joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a0a0
Capabilities:
Connect to http server
Create http request
Encode data using xor
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push esi
push edi
push 0
push 0
push 0
push 0
push str.MyBrowser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x42a25f
push 1
push 0
push 3
push 0
push 0
push 0x50
push dword [0x6c0700]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 8], eax
test eax, eax
je 0x42a264
mov dword [ebp - 4], str.whS
push ebx
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 0x18], 0x597588
mov dword [ebp - 0x14], 0
cmp byte [ebx + 0x13], 0
je 0x42a159
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x42a14a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x42a131
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 0x10]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 8]
push 1
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push edi
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x42a269
mov ecx, 0x5c38c8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42a184
sub ecx, edx
mov edx, 0x5c38cc
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x42a195
push ecx
push 0x5c38c8
sub edx, ebx
push edx
push 0x5c38cc
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
pop ebx
test eax, eax
je 0x42a26e
push 0x800
lea eax, [ebp - 0x818]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0xc], 0x800
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x818]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x42a273
push 0x41b730
lea eax, [ebp - 0x818]
push eax
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040a540
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x800
lea eax, [ebp - 0x818]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x800
lea eax, [ebp - 0x818]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42a278
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 8]
call esi
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0042a280
call fcn.0042a280
call fcn.0042a280
call fcn.0042a280
call fcn.0042a280
call fcn.0042a280
int3
Function at 0x42a280
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x587536
push eax
mov dword fs:[0], esp
sub esp, 0x158
cmp dword [0x6c0794], 1
push esi
jne 0x42a320
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.0040b9f0
lea eax, [ebp - 0x164]
mov dword [ebp - 4], 0
push str._nHTTP_Server_connection_fail_
push eax
call fcn.0040a540
add esp, 8
lea ecx, [ebp - 0x160]
call fcn.004096b0
test eax, eax
jne 0x42a302
push eax
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x164]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], 0xffffffff
call fcn.0040baf0
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6c07a4], 1
jne 0x42a3f4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xbc]
mov esi, eax
push 1
push 0x40
push 8
push 0x58fee4
call fcn.0040b9f0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0040a540
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str.HTTP_Server_connection_fail_
push eax
call fcn.0040a540
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0040a540
add esp, 0x24
lea ecx, [ebp - 0xb8]
call fcn.004096b0
test eax, eax
jne 0x42a3d6
push eax
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x58fee4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x5c]
call fcn.0040baf0
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [0x6c0798]
cmp eax, 1
je 0x42a43f
cmp eax, 3
je 0x42a43f
cmp eax, 4
je 0x42a43f
push 0
cmp eax, 2
jne 0x42a435
push 0
push 0
push 0x42a450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x42a42f
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x42a480
jmp 0x42a418

Function at 0x42a4b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push fcn.0042a0a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x42a600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push str.USER32.DLL
mov dword [ecx + 4], 0
mov dword [ecx + 0x18], str.SPLASH
mov dword [ecx + 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], 0x5975e4
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 8], eax
cmp byte [ebx + 0x13], 0
je 0x42a685
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x42a679
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x42a660
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
mov dword [0x6c06bc], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], 0x59761c
push ebx
mov ebx, dword [ebp - 0x10]
push edi
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42a9e4
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
pop esi
je 0x42a9db
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42a9c2
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x808080
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042a4f0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0042a930
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x2c]
call fcn.0042a560
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0042a520
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42bd50
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x42bd70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x42d600
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x6c7238
push esi
push edi
push ebx
call fcn.00446030
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov dword [0x6c1f50], ebx
call edi
shl eax, 2
push 0x21
mov dword [ebp - 4], eax
call edi
mov ebx, eax
push 4
shl ebx, 2
call edi
movdqu xmm0, xmmword [0x705998]
mov ecx, dword [0x7059a8]
add ebx, eax
push 0
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x18], ecx
call edi
movdqu xmm1, xmmword [ebp - 0x14]
mov edx, dword [ebp - 4]
xor esi, esi
push esi
push dword [ebp + 8]
movdqa xmm0, xmm1
psrldq xmm1, 8
psrldq xmm0, 4
movd ecx, xmm0
push esi
push esi
cmp eax, ecx
movd eax, xmm1
cmove edx, esi
add eax, ebx
push eax
lea eax, [ecx + edx]
push eax
push esi
push 0x80000000
push 0xca0000
push 0x6c2158
push 0x6c2358
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6c1f54], esi
test esi, esi
jne 0x42d6b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6c3afc
call fcn.0042f380
push 0
push 0
push 2
mov ecx, 0x6c3afc
call fcn.0042fa10
mov eax, dword [0x7070c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push dword [0x6de050]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x114]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ecx, 0x6d3af8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.004666c0
mov ecx, 0x6d3af8
mov dword [ebp - 8], eax
call fcn.004666d0
cmp byte [ebp + 0x14], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
jne 0x42d785
push 0x20000
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
push 1
push eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x10]
push eax
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
jmp 0x42d7c1
push 0xca0000
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0xca0000
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [ebp + 0x10]
mov ecx, 0x6ebdb0
push dword [ebp + 0xc]
call fcn.00535ca0
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x7070c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf8]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42dcc0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x6c1f30], 0x398
mov byte [0x6c1f45], 1
call fcn.0042b600
test eax, eax
jne 0x42dce6
mov esp, ebp
pop ebp
ret 0x10
call fcn.0042d5a0
push str.._Log_Debug.txt
mov dword [0x6c2594], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x58fee4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x6ebdb0
call fcn.00530740
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x705a36
push str._s__PID__d_
push 0x6c2158
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [0x6c2594], 0
je 0x42dd60
mov ecx, 0x6c2158
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42dd45
mov ax, word [0x597d64]
mov word [ecx], ax
mov al, byte [0x597d66]
mov byte [ecx + 2], al
xor ecx, ecx
jmp 0x42dd70
mov al, byte [ecx + 0x6c2158]
lea ecx, [ecx + 1]
mov byte [ecx + 0x6c2357], al
test al, al
jne 0x42dd70
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0042d8a0
add esp, 4
mov ecx, 0x6e8548
push str.._Resource_QuestScript_QuestString.bin
call fcn.005091b0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6e8548
call fcn.00509000
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6e8548
call fcn.00508e30
mov ecx, 0x6d38a0
call fcn.0045bbc0
push dword [ebp + 0x14]
push esi
call fcn.0042d600
add esp, 8
test eax, eax
jne 0x42dde5
call fcn.0042d810
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x42de20
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x42de00
mov eax, dword [0x6c31b0]
test al, 1
jne 0x42de48
or eax, 1
mov ecx, 0x6c25a8
mov dword [0x6c31b0], eax
call fcn.004ddb00
push 0x58d990
call fcn.00585ff3
add esp, 4
mov ecx, 0x6c25a8
call fcn.004ddb90
fld1
mov ecx, 0x6c3afc
fsubp st(1)
fstp qword [0x6c25a0]
call fcn.0042f5f0
cmp eax, 0xffffffff
jne 0x42de00
call fcn.0042d810
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42ea50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xff
push eax
push 0xf023f
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea ecx, [ebp - 0x108]
mov edx, 0x597c60
cmovne ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42eab0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf023f
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp + 0x14]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ead6
sub eax, esi
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43d4e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43d66d
cmp byte [esi], 0
je 0x43d66d
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43d66d
push ebx
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 0xc]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x64
cmovne ecx, edx
mov dword [ebp - 0x24], 0
xor edi, edi
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x43d65c
mov edi, edi
push edi
push str._04u
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push 5
push eax
mov byte [ebp - 0x14], 0
call fcn.0043fab0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43d63b
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.NetCfgInstanceId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43d5ea
push dword [ebp - 4]
call ebx
jmp 0x43d63b
push esi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x43d603
push dword [ebp - 4]
call ebx
jmp 0x43d63b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.Characteristics
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call ebx
test esi, esi
je 0x43d656
mov esi, dword [ebp + 8]
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x43d570
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0x24]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0x24]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43d880
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0
mov dword [ebp - 4], 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x43d8c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push dword [ebp + 8]
call fcn.0043fab0
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push edi
push dword [ebp - 4]
call dword [sym.imp.MSVCR120.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x43d8ee
push str.GetMAC_Failed__Because_malloc_failed_
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
lea eax, [ebp - 4]
mov esi, edi
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x43d929
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push dword [ebp + 8]
call fcn.0043fab0
push edi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x14
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 8]
push ebx
xor ebx, ebx
nop
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x43d96b
cmp eax, 8
ja 0x43d96b
push eax
lea eax, [esi + 0x194]
push eax
push dword [ebp + 8]
call sub.MSVCR120.dll_memcpy
mov ebx, dword [esi + 0x190]
lea eax, [esi + 8]
add esp, 0xc
mov ecx, edi
push eax
call fcn.0043d4e0
shr eax, 2
test al, 1
jne 0x43d971
mov esi, dword [esi]
test esi, esi
jne 0x43d930
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x444ad0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x6c3b04]
push esi
mov esi, ecx
mov ecx, 0x6c3afc
push 0
mov eax, dword [eax + 8]
push 0
mov dword [eax + 0xc], 1
cmp dword [esi + 0x10], 0
je 0x444b0b
push 3
mov dword [0x6c3d48], 1
call fcn.0042fa10
mov dword [esi + 0x10], 0
jmp 0x444b12
push 2
call fcn.0042fa10
cmp dword [0x6de03c], 0
pop esi
jne 0x444b30
mov dword [0x6de03c], 1
mov ecx, 0x6ddfa0
jmp fcn.004e9de0
ret

Function at 0x44a290
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [ecx + 0x10], 0
jne fcn.0045fc20
ret
Function at 0x4521d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588039
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x10]
mov dword [esi], vtable.cMultiLineText.0
call fcn.0044e4b0
push fcn.0044e4e0
push fcn.0044e4b0
push 5
push 0x20
lea eax, [esi + 0x5c]
mov dword [ebp - 4], 0
push eax
call fcn.005864e4
lea ecx, [esi + 0xfc]
mov byte [ebp - 4], 1
call fcn.0044e4b0
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 2
call fcn.0044e4b0
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 3
call fcn.0044e4b0
lea ecx, [esi + 0x1a8]
mov byte [ebp - 4], 4
call fcn.0044e4b0
push fcn.0044e4e0
push fcn.0044e4b0
push 0x32
push 0x20
lea eax, [esi + 0x1c8]
mov byte [ebp - 4], 5
push eax
call fcn.005864e4
xor eax, eax
mov dword [esi + 0x30], 0xffffff
push eax
push eax
push eax
push eax
mov word [esi + 0xc], ax
mov dword [esi + 0x4c], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x38]
push eax
mov dword [esi + 0x34], 0xffffff
mov dword [esi + 0x48], 0
mov dword [esi + 4], 0
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov word [esi + 0x58], ax
mov dword [esi + 0x1a0], eax
mov dword [esi + 0x80c], eax
mov eax, esi
mov dword [esi + 0x50], 0xff
mov dword [esi + 0x54], 0x64
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45f3e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588e83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00452fb0
lea ecx, [esi + 0x58]
mov dword [ebp - 4], 0
mov dword [esi], vtable.cWindow.0
call fcn.004521d0
lea ecx, [esi + 0x868]
mov byte [ebp - 4], 1
call fcn.0044e4b0
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov word [esi + 0x1c], ax
mov eax, 1
mov word [esi + 0xc], ax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x8fc], eax
mov dword [esi + 0x888], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], eax
mov dword [esi + 4], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x8f4], eax
mov dword [esi + 0x8f8], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x910], eax
mov dword [esi + 0x914], eax
mov dword [esi + 0x918], eax
mov dword [esi + 0x930], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x88c], 0xffffff
mov dword [esi + 0x890], 0xff
mov dword [esi + 0x894], 0x64
mov dword [esi + 0x18], fcn.004f8c80
mov dword [esi + 0x900], 0x3f800000
mov dword [esi + 0x904], 0x3f800000
mov dword [esi + 0x34], 1
mov dword [0x6d3a5c], eax
mov dword [0x6d3a60], eax
mov dword [esi + 0x8bc], eax
mov dword [esi + 0x8c0], eax
mov dword [esi + 0x8c4], eax
mov dword [esi + 0x8c8], eax
movdqu xmm0, xmmword [esi + 0x8bc]
mov dword [esi + 0x8b8], eax
movdqu xmmword [esi + 0x8cc], xmm0
xorps xmm0, xmm0
movdqu xmmword [esi + 0x91c], xmm0
mov dword [esi + 0x908], eax
mov dword [esi + 0x90c], eax
mov eax, esi
mov byte [esi + 0x92c], 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret