joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410766
Capabilities:
Create thread
Terminate process

Disassembly:
push 0xa8
mov eax, 0x551839
call fcn.005500e5
xor esi, esi
mov edi, 0x5619b0
cmp dword [0x68d67c], 1
jne 0x4107e8
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.00409075
push 0x56198c
mov dword [ebp - 4], esi
call fcn.00408fb9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
push edi
call fcn.00408fb9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
add esp, 0x18
lea ecx, [ebp - 0xb4]
call fcn.00409583
lea ecx, [ebp - 0xb4]
call fcn.00409144
mov eax, dword [0x68d680]
push esi
cmp eax, 1
jne 0x410814
push esi
push esi
push 0x410890
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x410822
push esi
push esi
push 0x410868
jmp 0x4107fa
cmp eax, 3
jne 0x410830
push esi
push esi
push 0x4108b8
jmp 0x4107fa
cmp eax, 4
jne 0x410866
push esi
push esi
push 0x40b022
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x5619e4
call fcn.00408fb9
pop ecx
push eax
push edi
call fcn.00408fb9
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41080d
jmp 0x41080e

Function at 0x4108e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x68d690], 1
jne 0x410939
movzx eax, word [0x449081]
push eax
lea eax, [ebp - 0x10]
push 0x561908
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
push 0x30
push 0x561a00
call fcn.00408fb9
pop ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x7361
cmp word [0x449081], ax
jne 0x410957
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.005500ac
mov esp, ebp
pop ebp
ret
call fcn.00410766
int3

Function at 0x410991
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x41095d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x4109a4
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x411bb0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4119b8
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
push dword [ebp + 8]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x411ba8
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x68d67c], 1
jne 0x411a52
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x561aac
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push dword [ebp + 8]
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x411b2d
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov ebx, 0x55ca18
mov esi, eax
push ebx
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x561ad0
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push dword [ebp + 8]
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x38
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push ebx
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
xor ebx, ebx
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x411b59
push ebx
push ebx
push 0x4109df
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x411b67
push ebx
push ebx
push 0x4109b7
jmp 0x411b3f
cmp eax, 3
jne 0x411b75
push ebx
push ebx
push 0x4108b8
jmp 0x411b3f
cmp eax, 4
jne 0x411ba6
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x561af4
call fcn.00408fb9
pop ecx
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x411b52
jmp 0x411b53
mov al, 1
call fcn.005500c2
ret
Function at 0x411dfc
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
inc edi
cmp dword [0x68d6a4], edi
jne 0x411e20
call fcn.004120fa
jmp 0x411e9a
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x411e3b
xor eax, eax
jmp 0x411e9c
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x411e37
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x411e37
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x411e37
push esi
push esi
push esi
push 0x411d7c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005500ac
mov esp, ebp
pop ebp
ret

Function at 0x411eac
Capabilities:
Create thread
Terminate process

Disassembly:
push 0xa8
mov eax, 0x551839
call fcn.005500e5
xor esi, esi
cmp dword [0x68d67c], 1
jne 0x411f28
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.00409075
push 0x5611c0
mov dword [ebp - 4], esi
call fcn.00408fb9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
push dword [0x68d5cc]
lea eax, [ebp - 0xb4]
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0xb4]
call fcn.00409583
lea ecx, [ebp - 0xb4]
call fcn.00409144
mov eax, dword [0x68d680]
cmp eax, 1
je 0x411f65
cmp eax, 3
je 0x411f65
cmp eax, 4
je 0x411f65
push esi
cmp eax, 2
jne 0x411f63
push esi
push esi
push 0x411fe9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x411f5d
push esi
push esi
push esi
push 0x412011
jmp 0x411f49
Function at 0x41204b
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x563aa8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41206f
push 4
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp + 0xc]
mov edi, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x412093
push 0
sub edx, eax
push edx
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
push eax
push eax
push edi
push ebx
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x4120fa
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x412039
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4121c3
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
xor edi, edi
push edi
push edi
push edi
push 0x41273b
push edi
push edi
call esi
push edi
push edi
push edi
push 0x41274c
push edi
push edi
call esi
push edi
push edi
push edi
push 0x4125c2
push edi
push edi
call esi
pop edi
pop esi
ret

Function at 0x41280e
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
cmp dword [0x68d67c], 1
jne 0x4128a3
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x563cf8
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
push 0x563d1c
call fcn.00408fb9
add esp, 0x10
push eax
push dword [0x68d5f8]
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
pop ecx
pop ecx
push eax
call fcn.004081fc
pop ecx
pop ecx
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x412995
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ca18
mov esi, eax
push edi
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x563d4c
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x563d70
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x563d1c
call fcn.00408fb9
add esp, 0x28
push eax
push dword [0x68d5f8]
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
pop ecx
pop ecx
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x14
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
push ebx
cmp eax, 1
jne 0x4129c1
push ebx
push ebx
push 0x412ab1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x4129cf
push ebx
push ebx
push 0x412a89
jmp 0x4129a7
cmp eax, 3
jne 0x4129dd
push ebx
push ebx
push 0x4108b8
jmp 0x4129a7
cmp eax, 4
jne 0x412a11
push ebx
push ebx
push 0x40b022
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x563d94
call fcn.00408fb9
pop ecx
push eax
push dword [0x68d5f8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4129ba
jmp 0x4129bb

Function at 0x412a47
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x412a13
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x412b22
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x68d584
call fcn.00412b16
test eax, eax
je 0x412b6d
mov eax, dword [0x68d680]
push 0x200030
push dword [0x68d5fc]
cmp eax, 1
jne 0x412b61
push 0x563df8
call fcn.00408fb9
pop ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x412b45
push 0x563e48
jmp 0x412b4a
xor eax, eax
ret

Function at 0x412bf2
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x412c69
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412c69
push edi
push dword [ebp - 0x124]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x412c57
push edi
call fcn.00412b81
pop ecx
test al, al
jne 0x412c80
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412c34
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x130], 0x103
push ebx
push 0x563ea8
je 0x412cd5
call fcn.00408fb9
pop ecx
push eax
push 0x563ed0
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x412c68
call fcn.00408fb9
pop ecx
push eax
push 0x563f24
call fcn.00408fb9
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x412d6d
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4130f7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x412d80
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push 0x56405c
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x412f0f
push 1
push edi
push 3
push edi
push edi
push 0x50
push dword [0x68d5e8]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x412f0f
push 1
push edi
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x56407c
push eax
push edi
push edi
push 0x564080
mov dword [ebp - 0x810], edi
call fcn.00408fb9
pop ecx
push eax
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x412f0f
mov ecx, 0x5908c0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412e1e
sub ecx, edx
mov edx, 0x5908c4
lea eax, [edx + 1]
mov dword [ebp - 0x80c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x412e35
sub edx, dword [ebp - 0x80c]
push ecx
push 0x5908c0
push edx
push 0x5908c4
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x412f0f
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x808], 0x800
lea eax, [ebp - 0x808]
push 0
push eax
lea eax, [ebp - 0x804]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x412f0f
push 0x40f5e1
lea eax, [ebp - 0x804]
push eax
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004081fc
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x412f0f
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret
call fcn.00412f15
int3
Function at 0x412f15
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push 0x158
mov eax, 0x551927
call fcn.005500e5
xor ebx, ebx
cmp dword [0x68d67c], 1
jne 0x412f83
push 1
push 0x40
push 8
push 0x55c9cc
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0x164]
call fcn.00409075
push 0x563ff4
mov dword [ebp - 4], ebx
call fcn.00408fb9
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004081fc
add esp, 0xc
lea ecx, [ebp - 0x164]
call fcn.00409583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00409144
cmp dword [0x68d68c], 1
jne 0x41304d
lea eax, [ebp - 0x14]
push eax
call fcn.0041310f
lea eax, [ebp - 0x14]
push eax
call fcn.0040ee71
pop ecx
pop ecx
push 1
push 0x40
push 8
mov edi, 0x55ca18
mov esi, eax
push edi
call fcn.00408fb9
pop ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409075
push 0x55ca30
mov dword [ebp - 4], 1
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push esi
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x564028
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
push 0x55ca78
call fcn.00408fb9
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004081fc
add esp, 0x30
lea ecx, [ebp - 0xbc]
call fcn.00409583
push 2
push edi
call fcn.00408fb9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00409144
mov eax, dword [0x68d680]
cmp eax, 1
je 0x41308a
cmp eax, 3
je 0x41308a
cmp eax, 4
je 0x41308a
push ebx
cmp eax, 2
jne 0x413088
push ebx
push ebx
push 0x413094
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x413082
push ebx
push ebx
push ebx
push 0x4130bc
jmp 0x41306e

Function at 0x4130e4
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push fcn.00412d80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4158b5
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x68ee5c], 0x398
mov byte [0x68ee59], 1
call fcn.004138bd
test eax, eax
je 0x415a0d
push esi
push edi
call fcn.00415271
xor edi, edi
push str.._Log_Debug.txt
mov dword [0x68f4ac], edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push 0x55ded4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x6b93e8
call fcn.00505d00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6d306e
push str._s__PID__d_
mov esi, 0x68f070
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [0x68f4ac], edi
je 0x41594b
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x415932
mov ax, word [0x564814]
mov word [esi], ax
mov al, byte [0x564816]
mov byte [esi + 2], al
mov ecx, edi
mov al, byte [ecx + 0x68f070]
mov byte [ecx + 0x68f270], al
inc ecx
test al, al
jne 0x41594d
push dword [ebp + 8]
call fcn.0041559f
mov esi, 0x6b59b8
mov dword [esp], str.._Resource_QuestScript_QuestString.bin
mov ecx, esi
call fcn.004e292c
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, esi
call fcn.004e2835
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, esi
call fcn.004e2701
mov ecx, 0x6a08e0
call fcn.0044111e
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004152ee
pop ecx
pop ecx
test eax, eax
jne 0x4159b5
call fcn.0041552a
xor eax, eax
jmp 0x415a0b
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4159de
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4159b5
call fcn.004154e6
mov ecx, eax
call fcn.004bc40c
fld1
mov ecx, 0x690a18
fsubp st(1)
fstp qword [0x68ee40]
call fcn.00416e36
cmp eax, 0xffffffff
jne 0x4159b5
call fcn.0041552a
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4164af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 0xf023f
push 0
push eax
push 0x80000002
mov dword [ebp - 0x10c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea ecx, [ebp - 0x104]
mov edx, 0x564710
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005500ac
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416531
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf023f
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp + 0x14]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416554
sub ecx, edx
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425086
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x67ccf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x42523f
cmp byte [edi], 0
je 0x42523f
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42523f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 0x11c]
test eax, eax
push 0x64
pop edx
cmovne ecx, edx
mov eax, ebx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x128], eax
test ecx, ecx
je 0x42522f
push esi
push eax
push str._04u
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push 5
push eax
mov byte [ebp - 8], bl
call fcn.004273ac
add esp, 0x10
mov dword [ebp - 0x114], ebx
lea eax, [ebp - 0x114]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42520d
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x120], 0x104
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4251b2
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42520d
push edi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4251a4
lea eax, [ebp - 0x120]
mov dword [ebp - 0x12c], ebx
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x120], 4
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push str.Characteristics
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x114]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x425228
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp eax, dword [ebp - 0x11c]
jb 0x425124
jmp 0x42522e
mov ebx, dword [ebp - 0x12c]
pop esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x425241
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005500ac
mov esp, ebp
pop ebp
ret 4