joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416c20
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x31168], 0
jne 0x416c46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3116c], eax
xor eax, eax
jmp 0x416c94
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00444850
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x31168]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x416c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3116c], eax
xor eax, eax
jmp 0x416c94
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x417350
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x414]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x41738d
mov ecx, dword [ebp - 4]
add ecx, 0x504
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x418]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
sbb eax, eax
neg eax
movzx ecx, al
test ecx, ecx
je 0x417425
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x500]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
je 0x4173ca
cmp dword [ebp - 0x24], 2
je 0x4173d8
jmp 0x417420
mov ecx, dword [ebp - 8]
add ecx, 0x2000
mov dword [ebp - 8], ecx
jmp 0x417420
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov edx, dword [ebp - 4]
add edx, 0x100
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x1800]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417381
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x417430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0x400
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00444520
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x417461
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jbe 0x417485
push 1
push 0x4736b8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
push edx
call fcn.004455b8
add esp, 0xc
test eax, eax
jne 0x417483
jmp 0x417485
jmp 0x417458
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 1
push 0
mov edx, dword [ebp - 4]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4174ff
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
push ecx
push 0
push 0
push 0x4736bc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4174f3
push 0x4736cc
call fcn.00444520
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x4736e8
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
push ecx
call fcn.00445426
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417527
push 0x473704
call fcn.00444520
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
push 0x473720
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
push ecx
call fcn.00445426
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov esp, ebp
pop ebp
ret 4
Function at 0x41a180
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4656a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x18], eax
call fcn.00454986
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 8
call fcn.004594e4
mov byte [ebp - 4], 1
push 0
push 0
push 0
push 0
push 1
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.0045e2d2
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x425bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
mov eax, dword [0x487490]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x124], 0
push 0
push 5
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x120]
call fcn.00404420
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x120]
sub edx, 0x10
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
push eax
call fcn.00404cc0
add esp, 4
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
add ecx, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x124]
or eax, 1
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401700
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004457b0
mov esp, ebp
pop ebp
ret

Function at 0x425cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
mov eax, dword [0x487490]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x124], 0
push 0
push 0x28
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x120]
call fcn.00404420
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x120]
sub edx, 0x10
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
push eax
call fcn.00404cc0
add esp, 4
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
add ecx, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x124]
or eax, 1
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401700
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004457b0
mov esp, ebp
pop ebp
ret
Function at 0x427e90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x468764
lea ecx, [ebp + 8]
call sym.DWGView.exe_public:_long_int___thiscall_WString::Find_char_const__const
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, 1
test ecx, ecx
je 0x427f2d
mov edx, dword [ebp - 0x10]
push edx
push 0x468764
lea ecx, [ebp + 8]
call sym.DWGView.exe_public:_long_int___thiscall_WString::Find_char_const___int_const
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x427efc
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x427f2d
mov ecx, dword [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp + 8]
call sym.DWGView.exe_public:_class_WString___thiscall_WString::Mid_long_int__long_int_
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x1c]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
jmp 0x427ecb
mov byte [ebp - 0x21], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42cbb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463f30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
call fcn.0042c610
cmp dword [0x48844c], 0
jne 0x42cbf9
cmp dword [0x488448], 0
jne 0x42cbf9
cmp dword [0x488450], 0
jne 0x42cbf9
cmp dword [0x488458], 0
jne 0x42cbf9
jmp 0x42ce00
mov eax, dword [0x48aca0]
and eax, 1
jne 0x42cc63
mov ecx, dword [0x48aca0]
or ecx, 1
mov dword [0x48aca0], ecx
mov dword [ebp - 4], 0
push 0
mov ecx, 0x48ac80
call fcn.0043b3d5
mov byte [ebp - 4], 1
mov dword [0x48ac80], 0x46e778
mov ecx, 0x48ac80
call fcn.004078b0
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x42cc4b
call fcn.00452c2e
mov byte [ebp - 4], 0
push 0x467530
call fcn.004447d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 1
push 0x48ac80
lea ecx, [ebp - 0x18]
call fcn.0043b381
mov dword [ebp - 4], 2
push 0x2800
push 0
push 0x488480
call fcn.00444850
add esp, 0xc
push 0x474e60
lea ecx, [ebp - 0x38]
call sym.DWGView.exe_public:_void___thiscall_WString::constructor_char_const__
mov byte [ebp - 4], 3
xor edx, edx
je 0x42ccb1
push 0x468850
lea ecx, [ebp - 0x38]
call fcn.0042b330
jmp 0x42ccc7
mov eax, 1
test eax, eax
je 0x42ccc7
push 0x468844
lea ecx, [ebp - 0x38]
call fcn.0042b330
lea ecx, [ebp - 0x2c]
call sym.DWGView.exe_public:_void___thiscall_WDateTime::constructor_void_
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x2c]
call sym.DWGView.exe_public:_class_WString___thiscall_WDateTime::ToString_void_
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
sub esp, 0xc
mov eax, esp
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x468834
push 0x488480
call fcn.00443eb6
add esp, 0x18
lea ecx, [ebp - 0x48]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov edx, dword [ebp - 0x34]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 8], ecx
push 0x468840
push 0x488480
call fcn.00444520
add esp, 4
add eax, 0x488480
push eax
call fcn.00443eb6
add esp, 0x14
lea edx, [ebp + 0xc]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x488480
call fcn.00444520
add esp, 4
add eax, 0x488480
push eax
call fcn.00443b9d
add esp, 0xc
mov dword [ebp - 0x3c], 0
cmp dword [0x48844c], 0
je 0x42cd95
push 0x488480
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x488448], 0
je 0x42cdab
push 0x488480
call fcn.0042ca70
add esp, 4
cmp dword [0x488458], 0
je 0x42cdc5
push 0x488480
call fcn.004318f0
mov ecx, eax
call fcn.004319a0
cmp dword [0x488450], 0
je 0x42cde1
push 0x488480
push 4
call fcn.004318f0
mov ecx, eax
call fcn.00431970
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0043b35f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ce10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
call fcn.0042c610
cmp dword [0x48844c], 0
jne 0x42ce59
cmp dword [0x488448], 0
jne 0x42ce59
cmp dword [0x488450], 0
jne 0x42ce59
cmp dword [0x488458], 0
jne 0x42ce59
jmp 0x42d05b
mov eax, dword [0x48d4c8]
and eax, 1
jne 0x42cec3
mov ecx, dword [0x48d4c8]
or ecx, 1
mov dword [0x48d4c8], ecx
mov dword [ebp - 4], 0
push 0
mov ecx, 0x48d4a8
call fcn.0043b3d5
mov byte [ebp - 4], 1
mov dword [0x48d4a8], 0x46e778
mov ecx, 0x48d4a8
call fcn.004078b0
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x42ceab
call fcn.00452c2e
mov byte [ebp - 4], 0
push 0x467540
call fcn.004447d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 1
push 0x48d4a8
lea ecx, [ebp - 0x18]
call fcn.0043b381
mov dword [ebp - 4], 2
push 0x2800
push 0
push 0x48aca8
call fcn.00444850
add esp, 0xc
push 0x474e60
lea ecx, [ebp - 0x38]
call sym.DWGView.exe_public:_void___thiscall_WString::constructor_char_const__
mov byte [ebp - 4], 3
xor edx, edx
je 0x42cf11
push 0x468850
lea ecx, [ebp - 0x38]
call fcn.0042b330
jmp 0x42cf22
xor eax, eax
je 0x42cf22
push 0x468844
lea ecx, [ebp - 0x38]
call fcn.0042b330
lea ecx, [ebp - 0x2c]
call sym.DWGView.exe_public:_void___thiscall_WDateTime::constructor_void_
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x2c]
call sym.DWGView.exe_public:_class_WString___thiscall_WDateTime::ToString_void_
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
sub esp, 0xc
mov eax, esp
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x468834
push 0x48aca8
call fcn.00443eb6
add esp, 0x18
lea ecx, [ebp - 0x48]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov edx, dword [ebp - 0x34]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 8], ecx
push 0x468840
push 0x48aca8
call fcn.00444520
add esp, 4
add eax, 0x48aca8
push eax
call fcn.00443eb6
add esp, 0x14
lea edx, [ebp + 0xc]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x48aca8
call fcn.00444520
add esp, 4
add eax, 0x48aca8
push eax
call fcn.00443b9d
add esp, 0xc
mov dword [ebp - 0x3c], 0
cmp dword [0x48844c], 0
je 0x42cff0
push 0x48aca8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x488448], 0
je 0x42d006
push 0x48aca8
call fcn.0042ca70
add esp, 4
cmp dword [0x488458], 0
je 0x42d020
push 0x48aca8
call fcn.004318f0
mov ecx, eax
call fcn.004319a0
cmp dword [0x488450], 0
je 0x42d03c
push 0x48aca8
push 4
call fcn.004318f0
mov ecx, eax
call fcn.00431970
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call sym.DWGView.exe_public:_void___thiscall_WString::destructor_void_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0043b35f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42e990
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x487490]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 8], 0
push 0x100
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e9e3
xor eax, eax
jmp 0x42eabb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x128], 0
jmp 0x42ea0e
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x128]
cmp dword [eax + ecx*4], 0
je 0x42eaae
mov edx, dword [ebp - 0x124]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x128]
mov ecx, dword [edx + eax*4]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00443860
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00404420
push 0
push 0x4688f4
lea ecx, [ebp - 0x12c]
call fcn.00405a50
test eax, eax
je 0x42ea9e
push 4
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*4]
push ecx
call fcn.00443860
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x12c]
call fcn.00401700
jmp 0x42e9ff
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 0x10]
call fcn.004457b0
mov esp, ebp
pop ebp
ret
Function at 0x42eb80
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42ebcd
cmp dword [ebp - 0x20], 0x6f
je 0x42ebcd
xor eax, eax
jmp 0x42ed73
mov ecx, dword [ebp - 0x18]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42ebe9
xor eax, eax
jmp 0x42ed73
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42ec06
xor eax, eax
jmp 0x42ed73
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x10], 0
je 0x42ed3d
call fcn.00454986
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
call dword [eax + 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x10
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
call fcn.00454986
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
call dword [eax + 0xc]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x1a0], 6
jne 0x42ed15
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push 0x468900
lea eax, [ebp - 0x28]
push eax
call fcn.00401540
add esp, 0x20
cmp dword [ebp - 0x24], 0
jne 0x42ece6
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404940
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x42ed15
cmp dword [ebp - 0x24], 1
jne 0x42ed15
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00404940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401700
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401700
jmp 0x42ed3d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401700
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401700
jmp 0x42ec13
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x50], ecx
push 0x474f58
mov edx, dword [ebp - 0x50]
push edx
call fcn.00444bcf
add esp, 8
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x42ed6e
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00404940
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ef80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 1
jne 0x42ef97
jmp 0x42f060
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x42efb7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], 1
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x42f000
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 8]
add edx, 0x24
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x42eed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x20
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esp, ebp
pop ebp
ret

Function at 0x42f0f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x42f107
jmp 0x42f19d
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x1c], 0
je 0x42f19d
mov edx, 1
test edx, edx
je 0x42f173
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
lea edx, [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [ebp - 4], 1
jne 0x42f169
jmp 0x42f173
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42f140
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x42f196
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x42f19d
mov dword [ebp - 0x14], 0
mov esp, ebp
pop ebp
ret