joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b20a9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5002b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a1c13
and dword [ebp - 0x14], 0
cmp dword [0x504740], 0
mov dword [ebp - 0x18], eax
jne 0x4b215c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b2204
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4e90c0
push ebx
call edi
test eax, eax
je 0x4b2204
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x4e90b0
push ebx
mov dword [0x504740], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x504744], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x504748], eax
call edi
push eax
call esi
mov dword [0x504750], eax
test eax, eax
je 0x4b215c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x50474c], eax
mov eax, dword [0x50474c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x4b21b5
cmp dword [0x504750], ecx
je 0x4b21b5
push eax
call esi
push dword [0x504750]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4b21b5
test ebx, ebx
je 0x4b21b5
call edi
test eax, eax
je 0x4b21ac
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4b21ac
test byte [ebp - 8], 1
jne 0x4b21b5
or dword [ebp + 0x10], 0x200000
jmp 0x4b21e8
mov eax, dword [0x504744]
cmp eax, dword [ebp - 0x18]
je 0x4b21e8
push eax
call esi
test eax, eax
je 0x4b21e8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b21e8
mov eax, dword [0x504748]
cmp eax, dword [ebp - 0x18]
je 0x4b21e8
push eax
call esi
test eax, eax
je 0x4b21e8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x504740]
call esi
test eax, eax
je 0x4b2204
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4b2206
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004959f8
leave
ret
Function at 0x10005a75
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005ab4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005ab4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005ab4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005ab4
cmp dword [ecx + 0x74], 0xe
jbe 0x10005ab4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008879
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10008916
push ebx
push esi
call fcn.10008842
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100087d6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100088c3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008915
push edi
push eax
call fcn.100071c3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100088e3
call fcn.1000731e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008914
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100087d6
add esp, 0x20
test eax, eax
jne 0x10008902
push edi
call fcn.1000731e
jmp 0x1000890a
push ebx
call fcn.1000731e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008b83
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010eb8
push 0x10010eb0
push str.FlsAlloc
push 0x1f
call fcn.10008a9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008bb7
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f140]
call esi
jmp 0x10008bbd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10008c01
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010ec8
push 0x10010ec0
push str.FlsGetValue
push 0x21
call fcn.10008a9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008c38
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10008c40
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010ed0
push 0x10010ec8
push str.FlsSetValue
push 0x22
call fcn.10008a9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008c7a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000e180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e1ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e1ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406d82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x4640d5
call fcn.00451324
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x471318
mov dword [edi + 4], 0x471308
mov dword [edi + 8], 0x4712fc
mov dword [edi + 0xc], 0x4712e8
and dword [ebp - 4], 0
lea ebx, [edi + 0x2cc]
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [ebp - 4], 0x14
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
cmp ecx, eax
mov dword [ebp - 0x10], ecx
je 0x406e18
jmp 0x406dd9
mov ecx, dword [ebp - 0x10]
mov esi, dword [ecx]
mov eax, dword [esi + 0x38]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x406e00
push dword [esi + 0x3c]
push str.__offer_job__d_still_live_
push 1
call fcn.0043fb8a
add esp, 0xc
call fcn.00406f82
push esi
call fcn.0044e64e
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x20]
pop ecx
jne 0x406dd6
lea esi, [ebx + 0x18]
call fcn.0041615a
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
and dword [0x48e680], 0
lea eax, [edi + 0x3ac]
push eax
call ebx
lea eax, [edi + 0x380]
push eax
mov byte [ebp - 4], 0x11
call fcn.00414f99
lea eax, [edi + 0x358]
push eax
mov byte [ebp - 4], 0x10
call fcn.00414f99
lea ecx, [edi + 0x348]
mov byte [ebp - 4], 0xf
call fcn.00444140
mov byte [ebp - 4], 0xe
mov eax, dword [edi + 0x344]
test eax, eax
je 0x406e80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [edi + 0x330]
call fcn.004163b1
lea esi, [edi + 0x320]
call fcn.004163b1
lea eax, [edi + 0x2f8]
push eax
mov byte [ebp - 4], 0xb
call fcn.00414f99
lea esi, [edi + 0x2e4]
call fcn.0041615a
lea eax, [edi + 0x2cc]
push eax
call ebx
lea ecx, [edi + 0x2b8]
mov byte [ebp - 4], 9
call fcn.00444140
lea esi, [edi + 0x280]
call fcn.004150c4
xor esi, esi
push esi
push 1
lea ecx, [edi + 0x25c]
call fcn.0041a87c
lea ecx, [edi + 0x248]
mov byte [ebp - 4], 6
call fcn.00444140
lea ecx, [edi + 0x238]
mov byte [ebp - 4], 5
call fcn.00444140
lea ecx, [edi + 0x228]
mov byte [ebp - 4], 4
call fcn.00444140
lea ecx, [edi + 0x218]
mov byte [ebp - 4], 3
call fcn.00444140
push esi
push 1
lea ecx, [edi + 0x1f4]
call fcn.0041a87c
push esi
push 1
lea ecx, [edi + 0x1d8]
call fcn.0041a87c
lea eax, [edi + 0x78]
push eax
mov byte [ebp - 4], 0
call fcn.00406cf1
or dword [ebp - 4], 0xffffffff
lea eax, [edi + 0x10]
call fcn.0042fc8f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4098b4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [eax + 0x1b8], ebx
jne 0x409905
cmp byte [eax + 0x1d5], bl
jne 0x409905
lea eax, [ebp - 4]
push eax
push 0x40990a
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 4], ebx
je 0x409905
push dword [ebp - 4]
push str.App::DetectSameInstallerRunning_771
push str._s__hwnd0x_p
push ebx
call fcn.0043fb8a
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
jmp 0x409907
xor al, al
pop ebx
leave
ret
Function at 0x411750
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, eax
push edi
add esi, 0x2cc
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [esi + 0x1c]
jmp 0x411774
mov eax, dword [edi]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
add edi, 4
cmp edi, dword [esi + 0x20]
jne 0x411766
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
ret

Function at 0x41348b
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x464e86
call fcn.00451324
sub esp, 0x60
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
cmp byte [esi + 0x1cc], bl
mov dword [ebp - 0x10], esp
je 0x413544
push 0x470e4a
lea ecx, [ebp - 0x24]
call fcn.00441bc0
lea eax, [ebp - 0x24]
push eax
push str.mobileUrl
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 1
call fcn.00444bb0
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00443790
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00444140
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00444140
cmp dword [ebp - 0x3c], ebx
je 0x41352f
lea ecx, [ebp - 0x50]
call fcn.0042b5c4
cmp al, bl
jne 0x41352f
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x41351e
lea eax, [ebp - 0x4c]
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 3
pop eax
mov ecx, esi
call fcn.004122bc
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.0041a87c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x413685
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x464e38
call fcn.00451324
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x7c]
mov dword [ebp - 4], ebx
call fcn.00415058
push ebx
push 0xfde9
mov eax, esi
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.0044c120
add esp, 0x10
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 3
call fcn.00416032
mov eax, dword [ebp - 0x40]
push 0x10
pop edi
cmp dword [ebp - 0x2c], edi
jae 0x4136e0
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
push str.App::OpenLinkInBrowser_3336
push str._s__app_d_link_s_
push ebx
call fcn.0043fb8a
add esp, 0x14
cmp dword [ebp - 0x30], ebx
je 0x413868
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x413716
dec eax
je 0x413726
dec eax
je 0x4137d4
jmp 0x413839
lea ecx, [ebp - 0x44]
call fcn.0042b5c4
cmp al, bl
jne 0x413868
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
call fcn.0041a131
push ebx
lea eax, [ebp - 0x60]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.00428b37
add esp, 0xc
cmp al, bl
je 0x4137ca
cmp dword [ebp - 0x4c], ebx
je 0x4137ca
push str.__in_new_ff_window
push ebx
call fcn.0043fb8a
pop ecx
pop ecx
push str._new_window__
lea ecx, [ebp - 0x7c]
call fcn.0041b5d0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.0041a2c5
push 0x471820
lea ecx, [ebp - 0x7c]
call fcn.00414b4a
cmp dword [ebp - 0x64], edi
mov ecx, dword [ebp - 0x78]
jae 0x413796
lea ecx, [ebp - 0x78]
cmp dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x5c]
jae 0x4137a1
lea eax, [ebp - 0x5c]
push esi
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push esi
lea ecx, [ebp - 0x7c]
call fcn.0041a87c
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.0041a87c
jmp 0x413868
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.0041a87c
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
call fcn.0041a131
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 6
call fcn.00428a7c
cmp al, bl
pop ecx
je 0x41382b
push str.__in_new_gc_window
push ebx
call fcn.0043fb8a
cmp dword [ebp - 0x2c], edi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x40]
jae 0x41380e
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x5c]
jae 0x413819
lea eax, [ebp - 0x5c]
push esi
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4137bb
push ebx
push esi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.0041a87c
cmp dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x40]
jae 0x413844
lea eax, [ebp - 0x40]
push esi
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x413868
push eax
push str.__ShellExec_failed:__d
push esi
call fcn.0043fb8a
add esp, 0xc
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.0041a87c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x41b22c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x41d270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov esi, str._windir_SysWOW64
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3c
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0xf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
and eax, 0x20
pop edi
add eax, 0x20
pop esi
leave
ret

Function at 0x41d2c8
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x462bef
call fcn.00451324
sub esp, 0x23c
push ebx
push esi
push edi
push 0x3f
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
and dword [ebp - 0x10], 0
xor eax, eax
mov byte [ebp - 0x148], 0
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x248], 0
lea edi, [ebp - 0x247]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0xff
push ebx
lea eax, [ebp - 0x148]
push eax
push 0x59
mov edi, 0x400
push edi
call esi
push ebx
lea eax, [ebp - 0x248]
push eax
push 0x5a
push edi
call esi
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b5d0
push 0x471f98
push eax
lea eax, [ebp - 0x48]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00417e9b
lea ecx, [ebp - 0x248]
push ecx
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00417e9b
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041a87c
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041a87c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41d397
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x46247e
call fcn.00451324
sub esp, 0x2c
push ebx
push edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x41d3c3
xor al, al
jmp 0x41d45e
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetUserGeoID
push edi
call esi
push str.GetGeoInfoA
push edi
mov dword [ebp - 0x14], eax
call esi
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
je 0x41d443
cmp eax, ebx
je 0x41d443
push 0x10
call dword [ebp - 0x14]
mov esi, eax
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.0044c3f0
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041a38e
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0041a87c
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
push eax
push 3
lea eax, [ebp - 0x10]
push eax
push 4
push esi
call dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0041af92
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0x14], ebx
pop esi
je 0x41d45c
cmp dword [ebp - 0x18], ebx
je 0x41d45c
xor eax, eax
inc eax
jmp 0x41d45e
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41db46
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x463961
call fcn.00451324
sub esp, 0x48
push ebx
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call sub.iphlpapi.dll_GetAdaptersInfo
cmp dword [ebp - 0x10], ebx
jne 0x41db7d
mov ecx, dword [ebp + 8]
push 0x470e4a
call fcn.0041b5d0
jmp 0x41dc67
push esi
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0041a131
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call fcn.0044ed99
mov esi, eax
pop ecx
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x14], esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x41dc2b
cmp esi, ebx
je 0x41dc2b
push edi
cmp dword [esi + 0x190], ebx
je 0x41dc24
cmp dword [ebp - 0x1c], ebx
je 0x41dbcc
push 0x472f9c
lea ecx, [ebp - 0x30]
call fcn.00414b4a
cmp dword [esi + 0x190], ebx
jbe 0x41dc24
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x54], 0
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
movzx eax, byte [esi + ebx + 0x194]
push eax
lea eax, [ebp - 0x54]
push str._02X
push eax
call fcn.004503b5
add esp, 0xc
test ebx, ebx
jbe 0x41dc0d
push 0x474aac
lea ecx, [ebp - 0x30]
call fcn.00414b4a
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x30]
call fcn.00414b4a
inc ebx
cmp ebx, dword [esi + 0x190]
jb 0x41dbd4
xor ebx, ebx
mov esi, dword [esi]
cmp esi, ebx
jne 0x41dbb2
pop edi
push dword [ebp - 0x14]
call fcn.0044edab
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
pop ecx
pop esi
jae 0x41dc41
lea eax, [ebp - 0x2c]
push eax
push str.MACS_____s
push ebx
call fcn.0043fb8a
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call fcn.0041b74c
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0041a87c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41e743
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x46603d
call fcn.00451324
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0x10
jb 0x41e751
mov eax, dword [esi + 4]
jmp 0x41e754
lea eax, [esi + 4]
push dword [ebp + 8]
push eax
push str.CompInfo::TestFileExists_532
push str._s__f_s_isDir_d
push 0
call fcn.0043fb8a
add esp, 0x14
push esi
lea ecx, [ebp - 0x28]
call fcn.0041b74c
and dword [ebp - 4], 0
push 3
lea ebx, [ebp - 0x28]
call fcn.00421c41
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
pop ecx
jae 0x41e790
lea eax, [ebp - 0x24]
push eax
push str.__fullpath_s
xor esi, esi
push esi
call fcn.0043fb8a
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [ebp - 0x10], 0x10
jae 0x41e7ad
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41e7bc
xor bl, bl
jmp 0x41e7ea
cmp dword [ebp + 8], esi
jge 0x41e7c5
mov bl, 1
jmp 0x41e7ea
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x41e7d1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x41e7e4
cmp dword [ebp + 8], esi
setne bl
jmp 0x41e7ea
cmp dword [ebp + 8], esi
sete bl
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.0041a87c
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41ecc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ed13
cmp dword [ebp + 0xc], 1
je 0x41ecf5
cmp dword [ebp + 0xc], 2
jne 0x41ed07
test edi, edi
mov eax, dword [ebp - 4]
je 0x41ed0f
test eax, eax
je 0x41ed0c
cmp byte [eax + edi - 1], 0
je 0x41ed0f
push 0xd
pop eax
jmp 0x41ed13
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x41f7ae
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.sqlite3_libversion_number
push dword [esi + 0x1c]
call edi
push str.sqlite3_open
push dword [esi + 0x1c]
mov dword [esi], eax
call edi
push str.sqlite3_prepare
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call edi
push str.sqlite3_step
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call edi
push str.sqlite3_finalize
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call edi
push str.sqlite3_column_text
push dword [esi + 0x1c]
mov dword [esi + 0x14], eax
call edi
push str.sqlite3_close
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call edi
xor ecx, ecx
cmp dword [esi], ecx
mov dword [esi + 0x18], eax
pop edi
je 0x41f837
cmp dword [esi + 4], ecx
je 0x41f837
cmp dword [esi + 8], ecx
je 0x41f837
cmp dword [esi + 0xc], ecx
je 0x41f837
cmp dword [esi + 0x14], ecx
je 0x41f837
cmp dword [esi + 0x10], ecx
je 0x41f837
cmp eax, ecx
je 0x41f837
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x41f911
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x93c
push ebx
push edi
push 0xe
mov ebx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0x100
lea eax, [ebp - 0x13c]
xor edi, edi
push edi
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], eax
call fcn.0044eba0
push 0x800
lea eax, [ebp - 0x93c]
push edi
push eax
mov dword [ebp - 0x28], 0xff
mov dword [ebp - 0x10], eax
call fcn.0044eba0
mov eax, dword [ebx + 0x14]
add esp, 0x18
cmp dword [ebx + 0x18], 0x10
mov dword [ebp - 0xc], 0x7ff
jb 0x41f97a
mov ebx, dword [ebx + 4]
jmp 0x41f97d
add ebx, 4
lea ecx, [ebp - 0x3c]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x2c]
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.0041af92
push dword [ebp - 0x10]
lea ecx, [esi + 0x20]
call fcn.0041af92
movzx eax, word [ebp - 0x24]
pop edi
mov dword [esi + 0x3c], eax
pop ebx
leave
ret
Function at 0x42009b
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push edi
mov ecx, esi
call fcn.0041f9b0
test al, al
jne 0x4200ac
xor eax, eax
pop ecx
ret
push 8
call fcn.0044d764
test eax, eax
pop ecx
je 0x4200bf
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x4200c1
xor eax, eax
lea ecx, [esp]
push ecx
push 4
push eax
push 0x4200f2
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, dword [esi + 0x5c]
pop ecx
ret