joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf19c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf382
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4cf33e
mov eax, dword [ebp - 4]
call fcn.004d0b44
cmp ebx, eax
jge 0x4cf33e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c5790
mov edx, dword [0x4c72fc]
call fcn.0040478c
mov esi, eax
mov eax, esi
call fcn.004c81c0
test al, al
je 0x4cf334
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4cf328
xor eax, eax
push ebp
push 0x4cf321
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cf754
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041dbac
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405c34
mov eax, dword [ebp - 8]
call fcn.00405a04
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cf518
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf36c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4cf320
mov eax, dword [ebp - 4]
call fcn.004cf7d8
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b88c
jmp 0x4cf36c
mov eax, dword [ebp - 8]
call fcn.004054f8
jmp 0x4cf36c
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040ac78
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418870]
call fcn.0040efd4
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf389
lea eax, [ebp - 0x54]
call fcn.004054f8
ret
Function at 0x4d4804
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403bd0
ret

Function at 0x4d4bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d4d35
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d4d48
call fcn.004d4a58
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d4cfb
xor edx, edx
push ebp
push 0x4d4cf4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d4d88
call fcn.004d4a58
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d4cda
push ebp
mov eax, 0x4d4db4
call fcn.004d4b48
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4cfb
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d3c
lea eax, [ebp - 0x408]
call fcn.004054f8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4d4f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d5114
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d5128
call fcn.004d4db8
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d50d5
xor eax, eax
push ebp
push 0x4d50ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4d5160
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d502a
push ebp
mov eax, 0x4d517c
call fcn.004d4ea8
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d5188
call fcn.004d4db8
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d50b4
push dword [ebp - 0x3f0]
push 0x4d51ac
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405768
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d50d5
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d511b
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4db5dc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4db717
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4db6e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004059a4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040ae9c
test al, al
jne 0x4db657
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040392c
lea eax, [ebp - 0x1d0]
call fcn.004036c8
call fcn.004030f4
push dword [0x4f4dd0]
push 0x4db730
push dword [0x4f4dd4]
push 0x4db730
push dword [0x4f4dd8]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004058a8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004e1f60
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405cc4
call fcn.00404024
call fcn.004030f4
lea eax, [ebp - 0x1d0]
call fcn.004039f4
call fcn.004030f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db6f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db71e
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x4dc898
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4dca00
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004dba70
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004dba90
mov ebx, eax
jmp 0x4dc9d2
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040b430
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409d84
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409d84
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040593c
je 0x4dc9b2
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409d84
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409d84
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040593c
jne 0x4dc9c7
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004dbab0
mov ebx, eax
test ebx, ebx
jne 0x4dc913
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dca07
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4ded7c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4ded98
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret

Function at 0x4def10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4defea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4df000
mov edx, dword [ebp - 4]
call fcn.0040582c
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4def5a.0
jmp dword [eax*4 + 0x4def61]
mov eax, ebx
mov edx, 0x4df00c
call fcn.0040554c
jmp 0x4defcf
mov eax, ebx
mov edx, 0x4df01c
call fcn.0040554c
jmp 0x4defcf
mov eax, ebx
mov edx, 0x4df02c
call fcn.0040554c
jmp 0x4defcf
mov eax, ebx
mov edx, 0x4df040
call fcn.0040554c
jmp 0x4defcf
mov eax, ebx
mov edx, 0x4df050
call fcn.0040554c
jmp 0x4defcf
mov eax, ebx
mov edx, 0x4df064
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deff1
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4df2a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4df339
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4df350
mov edx, dword [ebp - 4]
call fcn.0040582c
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df340
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret

Function at 0x4e26ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e277d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040b88c
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e7b8
mov eax, dword [ebp - 0x108]
mov edx, 0x4e2794
call fcn.0040593c
je 0x4e274d
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e7b8
mov eax, dword [ebp - 0x10c]
mov edx, 0x4e27a0
call fcn.0040593c
je 0x4e274d
lea eax, [ebp - 4]
mov edx, 0x4e27a0
call fcn.004057e0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2784
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x25803194
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x258031a3
pop dword [ebp - 0x50]
mov eax, 0x62978d1
sub eax, 0xe0a9472e
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf243a4e1
sub dword [ebp - 0x60], 0xa3f15f96
mov dword [ebp - 0x5c], 0x29b35df3
add dword [ebp - 0x5c], 0x87fee52
mov dword [ebp - 0x58], 0x48631499
add dword [ebp - 0x58], 0x3e92f95
mov dword [ebp - 0x54], 0xf207586c
add dword [ebp - 0x54], 0xdf8a794
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x22e6b67c
sub dword [ebp - 0x60], 0xae744d26
mov dword [ebp - 0x5c], 0xb2b9dd74
add dword [ebp - 0x5c], 0x8eb28401
mov dword [ebp - 0x58], 0x7bb6f45c
sub dword [ebp - 0x58], 0x184787f0
mov dword [ebp - 0x54], 0xfa2fdc21
add dword [ebp - 0x54], 0x5d023df
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xd89df206
sub eax, 0xb31c2186
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b059
push 0
call eax
mov ecx, 0x927f5a28
sub ecx, 0x927f1852
xor edx, edx
add edx, eax
mov edi, 0xa5f6e3a9
add edi, 0x7f8bb257
add edi, dword [ebp - 0x50]
mov esi, 0x8b16acd4
xor dword [ebp - 0x20], edx
mov ebx, dword [edi]
mov dword [ebp - 0x2c], 0x45125a26
sub ebx, esi
mov dword [ebp - 0x18], 0x7c6eb251
mov dword [edx], ebx
add dword [ebp - 8], 0x64920a50
add edx, 0xdde940a2
sub edx, 0xdde9409e
add edi, 0x4f16fce2
sub edi, 0x4f16fcde
loop 0x258032bc
add eax, 0xfa2b
mov ebx, eax
add eax, 0x3412122
add eax, 0xfcbedee3
mov ecx, 0xaad4d570
sub ecx, 0x8554d570
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.25803194
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.25803194
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.25803194
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.25803194
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.25803194
pop ecx
jmp 0x258071e5
Function at 0x2580babc
Capabilities:
Query remote server for available data

Disassembly:
push 0x18
push 0x25820790
call fcn.2581aaa0
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x134]
add eax, 0x28
push eax
push dword [ecx + 0x130]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580bbbc
test ebx, ebx
jne 0x2580bbe4
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580bbea
cmp dword [ebp - 0x20], 0
jne 0x2580bbec
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2580c0de
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0x1c
push 0x258208b8
call fcn.2581aaa0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580c1cf
test ebx, ebx
jne 0x2580c1f7
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580c206
cmp dword [ebp - 0x20], 0
je 0x2580c206
test byte [ebp - 0x24], 0x20
jne 0x2580c206
push 2
pop edi
mov ax, di
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401010
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x401007
call 0xe844d48e
add dword [eax], eax
add byte [eax], al
jmp 0x2d9171
Function at 0x40556d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4055a5
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x405593
mov al, 1
jmp 0x4055ef
cmp dword [ebx + 0x54], ecx
jne 0x40559c
mov al, 2
jmp 0x4055ef
cmp dword [ebx + 0x7c], ecx
jne 0x4055ef
mov al, 3
jmp 0x4055ef
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4055ba
mov al, 4
jmp 0x4055ef
cmp ecx, 5
jne 0x4055da
cmp ebx, 0
jne 0x4055c8
mov al, 5
jmp 0x4055ef
cmp ebx, 1
jne 0x4055d1
mov al, 6
jmp 0x4055ef
cmp ebx, 2
jne 0x4055da
mov al, 7
jmp 0x4055ef
cmp ecx, 6
jne 0x4055e6
cmp ebx, 0
jne 0x4055e8
mov al, 8
jmp 0x4055ef
cmp ebx, 1
jne 0x4055ef
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405602
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0041aba6
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0041aba6
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x405698
mov dword [ebp - 0x18], esp
mov eax, 6
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x405695
push 6
call fcn.0041abb2
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 4
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x4056c4
push 6
call fcn.0041abb2
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x12
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x4056f2
push 6
call fcn.0041abb2
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x13
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x40571e
push 6
call fcn.0041abb2
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x14
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x4057ad
push 6
call fcn.0041abb2
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0xa
call fcn.0041abb8
cmp dword [ebp - 0x18], esp
je 0x4057d2
push 6
call fcn.0041abb2
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x4057da
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0041abac
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0041abac
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8