joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff52047
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x7ff92e88
call fcn.7ff890d8
sub esp, 0x30
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x10]
push eax
push 0x7ffa5e2c
call fcn.7ff884fe
add esp, 0xc
push dword [ebp + 8]
call fcn.7ff865bd
pop ecx
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.7ff884fe
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.7ff86114
lea eax, [ebp - 0x10]
push eax
call fcn.7ff84b82
pop ecx
lea eax, [ebp - 0x14]
push eax
call fcn.7ff84b82
pop ecx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.7ff86204
pop ecx
pop ecx
test eax, eax
je 0x7ff521f0
push 1
lea eax, [ebp - 0x28]
push eax
push str.PATH
call dword [0x7ff96074]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc eax
push eax
call fcn.7ff871a5
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
inc eax
push eax
push dword [ebp - 0x20]
push str.PATH
call dword [0x7ff96074]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff52137
mov eax, dword [ebp - 0x2c]
movsx eax, byte [eax]
cmp eax, 0x3b
je 0x7ff52137
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ff52119
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call section..text
add esp, 0xc
test eax, eax
jne 0x7ff52180
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x7ff52163
push dword [ebp - 0x1c]
call fcn.7ff8726e
pop ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.7ff86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.7ff86114
jmp 0x7ff52208
mov eax, dword [ebp - 0x2c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff52191
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax]
test eax, eax
jne 0x7ff52113
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push 0x7ff96604
lea eax, [ebp - 0x34]
push eax
call fcn.7ff85dd0
add esp, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push str.PATH
call dword [0x7ff96070]
lea ecx, [ebp - 0x34]
call fcn.7ff86114
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x7ff521f0
push dword [ebp - 0x1c]
call fcn.7ff8726e
pop ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.7ff86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.7ff86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ff52bf9
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x7ff92f3c
call fcn.7ff890d8
sub esp, 0x64
mov dword [ebp - 0x70], ecx
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x70]
add ecx, 0x88
call fcn.7ff54327
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x70]
add ecx, 0x78
call fcn.7ff54327
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x70]
add ecx, 0x68
call fcn.7ff54327
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x70]
add ecx, 0x58
call fcn.7ff54327
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x70]
add ecx, 0x48
call fcn.7ff5426d
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x70]
add ecx, 0x34
call fcn.7ff541b3
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x70]
add ecx, 0x30
call fcn.7ff86114
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x70]
add ecx, 0x2c
call fcn.7ff86114
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x70]
add ecx, 0x28
call fcn.7ff86114
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x70]
add ecx, 0x24
call fcn.7ff86114
and byte [ebp - 4], 0
mov ecx, dword [ebp - 0x70]
add ecx, 0x20
call fcn.7ff86114
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x70]
add ecx, 0x1c
call fcn.7ff86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x7ff52dd8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x7ffa5a60]
push dword [eax + 8]
push 0
push 0x400
call dword [0x7ff9608c]
mov dword [0x7ffa5988], eax
push 0x28
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.7ff89580
add esp, 0xc
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x7ff52f3d
push 0
call dword [0x7ff962c8]
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call dword [0x7ff962f0]
mov dword [ebp - 0x14], eax
push 0xf
call dword [0x7ff9636c]
push eax
call dword [0x7ff9602c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], str.th_logger
lea eax, [ebp - 0x2c]
push eax
call dword [0x7ff963cc]
push str.Arial
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64
push 0
push 0
push 0
push 0xe
call dword [0x7ff96030]
mov dword [0x7ffa5980], eax
mov eax, dword [0x7ffa5a60]
add eax, 0xc
push eax
mov eax, dword [0x7ffa5a60]
push dword [eax + 8]
push str.Log__x:__s
lea eax, [ebp - 0x4c]
push eax
call fcn.7ff85dd0
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
push 0
push 0
call dword [0x7ff962c8]
push eax
push 0
push 0
push 0x1f4
push 0x258
push 0x80000000
push 0x80000000
push 0xcf0000
push dword [ebp - 0x54]
push str.th_logger
push 0
call dword [0x7ff963c4]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x4c]
call fcn.7ff86114
push 1
push dword [ebp - 4]
call dword [0x7ff963d4]
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
call dword [0x7ff963b0]
test eax, eax
je 0x7ff52f34
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call dword [0x7ff963b4]
test eax, eax
jne 0x7ff52f32
lea eax, [ebp - 0x48]
push eax
call dword [0x7ff963b8]
lea eax, [ebp - 0x48]
push eax
call dword [0x7ff963bc]
jmp 0x7ff52ef9
push 0
call fcn.7ff775b3
leave
ret
Function at 0x7ff537c5
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov eax, 0x7ff92f6e
call fcn.7ff890d8
sub esp, 0x60
call dword [0x7ff9606c]
push eax
push str.ts_log._d
lea eax, [ebp - 0x14]
push eax
call fcn.7ff85dd0
add esp, 0xc
and dword [ebp - 4], 0
push dword [ebp - 0x14]
push 0
push 2
call dword [0x7ff96068]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7ff53827
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x10]
call dword [0x7ff960a0]
mov dword [0x7ffa5a60], eax
call fcn.7ff52dd8
jmp 0x7ff53937
mov eax, dword [0x7ffa59a0]
and eax, 0x40000000
test eax, eax
je 0x7ff53937
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x58]
push eax
call dword [0x7ff96064]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push dword [0x7ffa5e10]
call dword [0x7ff96060]
test eax, eax
je 0x7ff53937
push dword [ebp - 0x60]
push str.ts_log._d
lea eax, [ebp - 0x6c]
push eax
call fcn.7ff85dd0
add esp, 0xc
mov byte [ebp - 4], 1
push dword [ebp - 0x6c]
push 0x210
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [0x7ff9605c]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x10]
call dword [0x7ff960a0]
mov dword [0x7ffa5a60], eax
mov eax, dword [0x7ffa5a60]
mov ecx, dword [0x7ffa59a0]
mov dword [eax], ecx
mov eax, dword [0x7ffa5a60]
and dword [eax + 4], 0
call dword [0x7ff9606c]
mov ecx, dword [0x7ffa5a60]
mov dword [ecx + 8], eax
push 0x100
call dword [0x7ff9609c]
push eax
mov eax, dword [0x7ffa5a60]
add eax, 0xc
push eax
call fcn.7ff862fb
add esp, 0xc
push dword [ebp + 8]
mov eax, dword [0x7ffa5a60]
add eax, 0x10c
push eax
call fcn.7ff862c2
pop ecx
pop ecx
mov eax, dword [0x7ffa5a60]
mov dword [0x7ffa2154], eax
push dword [ebp - 0x64]
call dword [0x7ff96098]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.7ff86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.7ff86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ff56c7a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x7ffa59a4]
and eax, 0x80
test eax, eax
je 0x7ff56d8a
push 2
lea eax, [ebp - 4]
push eax
push str.TS_LEVEL
call dword [0x7ff96074]
test eax, eax
jne 0x7ff56d8a
push 0x7ffa5e18
mov ecx, 0x7ffa5e10
call fcn.7ff860eb
movzx eax, al
test eax, eax
je 0x7ff56cc5
jmp 0x7ff56d8a
mov eax, dword [0x7ffa59a4]
and eax, 0x100
test eax, eax
je 0x7ff56ce4
push dword [0x7ffa5e2c]
call fcn.7ff56d8c
pop ecx
jmp 0x7ff56d8a
mov eax, dword [0x7ffa59a4]
and eax, 0x80
test eax, eax
je 0x7ff56d8a
call dword [0x7ff9609c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x7ff56d42
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56d2f
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x7ff56d2f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ff56d11
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56d40
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ff56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x7ff56d60
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ff56d42
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x7ff56d74
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ff56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
jne 0x7ff56d8a
push dword [0x7ffa5e2c]
call fcn.7ff56d8c
pop ecx
leave
ret
Function at 0x7ff56d8c
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
mov eax, 0x7ff931de
call fcn.7ff890d8
sub esp, 0x18
call dword [0x7ff9609c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x7ff56ddb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56dd2
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x7ff56dd2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ff56db4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ff56df9
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56df9
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x7ff56df9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ff56ddb
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56e17
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x7ff56e17
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ff56df9
push dword [ebp + 8]
call fcn.7ff865bd
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
mov eax, dword [0x7ffa59a4]
and eax, 0x100
test eax, eax
jne 0x7ff56e4d
mov eax, dword [0x7ffa59a4]
and eax, 0x80
test eax, eax
je 0x7ff56e75
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
jne 0x7ff56e75
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.7ff8872b
pop ecx
pop ecx
push 0
push dword [ebp + 8]
push 0x7ffa59b8
call fcn.7ff5c94f
add esp, 0xc
mov eax, dword [0x7ffa59b8]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x24], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ff56ea0
push dword [ebp - 0x1c]
push dword [ebp + 8]
push str.__s___s
lea eax, [ebp - 0x24]
push eax
call fcn.7ff863ab
add esp, 0x10
jmp 0x7ff56eb4
push dword [ebp + 8]
push str.__s_
lea eax, [ebp - 0x24]
push eax
call fcn.7ff863ab
add esp, 0xc
push 0
call dword [0x7ff962c8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x44]
cmp eax, 3
jne 0x7ff56ee6
mov dword [ebp - 0x10], 1
push 0x7ff96cdc
push str.TS_LEVEL
call dword [0x7ff96070]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.7ff56f34
add esp, 0x10
push 0
call fcn.7ff775b3
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.7ff86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.7ff86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ff56f34
Capabilities:
Create process on windows
Set environment variable

Disassembly:
mov eax, 0x7ff931fa
call fcn.7ff890d8
sub esp, 0x74
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x54]
push eax
call dword [0x7ff96064]
push 0
push str.TS_LOADER
call dword [0x7ff96070]
push 0
push str.TS_MODULE0
call dword [0x7ff96070]
and dword [ebp - 0x68], 0
and dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.7ff865bd
pop ecx
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.7ff884fe
add esp, 0xc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.7ff86114
cmp dword [ebp + 0x14], 0
je 0x7ff56fb5
mov eax, dword [ebp - 0x28]
or al, 1
mov dword [ebp - 0x28], eax
and word [ebp - 0x24], 0
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x68]
push 0
push dword [ebp - 0x10]
push 0
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [0x7ff96060]
test eax, eax
jne 0x7ff56ffc
or dword [ebp - 0x74], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ff86114
mov eax, dword [ebp - 0x74]
jmp 0x7ff5705d
cmp dword [ebp + 0x10], 0
je 0x7ff5704a
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [0x7ff960c0]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x64]
call dword [0x7ff96088]
test eax, eax
je 0x7ff57035
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ff86114
mov eax, dword [ebp - 0x78]
jmp 0x7ff5705d
or dword [ebp - 0x7c], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ff86114
mov eax, dword [ebp - 0x7c]
jmp 0x7ff5705d
or dword [ebp - 0x80], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ff86114
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ff5c8e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [0x7ffa2360]
push dword [ebp + 8]
call dword [0x7ff9600c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7ff5c911
mov eax, dword [ebp - 4]
jmp 0x7ff5c94d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [0x7ff96010]
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [section..rdata]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x7ff5d138
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [0x7ff9600c]
test eax, eax
jne 0x7ff5d1b3
mov dword [ebp - 0x110], 0x104
mov dword [ebp - 8], 1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [0x7ff96010]
lea eax, [ebp - 0x10c]
push eax
push 0x7ff97740
push dword [ebp + 8]
call fcn.7ff86788
add esp, 0xc
push dword [ebp - 4]
call dword [section..rdata]
leave
ret
Function at 0x7ff604e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x7ff604fb
mov eax, dword [0x7ffa58d8]
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7ff5eeca
pop ecx
push eax
call dword [0x7ff96158]
mov dword [ebp - 4], eax
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x8000000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff60540
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.LoadResource_mod_x_ptr0x_x____0x_x_n
call fcn.7ff54190
add esp, 0x10
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x7ff60561
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x7ff938dd
call fcn.7ff890d8
sub esp, 0x2c
push 2
push 0
push dword [ebp + 8]
call fcn.7ff765b1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x7ff6058a
xor eax, eax
jmp 0x7ff6066d
and dword [ebp - 0x10], 0
and dword [ebp - 0x18], 0
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x7ff60679
push 0x10
push dword [ebp - 0x1c]
call fcn.7ff60262
cmp dword [ebp - 0x18], 0
jne 0x7ff605bd
cmp dword [ebp - 0x14], 0xffffffff
je 0x7ff60650
cmp dword [ebp - 0x18], 0
je 0x7ff605cb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
jmp 0x7ff605d1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
push 0x10
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.7ff6036e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x7ff60650
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.7ff60547
mov dword [ebp - 0x28], eax
push 0
call dword [0x7ff96044]
cmp dword [ebp + 0xc], 0
je 0x7ff6064a
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.7ff604e9
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
call dword [0x7ff96160]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x28]
jae 0x7ff60633
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x7ff60639
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call fcn.7ff89190
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call fcn.7ff73828
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.7ff86114
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ff63dd8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
push 1
push dword [ebp + 8]
call fcn.7ff61631
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7ff63e4f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x7ff63e4f
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff63e30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push dword [eax + 0xc]
push dword [ebp + 8]
push str.GetFileSize__internal__h_x_____x_n
call fcn.7ff54190
add esp, 0xc
push 0
call dword [0x7ff96044]
cmp dword [ebp + 0xc], 0
je 0x7ff63e44
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
jmp 0x7ff63e8d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x7ff960e4]
mov dword [ebp - 8], eax
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff63e8a
push dword [ebp - 8]
push dword [ebp + 8]
push str.GetFileSize__internal__h_x_____x_n
call fcn.7ff54190
add esp, 0xc
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x7ff640ea
Capabilities:
Delete file

Disassembly:
mov eax, 0x7ff93b28
call fcn.7ff890d8
sub esp, 0x15c
and dword [ebp - 0x160], 0
and dword [ebp - 0x158], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
call dword [0x7ff960b0]
mov dword [ebp - 0x14], eax
cmp dword [0x7ffa5dd0], 5
jge 0x7ff64264
push 0
lea eax, [ebp - 0x160]
push eax
push 8
push dword [ebp + 8]
call fcn.7ff80086
add esp, 0x10
test eax, eax
je 0x7ff64264
cmp dword [ebp - 0x158], 0
je 0x7ff64264
mov eax, dword [ebp - 0x158]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x168], eax
push dword [ebp - 0x168]
call fcn.7ff7066d
test eax, eax
je 0x7ff6419e
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff64195
push dword [ebp + 8]
push str.DeleteFile__s____0__Loaded_as_DLL_EXE__n
call fcn.7ff54190
pop ecx
pop ecx
and dword [ebp - 0x10], 0
jmp 0x7ff64262
cmp dword [ebp - 0x15c], 3
jne 0x7ff641de
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff641cd
push dword [ebp + 8]
push str.DeleteFile__s____0__already_deleted__n
call fcn.7ff54190
pop ecx
pop ecx
push 2
call dword [0x7ff96044]
and dword [ebp - 0x10], 0
jmp 0x7ff64262
mov eax, dword [ebp - 0x158]
and dword [eax + 0x44], 0
push dword [ebp - 0x14]
call dword [0x7ff96044]
cmp dword [ebp - 0x15c], 0
jne 0x7ff64229
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff64220
push dword [ebp + 8]
push str.DeleteFile__internal_only___s____1_n
call fcn.7ff54190
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
jmp 0x7ff64262
push dword [ebp - 0x160]
call dword [0x7ff961ac]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff64262
push dword [ebp - 0x10]
push dword [ebp + 8]
push str.DeleteFile__cached_extracted___s_____x_n
call fcn.7ff54190
add esp, 0xc
jmp 0x7ff642a5
push dword [ebp - 0x14]
call dword [0x7ff96044]
push dword [ebp + 8]
call dword [0x7ff961ac]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7ffa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ff642a5
push dword [ebp - 0x10]
push dword [ebp + 8]
push str.DeleteFile__system___s_____x_n
call fcn.7ff54190
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x164], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.7ff86114
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4