joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0ebb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.00417535
push 0x66
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x593023
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x592fbc
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x593023
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x59304d
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x59304d
cmp dword [0x62002c], 0
je 0x59304d
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.00419f9c
mov ecx, esi
call fcn.00419cdd
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x594ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1124
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [edi + 0x88], ebx
call fcn.00417535
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x594bbc
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x594b55
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x594bbc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp word [esi], 1
jne 0x594bf0
mov eax, 0xffff
cmp word [esi + 2], ax
jne 0x594bf0
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x594bf0
cmp dword [ecx + 0x20], 0
je 0x594bf0
call fcn.004148ad
or dword [esi + 8], eax
push 0
push ebx
push esi
mov ecx, edi
call fcn.00419c67
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x597100
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1426
mov eax, dword fs:[0]
push eax
sub esp, 0x504
mov eax, dword [0x614040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
lea ecx, [ebp - 0x508]
call fcn.00555a90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x508]
mov eax, dword [edi + 0x100]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0xbc], 0x1faf
call fcn.005555f0
lea ecx, [ebp - 0x508]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00555740
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x510], eax
cmp esi, 1
je 0x5971dd
mov eax, dword [0x61ff18]
shr eax, 8
cmp al, 0xb
je 0x597350
lea esp, [esp]
mov ecx, dword [edi + 0x1d4]
xor edx, edx
mov esi, dword [ecx + 8]
test esi, esi
jle 0x5971ce
mov eax, dword [ecx + 4]
add eax, 0x20
cmp dword [eax], 0
je 0x5971bb
inc edx
add eax, 0x90
dec esi
jne 0x5971b5
test edx, edx
jle 0x5971ce
call fcn.0059bbc0
jmp 0x5971a0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x180]
jmp 0x597357
mov ecx, dword [0x61fedc]
mov eax, 0x92492493
mov esi, dword [0x61fed8]
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x59722e
mov ecx, dword [edi + 0x1d4]
xor edx, edx
mov esi, dword [ecx + 8]
test esi, esi
jle 0x5971ce
mov eax, dword [ecx + 4]
add eax, 0x20
cmp dword [eax], 0
je 0x59721b
inc edx
add eax, 0x90
dec esi
jne 0x597215
test edx, edx
jle 0x5971ce
call fcn.0059bbc0
jmp 0x597200
or ebx, 0xffffffff
cmp esi, dword [0x61fedc]
je 0x5972ad
lea esp, [esp]
call fcn.00416b46
mov ecx, dword [eax + 4]
call fcn.0040d587
mov dword [ebp - 4], 1
push dword [edi + 0x100]
fld1
push ecx
mov ecx, dword [edi + 0x1d4]
fstp dword [esp]
push dword [esi]
call fcn.0059b8d0
mov ebx, eax
test ebx, ebx
js 0x59729b
push ebx
push esi
mov ecx, edi
call fcn.00597380
lea ecx, [ebp - 0x509]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ab10
add esi, 0x1c
cmp esi, dword [0x61fedc]
jne 0x597240
jmp 0x5972ad
lea ecx, [ebp - 0x509]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ab10
mov ecx, 0x61fed8
call fcn.00404190
mov ecx, dword [0x61fee0]
mov eax, 0x92492493
sub ecx, dword [0x61fed8]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x80
jae 0x5972ec
push 0x80
mov ecx, 0x61fed8
call fcn.00404700
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x510]
cmp eax, 0x64
jae 0x59730b
mov ecx, 0x64
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jns 0x59731a
mov ecx, edi
call fcn.00597a60
xor eax, eax
jmp 0x59735c
mov ecx, dword [edi + 0x1d4]
push ebx
call fcn.0059bc80
push 0
push eax
mov eax, dword [edi + 0x1c8]
push 0x186
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x1c4]
push 0
push 0
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, edi
call fcn.00597a60
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret
Function at 0x598de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1554
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
call fcn.00417535
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x598ecb
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x598e64
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x598ecb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x598ef5
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x598ef5
cmp dword [0x62002c], 0
je 0x598ef5
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419c67
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5990f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b157f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.00417535
push 0x66
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x5991d3
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x59916c
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5991d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x5991fd
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x5991fd
cmp dword [0x62002c], 0
je 0x5991fd
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.00419f9c
mov ecx, esi
call fcn.00419cdd
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5993d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1678
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
push 0x66
call fcn.00419783
mov dword [ebp - 4], 0
lea ecx, [esi + 0x98]
mov dword [esi], vtable.CDlgImageMerge.0
call fcn.00583e60
mov byte [ebp - 4], 1
lea ecx, [esi + 0x118]
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
call fcn.00418663
mov dword [esi + 0x1a8], 0
mov dword [esi + 0x1ac], 0
mov dword [esi + 0x1b0], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x1cc]
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x1b8], 0
mov dword [esi + 0x1bc], 0
mov dword [esi + 0x1c0], 0
mov dword [esi + 0x1c4], 0
mov dword [esi + 0x1c8], 0
call fcn.00417a22
mov dword [esi + 0x1d4], 0
lea ecx, [esi + 0x1e8]
mov dword [esi + 0x1d8], 0
mov dword [esi + 0x1dc], 0
mov dword [esi + 0x1e0], 0
call fcn.0056dd40
mov dword [esi + 0x24c], 0
mov dword [esi + method.CBrush.virtual_0], vtable.CBrush.0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
mov dword [esi + 0x254], 0
mov dword [esi + 0xb0], esi
mov dword [esi + 0x100], eax
call fcn.00416b46
call fcn.00416b46
push 0x5a
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x4c
mov dword [esi + 0x1b8], eax
call fcn.0040d4d6
add esp, 4
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x59955d
mov ecx, eax
call fcn.0059c150
mov dword [esi + 0x1d4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1d4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x59aae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b187f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [edi + 0x88], ebx
call fcn.00417535
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x59abcc
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x59ab65
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x59abcc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp word [esi], 1
jne 0x59ac00
mov eax, 0xffff
cmp word [esi + 2], ax
jne 0x59ac00
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x59ac00
cmp dword [ecx + 0x20], 0
je 0x59ac00
call fcn.004148ad
or dword [esi + 8], eax
push 0
push ebx
push esi
mov ecx, edi
call fcn.00419c67
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x59ac40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b18aa
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x614040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.00417535
push 0x67
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.0041774b
call fcn.00416b46
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x59ad23
call fcn.00414eab
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x59acbc
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.00417584
call fcn.00416b46
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004177b3
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x59ad23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x59ad4d
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x59ad4d
cmp dword [0x62002c], 0
je 0x59ad4d
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.00419f9c
mov ecx, esi
call fcn.00419cdd
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x59bbc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
xor eax, eax
or edi, ebx
cmp dword [esi + 8], eax
jle 0x59bc79
mov edx, dword [esi + 4]
xor ecx, ecx
mov edi, edi
mov edx, dword [ecx + edx + 0x88]
cmp edi, edx
jge 0x59bbef
mov edi, edx
mov ebx, eax
mov edx, dword [esi + 4]
inc eax
add ecx, 0x90
cmp eax, dword [esi + 8]
jl 0x59bbe0
test ebx, ebx
js 0x59bc79
lea ebx, [ebx + ebx*8]
mov ecx, edx
add ebx, ebx
mov eax, dword [ecx + ebx*8 + 0x88]
mov dword [ebp - 4], eax
test eax, eax
js 0x59bc53
mov dword [ecx + ebx*8 + 0x88], 0xffffffff
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x59bc53
xor edx, edx
jmp 0x59bc30
mov edi, dword [esi + 4]
mov eax, dword [edi + edx + 0x88]
cmp eax, dword [ebp - 4]
jle 0x59bc47
dec eax
mov dword [edi + edx + 0x88], eax
inc ecx
add edx, 0x90
cmp ecx, dword [esi + 8]
jl 0x59bc30
mov eax, dword [esi + 4]
push dword [eax + ebx*8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 4]
push dword [eax + ebx*8 + 0x20]
call fcn.0040d50c
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + ebx*8 + 0x20], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402586
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x4025a6
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x4025b2
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x4025bb
cmp byte [ebx], 0
jne 0x4025c2
xor eax, eax
jmp 0x40267c
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x402629
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x4025f4
cmp dword [ebp - 4], 0
je 0x4025f4
cmp dword [ebp - 8], 0
jne 0x4025f4
cmp dword [ebp + 0x10], 0
je 0x4025ef
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x402628
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402606
xor ecx, ecx
mov cl, al
cmp ecx, 0xa
jne 0x402613
and eax, 0xff
cmp eax, 0xd
jne 0x40262e
inc ebx
jmp 0x40262e
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x402628
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x40262e
inc esi
cmp byte [ebx], 0
jne 0x4025cb
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x40267a
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x40267a
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.0040fef4
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402684
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
push ebx
push esi
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, ebx
call fcn.0040fe64
cmp eax, 0x3f6
jae 0x4028c6
lea eax, [ebp - 0x40]
mov ecx, 0x3c
xor edx, edx
call fcn.0040fddc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x5c0
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x22
jne 0x4026d1
lea edx, [ebx + 1]
jmp 0x4026d3
mov edx, ebx
mov dword [ebp - 0x30], edx
xor eax, eax
jmp 0x40272a
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x22
jne 0x4026fd
jmp 0x4026f6
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4026f6
mov byte [ebx + eax], 0x20
jmp 0x4026fd
inc eax
cmp byte [ebx + eax], 0
jne 0x4026e6
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x20
je 0x402712
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x2f
jne 0x402729
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x20
jne 0x402720
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [ebp - 0x2c], eax
jmp 0x402730
inc eax
cmp byte [ebx + eax], 0
jne 0x4026da
cmp byte [0x415cfe], 0
je 0x402740
mov dword [ebp - 0x2c], 0x415cfe
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x30]
call fcn.00406348
mov esi, eax
test esi, esi
je 0x40276c
mov edx, str..inf
mov eax, esi
call fcn.0040ff60
test eax, eax
jne 0x40276c
mov dword [ebp - 0x34], str.Install
xor edx, edx
mov eax, dword [ebp - 0x30]
call fcn.00406f34
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x402796
lea edx, [ebp - 0x440]
mov eax, dword [ebp - 0x30]
call fcn.00407000
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 1], 0
je 0x4027d5
cmp byte [ebp - 2], 0
jne 0x4027d5
lea eax, [ebp - 0x840]
mov edx, dword [ebp - 0x30]
call fcn.0040fee0
mov edx, str..exe
lea eax, [ebp - 0x840]
call fcn.0040ffa8
lea eax, [ebp - 0x840]
xor edx, edx
call fcn.00406f34
test al, al
je 0x4028c6
lea ecx, [ebp - 0x40]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x402805
and dword [ebp - 0x3c], 0xfffffbff
mov dword [ebp - 0x30], ebx
lea edx, [ebp - 0x40]
push edx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x4028c6
xor ebx, ebx
cmp byte [0x4158f4], 0
jne 0x40281e
cmp byte [ebp - 1], 0
je 0x402867
cmp dword [0x416180], 0
je 0x402836
push dword [0x416180]
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x40283a
xor eax, eax
jmp 0x40283f
mov eax, 1
test eax, eax
je 0x402852
push 0
push dword [0x416180]
call sub.USER32.DLL_ShowWindow
mov bl, 1
push 0x7d0
push dword [ebp - 8]
call sub.USER32.DLL_WaitForInputIdle
mov eax, dword [ebp - 8]
call fcn.004028cc
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
je 0x402883
mov edx, str..exe
mov eax, esi
call fcn.0040ff60
test eax, eax
je 0x4028b5
cmp byte [0x4158f4], 0
je 0x40289e
cmp byte [ebp - 1], 0
jne 0x40289e
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x4028b5
cmp byte [ebp - 1], 0
mov edx, 0xc8
jne 0x4028af
add edx, 0x320
push edx
call sub.KERNEL32.DLL_Sleep
test bl, bl
je 0x4028c6
push 1
push dword [0x416180]
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
mov esp, ebp
pop ebp
ret