eax
push ecx
mov ecx, esi
call fcn.12f58590
mov eax, dword [esp + 0x34]
test eax, eax
je 0x12ff715f
mov edx, dword [0x131833bc]
push eax
push edx
mov ecx, esi
call fcn.12f58590
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x12ff91c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x138
test eax, eax
push ebx
push ebp
push esi
jne 0x12ff91e0
pop esi
pop ebp
mov eax, 0xf0000001
pop ebx
add esp, 0x138
ret
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x130c55d4
call esi
push str.comctl32.dll
mov ebp, eax
call esi
test ebp, ebp
mov ebx, eax
je 0x12ff92f1
test ebx, ebx
je 0x12ff92f1
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
test eax, eax
je 0x12ff929b
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x44]
mov byte [esp + 0x10], al
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [0x1318350c]
push 9
add ecx, 9
lea edx, [esp + 0x48]
push ecx
push edx
stosb byte es:[edi], al
call fcn.12f5c900
mov eax, dword [0x1318350c]
push 9
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.12f5c900
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x44]
push eax
push ebp
call esi
push 0x47
push ebx
call esi
push 0x49
push ebx
call esi
push 0x13183610
push ebp
call esi
push 0x13183604
push ebp
call esi
push 0x131835f4
push ebp
call esi
push 0x131835e0
push ebp
call esi
push 0x131835ac
call fcn.13051780
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
Function at 0x12ffbe20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1307f4b8
push 0x12f5e0fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x12ffbe54
mov ebx, 0x10000
jmp 0x12ffbe5a
add ebx, 0x10000
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or edi, 0xffffffff
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jbe 0x12ffbf08
cmp dword [ebp - 0x28], 0x1000
jne 0x12ffbf20
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x12ffbf20
test ah, 1
jne 0x12ffbf20
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x40
jbe 0x12ffbf1d
cmp word [ebx], 0x5a4d
jne 0x12ffbf1d
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov dword [ebp - 0x40], esi
mov ecx, esi
sub ecx, ebx
add ecx, 4
cmp ecx, eax
jb 0x12ffbed8
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x12ffbf1d
cmp dword [esi], 0x4550
mov dword [ebp - 4], edi
jne 0x12ffbf20
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + edx]
jmp 0x12ffbe69
Function at 0x12ffc130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1307f4d8
push 0x12f5e0fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
xor edi, edi
cmp eax, edi
jne 0x12ffc170
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edi
cmp word [ecx], 0x5a4d
je 0x12ffc184
push 0xc1
jmp 0x12ffc278
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax], 0x4550
je 0x12ffc19e
push 0xbf
jmp 0x12ffc278
mov cx, word [eax + 0x14]
cmp cx, di
je 0x12ffc273
and ecx, 0xffff
lea ecx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edi
xor edx, edx
mov dx, word [eax + 6]
cmp edi, edx
jae 0x12ffc273
lea eax, [edi + edi*4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
mov esi, 0x131839f8
mov ecx, eax
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [esi]
jne 0x12ffc1fd
test dl, dl
je 0x12ffc1f9
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [esi + 1]
jne 0x12ffc1fd
add ecx, 2
add esi, 2
test dl, dl
jne 0x12ffc1d9
xor ecx, ecx
jmp 0x12ffc202
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x12ffc25e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x12ffc273
mov edx, dword [eax + 0x10]
test edx, edx
je 0x12ffc273
mov edx, dword [ebp - 0x1c]
lea esi, [ecx + edx]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov eax, dword [esi]
cmp eax, 0x40
jb 0x12ffc273
cmp dword [esi + 4], 0x727444
jne 0x12ffc273
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x12ffc23a
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x24]
jmp 0x12ffc1bb
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x12ffc4c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1307f4f8
push 0x12f5e0fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xc]
test eax, eax
mov esi, 0x10000
je 0x12ffc4f8
lea esi, [eax + 0x10000]
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or ebx, 0xffffffff
mov edi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x12ffc538
mov eax, dword [ebp - 0x2c]
mov ecx, eax
and ecx, 0xfff
cmp ecx, 0xfff
je 0x12ffc538
mov edx, dword [ebp - 0x38]
add eax, edx
cmp eax, esi
jae 0x12ffc54d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 0x28], 0x1000
jne 0x12ffc60e
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x12ffc60e
test ah, 1
jne 0x12ffc60e
mov dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x78]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x12ffc59a
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x12ffc50a
cmp word [ebp - 0x78], 0x5a4d
jne 0x12ffc5c8
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x2c]
ja 0x12ffc5c8
cmp eax, 0x40
jb 0x12ffc5c8
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x12ffc5d9
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x12ffc50a
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
mov dword [ebp - 4], ebx
jne 0x12ffc60e
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea esi, [eax + ecx]
jmp 0x12ffc50a
Function at 0x12ffdf00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1307f508
push 0x12f5e0fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x12ffdf38
lea esi, [eax + 0x10000]
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
or ebx, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call edi
test eax, eax
jbe 0x12ffdfc6
cmp dword [ebp - 0x28], 0x1000
jne 0x12ffdf83
mov eax, dword [ebp - 0x24]
cmp al, 1
je 0x12ffdf83
test ah, 1
jne 0x12ffdf83
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], esi
cmp word [esi], 0x5a4d
je 0x12ffdf8e
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x2c]
lea esi, [edx + ecx]
jmp 0x12ffdf4d
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 0x40], eax
cmp dword [eax], 0x4550
mov dword [ebp - 4], ebx
jne 0x12ffdf83
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x12ffe1e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1307f528
push 0x12f5e0fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
xor edi, edi
cmp eax, edi
jne 0x12ffe220
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edi
cmp word [ecx], 0x5a4d
je 0x12ffe234
push 0xc1
jmp 0x12ffe328
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax], 0x4550
je 0x12ffe24e
push 0xbf
jmp 0x12ffe328
mov cx, word [eax + 0x14]
cmp cx, di
je 0x12ffe323
and ecx, 0xffff
lea ecx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edi
xor edx, edx
mov dx, word [eax + 6]
cmp edi, edx
jae 0x12ffe323
lea eax, [edi + edi*4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
mov esi, 0x131839f8
mov ecx, eax
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [esi]
jne 0x12ffe2ad
test dl, dl
je 0x12ffe2a9
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [esi + 1]
jne 0x12ffe2ad
add ecx, 2
add esi, 2
test dl, dl
jne 0x12ffe289
xor ecx, ecx
jmp 0x12ffe2b2
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x12ffe30e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x12ffe323
mov edx, dword [eax + 0x10]
test edx, edx
je 0x12ffe323
mov edx, dword [ebp - 0x1c]
lea esi, [ecx + edx]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov eax, dword [esi]
cmp eax, 0x40
jb 0x12ffe323
cmp dword [esi + 4], 0x727444
jne 0x12ffe323
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x12ffe2ea
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x24]
jmp 0x12ffe26b
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4