joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, 1
add byte [eax], al
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x409666
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x409666
push edx
call 0x4095f0
add byte [edi + 0x50], al
inc edx
xor al, 0x36
inc edi
inc ebp
add esp, 4
sub edx, 0x832c
pop edx
push esi
jmp 0x409600
or esi, 0xe4a1
and esi, 0x14730
add esi, 0x12864
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x409658
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x40965f
jmp 0x4095a5
jmp 0x409666
push edi
push esi
add esp, 4
sub edi, 0x3fd9
jmp 0x409679
jmp 0x40967f
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x3e1e
and ecx, 0xf2fe
add ecx, 0xe0f6
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x4096c5
mov dword [ebp - 0xcd4], 0
jmp 0x409734
push eax
call 0x4096d4
add byte [eax], bh
xor ecx, dword [ebp + 0x38]
dec ebx
inc ebx
xor al, 0x4a
add esp, 4
and eax, 0xa421
call 0x4096ea
add byte [ecx + ecx*2 + 0x36], cl
dec esp
xor dl, byte [eax + 0x4e]
add esp, 4
jmp 0x4096f6
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x40972a
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x409734
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x40974b
mov edx, dword [ebp - 0x1a00]
mov dword [ebp - 0x3f8], edx
jmp 0x40975c
jmp 0x409535
cmp dword [ebp - 0x3f8], 0
je 0x409837
push edi
sub edi, 0x104dd
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x9cd5
or ecx, 0x3d65
pop ecx
push eax
or eax, 0x8a97
call 0x409797
add byte [0x3b414033], dh
cmp cl, byte [ebx + eax*4 - 0x3c]
add al, 0x58
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x1a04], ecx
push eax
push ebx
add esp, 4
add eax, 0x17025
sub eax, 0xe2c5
or eax, 0x5281
pop eax
push ecx
add ecx, 0x14850
sub ecx, 0x120d3
add ecx, 0x1652a
and ecx, 0xb895
pop ecx
mov edx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1a08], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x1a08]
test eax, eax
jne 0x409837
push esi
push esi
add esp, 4
jmp 0x409800
or esi, 0x1071f
pop esi
push edi
push ecx
add esp, 4
sub edi, 0xab00
jmp 0x409819
pop edi
push esi
or esi, 0x16a40
or esi, 0xcfc5
pop esi
mov dword [ebp - 0xab4], 0
jmp 0x409f22
Function at 0x4096ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, 1
add byte [eax], al
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x409666
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x409666
push edx
call 0x4095f0
add byte [edi + 0x50], al
inc edx
xor al, 0x36
inc edi
inc ebp
add esp, 4
sub edx, 0x832c
pop edx
push esi
jmp 0x409600
or esi, 0xe4a1
and esi, 0x14730
add esi, 0x12864
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x409658
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x40965f
jmp 0x4095a5
jmp 0x409666
push edi
push esi
add esp, 4
sub edi, 0x3fd9
jmp 0x409679
jmp 0x40967f
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x3e1e
and ecx, 0xf2fe
add ecx, 0xe0f6
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x4096c5
mov dword [ebp - 0xcd4], 0
jmp 0x409734
push eax
call 0x4096d4
add byte [eax], bh
xor ecx, dword [ebp + 0x38]
dec ebx
inc ebx
xor al, 0x4a
add esp, 4
and eax, 0xa421
call 0x4096ea
add byte [ecx + ecx*2 + 0x36], cl
dec esp
xor dl, byte [eax + 0x4e]
add esp, 4
jmp 0x4096f6
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x40972a
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x409734
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x40974b
mov edx, dword [ebp - 0x1a00]
mov dword [ebp - 0x3f8], edx
jmp 0x40975c
jmp 0x409535
cmp dword [ebp - 0x3f8], 0
je 0x409837
push edi
sub edi, 0x104dd
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x9cd5
or ecx, 0x3d65
pop ecx
push eax
or eax, 0x8a97
call 0x409797
add byte [0x3b414033], dh
cmp cl, byte [ebx + eax*4 - 0x3c]
add al, 0x58
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x1a04], ecx
push eax
push ebx
add esp, 4
add eax, 0x17025
sub eax, 0xe2c5
or eax, 0x5281
pop eax
push ecx
add ecx, 0x14850
sub ecx, 0x120d3
add ecx, 0x1652a
and ecx, 0xb895
pop ecx
mov edx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1a08], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x1a08]
test eax, eax
jne 0x409837
push esi
push esi
add esp, 4
jmp 0x409800
or esi, 0x1071f
pop esi
push edi
push ecx
add esp, 4
sub edi, 0xab00
jmp 0x409819
pop edi
push esi
or esi, 0x16a40
or esi, 0xcfc5
pop esi
mov dword [ebp - 0xab4], 0
jmp 0x409f22
Function at 0x409797
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, 1
add byte [eax], al
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x409666
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x409666
push edx
call 0x4095f0
add byte [edi + 0x50], al
inc edx
xor al, 0x36
inc edi
inc ebp
add esp, 4
sub edx, 0x832c
pop edx
push esi
jmp 0x409600
or esi, 0xe4a1
and esi, 0x14730
add esi, 0x12864
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x409658
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x40965f
jmp 0x4095a5
jmp 0x409666
push edi
push esi
add esp, 4
sub edi, 0x3fd9
jmp 0x409679
jmp 0x40967f
pop edi
push ecx
push ecx
add esp, 4
or ecx, 0x3e1e
and ecx, 0xf2fe
add ecx, 0xe0f6
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x4096c5
mov dword [ebp - 0xcd4], 0
jmp 0x409734
push eax
call 0x4096d4
add byte [eax], bh
xor ecx, dword [ebp + 0x38]
dec ebx
inc ebx
xor al, 0x4a
add esp, 4
and eax, 0xa421
call 0x4096ea
add byte [ecx + ecx*2 + 0x36], cl
dec esp
xor dl, byte [eax + 0x4e]
add esp, 4
jmp 0x4096f6
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x40972a
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x409734
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x40974b
mov edx, dword [ebp - 0x1a00]
mov dword [ebp - 0x3f8], edx
jmp 0x40975c
jmp 0x409535
cmp dword [ebp - 0x3f8], 0
je 0x409837
push edi
sub edi, 0x104dd
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x9cd5
or ecx, 0x3d65
pop ecx
push eax
or eax, 0x8a97
call 0x409797
add byte [0x3b414033], dh
cmp cl, byte [ebx + eax*4 - 0x3c]
add al, 0x58
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x1a04], ecx
push eax
push ebx
add esp, 4
add eax, 0x17025
sub eax, 0xe2c5
or eax, 0x5281
pop eax
push ecx
add ecx, 0x14850
sub ecx, 0x120d3
add ecx, 0x1652a
and ecx, 0xb895
pop ecx
mov edx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1a08], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x1a08]
test eax, eax
jne 0x409837
push esi
push esi
add esp, 4
jmp 0x409800
or esi, 0x1071f
pop esi
push edi
push ecx
add esp, 4
sub edi, 0xab00
jmp 0x409819
pop edi
push esi
or esi, 0x16a40
or esi, 0xcfc5
pop esi
mov dword [ebp - 0xab4], 0
jmp 0x409f22
Function at 0x403b10
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x6fb05c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], ecx
push 0
push str.data
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.data_aiconfig
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x70b17c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x129]
mov dword [ebp - 0x58], edx
mov ax, word [ebp - 0x58]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
push ecx
push 0x5ca67c
lea edx, [ebp - 0x50]
push edx
call fcn.0059f1bf
add esp, 0xc
push 0x5ca694
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0059f178
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x403bb2
mov edx, dword [ebp - 4]
push edx
push 1
push 0x1c64
mov eax, dword [ebp - 0x5c]
add eax, 0xec
push eax
call fcn.0059f02b
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.0059ee60
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059eb13
mov esp, ebp
pop ebp
ret

Function at 0x403bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x6fb05c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [0x70b17c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x129]
mov dword [ebp - 0x58], edx
mov ax, word [ebp - 0x58]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
push ecx
push str.._data_aiconfig__d.dat
lea edx, [ebp - 0x50]
push edx
call fcn.0059f1bf
add esp, 0xc
push 0x1c64
push 0
mov eax, dword [ebp - 0x5c]
add eax, 0xec
push eax
call fcn.0059eb30
add esp, 0xc
push 0x5ca6b0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0059f178
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x403cab
mov eax, dword [ebp - 4]
push eax
push 1
push 0x1c64
mov ecx, dword [ebp - 0x5c]
add ecx, 0xec
push ecx
call fcn.0059f4ab
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.0059ee60
add esp, 4
call fcn.00401550
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0
fild qword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
fstp dword [ecx + 0xe0]
call fcn.00401550
mov edx, dword [eax + 0x22c]
imul edx, edx, 0x64
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
fstp dword [eax + 0xe8]
jmp 0x403cb3
mov ecx, dword [ebp - 0x5c]
call fcn.00403cd0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059eb13
mov esp, ebp
pop ebp
ret

Function at 0x4110a0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0x411020
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6fccf4], eax
pop ebp
ret 4
Function at 0x411710
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov ecx, 0x6feaa0
call fcn.0042be00
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6fc7d4], esi
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x735dd4]
xor edx, edx
mov eax, esi
div dword [0x735360]
mov eax, dword [0x735364]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x41176e
cmp dword [edx], esi
je 0x4117b5
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x411763
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6fc7d8
push 0x6fc9f0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6fc7c0], esi
test esi, esi
jne 0x4117d4
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x41176e
mov eax, dword [ebp + 8]
push 0
push eax
mov eax, dword [edx + 8]
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x411786
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6fcd20
call fcn.00413040
cmp dword [0x70d0a8], 0
push 0
mov ecx, 0x6fcd20
push 0
jne 0x411824
push 1
call fcn.00412ea0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call fcn.00412ea0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x412040
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004110a0
mov eax, dword [ebp + 0x10]
mov dword [0x6fc7b8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412082
test dl, dl
je 0x41207e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412082
add eax, 2
add ecx, 2
test dl, dl
jne 0x412062
xor eax, eax
jmp 0x412087
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4120a8
push 0
push 0x5caa10
push 0x5caa18
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00411340
test eax, eax
je 0x41209f
push esi
call fcn.004110a0
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5caa60
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5caa64
push 0x71a810
call fcn.00537f90
push str._____________________Client_Start______________________
push 0x71a810
call fcn.00537f90
push str._______________________________________________________
push 0x71a810
call fcn.00537f90
add esp, 0x18
call fcn.00411280
mov ecx, 0x71bde8
call fcn.0054c2c0
push 0x735232
push 0x6fc7d8
call fcn.0059f1bf
push 0x735232
push 0x6fc9f0
call fcn.0059f1bf
push esi
call fcn.00411fe0
add esp, 0x14
mov ecx, 0x71bde8
call fcn.00544ba0
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x718a68
call fcn.004fea80
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x718a68
call fcn.004ff6b0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x718a68
call fcn.004fd6f0
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x718a68
call fcn.004fec60
mov ecx, 0x70a700
call fcn.0043aea0
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.00411710
add esp, 8
test eax, eax
jne 0x4121a4
call fcn.00411350
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call esi
test eax, eax
je 0x4121d8
lea edx, [ebp - 0x1c]
push edx
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x4121b8
mov ecx, 0x6fcd20
call fcn.00413430
cmp eax, 0xffffffff
jne 0x4121b8
call fcn.00411350
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425f50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x6fb05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x130], eax
cmp eax, ebx
je 0x42615a
cmp byte [eax], bl
je 0x42615a
lea eax, [ebp - 0x118]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42615a
mov edx, dword [ebp - 0x118]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x11c]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x425fdc
mov dword [ebp - 0x11c], 0x64
push edi
xor edi, edi
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x11c], ebx
jbe 0x426135
push esi
xor eax, eax
push edi
push str._04u
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
lea eax, [ebp - 0xc]
push 5
push eax
call fcn.004264c0
mov eax, dword [ebp - 0x118]
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4260f5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x120]
push ecx
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x104
call esi
test eax, eax
je 0x426087
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4260f5
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4260ae
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4260f5
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x124]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x120], 4
call esi
mov ecx, dword [ebp - 0x114]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x426128
inc edi
cmp edi, dword [ebp - 0x11c]
jb 0x425ff2
mov eax, dword [ebp - 0x118]
pop esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059eb13
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], edx
pop esi
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059eb13
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0059eb13
mov esp, ebp
pop ebp
ret 4
Function at 0x426170
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x4261b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push 0x5cca34
push 0x12
push ecx
call fcn.004264c0
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push esi
push edx
call fcn.005a0ea7
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, edi
jne 0x4261e0
mov eax, dword [ebp + 8]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x426218
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.004264c0
push esi
call fcn.005a0e6d
add esp, 0x14
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x426257
cmp eax, 8
ja 0x426257
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0059f7e0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00425f50
test al, 4
jne 0x42625d
mov esi, dword [esi]
test esi, esi
jne 0x426220
mov edx, dword [ebp - 0xc]
push edx
call fcn.005a0e6d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x447b10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc8c3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00439ab0
xor edi, edi
lea ecx, [esi + 0x50]
mov dword [ebp - 4], edi
mov dword [esi], vtable.cWindow.0
call fcn.00438e00
mov ebx, 1
lea ecx, [esi + 0x194]
mov byte [ebp - 4], bl
call fcn.004355c0
fldz
fst dword [esi + 0x1e4]
xor eax, eax
fstp dword [esi + 0x1e8]
mov ecx, ebx
fld1
xor edx, edx
fst dword [esi + 0x1f0]
mov word [esi + 0x1c], ax
fstp dword [esi + 0x1f4]
mov dword [esi + 8], edi
mov word [esi + 0xc], cx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x1b8], 0xffffff
mov dword [esi + 0x1bc], 0xff
mov dword [esi + 0x1c0], 0x64
mov dword [esi + 0x18], 0x447b00
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.00441ad0

Function at 0x4496a0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5d0eac
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.00449150
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.005995c0
mov ecx, esi
call fcn.0051ed70
pop edi
mov dword [0x6fd594], esi
mov ecx, esi
pop esi
jmp fcn.0051f8f0

Function at 0x463350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd4c6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
xor edi, edi
mov dword [esi], vtable.CReinforceManager.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
push 0x14
mov byte [ebp - 4], 1
call fcn.004ccf50
push 0x14
lea ecx, [esi + 0x28]
call fcn.004ccf50
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret