joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009110
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x10051050]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push str.MyBrowser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x10009289
push 1
push 0
push 3
push 0
push 0
push 0x50
push dword [0x10056530]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x10009289
push 1
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x10049f18
push eax
push 0
push 0
push str.Codex_ServerSideBan_Renew.php
push str.POST
push ebx
mov dword [esp + 0x3c], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x10009289
mov ecx, str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100091b0
sub ecx, edx
mov edx, str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
lea eax, [edx + 1]
mov dword [esp + 0x14], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100091c5
sub edx, dword [esp + 0x14]
push ecx
push str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
push edx
push str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x10009289
push 0x800
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10017c30
add esp, 0xc
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x28]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x10009289
lea edx, [esp + 0x20]
mov ecx, 0x10055830
call fcn.10004190
push eax
call fcn.10006c40
add esp, 4
lea eax, [esp + 0x20]
push 0x800
push 0
push eax
call fcn.10017c30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10009289
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10015ed5
mov esp, ebp
pop ebp
ret
call fcn.10008f40
int3
Function at 0x1000a7e0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b16b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100565c4], 1
jne 0x1000a89e
sub esp, 8
lea ecx, [ebp - 0x174]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._nST_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.10004190
mov edx, str.Speed_Hack_or_System_Freeze_detected_
lea ecx, [ebp - 0x174]
call fcn.10004190
lea ecx, [ebp - 0x170]
call fcn.10003860
test eax, eax
jne 0x1000a88c
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000a980
lea eax, [ebp - 0x14]
push eax
call fcn.1001b31e
lea eax, [ebp - 0x14]
push eax
call fcn.1001b60b
push 8
push 0x1004936c
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc4]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc4]
mov edx, eax
call fcn.10004190
mov edx, str.ST_Scan:
lea ecx, [ebp - 0xc4]
call fcn.10004190
mov edx, str.Speed_Hack_or_System_Freeze_detected_
lea ecx, [ebp - 0xc4]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc4]
call fcn.10004190
lea ecx, [ebp - 0xc0]
call fcn.10003860
test eax, eax
jne 0x1000a968
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10002040
mov eax, dword [0x100565c8]
push 0
cmp eax, 1
jne 0x1000a9b2
push 0
push 0
push 0x1000a7b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000a9c2
push 0
push 0
push 0x1000a780
jmp 0x1000a995
cmp eax, 3
jne 0x1000a9d2
push 0
push 0
push 0x10001d50
jmp 0x1000a995
cmp eax, 4
jne 0x1000a9ac
push 0
push 0
push 0x100148f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.ST_Scan
push str.Speed_Hack_detected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000a9aa
Function at 0x1000ab80
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b52b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1004a618
call fcn.1001c334
add esp, 4
cmp dword [0x100565c4], 1
jne 0x1000ac4b
sub esp, 8
lea ecx, [ebp - 0x178]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._n_Hardware_Banned:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10004190
mov edx, str.Contact_Administrator_
lea ecx, [ebp - 0x178]
call fcn.10004190
lea ecx, [ebp - 0x174]
call fcn.10003860
test eax, eax
jne 0x1000ac39
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000ad21
lea eax, [ebp - 0x18]
push eax
call fcn.1001b31e
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1001b60b
push ecx
push 8
push 0x1004936c
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10004190
mov edx, str.HB___Hardware_Banned_
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10004190
lea ecx, [ebp - 0xc4]
call fcn.10003860
test eax, eax
jne 0x1000ad09
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.10002040
mov eax, dword [0x100565c8]
cmp eax, 1
je 0x1000ad62
cmp eax, 3
je 0x1000ad62
cmp eax, 4
je 0x1000ad62
push 0
cmp eax, 2
jne 0x1000ad5c
push 0
push 0
push 0x1000ab20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000ab50
jmp 0x1000ad45
Function at 0x1000add0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b52b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100565c4], 1
jne 0x1000ae8e
sub esp, 8
lea ecx, [ebp - 0x178]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._n_HB___Load_data_fail:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10004190
mov edx, str.Unable_to_load_data_
lea ecx, [ebp - 0x178]
call fcn.10004190
lea ecx, [ebp - 0x174]
call fcn.10003860
test eax, eax
jne 0x1000ae7c
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000af74
lea eax, [ebp - 0x18]
push eax
call fcn.1001b31e
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1001b60b
push ecx
push 8
push 0x1004936c
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10004190
mov edx, str.HB___Load_data_fail:
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str.Unable_to_load_data_
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10004190
lea ecx, [ebp - 0xc4]
call fcn.10003860
test eax, eax
jne 0x1000af5c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.10002040
mov eax, dword [0x100565c8]
cmp eax, 1
je 0x1000afb5
cmp eax, 3
je 0x1000afb5
cmp eax, 4
je 0x1000afb5
push 0
cmp eax, 2
jne 0x1000afaf
push 0
push 0
push 0x1000ad70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000ada0
jmp 0x1000af98
Function at 0x1000b030
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b52b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100565c4], 1
jne 0x1000b0da
sub esp, 8
lea ecx, [ebp - 0x178]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._n_HB___FTP_Server_connection_fail_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10004190
lea ecx, [ebp - 0x174]
call fcn.10003860
test eax, eax
jne 0x1000b0c8
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000b1b0
lea eax, [ebp - 0x18]
push eax
call fcn.1001b31e
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1001b60b
push ecx
push 8
push 0x1004936c
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10004190
mov edx, str.HB___FTP_Server_connection_fail_
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10004190
lea ecx, [ebp - 0xc4]
call fcn.10003860
test eax, eax
jne 0x1000b198
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.10002040
mov eax, dword [0x100565c8]
cmp eax, 1
je 0x1000b1f1
cmp eax, 3
je 0x1000b1f1
cmp eax, 4
je 0x1000b1f1
push 0
cmp eax, 2
jne 0x1000b1eb
push 0
push 0
push 0x1000afd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000b000
jmp 0x1000b1d4
Function at 0x1000b260
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b52b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100565c4], 1
jne 0x1000b30a
sub esp, 8
lea ecx, [ebp - 0x178]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._nHB___HTTP_connection_fail_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10004190
lea ecx, [ebp - 0x174]
call fcn.10003860
test eax, eax
jne 0x1000b2f8
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000b3e0
lea eax, [ebp - 0x18]
push eax
call fcn.1001b31e
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1001b60b
push ecx
push 8
push 0x1004936c
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10004190
mov edx, str.HB___HTTP_connection_fail_
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10004190
lea ecx, [ebp - 0xc4]
call fcn.10003860
test eax, eax
jne 0x1000b3c8
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.10002040
mov eax, dword [0x100565c8]
cmp eax, 1
je 0x1000b421
cmp eax, 3
je 0x1000b421
cmp eax, 4
je 0x1000b421
push 0
cmp eax, 2
jne 0x1000b41b
push 0
push 0
push 0x1000b200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1000b230
jmp 0x1000b404
Function at 0x1000baf0
Capabilities:
Capture public ip
Connect to http server
Create http request
Read data from internet
Receive data
Send file using ftp
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10051050]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0
push 1
push dword [0x10056538]
push dword [0x10056534]
push 0x15
push dword [0x10056530]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call ebx
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000bc3f
lea eax, [esp + 0xc]
push eax
push 0x2f
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0xc]
cmp eax, 0x2f
jae 0x1000bc63
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [esp + eax + 0x18], 0
call esi
push 0
push 2
lea eax, [esp + 0x1c]
push eax
push 0x1004a84c
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x1000bc51
push edi
call esi
push dword [esp + 0x10]
call esi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0x8000000
push 1
push dword [0x10056538]
mov edi, eax
push dword [0x10056534]
push 0x15
push dword [0x10056530]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 1
push 0x80
push 1
push 0x1004a848
mov ebx, eax
push str.1Hardware_Banlist.txt
push ebx
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x1000bc44
push 2
push 0x1004a848
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call esi
push edi
call esi
call fcn.1000b7d0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10015ed5
mov esp, ebp
pop ebp
ret
call fcn.1000b260
push 0x1004a848
call fcn.1001c334
add esp, 4
push 0x1004a84c
call fcn.1001c334
add esp, 4
call fcn.1000b030
call fcn.1001606c
int3
Function at 0x1000bc70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bc60
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x10051050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000bd3c
sub esp, 8
lea ecx, [ebp - 0x128]
push 8
push 0x1004a84c
call fcn.100030c0
mov edx, 0x1004a868
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.10004190
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x128]
call fcn.10004190
lea ecx, [ebp - 0x124]
call fcn.10003860
test eax, eax
jne 0x1000bd2c
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x128]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
call fcn.1000baf0
lea ecx, [ebp - 0x128]
call fcn.10002040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015ed5
mov esp, ebp
pop ebp
ret

Function at 0x1000bd60
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x14
mov dword [ebp - 4], 4
call fcn.1001fc39
push 0x288
mov ebx, eax
call fcn.1001fc39
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000bda0
push 0x179
push 0x1004a870
push str.AdapterInfo___NULL
call fcn.1001fbb8
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1000be3a
push dword [ebp - 4]
call fcn.1001fc39
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000bddc
push 0x17d
push 0x1004a870
push str.AdapterInfo___NULL
call fcn.1001fbb8
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1000be29
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push ebx
call fcn.1000aab0
add esp, 0x20
push esi
call fcn.1001b632
add esp, 4
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000add0
int3

Function at 0x1000e9f0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push dword [0x10056540]
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1000ea1e
push 0
push dword [0x10056524]
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
jne 0x1000ea23
jmp fcn.1000e7a0
mov esp, ebp
pop ebp
ret
Function at 0x1000eaa0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bf4b
mov eax, dword fs:[0]
push eax
sub esp, 0x170
push esi
push edi
mov eax, dword [0x10051050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x1000ece2
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x100565c4], 1
jne 0x1000eb80
sub esp, 8
lea ecx, [ebp - 0x178]
push 8
push str.BaseWarAntiKontrol.log
call fcn.100030c0
mov edx, str._n1__Hile_Algilandi:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10004190
mov edx, edi
lea ecx, [ebp - 0x178]
call fcn.10004190
lea ecx, [ebp - 0x174]
call fcn.10003860
test eax, eax
jne 0x1000eb6e
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.10002040
cmp dword [0x100565d4], 1
jne 0x1000ec63
lea eax, [ebp - 0x18]
push eax
call fcn.1001b31e
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1001b60b
push ecx
push 8
push 0x1004936c
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.100030c0
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10004190
push esi
call fcn.1001a5f2
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10004190
mov edx, str.1__Hile_Algilandi:
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, edi
lea ecx, [ebp - 0xc8]
call fcn.10004190
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10004190
lea ecx, [ebp - 0xc4]
call fcn.10003860
test eax, eax
jne 0x1000ec4b
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001bb0
push 2
push 0x1004936c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.10002040
mov eax, dword [0x100565c8]
push 0
cmp eax, 1
jne 0x1000ec95
push 0
push 0
push 0x1000ea70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000eca5
push 0
push 0
push 0x10001cf0
jmp 0x1000ec78
cmp eax, 3
jne 0x1000ecb5
push 0
push 0
push 0x10001d50
jmp 0x1000ec78
cmp eax, 4
jne 0x1000ec8f
push 0
push 0
push 0x100148f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.Hile_Algilandi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000ec8d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret