Function at 0x401540
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42be6a
mov eax, dword fs:[0]
push eax
mov eax, 0x293c
call fcn.0040dcd0
mov eax, dword [0x439080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x292c], 0x2880
lea eax, [ebp - 0x292c]
push eax
lea ecx, [ebp - 0x2890]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x401814
lea edx, [ebp - 0x2890]
mov dword [ebp - 0x2914], edx
cmp dword [ebp - 0x2914], 0
je 0x401814
lea ecx, [ebp - 0x28a8]
call fcn.00405d60
mov dword [ebp - 4], 0
mov dword [ebp - 0x2918], 0
jmp 0x4015db
mov eax, dword [ebp - 0x2918]
add eax, 1
mov dword [ebp - 0x2918], eax
mov ecx, dword [ebp - 0x2914]
mov edx, dword [ebp - 0x2918]
cmp edx, dword [ecx + 0x190]
jae 0x401657
mov eax, dword [ebp - 0x2914]
add eax, dword [ebp - 0x2918]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X
lea edx, [ebp - 0x2928]
push edx
call fcn.0040cd40
add esp, 0xc
lea eax, [ebp - 0x2928]
push eax
lea ecx, [ebp - 0x28a8]
call fcn.00407620
nop
mov ecx, dword [ebp - 0x2914]
mov edx, dword [ecx + 0x190]
sub edx, 1
cmp dword [ebp - 0x2918], edx
jae 0x401652
push 0x42d36c
lea ecx, [ebp - 0x28a8]
call fcn.00407620
nop
jmp 0x4015cc
push str.00_05_69
lea ecx, [ebp - 0x290c]
call fcn.00405c70
mov byte [ebp - 4], 1
push str.00_0C_29
lea ecx, [ebp - 0x28f4]
call fcn.00405c70
mov byte [ebp - 4], 2
push str.00_50_56
lea ecx, [ebp - 0x28dc]
call fcn.00405c70
mov byte [ebp - 4], 3
push str.08_00_27
lea ecx, [ebp - 0x28c4]
call fcn.00405c70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x291d]
call fcn.00405800
push eax
lea eax, [ebp - 0x28ac]
push eax
lea ecx, [ebp - 0x290c]
push ecx
lea ecx, [ebp - 0x2948]
call fcn.00405f20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2940]
call fcn.00406060
mov byte [ebp - 4], 6
push fcn.00406b50
push 4
push 0x18
lea ecx, [ebp - 0x290c]
push ecx
call fcn.0040db54
nop
lea edx, [ebp - 0x2940]
mov dword [ebp - 0x2924], edx
mov ecx, dword [ebp - 0x2924]
call fcn.00409910
mov dword [ebp - 0x291c], eax
mov ecx, dword [ebp - 0x2924]
call fcn.00409930
mov dword [ebp - 0x2930], eax
jmp 0x401737
mov eax, dword [ebp - 0x291c]
add eax, 0x18
mov dword [ebp - 0x291c], eax
mov ecx, dword [ebp - 0x291c]
cmp ecx, dword [ebp - 0x2930]
je 0x4017df
mov edx, dword [ebp - 0x291c]
mov dword [ebp - 0x2934], edx
push 0
mov eax, dword [ebp - 0x2934]
push eax
lea ecx, [ebp - 0x28a8]
call fcn.0040adc0
test eax, eax
jne 0x4017da
push 0x405110
lea ecx, [ebp - 0x28a8]
push ecx
push str._DETECTION__VM_like_MAC_address_detected:
push 0x43a140
call fcn.00403130
add esp, 8
push eax
call fcn.00403100
add esp, 8
mov ecx, eax
call fcn.004070a0
mov edx, dword [0x439fd8]
add edx, 1
mov dword [0x439fd8], edx
mov byte [ebp - 0x290d], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2940]
call fcn.00406c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28a8]
call fcn.00406b50
mov al, byte [ebp - 0x290d]
jmp 0x401816
jmp 0x401728
mov eax, dword [ebp - 0x2914]
mov ecx, dword [eax]
mov dword [ebp - 0x2914], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2940]
call fcn.00406c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28a8]
call fcn.00406b50
nop
jmp 0x4015a1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dcb5
mov esp, ebp
pop ebp
ret