joyce8/EMBER2024-capa huggingface dataset:
Function at 0x575811
Capabilities:
Encode data using xor

Disassembly:
pushal
bswap di
pushal
pop edi
mov edi, 0x428cf3
jmp 0x5a7b82
jmp fcn.0056b975
push edi
xchg dword [esp + 0x14], edi
pushal
mov byte [esp + 8], bh
push dword [esp + 0x10]
push dword [esp + 0x38]
ret 0x3c
lea esp, [esp + 4]
jp 0x57f345
xchg dword [esp], edi
pushfd
jmp 0x58e60c
pushfd
mov word [esp], 0x3557
pushal
xchg dword [esp + 0x24], edi
jmp 0x56a8b2
push 0xe3818a3a
mov dword [esp + 4], edi
lea edi, [ebx + 0x34ead2a5]
mov word [esp], 0x64d6
lea esp, [esp + 4]
je 0x540be8
pushfd
mov edi, 0x428cf3
mov byte [esp], bh
mov byte [esp], dh
mov byte [esp], cl
pushfd
mov edi, dword [edi + 0x16f227]
push dword [esp + 4]
jmp 0x5b2a94
mov byte [esp + 4], bh
mov edi, dword [edi + 0x16f227]
pushfd
lea edi, [edi - 0x8ee0afc]
call fcn.0057b7ea
lcall 0xc9a, 0x3abcdfc7
stosd dword es:[edi], eax
add al, ah
in al, 0xee
std
aam 0xd3
fmulp st(1)
mul byte [ebp + 0xe564a14]
xor dword [ecx - 9], 0xffffffa8
adc dword [eax + 0x1120580c], ecx
xor eax, 0xc8ab4fe0
dec ebp
mov esp, 0x17c9eeb4
jo 0x5a7b9f
push edx
popal
movsd dword es:[edi], dword [esi]
popal
cmp ebx, ecx
rcr ch, cl
or dword [ebx + 0x6e343c5f], edx
fisttp qword [ecx]
xchg ebx, eax
pop edi
cmp al, 0x34
outsb dx, byte [esi]
std
jg 0x5a7bcd
mov eax, 0xbf316e56
sbb dword [ebx], 0x715f7b03
retf 0xc3d7
lea edi, [edi - 0x8ee0afc]
push dword [esp + 8]
jmp 0x56e224

Function at 0x583c17
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
stc
push ebx
xchg dword [esp + 0x20], ebp
pushal
and bp, 0x8166
lea ebp, [esp + 0x40]
push 0xd2c11a65
cmc
clc
sub esp, 0xffffffc4
jno 0x5be155
push esp
stc
cmp dword [ebp + 8], 0
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
push ecx
mov dword [esp + 4], 0
push 0xc09393bb
lea esp, [esp + 8]
call fcn.005a3276
push ebp
jmp 0x5d5afa

Function at 0x588164
Capabilities:
Encode data using xor

Disassembly:
push ebx
lea esp, [esp + 8]
je 0x58087f
lahf
test dh, al
mov eax, dword [ebp + 0xc]
push 0x16cc7171
clc
clc
test eax, 0xffff0000
mov dword [esp], eax
mov byte [esp], 0x6e
lea esp, [esp + 4]
jne 0x5ca44d
movsx bx, cl
call fcn.00560506
push ebx
in eax, dx
test byte [eax + 0x56], cl
imul ebx, dword [edi - 0x7bf07249], 0x6f38655f
xor eax, 0x596d4077
dec edi
pop edi
push ecx
insb byte es:[edi], dx
aas
test byte [0xe1c5efb3], ah
leave
fld st(5)
loope 0x5808aa
mov ecx, 0xc34a49c
invalid
test ebx, ebx
mov dword [esp], 0x9113bdae
jmp 0x58086e
movzx cx, cl
movsx cx, al
movsx ecx, bl
sete ch
push eax
sete ch
movzx ecx, al
pushal
mov dword [esp + 0x1c], edi
pushal
movsx cx, al
pushfd
setle ch
mov ecx, esi
call fcn.00578544

Function at 0x58a23c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov dword [esp], ebx
call fcn.005b8fa9
pushfd
lea esp, [esp + 0xc]
je 0x5b8fbf
jmp 0x583a52

Function at 0x58b294
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
je 0x565672
lahf
pushal
push eax
mov ah, byte [esp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x541ab8
bt sp, 8
add esp, 8
cmp bl, ah
cmp bl, dh
pushfd
pushal
test edi, edi
jmp 0x567fac
Function at 0x5b839a
Capabilities:
Encode data using xor

Disassembly:
pushfd
nop
push dword [esp]
mov dword [esp + 8], eax
bswap eax
cwde
movzx eax, dl
mov eax, 0x41d98f
push dword [esp]
mov byte [esp + 8], 0x6d
push dword [esp + 4]
call fcn.00543a0c
pop edi
cld
mov ah, 0x15
mov ah, byte [ebx]
jle 0x5b83f9
outsb dx, byte [esi]
xor byte [esi + 0x3c], bh
push 0x1f496842
cdq
or al, ch
loopne 0x5b83c7
stc
int3
sbb eax, dword [edi + 0x64f2da36]
sbb dh, ah
push esp
invalid

Function at 0x5b8fa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 8]
call fcn.00547751
test al, ch
push 0x78a913ac
push ecx
pushfd
add esp, 0x10

Function at 0x5bf53c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt di, 3
test ebx, 0xffff0000
mov byte [esp + 8], ah
push dword [esp + 0xc]
push dword [esp + 0xc]
lea esp, [esp + 0x2c]
je 0x5b8fbf
pushal
mov dword [esp + 0x1c], ebx
mov byte [esp + 4], dl
lea esp, [esp + 0x1c]
call fcn.00547751
clc
call fcn.0058b294
pushal
jmp 0x58c706

Function at 0x5d3e9d
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp], 0x581449
call fcn.00564719
lea esp, [esp + 0x40]
jne 0x56cee4
push 2
jmp 0x56b9f3

Function at 0x5d510f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x567f9b
setl dl
movzx dx, bl
mov edx, 0x41bf73
call fcn.005de460
jmp 0x5d782c
push dword [esp + 8]
xchg dword [esp + 0x14], edx
pushal
mov byte [esp + 4], ah
xchg dword [esp + 0x30], edx
jmp 0x547030

Function at 0x5dcdca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop esi
mov esi, dword [esp + 0x24]
jmp 0x56e25f

Function at 0x5e248a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
lea esp, [esp + 8]
je 0x5bdea5
cmp dh, 0x78
push ecx
call fcn.005a4014
mov dword [ebp - 8], 0
pushal
push eax
lea esp, [esp + 0x3c]
je 0x5e24a8
xchg bx, ax
movsx eax, al
setle al
mov eax, dword [ebp + 0x10]
not bl
setnp bl
setg bl
pushfd
lea ebx, [ebp - 8]
mov byte [esp], 0x7b
push esi
lea esp, [esp + 8]
call fcn.00542390
sbb ebx, 0xe0b2891c
mov ebx, dword [ebp - 8]
push 0x3a6868c9
test bl, 0x18
cmp cx, 0x7835
test eax, eax
jmp 0x5d8c71

Function at 0x686422
Capabilities:
Check for trap flag exception

Disassembly:
clc
mov byte [esp], ah
rol dl, 3
push dword [esp]
bt sp, bp
stc
xor dl, 0xdb
stc
clc
push word [esp + 8]
popf
call fcn.007bd925
push edi
pushfd
bts esi, 8
mov dword [esp], ebx
xor edi, 0x9f5aa022
btr di, sp
mov esi, dword [esp + 0x14]
pushal
mov edi, dword [esp + 0x38]
rcr dl, cl
xadd dl, al
call fcn.006b7a08
mov byte es:[0xbc069e06], al
mov ch, 0x4f
jno 0x68649c
nop
ret
pop es
rol byte [0x921cca74], 0x4d
sti
in al, 0x43
mov ebp, 0x7311d730
dec edi
sub al, 0xc
outsb dx, byte [esi]
cmp dword [esp + eax - 0x41], esi
wait
and bh, byte [eax + 0x6fb4c1f7]
mov edi, 0xfa5cb806
salc
push ss
pop ebx
mov bh, 0x4c
mov cl, 0xbe
xor dword [ebp + edi - 0x1cb6ca1b], esi
mov ah, 0xa9
sub dword [ebp + 0x5a5f453e], esp
sbb al, byte [ecx]
jle 0x68654b
push edi
in eax, 0xe1
ret 0xde93
aad 0xb4
invalid
Function at 0x6ade20
Capabilities:
Encode data using xor

Disassembly:
stc
push dword [edi]
pop dword [esp + 0x28]
stc
cmc
test cx, dx
cmp edi, ebx
push dword [esp + 0xc]
jmp 0x7bd62c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
ja 0x6b2bd4
push edx
push ebx
neg al
sub ebx, edi
lea edi, [edx*4 - 0x37f097b2]
add esp, 8
add ebx, esp
mov di, 0x8983
add di, ax
adc di, 0x6473
mov edi, ebx
shr al, 3
mov al, 0x2e
bt bx, 0xb
cmc
call fcn.006b72ec
pop es
xor esi, dword [ebx + ebx*2 + 0x4a]
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
adc al, 0x44
invalid
Function at 0x444cdc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x444cf3
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x444ce3
mov eax, ecx
pop ebx
ret

Function at 0x4544e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4544f4
add esp, 0xfffffff0
call fcn.00408a44
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44e57c]
call fcn.0046e978
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x45351c]
call fcn.0046ffd4
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x45351c]
call fcn.0046ffd4
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x454549
call fcn.00408a9c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b0b9c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b0bdf
cmp byte [ebx + 0x11], 0
jne 0x4b0bdf
cmp byte [ebx + 0x24], 0
jne 0x4b0bdf
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b0bf6
mov ecx, dword [0x7149dc]
mov dl, 1
mov eax, dword [0x481410]
call fcn.0042cad0
call fcn.004098d4
pop ebx
ret
mov ecx, dword [0x7149dc]
mov dl, 1
mov eax, dword [0x481410]
call fcn.0042cad0
call fcn.004098d4
pop ebx
ret

Function at 0x4b11c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b120e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b0b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1227
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b3aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x71b914
cmp dword [edi], 0
jne 0x4b3b1c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x71b910]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x70bcf4
mov ecx, 2
call fcn.004077e0
mov edx, 0x4b3a78
lea eax, [esi + 5]
call fcn.004b3a98
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004b3a98
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4b3af1
mov dword [0x71b910], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4bdea8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4bdefa
test eax, edx
je 0x4bdefd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4bdebd
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x4bdee3
add ecx, 4
js 0x4bded3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4bdee0
movzx eax, byte [eax + ecx]
movzx edx, byte [edx + ecx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4bdf09
test edx, edx
jne 0x4bdeb0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4c0c88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4c0d24
push 0
mov eax, ebx
call fcn.0040ae9c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x4c0cff
mov ebx, esi
test ebx, ebx
je 0x4c0cd1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040ae9c
push eax
push 1
push 0
mov eax, edi
call fcn.0040ae9c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
je 0x4c0d1a
mov ecx, dword [0x71451c]
mov dl, 1
mov eax, dword [0x4bf9b4]
call fcn.0042cad0
call fcn.004098d4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4c91f8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x70d5b0]
cmp edx, 4
mov eax, ecx
jl 0x4c9200
pop ebp
ret

Function at 0x4c921c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x70d9b0]
cmp edx, 4
mov eax, ecx
jl 0x4c9224
pop ebp
ret
Function at 0x654f78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6550c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x711aa0]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x65509f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x711aac], 0
jne 0x655072
mov dword [0x711aac], 0x104
mov eax, dword [0x711aa8]
test eax, eax
je 0x654fee
cmp word [eax], 0
je 0x654fee
lea eax, [ebp - 4]
mov edx, dword [0x711aa8]
call fcn.0040aefc
mov eax, dword [ebp - 4]
sub eax, 0xa
movzx esi, word [eax]
jmp 0x654ff2
mov si, 2
movzx eax, si
imul dword [0x711aac]
call fcn.00407294
mov dword [0x711aa8], eax
mov eax, dword [0x711aa8]
push eax
mov eax, dword [0x711aac]
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [0x711aac], eax
mov eax, ebx
mov ecx, dword [0x711aac]
mov edx, dword [0x711aa8]
call fcn.0040a374
mov eax, dword [ebx]
call fcn.00654f5c
mov eax, dword [ebx]
call fcn.00655d94
test al, al
jne 0x655085
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, 0x654f54
call fcn.004106d8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41d180]
call fcn.0042ca4c
call fcn.004098d4
jmp 0x655085
mov eax, ebx
mov ecx, dword [0x711aac]
mov edx, dword [0x711aa8]
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6550a6
mov eax, dword [0x711aa0]
mov edx, dword [eax]
call dword [edx + 4]
pop eax
jmp eax
Function at 0x655a14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
seta byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x655afc
mov eax, ebx
call fcn.00407294
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x655af5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x655add
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x655b0c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655add
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [esi], edx
and eax, 0xffff
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655afc
mov eax, dword [ebp - 0xc]
call fcn.004072b0
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x655b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
mov edx, dword [0x714b4c]
mov edx, dword [edx]
call fcn.0040a5cc
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x655bf1
mov eax, ebx
call fcn.00407294
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x655bea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x655bd2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x655bf8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655ba3
mov ecx, dword [ebp - 8]
dec ecx
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040a374
jmp 0x655bd2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x655c40
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655bd2
mov eax, dword [ebp - 0x14]
test byte [eax + 0x1c], 1
je 0x655bd2
mov eax, edi
mov edx, 0x655c50
call fcn.0040a5cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655bf1
mov eax, dword [ebp - 4]
call fcn.004072b0
pop eax
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6587d8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
xor edx, edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040b634
xor eax, eax
push ebp
push 0x658994
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425cb0
test al, al
je 0x658836
mov eax, dword [ebp - 0x274]
call fcn.004261bc
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x278]
mov edx, 0x6589ac
call fcn.0040b0a8
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.0042612c
test eax, eax
jne 0x658941
xor eax, eax
push ebp
push 0x65893a
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x260], 0x10
jne 0x6588bb
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x27c]
call fcn.004261bc
jmp 0x65890c
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589c0
call fcn.0040b298
je 0x65890c
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589d0
call fcn.0040b298
je 0x65890c
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x280]
call fcn.006587d8
lea eax, [ebp - 0x270]
call fcn.0042617c
test eax, eax
je 0x658883
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658941
lea eax, [ebp - 0x270]
call fcn.004261a0
pop eax
jmp eax
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425d48
test al, al
je 0x658963
mov eax, dword [ebp - 0x274]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65899b
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040ba20
pop eax
jmp eax
Function at 0x658a84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x658be2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71863c]
call fcn.0040db1c
mov ebx, eax
push 0xa
push 0x658bf0
push ebx
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
jne 0x658b30
mov eax, esi
call fcn.00658a1c
mov eax, dword [esi]
test eax, eax
je 0x658ad3
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
cmp ebx, 2
jl 0x658bb7
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004243ac
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040b298
jne 0x658b25
mov edx, esi
mov ecx, ebx
mov eax, 0x658c20
call fcn.0040b374
dec ebx
cmp ebx, 1
jne 0x658adf
jmp 0x658bb7
push edi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x658bb2
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x658bab
push edi
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404cf0]
call fcn.0040d280
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.004077e0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.004320cc
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004315c0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x658b9a
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00431f74
jmp 0x658bb7
call fcn.0042f4e8
jmp 0x658bb7
call fcn.0042f4e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658be9
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 4]
mov edx, dword [0x404cf0]
call fcn.0040d3a4
pop eax
jmp eax
Function at 0x65b6f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65b7ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4799b4]
call fcn.004a3cdc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x65b7ce
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x65b7ab
xor eax, eax
push ebp
push 0x65b7a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
jmp 0x65b785
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040aefc
mov edx, dword [ebp - 4]
mov eax, 0x65b808
call fcn.004bd710
mov ebx, eax
test bl, bl
jne 0x65b775
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
call fcn.0040a700
mov edi, eax
inc edi
mov eax, edi
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x65b74d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7ab
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7d5
mov eax, dword [ebp - 0x10]
call fcn.00408510
pop eax
jmp eax