joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10189fd
Capabilities:
Check os version

Disassembly:
push 0x184
mov eax, 0x10263fc
call fcn.0100a0f9
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x148]
call fcn.010131fd
xor ebx, ebx
mov dword [ebp - 4], ebx
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x190]
call fcn.0100e3af
mov byte [ebp - 4], 1
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x16c], 0x1005ef0
mov dword [ebp - 0x168], 0x1005758
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], 0x1005724
mov dword [ebp - 0x15c], 0x10052d8
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], 0x10052bc
mov dword [ebp - 0x150], 0x1004e48
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1018afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1018acb
test dword [eax + 0x1c], 0x400000
je 0x1018acb
push esi
push 0x10045d4
push 0x7e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x20]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x190]
call fcn.0100e3a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.0101323e
xor eax, eax
call fcn.0100a18b
ret 8
xor eax, eax
cmp byte [ebp - 0x12], 1
mov dword [ebp - 0x134], ebx
setne al
lea esi, [ebp - 0x16c]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], ebx
jne 0x1018b26
cmp dword [esi + 8], ebx
jne 0x1018bc2
mov eax, dword [esi]
mov dword [ebp - 0x140], eax
push ebx
lea eax, [ebp - 0x148]
push eax
push edi
call fcn.010188f4
push eax
lea ecx, [ebp - 0x130]
call fcn.0100ff2b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x130]
push ebx
push dword [esi + 4]
lea eax, [ebp - 0x190]
push 0x1777
push eax
call fcn.0101710e
cmp eax, ebx
je 0x1018b81
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x190]
push eax
call fcn.01017ee9
cmp eax, ebx
jne 0x1018bb3
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1018bae
test dword [eax + 0x1c], 0x200000
je 0x1018bae
push dword [ebp - 0x140]
push 0x10045d4
push 0x7f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a926
cmp dword [ebp + 0xc], ebx
je 0x1018be0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.0100fefd
inc dword [ebp - 0x134]
add esi, 0xc
cmp dword [ebp - 0x134], 3
jb 0x1018b15
xor esi, esi
inc esi
jmp 0x1018c7e
lea ecx, [ebp - 0x190]
call fcn.01009ad7
cmp eax, 5
je 0x1018c58
lea ecx, [ebp - 0x190]
call fcn.01009ad7
cmp eax, 0xe
je 0x1018c58
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1018c2a
test dword [eax + 0x1c], 0x200000
je 0x1018c2a
push 0x10045d4
push 0x80
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100904c
push ebx
push 0x54f
push 0x1004e3c
push 0xda9
push 0x10045e8
call fcn.0100a7b1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.0100fefd
jmp 0x1018ad3
mov esi, dword [edi]
lea ecx, [ebp - 0x190]
add esi, 0x20
call fcn.01009ad7
push eax
mov ecx, edi
call dword [esi]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.0100fefd
xor esi, esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x190]
call fcn.0100e3a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.0101323e
mov eax, esi
jmp 0x1018af2
Function at 0x101af7a
Capabilities:
Set registry value

Disassembly:
push 0x60
mov eax, 0x1026638
call fcn.0100a0f9
mov edi, dword [ebp + 8]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 1
mov eax, dword [0x102b00c]
mov esi, 0x102b00c
mov ebx, 0x1006694
cmp eax, esi
je 0x101afbe
test dword [eax + 0x1c], 0x200000
je 0x101afbe
push ecx
push ebx
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
and dword [ebp - 0x6c], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
push 0x102
push 0
push dword [ebp - 0x64]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x68], ecx
cmp ecx, 2
jne 0x101b01d
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b00f
test dword [eax + 0x1c], 0x400000
je 0x101b00f
push dword [ebp - 0x64]
push ebx
push 0x4b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a926
mov eax, dword [edi]
push 0x80338005
mov ecx, edi
call dword [eax + 0x20]
jmp 0x101b08c
cmp ecx, 5
jne 0x101b04e
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b045
test dword [eax + 0x1c], 0x400000
je 0x101b045
push dword [ebp - 0x64]
push ebx
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a926
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
jmp 0x101b08c
test ecx, ecx
je 0x101b095
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b076
test dword [eax + 0x1c], 0x400000
je 0x101b076
push dword [ebp - 0x64]
push ecx
push ebx
push 0x4d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101013d
push dword [ebp - 0x68]
mov eax, dword [edi]
push 0x1003eb0
push 0x4033c360
push edi
call dword [eax + 0x28]
add esp, 0x10
and dword [ebp - 0x60], 0
jmp 0x101b128
lea eax, [ebp - 0x5c]
push eax
call fcn.0100ba35
push 0x4a
lea eax, [ebp - 0x5c]
push eax
push 1
push 0
push 0x10069b4
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x101b0ff
mov ecx, dword [edi]
and dword [ebp - 0x60], 0
push eax
push 0x1004184
push 0x4033c360
push edi
call dword [ecx + 0x28]
add esp, 0x10
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b128
test dword [eax + 0x1c], 0x400000
je 0x101b128
push 0x10069b4
push dword [ebp - 0x68]
push ebx
push 0x4e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101013d
jmp 0x101b128
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b128
test dword [eax + 0x1c], 0x200000
je 0x101b128
lea ecx, [ebp - 0x5c]
push ecx
push 0x10069b4
push ebx
push 0x4f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0100c353
mov eax, dword [ebp - 0x60]
call fcn.0100a18b
ret 4
Function at 0x101fa9e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102b01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
call fcn.0100b94b
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101fadc
xor al, al
jmp 0x101fb8c
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fae5
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebp + eax*2 - 0x212]
lea eax, [ebp - 0x210]
jne 0x101fb0d
push 0x10071e0
jmp 0x101fb12
push 0x10071c4
push esi
push eax
call fcn.0100b5f5
test eax, eax
jge 0x101fb46
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x101fad5
test dword [eax + 0x1c], 0x200
je 0x101fad5
push 0x1006f50
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100904c
jmp 0x101fad5
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
mov ecx, edi
call fcn.0100c389
cmp dword [edi], 0
jne 0x101fb8a
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x101fad5
test dword [eax + 0x1c], 0x200
je 0x101fad5
push 0x1006f50
push 0xb
jmp 0x101fb39
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100a071
leave
ret

Function at 0x10240b6
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x10240fb
test dword [eax + 0x1c], 0x200000
je 0x10240fb
push esi
push 0x10084e0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x102412b
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1024175
test dword [eax + 0x1c], 0x400000
je 0x1024175
push dword [ebp - 4]
push 0x10084e0
push 0xb
jmp 0x102416a
push edi
xor eax, eax
push 0x1008530
inc eax
push eax
push ebx
push 0x1008520
mov dword [esi + 8], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x1024182
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1024175
test dword [eax + 0x1c], 0x400000
je 0x1024175
push dword [ebp - 4]
push 0x10084e0
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push 0x10084f0
lea ecx, [esi + 0x10]
call fcn.01024035
mov dword [esi], 1
jmp 0x102417b
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40633c
pop dword [ebp - 8]
mov eax, 0xe2a03fae
add eax, 0x1da0238e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xaf4bc189
sub dword [ebp - 0x18], 0x60f97c3e
mov dword [ebp - 0x14], 0xfbd614f5
add dword [ebp - 0x14], 0x365d3750
mov dword [ebp - 0x10], 0xd6397505
add dword [ebp - 0x10], 0x7612cf29
mov dword [ebp - 0xc], 0x9169835c
add dword [ebp - 0xc], 0x6e967ca4
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3ed2d42a
sub eax, 0x3e9263ca
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x4965d34c
sub dword [ebp - 0x18], 0xd4f369f6
mov dword [ebp - 0x14], 0x862ef61b
sub dword [ebp - 0x14], 0x44c294a6
mov dword [ebp - 0x10], 0xe096b552
add dword [ebp - 0x10], 0x82d8b71a
mov dword [ebp - 0xc], 0x778271af
sub dword [ebp - 0xc], 0x778271af
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x37824d2b
add eax, 0xc8be23d5
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3db25
push 0
call eax
mov ecx, 0xedb7ba0f
sub ecx, 0xedb755bf
xor edi, edi
add edi, eax
mov edx, 0xd4091590
add edx, 0x2c37ea70
add edx, dword [ebp - 8]
mov esi, 0x87ffc277
add esi, 0x4d45f343
sub dword [ebp - 4], edx
mov ebx, dword [edx]
xor dword [ebp - 4], edx
add ebx, esi
mov dword [ebp - 4], 0xe25407d
mov dword [edi], ebx
sub dword [ebp - 4], esi
add edi, 4
add edx, 4
loop 0x406460
add eax, 0x18413
xor ebx, ebx
add ebx, eax
add eax, 0xd207f63a
sub eax, 0xd207f635
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401080
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push section..text
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6e4a34], eax
ret 4
Function at 0x4014b0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x6e2f0c]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4014e6
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5b96d4]
mov dword [eax], ecx
mov cl, byte [0x5b96d8]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x5b9678
push edx
mov byte [eax + 8], cl
call fcn.0058dbb4
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401545
push eax
call fcn.0058d96a
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.0058d3fe
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401564
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5b96c4]
mov dword [eax], ecx
mov ecx, dword [0x5b96c8]
mov dword [eax + 4], edx
mov edx, dword [0x5b96cc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.0058d7f1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.0058d7f1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4015a4
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401620
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.0058d7f1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.0058d7f1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401650
push ebx
call fcn.0058d96a
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0058d3fe
add esp, 0x35c
ret
Function at 0x4016e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6e7240
call fcn.0041b890
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6e4514], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x71f81c]
xor edx, edx
mov eax, esi
div dword [0x71eda8]
mov eax, dword [0x71edac]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40173d
cmp dword [edx], esi
je 0x401781
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x401732
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6e4518
push 0x6e4730
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6e4500], esi
test esi, esi
jne 0x40179d
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40173d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x401752
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6e5368
call fcn.00402ff0
cmp dword [0x6f57f8], 0
push 0
mov ecx, 0x6e5368
push 0
jne 0x4017ee
push 1
call fcn.00402e60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.00402e60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x401ff0
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.00401080
mov eax, dword [esp + 0x2c]
mov dword [0x6e44f8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402031
test dl, dl
je 0x40202d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402031
add eax, 2
add ecx, 2
test dl, dl
jne 0x402011
xor eax, eax
jmp 0x402036
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402057
push 0
push str.Error__
push 0x5b9804
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.00401330
test eax, eax
je 0x40204e
push esi
call fcn.00401080
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5b97f0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x704258
call fcn.0052d310
push str._____________________Client_Start______________________
push 0x704258
call fcn.0052d310
push str._______________________________________________________
push 0x704258
call fcn.0052d310
add esp, 0x18
call fcn.00401260
mov ecx, 0x705830
call fcn.005413a0
push 0x71ec7a
push 0x6e4518
call fcn.0058dd5f
push 0x71ec7a
push 0x6e4730
call fcn.0058dd5f
push esi
call fcn.00401f80
add esp, 0x14
mov ecx, 0x705830
call fcn.00539c80
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6ff278
call fcn.004e8b80
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6ff278
call fcn.004e97b0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6ff278
call fcn.004e77d0
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6ff278
call fcn.004e8d60
mov ecx, 0x6f2ea0
call fcn.0042a7f0
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.004016e0
add esp, 8
test eax, eax
jne 0x402154
call fcn.00401340
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40218b
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x402168
mov ecx, 0x6e5368
call fcn.00403380
cmp eax, 0xffffffff
jne 0x402168
call fcn.00401340
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4159f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6e2f0c]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x415ba2
cmp byte [esi], bl
je 0x415ba2
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415ba2
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x415a74
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x415b90
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.00415f30
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415b69
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x415b0f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x415b69
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x415b2c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x415b69
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x415b87
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x415a90
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x415ba4
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x415ba4
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.0058d3fe
add esp, 0x130
ret 4
Function at 0x415bc0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x415c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00415f30
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0058ea97
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x415c35
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x415c70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00415f30
push esi
call fcn.0058ea5d
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x415cab
cmp eax, 8
ja 0x415cab
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0058e0b0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.004159f0
test al, 4
jne 0x415cb1
mov esi, dword [esi]
test esi, esi
jne 0x415c75
mov edx, dword [esp + 0x14]
push edx
call fcn.0058ea5d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4