joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.004040a0
call fcn.0040cd80
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040f7d0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f574
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040f7d0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x40f4b4
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
xor eax, eax
jne 0x40f49f
xor ecx, ecx
jne 0x40f49f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40f55b
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40f550
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0040f580
add esp, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040f7f0
add esp, 4
movzx edx, al
test edx, edx
jne 0x40f535
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x40f54e
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40f559
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40f564
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40f574
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x410300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.004042e0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.004020b0
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.004105f0
lea ecx, [ebp - 0x438]
call fcn.004020b0
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040fe70
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41037e
call fcn.00403230
mov dword [ebp - 0x444], eax
jmp 0x4104d3
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x4103af
call fcn.00403230
mov dword [ebp - 0x444], eax
jmp 0x4104d3
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x4103df
call fcn.00403230
mov dword [ebp - 0x444], eax
jmp 0x4104d3
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x41042f
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.00412fe0
lea ecx, [ebp - 0x2c]
call fcn.00404900
mov eax, dword [ebp - 0x44c]
jmp 0x410508
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00412f80
lea ecx, [ebp - 0x438]
call fcn.00412f70
test eax, eax
jne 0x41045c
mov dword [ebp - 0x444], 0x8007000e
jmp 0x4104d3
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00412f70
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.004042e0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x41049e
call fcn.00403230
mov dword [ebp - 0x444], eax
jmp 0x4104d3
lea ecx, [ebp - 0x438]
call fcn.00412f70
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.00412f70
push eax
lea ecx, [ebp - 0x18]
call fcn.00410620
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x4104e3
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.00412fe0
lea ecx, [ebp - 0x2c]
call fcn.00404900
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411de0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00411bb0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00411d80
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x411e4b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00411be0
mov eax, dword [ebp - 0x224]
jmp 0x411edc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x411eb1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00411de0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x411ea8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00411be0
mov eax, dword [ebp - 0x228]
jmp 0x411edc
mov dword [ebp - 4], 0x100
jmp 0x411e52
lea ecx, [ebp - 0x14]
call fcn.00411cc0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00411c60
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00411be0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 4
Function at 0x412440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x412449
xor ecx, ecx
jne 0x412449
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41246a
mov eax, 0xd
jmp 0x4124c5
xor eax, eax
jne 0x412451
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41247b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x413ed0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004252aa
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x413f80
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00424c75
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.004252aa
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
jne 0x413f1f
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push 0
push 0x4391e0
push 0x4391e8
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.004169d0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0xc], 1
mov ecx, 0x443ba8
call fcn.00403210
mov dword [ebp - 8], eax
push 0xf0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417fab
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417fab
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x417fab
cmp dword [ebp - 0xc], 0
je 0x417fab
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x417fab
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x403
jne 0x417f29
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x130]
call fcn.00418120
lea ecx, [ebp - 0x130]
call fcn.00412f70
push eax
push 0
push 0x143
movzx eax, word [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.00417fc0
cmp eax, 0xffffffff
jne 0x417f1c
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x130]
call fcn.00418150
jmp 0x417f9d
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x1234
jne 0x417f9d
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x150], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x258]
call fcn.00418120
mov ecx, eax
call fcn.00412f70
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x258]
call fcn.00418150
lea eax, [ebp - 0x154]
push eax
push 0
push 0x40b
movzx ecx, word [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.00417fc0
cmp eax, 0xffffffff
jne 0x417f9d
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
jmp 0x417e80
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 4
Function at 0x41dfe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
mov byte [ebp - 0x211], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00425230
add esp, 0xc
mov edx, dword [ebp - 0x218]
add edx, 0xaec
push edx
push 0x439ad0
lea eax, [ebp - 0x210]
push eax
call fcn.0041f0f0
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41e07e
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x439ae8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41e07e
mov byte [ebp - 0x211], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x211]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 4

Function at 0x41e6e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 4
Function at 0x41e710
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0x104
mov eax, dword [ebp - 0x18]
add eax, 0x1d0
push eax
call fcn.00427842
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 0x1d0
push ecx
call fcn.00427581
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
jmp 0x41e776
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x41e7a3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
movzx eax, word [edx + ecx*2 + 0x1d0]
cmp eax, 0x5c
jne 0x41e7a1
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov word [eax + edx*2 + 0x1d0], cx
jmp 0x41e7a3
jmp 0x41e76d
mov ecx, dword [ebp - 0x18]
add ecx, 0x1d0
push ecx
push str._slander.ini
push 0x104
mov edx, dword [ebp - 0x18]
add edx, 0x3d8
push edx
call fcn.0041f440
add esp, 0x10
mov dword [ebp - 0x14], 1
jmp 0x41e7db
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jge 0x41e8cd
push 0x439d9c
call fcn.00427581
add esp, 4
push eax
push str._ShowDeskTop
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.0042779c
add esp, 0xc
test eax, eax
jne 0x41e822
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1c0], 1
jmp 0x41e8c8
push 0x439dd4
call fcn.00427581
add esp, 4
push eax
push str._Setup
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0042779c
add esp, 0xc
test eax, eax
jne 0x41e85a
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x1cc], 1
jmp 0x41e8c8
push 0x439df4
call fcn.00427581
add esp, 4
push eax
push str._Uninstall
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx*4]
push eax
call fcn.0042779c
add esp, 0xc
test eax, eax
jne 0x41e892
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c4], 1
jmp 0x41e8c8
push 0x439e24
call fcn.00427581
add esp, 4
push eax
push str._NotRun
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.0042779c
add esp, 0xc
test eax, eax
jne 0x41e8c8
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1c8], 1
jmp 0x41e7d2
mov esp, ebp
pop ebp
ret
Function at 0x41ede0
Capabilities:
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x868], ecx
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00425230
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00425230
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x858], cx
push 0x1fe
push 0
lea edx, [ebp - 0x856]
push edx
call fcn.00425230
add esp, 0xc
xor eax, eax
mov word [ebp - 0x618], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x616]
push ecx
call fcn.00425230
add esp, 0xc
mov dword [ebp - 0x654], 0
push 0x38
push 0
lea edx, [ebp - 0x650]
push edx
call fcn.00425230
add esp, 0xc
mov dword [ebp - 0x654], 0x3c
mov dword [ebp - 0x640], 0x104
lea eax, [ebp - 0x418]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x624], 0x104
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea edx, [ebp - 0x858]
mov dword [ebp - 0x638], edx
mov dword [ebp - 0x634], 0x100
lea eax, [ebp - 0x618]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 0x100
lea ecx, [ebp - 0x654]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00427581
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, 1
jne 0x41eff6
push 0
push 0
push 0
push 0
push str.HTTP_CLIENT
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 0
je 0x41eff6
push 0
push 0
push 3
mov ecx, dword [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x638]
push edx
movzx eax, word [ebp - 0x63c]
push eax
mov ecx, dword [ebp - 0x644]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0
je 0x41efe9
push 0
push 0x84000000
push 0
push 0
push str.HTTP_1.0
mov eax, dword [ebp - 0x628]
push eax
push 0x43a1b0
mov ecx, dword [ebp - 0x860]
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
je 0x41efdc
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x864]
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov eax, dword [ebp - 0x864]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x860]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x85c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret 4
Function at 0x41f630
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00425304
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x41f712
mov dword [ebp - 0x14], 0
jmp 0x41f696
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 0x190]
jge 0x41f703
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x194]
push ecx
call fcn.0041f5b0
add esp, 8
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x190]
sub ecx, 1
cmp dword [ebp - 0x14], ecx
jge 0x41f6ef
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov byte [edx], 0x3a
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x41f701
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov byte [ecx], 0x23
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x41f68d
jmp 0x41f712
mov edx, dword [ebp - 8]
push edx
call fcn.004253fc
add esp, 4
cmp dword [ebp - 0x10], 0
jle 0x41f73c
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov al, 1
jmp 0x41f73e
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x41f750
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x442730]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov byte [ebp - 5], 0
mov dword [ebp - 0xc], 0x288
push 0x288
call fcn.00425304
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f788
xor al, al
jmp 0x41f8a5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x41f7c2
mov edx, dword [ebp - 4]
push edx
call fcn.004253fc
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00425304
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f7c2
xor al, al
jmp 0x41f8a5
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x41f896
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
jmp 0x41f7e7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x41f896
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1a0], 6
je 0x41f7ff
jmp 0x41f7df
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x190], 6
je 0x41f80d
jmp 0x41f7df
mov byte [ebp - 0x28], 0
xor edx, edx
mov dword [ebp - 0x27], edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov word [ebp - 0x17], dx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push 0x43a234
lea eax, [ebp - 0x28]
push eax
call fcn.00427902
add esp, 0x20
push 0x14
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00424e30
add esp, 0xc
mov byte [ebp - 5], 1
jmp 0x41f896
mov eax, dword [ebp - 4]
push eax
call fcn.004253fc
add esp, 4
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00425195
mov esp, ebp
pop ebp
ret