joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x424567
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x424580
call fcn.0040d548
test eax, eax
jl 0x4243be
neg eax
mov edx, dword [0x427e6c]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402d2c
mov dword [ebp - 0x50], 0x424258
mov eax, dword [0x428660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x427d28]
call fcn.0040462c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x42458c
mov eax, dword [0x428660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.0040e588
mov dword [ebp - 0xc], 0x2c80000
lea eax, [ebp - 0x58]
call fcn.0040cde8
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x414ea4]
call fcn.00415688
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4245a0
mov edx, 0x4245c4
mov eax, ebx
call fcn.00415cf8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x428660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
mov eax, dword [0x427d28]
call fcn.0040462c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00405d1c
mov edx, dword [0x427d8c]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00415ef4
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00415dfc
push eax
mov eax, ebx
call fcn.00415e74
mov edx, eax
pop ecx
pop eax
call fcn.0040e698
mov eax, dword [0x427d8c]
cmp dword [eax], 0
je 0x42451d
push 0
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x42450a
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x427d30], 0
jne 0x42451d
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4244ef
push 1
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.0041d1fc
call fcn.0041d1cc
xor edx, edx
mov eax, 0x2b
call fcn.004145e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42456e
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004041ac
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x4247fc
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x424804
xor eax, eax
push ebp
push 0x424910
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402820
lea eax, [ebp - 0x10]
call fcn.0041a93c
push dword [ebp - 0x10]
push 0x424924
push 0x424930
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00407314
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040d288
push dword [ebp - 0x18]
push 0x42493c
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x1c]
push 0x424964
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push dword [ebp - 0xc]
push 0x424974
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x20]
push 0x42498c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push 0
push dword [ebp - 8]
push 0x424998
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00406bac
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x24]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424917
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004041ac
ret
Function at 0x10001470
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10001260
cmp dword [0x10025438], 1
jne 0x1000152a
push str.interface.u
call fcn.100013a0
cmp eax, dword [0x1002546c]
je 0x1000152a
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.u
push 0x10020b14
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x10
push 0
push str._L2J_Guard_Protection____http:__www.l2jguard.org___n_n___We_find_programs_using_the_same_function_Hackers_Bots._n___Believed_to_be_an_error_._We_inform_or_will_fix._n___Send_folder_L2JGuard__your_system_to_the_Administrator___n_n___Sorry_for_the_inconvenience__we_need_maximum_security_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1002543c], 1
jne 0x10001570
push str.interface.xdat
call fcn.100013a0
cmp eax, dword [0x10025470]
je 0x10001570
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.xdat
jmp 0x100014bf
cmp dword [0x10025440], 1
jne 0x100015b6
push str.WarGuard_Protect.bmp
call fcn.100013a0
cmp eax, dword [0x10025474]
je 0x100015b6
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Image_Protect_BMP
jmp 0x100014bf
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100015c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x10029894]
push edi
mov edi, dword [0x10029898]
cmp esi, edi
je 0x100015f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100015f3
add esi, 4
cmp esi, edi
jne 0x100015e0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001740
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x100017f6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100017ef
push esi
nop dword [eax + eax]
mov eax, ebx
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100017be
test dx, dx
je 0x100017ba
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100017be
add ecx, 4
add eax, 4
test dx, dx
jne 0x10001798
xor eax, eax
jmp 0x100017c3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100017dc
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001806
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001790
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100035b0
mov esp, ebp
pop ebp
ret
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10020b00
lea eax, [ebp - 0x234]
push str.WarGuard_Log.txt
push eax
call fcn.1000a624
push ebx
push str._ls___WP__n
push dword [ebp - 0x234]
call fcn.10001200
push dword [ebp - 0x234]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100018a0
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
mov ecx, str.L2Tower.exe
call fcn.10001740
mov ecx, str.L2NET.exe
call fcn.10001740
mov ecx, str.HxD.exe
call fcn.10001740
mov ecx, str.boot.exe
call fcn.10001740
mov ecx, str.alquimista.exe
call fcn.10001740
mov ecx, str.L2Divine.exe
call fcn.10001740
mov ecx, str.SandMan.exe
call fcn.10001740
mov ecx, str.SbieSvc.exe
call fcn.10001740
mov ecx, str.SbieSvc32.exe
call fcn.10001740
mov ecx, str.SbieSvc32.exe
call fcn.10001740
mov ecx, str.SbieCtrl.exe
call fcn.10001740
mov ecx, str.Start.exe
jmp fcn.10001740
Function at 0x100019c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10001a5f
push 0x10020b00
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000a624
push esi
push str._s___TW__n
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001a70
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, str.Process_Explorer_11.33
call fcn.100019c0
mov ecx, str.Process_Explorer
call fcn.100019c0
mov ecx, str.ArtMoney_PRO_v7.27
call fcn.100019c0
mov ecx, str.ArtMoney_SE_v7.31
call fcn.100019c0
mov ecx, str.ArtMoney_SE_v7.32
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.0
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.1.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.2
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.3
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.4
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.5
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.6
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.6.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.0
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.4
call fcn.100019c0
mov ecx, str.Cheat_Engine
call fcn.100019c0
mov ecx, str.Created_processes
call fcn.100019c0
mov ecx, str.SandBoxie_Plus_v0.9.3
call fcn.100019c0
mov ecx, str.Sandboxie_Control___sandboxie_plus.com
call fcn.100019c0
mov ecx, str.Created_processes
call fcn.100019c0
mov ecx, str.Lineage2_v1.71
call fcn.100019c0
mov ecx, str.XAAAA
jmp fcn.100019c0
Function at 0x10001b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10001c23
push 0x10020b00
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000a624
push esi
push str._s___CW__n
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001c30
Capabilities:
Create process on windows
Set registry value
Terminate process

Disassembly:
mov ecx, str.PROCEXPL
call fcn.10001b80
mov ecx, str.TreeListWindowClass
call fcn.10001b80
mov ecx, str.ProcessHacker
call fcn.10001b80
mov ecx, str.RegEdit_RegEdit
call fcn.10001b80
mov ecx, str.ProcessThreadsView
call fcn.10001b80
mov ecx, str.TreeListWindowClass
call fcn.10001b80
mov ecx, str.PhTreeNew
call fcn.10001b80
mov ecx, 0x100211a0
call fcn.10001b80
mov ecx, str.TformSettings
call fcn.10001b80
mov ecx, str.TWildProxyMain
call fcn.10001b80
mov ecx, str.TUserdefinedform
call fcn.10001b80
mov ecx, str.TformAddressChange
call fcn.10001b80
mov ecx, str.TMemoryBrowser
call fcn.10001b80
mov ecx, str.TFoundCodeDialog
call fcn.10001b80
mov ecx, str.TL2PacketHackMain
call fcn.10001b80
mov ecx, str.vxwindowclassnr
call fcn.10001b80
mov ecx, str.l2packet
call fcn.10001b80
mov ecx, str.hlapex
call fcn.10001b80
mov ecx, str.wp_v5
call fcn.10001b80
mov ecx, 0x10021250
call fcn.10001b80
mov ecx, str.TfProcessRawLog
call fcn.10001b80
mov ecx, str.TfScriptEditor
call fcn.10001b80
mov ecx, str.TfScript
call fcn.10001b80
mov ecx, str.TTabSheet
call fcn.10001b80
mov ecx, str.TJvSpinEdit
call fcn.10001b80
mov ecx, str.PhTreeNew
call fcn.10001b80
mov ecx, str.TPaintPanel
call fcn.10001b80
mov ecx, str.ThtmlLiteEx
call fcn.10001b80
mov ecx, str.TfmMain
call fcn.10001b80
mov ecx, str.TvkProgressBar
call fcn.10001b80
mov ecx, str.TTabSheet
call fcn.10001b80
mov ecx, str.SandboxieControlWnsClass
call fcn.10001b80
mov ecx, str.0x150114__1376532_
call fcn.10001b80
mov ecx, str.0x507B6__329654_
jmp fcn.10001b80
Function at 0x10002000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x10002024
lea ecx, [ebx + 5]
add ecx, dword [ebx + 1]
call fcn.10002000
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10024d1c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100298a8]
cmp eax, dword [ecx + 4]
jle 0x1000207c
push 0x100298a8
call fcn.10003ade
add esp, 4
cmp dword [0x100298a8], 0xffffffff
jne 0x1000207c
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x100298a8
mov dword [0x100298a4], eax
call fcn.10003a94
add esp, 4
push esi
mov esi, dword [0x100298a4]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x100020a3
nop
lea ecx, [esi + 0x1c]
call fcn.10001ff0
test eax, eax
je 0x100020a5
add esi, 0x20
cmp esi, edx
jne 0x10002090
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001db0
add edi, eax
cmp edi, 5
jl 0x100020a7
test edi, edi
jle 0x100020d1
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100020c0
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10020b00
lea eax, [ebp - 4]
mov esi, ecx
push str.Protection.log
push eax
call fcn.1000a624
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100021bb
push esi
push 0x10020b14
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10007641
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100021e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.100194f0
mov eax, dword [0x1002400c]
xor eax, esp
mov dword [esp + 0x1088], eax
mov eax, ecx
mov dword [esp + 0x1060], 0xf2c3870
push ebx
push esi
push edi
movups xmm0, xmmword [eax]
push ecx
lea edx, [esp + 0x1070]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1074], 0x171811fb
mov dword [esp + 0x1078], 0x15012d12
mov dword [esp + 0x107c], 0xef8107a
movups xmmword [esp + 0x1080], xmm0
call fcn.100010d0
lea esi, [esp + 0x1080]
mov dword [esp + 0x18], 3
add esp, 4
mov dword [esp + 0x10], esi
mov ecx, dword [esi + 4]
lea edi, [esp + 0x64]
mov eax, dword [esi]
mov esi, 0x10
mov dword [esp + 0xc], ecx
xor eax, dword [edi]
lea edi, [edi - 4]
mov edx, eax
mov dword [esp + 0x18], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esp + eax*4 + 0x68]
add eax, dword [esp + ecx*4 + 0x468]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esp + ecx*4 + 0x868]
movzx ecx, bl
add eax, dword [esp + ecx*4 + 0xc68]
xor eax, dword [esp + 0xc]
mov dword [esp + 0xc], edx
sub esi, 1
jne 0x10002277
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
xor ecx, edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x24]
xor ecx, eax
mov dword [esi + 4], ecx
add esi, 8
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
jne 0x10002265
mov eax, dword [esp + 0x1c]
movups xmm0, xmmword [esp + 0x107c]
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
pop ebx
xor ecx, esp
movups xmmword [eax], xmm0
call fcn.100035b0
mov esp, ebp
pop ebp
ret

Function at 0x100023b0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c88
call fcn.100194f0
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2c88]
mov dword [ebp - 0x2c88], 0x2880
push eax
lea eax, [ebp - 0x2c84]
mov esi, ecx
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x100023fd
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100035b0
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af0], 0
lea eax, [ebp - 0x2c84]
jne 0x10002448
nop dword [eax]
cmp byte [eax + 0x195], 0
jne 0x10002448
cmp byte [eax + 0x196], 0
jne 0x10002448
cmp byte [eax + 0x197], 0
jne 0x10002448
cmp byte [eax + 0x198], 0
jne 0x10002448
cmp byte [eax + 0x199], 0
jne 0x10002448
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x10002410
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x404]
push 0x3e8
push eax
call fcn.10002150
push 0x3e8
lea eax, [ebp - 0x404]
push eax
push 0x3e8
push esi
push 0
call fcn.1000b3d3
mov ecx, dword [ebp - 4]
add esp, 0x38
xor ecx, ebp
mov al, 1
pop esi
call fcn.100035b0
mov esp, ebp
pop ebp
ret
Function at 0x10002640
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d24
call fcn.100194f0
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x204]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10002753
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100050d0
push str.._
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000b0f2
lea eax, [ebp - 0x204]
mov byte [ebp - 0x202], 0
push eax
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000b3f3
add esp, 0x24
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002753
push 0x2710
lea eax, [ebp - 0x2d14]
mov dword [ebp - 0x2d24], 0
push 0
push eax
mov dword [ebp - 0x2d18], 0
mov dword [ebp - 0x2d20], 0
mov dword [ebp - 0x2d1c], 0
call fcn.100050d0
add esp, 0xc
lea eax, [ebp - 0x2d24]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2d14]
push eax
push 0xc
lea eax, [ebp - 0x2d20]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002765
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100035b0
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2cfc]
lea eax, [ebp - 0x604]
push eax
push ecx
lea ecx, [ebp - 0x2d14]
call fcn.100024c0
push eax
push 0x10021350
lea eax, [ebp - 0x604]
push 0x3e8
push eax
call fcn.10002150
push 0x3e8
lea eax, [ebp - 0x604]
push eax
push 0x3e8
push edi
push 0
call fcn.1000b3d3
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.100035b0
mov esp, ebp
pop ebp
ret