joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a1d0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x5754fb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov dword [esp + 0x248], ebx
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
cmp ebp, ebx
jne 0x43a24b
mov ebx, dword [esp + 0x14]
xor ebp, ebp
mov dword [esp + 0x20], ebx
xor edi, edi
lea esi, [esp + 0x1c]
call fcn.004122f0
push 0x206
lea ecx, [esp + 0x2a]
push edi
push ecx
mov word [esp + 0x30], di
call sub.MSVCR80.dll_memset
add esp, 0xc
test ebp, ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0x104
jne 0x43a2c2
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x1c]
lea esi, [esp + 0x2c]
call fcn.0041a310
test eax, eax
jne 0x43a2b5
cmp dword [esp + 0x14], eax
jbe 0x43a2b5
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [esp + 0x18], 1
test ebx, ebx
je 0x43a2c2
push ebx
call ebp
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a2e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x43a2e9
push ebx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00569ed6
add esp, 0x228
ret
Function at 0x43a750
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x57b580
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
xor esi, esi
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
xor edi, edi
lea ebx, [esp + 0x14]
mov dword [esp + 0x20], esi
call fcn.004125d0
lea edi, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.004101e0
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a7d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xa
push str.uplive.svr
lea ecx, [esp + 0x18]
push ecx
call fcn.00410240
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a805
push edi
push 0
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a829
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x43ad40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x57b4b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor edi, edi
lea ebx, [esp + 0x14]
call fcn.004125d0
push eax
lea eax, [esp + 0x14]
push eax
mov ebx, str.kwifilive.exe
mov dword [esp + 0x28], edi
call fcn.0041a8a0
add esp, 8
mov byte [esp + 0x20], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or esi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43adaf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ae14
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0x58c320
push edx
mov ecx, 1
call fcn.00418290
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x43adfc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x43ae35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x43bcd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x572c02
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x22c], edi
mov dword [esp + 0x10], edi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x5e736c
mov dword [esp + 0x14], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x206
lea eax, [esp + 0x1e]
mov dword [esp + 0x230], edi
push edi
push eax
mov dword [esp + 0x1c], 1
mov word [esp + 0x24], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x19
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, edi
je 0x43bd94
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43bd72
sub eax, edx
sar eax, 1
lea edx, [esp + 0x18]
mov ebx, eax
push edx
mov eax, esi
call fcn.00410570
call fcn.00412840
mov eax, esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00569ed6
add esp, 0x220
ret
Function at 0x43beb0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x572698
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x9c]
xor ebp, ebp
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], ebp
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
mov dword [esp + 0xb0], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x43bfc2
call fcn.0043d9e0
cmp eax, edi
jl 0x43bfe1
push 0x1000
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x38], 0xefcdab89
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call fcn.00569ecc
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], edi
push edi
lea edx, [esp + 0x18]
push edx
push 0x1000
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43bf87
call fcn.0043d9e0
cmp eax, edi
jl 0x43bfcd
cmp dword [esp + 0x14], edi
je 0x43bfe8
mov esi, dword [0x6198c0]
cmp esi, edi
je 0x43bfa4
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x6198c0]
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x34]
call fcn.00404c70
add esp, 4
cmp esi, edi
je 0x43bf67
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43bf67
mov ebp, eax
mov dword [esp + 0x1c], ebp
jmp 0x43bf2c
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
cmp ebp, edi
je 0x43bfe1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43c086
lea esi, [esp + 0x30]
lea ebx, [esp + 0x20]
call fcn.00404d90
mov eax, dword [0x6198c0]
cmp eax, edi
je 0x43c005
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [esp + 0x2f]
movzx ecx, byte [esp + 0x2e]
movzx edx, byte [esp + 0x2d]
push eax
movzx eax, byte [esp + 0x30]
push ecx
movzx ecx, byte [esp + 0x33]
push edx
movzx edx, byte [esp + 0x36]
push eax
movzx eax, byte [esp + 0x39]
push ecx
movzx ecx, byte [esp + 0x3c]
push edx
movzx edx, byte [esp + 0x3f]
push eax
movzx eax, byte [esp + 0x42]
mov edi, dword [esp + 0x34]
push ecx
movzx ecx, byte [esp + 0x45]
push edx
movzx edx, byte [esp + 0x48]
push eax
movzx eax, byte [esp + 0x4b]
push ecx
movzx ecx, byte [esp + 0x4e]
push edx
movzx edx, byte [esp + 0x51]
push eax
movzx eax, byte [esp + 0x54]
push ecx
push edx
push eax
push 0x590a60
call fcn.00410c00
add esp, 0x44
test ebp, ebp
je 0x43c081
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00569ed6
add esp, 0x84
ret
Function at 0x43c7d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57d468
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea edi, [esp + 0xc]
call fcn.00439120
mov edx, dword [esp + 0x40]
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.0043c840
lea esi, [esp + 0xc]
mov edi, eax
call fcn.00439060
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x440f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREkingsoftkwifiKSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x440fc9
mov eax, dword [esp + 4]
test eax, eax
mov dword [esp + 8], 0xc0
je 0x440fd8
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push edi
push str.kcinfo
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440fc9
mov eax, dword [esi]
cmp dword [esp + 8], eax
jne 0x440fc9
cmp eax, 0xc0
jne 0x440fc9
mov edi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x440fd8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x440fe0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREkingsoftkwifiKSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x441032
mov eax, dword [esp]
test eax, eax
je 0x441040
mov ecx, dword [esp + 8]
push 0xc0
push ecx
push 3
push 0
push str.kcinfo
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
test eax, eax
je 0x441040
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x441050
Capabilities:
Get local ipv4 addresses

Disassembly:
sub esp, 0x28
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
mov dword [esp + 8], ebp
call fcn.00441c40
lea ecx, [esp + 4]
push ecx
push ebp
push ebp
push 7
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x44114e
mov edx, dword [esp + 4]
push edi
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esp + 0xc], edi
je 0x44114d
lea eax, [esp + 8]
push eax
push edi
push ebp
push 7
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
jne 0x441143
push ebx
push esi
mov esi, dword [sym.imp.MSVCR80.dll_strstr]
mov ebx, edi
jmp 0x4410d0
cmp dword [esp + 0x30], 0x10
mov ecx, dword [esp + 0x1c]
jae 0x4410df
lea ecx, [esp + 0x1c]
mov eax, dword [ebx + 0xc]
push ecx
push eax
call esi
add esp, 8
test eax, eax
jne 0x4410f6
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4410d0
jmp 0x441141
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x441141
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441100
sub eax, edx
sar eax, 1
mov esi, eax
lea edi, [esi + esi + 2]
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x44113d
push edi
push 0
push ebp
call sub.MSVCR80.dll_memset
mov ecx, dword [ebx + 0x28]
push esi
push ecx
push ebp
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0x18
mov edi, dword [esp + 0x14]
pop esi
pop ebx
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00569ed6
add esp, 0x28
ret
Function at 0x441650
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
mov dword [esp + 0xc], ebp
call fcn.00441c40
lea ecx, [esp + 8]
push ecx
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x441709
mov edx, dword [esp + 8]
push esi
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, ebp
mov dword [esp + 8], esi
je 0x441708
lea eax, [esp + 0xc]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4416fe
push edi
mov edi, dword [sym.imp.MSVCR80.dll_strstr]
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x4416c1
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 8]
push ecx
call edi
add esp, 8
test eax, eax
jne 0x4416d7
mov esi, dword [esi]
test esi, esi
jne 0x4416b2
jmp 0x4416f9
cmp dword [esi + 0x190], 6
jne 0x4416f9
mov edx, dword [esi + 0x194]
mov dword [ebx], edx
mov ax, word [esi + 0x198]
mov word [ebx + 4], ax
mov ebp, dword [esi + 0x190]
mov esi, dword [esp + 0xc]
pop edi
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00569ed6
add esp, 0x28
ret

Function at 0x441ac0
Capabilities:
Get routing table

Disassembly:
push ecx
push ebx
xor ebx, ebx
push edi
mov dword [esp + 8], ebx
call fcn.00441460
mov edi, eax
push 1
lea eax, [esp + 0xc]
push eax
push ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x441b52
mov ecx, dword [esp + 8]
push esi
push ecx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x441b4b
push 1
lea edx, [esp + 0x10]
push edx
push esi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x441b41
mov edx, dword [esi]
cmp edx, ebx
jbe 0x441b41
xor ecx, ecx
cmp edx, ebx
jbe 0x441b41
lea eax, [esi + 4]
cmp eax, ebx
je 0x441b24
cmp edi, dword [eax + 0x10]
jne 0x441b24
cmp dword [eax], ebx
je 0x441b3f
add ecx, 1
add eax, 0x38
cmp ecx, edx
jb 0x441b17
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
pop ecx
ret
mov bl, 1
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
pop ecx
ret
pop edi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x441b60
Capabilities:
Get routing table

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 1
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
or ebp, 0xffffffff
push ebx
or esi, ebp
mov dword [esp + 0x1c], ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x441c30
mov ecx, dword [esp + 0x10]
push edi
push ecx
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x10], edi
je 0x441c24
push 1
lea edx, [esp + 0x18]
push edx
push edi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x441c1a
mov edi, dword [edi]
test edi, edi
jbe 0x441c16
xor ecx, ecx
test edi, edi
jbe 0x441bec
mov eax, dword [esp + 0x10]
add eax, 0x28
lea edx, [eax - 0x24]
test edx, edx
je 0x441be2
cmp dword [eax - 0x24], 0
jne 0x441be2
mov edx, dword [eax]
cmp esi, edx
jbe 0x441be2
mov ebp, dword [eax - 0x14]
mov esi, edx
mov ebx, ecx
add ecx, 1
add eax, 0x38
cmp ecx, edi
jb 0x441bc8
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x441c16
cmp ebx, edi
jae 0x441c16
mov edx, dword [esp + 0x10]
lea ecx, [ebx*8]
sub ecx, ebx
lea esi, [edx + ecx*8 + 4]
mov ecx, 0xe
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jmp 0x441c1a
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 4
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x441c40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x570732
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov esi, ecx
mov ecx, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esp + 0x28], ebx
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov edi, 1
mov ecx, 0x5e736c
mov dword [esp + 0x18], edi
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], edi
movzx eax, byte [esi + 0xf]
movzx ecx, byte [esi + 0xe]
movzx edx, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push ecx
movzx ecx, byte [esi + 0xb]
push edx
movzx edx, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push ecx
movzx ecx, byte [esi + 8]
push edx
movzx edx, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea edi, [esp + 0x44]
call fcn.00441d40
mov esi, dword [esp + 0x44]
add esp, 0x30
push esi
mov ecx, ebp
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea eax, [esi - 0x10]
mov byte [esp + 0x28], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x441d1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x443d30
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x57b316
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x14], 0x619f00
xor ebx, ebx
mov dword [0x619f00], eax
mov dword [0x619f04], eax
mov dword [esp + 0x20], ebx
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [0x619f08], eax
mov dword [0x619f0c], ebx
mov byte [0x619f10], bl
mov dword [0x619f14], ebx
mov byte [esp + 0x20], 2
mov dword [0x619f18], ebx
mov dword [0x619f1c], ebx
xor edi, edi
lea ebx, [esp + 0x10]
call fcn.004125d0
push eax
lea eax, [esp + 0x10]
push eax
mov ebx, str.kwifi.ini
mov byte [esp + 0x28], 3
call fcn.0041a8a0
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443df1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x443e1c
mov edx, dword [esp + 0xc]
push edx
push 0
push str.wifiinfo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x619f0c], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443e3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x619f00
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret

Function at 0x44437e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pop dword [esp + 0x54]
lea esp, [esp + 0x54]
jnp 0x61c1c6
pop dword [ebp]
push 0x2d4b0003
pushal
lea esp, [esp + 0x24]
jmp fcn.004b18ef
call fcn.0061c583
neg al
pushfd
call fcn.0061b5da

Function at 0x4444cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
mov byte [esp], bh
mov word [ebp], ax
mov dword [esp], ebx
push ecx
lea esp, [esp + 0x30]
jmp fcn.004b18ef
Function at 0x446de0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5706a0
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x20], 0
lea eax, [esp + 0x24]
push eax
push ebp
lea edi, [esp + 0x30]
mov dword [esp + 0x20], 1
call fcn.00446ed0
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446e4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x28]
call fcn.00445a70
mov eax, ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x4482e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56bf0a
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x40], 0
mov ecx, edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esp + 0x40], 0
movzx eax, byte [esi + 0xf]
movzx ecx, byte [esi + 0xe]
movzx edx, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push ecx
movzx ecx, byte [esi + 0xb]
push edx
movzx edx, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push ecx
movzx ecx, byte [esi + 8]
push edx
movzx edx, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea edx, [esp + 0x3c]
push 0x28
push edx
mov dword [esp + 0x3c], 1
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x38
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00569ed6
add esp, 0x40
ret